@opengeni/api-router 3.2.2 → 3.4.0

package/src/routes/computer-sessions.ts

@@ -58,12 +58,14 @@ import {
   terminalizeStaleConnectedInteractionPlacement,
   touchComputerSessionController,
   type ComputerSessionControlRecord,
+  type EnrollmentRecord,
   type LeaseSnapshot,
 } from "@opengeni/db";
 import {
   hasPermission,
   requireAccessGrant,
   requireSessionAuthorization,
+  withSessionAuthorizationReadReuse,
   relayConfigFromSettings,
   resolveChannelAMachineConnection,
   resolveSessionSandboxRuntime,
@@ -125,7 +127,12 @@ import {
   observeComputerFrameEvidenceMismatch,
   observeLifecycleResult,
 } from "../interaction-metrics";
-import { withChannelA, withChannelARead, type ChannelAOperation } from "../sandbox/channel-a";
+import {
+  withChannelA,
+  withChannelARead,
+  type ChannelAHandle,
+  type ChannelAOperation,
+} from "../sandbox/channel-a";
 import { USER_CONTENT_SECURITY_HEADERS } from "../http/user-content";
 import { wrongInteractionPlacementMessage } from "./interaction-placement-message";
 import {
@@ -144,6 +151,14 @@ type ComputerPlacement = {
   screenControlAllowed?: boolean;
 };
 
+type ActiveComputerControllerCallback<T> = (input: {
+  client: BrowserControlClient;
+  sessionClient: ReturnType<BrowserControlClient["computerSessionClient"]>;
+  record: ComputerSessionControlRecord;
+  binding: NonNullable<ComputerSessionControlRecord["session"]["controller"]>;
+  placement: ComputerPlacement;
+}) => Promise<T>;
+
 const MODEL_COMPUTER_FRAME_MAX_BYTES = 256 * 1024;
 
 type ComputerFrameCaptureClient = {
@@ -1117,6 +1132,38 @@ export function registerComputerSessionRoutes(
     },
   );
 
+  async function routedMachineConnection(
+    handle: ChannelAHandle,
+    grant: AccessGrant,
+    sourceSession: Session,
+    sandboxId: string,
+  ): Promise<EnrollmentRecord | null> {
+    const machineAuthority = await handle.machineAuthority();
+    const sandbox = await getSandbox(
+      deps.db,
+      {
+        accountId: grant.accountId,
+        workspaceId: sourceSession.workspaceId,
+        subjectId: machineAuthority.subjectId,
+      },
+      sandboxId,
+    );
+    if (sandbox?.kind !== "selfhosted" || !sandbox.enrollmentId) {
+      throw new ComputerSessionStateError("Connected Machine placement is unavailable");
+    }
+    return await resolveChannelAMachineConnection(
+      deps.db,
+      {
+        accountId: grant.accountId,
+        workspaceId: sourceSession.workspaceId,
+        sessionId: sourceSession.id,
+        machineWorkspaceId: sandbox.workspaceId,
+        enrollmentId: sandbox.enrollmentId,
+      },
+      machineAuthority,
+    );
+  }
+
   async function withComputerPlacement<T>(
     sourceSession: Session,
     grant: AccessGrant,
@@ -1174,6 +1221,7 @@ export function registerComputerSessionRoutes(
           enrollment.agentCapabilities.operationResourcePolicy === true,
         operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
         transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
+        browserControlHttpSupported: enrollment.agentCapabilities.browserControlHttp === true,
         ...(deps.settings.agentOpStreamEnabled === true &&
         enrollment.opStream === true &&
         deps.bus.getOpStreamConnection
@@ -1237,33 +1285,15 @@ export function registerComputerSessionRoutes(
         const resolved = await handle.routingSession.prime();
         let screenControlAllowed = false;
         if (operation !== "computer.end" && resolved.kind === "selfhosted" && resolved.sandboxId) {
-          // Look the routed machine up as the routing did: an agent acts for
-          // the person who started its turn, so a personal (Only me) machine
-          // stays reachable, subject to that attempt's per-chat permission.
-          const machineAuthority = await handle.machineAuthority();
-          const sandbox = await getSandbox(
-            deps.db,
-            {
-              accountId: grant.accountId,
-              workspaceId: sourceSession.workspaceId,
-              subjectId: machineAuthority.subjectId,
-            },
-            resolved.sandboxId,
-          );
-          if (sandbox?.kind !== "selfhosted" || !sandbox.enrollmentId) {
-            throw new ComputerSessionStateError("Connected Machine placement is unavailable");
-          }
-          const enrollment = await resolveChannelAMachineConnection(
-            deps.db,
-            {
-              accountId: grant.accountId,
-              workspaceId: sourceSession.workspaceId,
-              sessionId: sourceSession.id,
-              machineWorkspaceId: sandbox.workspaceId,
-              enrollmentId: sandbox.enrollmentId,
-            },
-            machineAuthority,
-          );
+          // The request already resolved this machine's live runner when it
+          // pinned the route; otherwise look the routed machine up as the
+          // routing did: an agent acts for the person who started its turn, so
+          // a personal (Only me) machine stays reachable, subject to that
+          // attempt's per-chat permission.
+          const enrollment =
+            handle.pinnedMachine?.sandboxId === resolved.sandboxId
+              ? handle.pinnedMachine.enrollment
+              : await routedMachineConnection(handle, grant, sourceSession, resolved.sandboxId);
           if (!enrollment?.connectionInstanceId) {
             throw new ComputerSessionStateError("Connected Machine is unavailable");
           }
@@ -1476,14 +1506,37 @@ export function registerComputerSessionRoutes(
     computerSessionId: string,
     authorizationOperation: SessionAuthorizationOperation,
     channelOperation: ChannelAOperation,
-    callback: (input: {
-      client: BrowserControlClient;
-      sessionClient: ReturnType<BrowserControlClient["computerSessionClient"]>;
-      record: ComputerSessionControlRecord;
-      binding: NonNullable<ComputerSessionControlRecord["session"]["controller"]>;
-      placement: ComputerPlacement;
-    }) => Promise<T>,
+    callback: ActiveComputerControllerCallback<T>,
     recoverMissing = true,
+  ): Promise<T> {
+    // The source-session check and the machine-route check that follows it
+    // prove the same live agent attempt; they share those reads. Everything
+    // from the controller call onward reads fresh.
+    return await withSessionAuthorizationReadReuse((authorizationReads) =>
+      withActiveComputerControllerReads(
+        context,
+        grant,
+        workspaceId,
+        computerSessionId,
+        authorizationOperation,
+        channelOperation,
+        callback,
+        recoverMissing,
+        authorizationReads,
+      ),
+    );
+  }
+
+  async function withActiveComputerControllerReads<T>(
+    context: Context,
+    grant: AccessGrant,
+    workspaceId: string,
+    computerSessionId: string,
+    authorizationOperation: SessionAuthorizationOperation,
+    channelOperation: ChannelAOperation,
+    callback: ActiveComputerControllerCallback<T>,
+    recoverMissing: boolean,
+    authorizationReads: { handOffToToolDispatch(): void },
   ): Promise<T> {
     try {
       const record = await getComputerSessionControlRecord(deps.db, {
@@ -1491,11 +1544,20 @@ export function registerComputerSessionRoutes(
         workspaceId,
         computerSessionId,
       });
-      await authorizeSourceSession(deps, grant, record.sourceSessionId, authorizationOperation);
-      let sourceSession: Session | null = null;
+      // Only a cached managed controller can skip the source session; read it
+      // alongside authorization otherwise. A denial still wins.
+      const sourceSessionNeeded = record.session.placement?.kind !== "sandbox_group";
+      const [authorized, sourceRead] = await Promise.allSettled([
+        authorizeSourceSession(deps, grant, record.sourceSessionId, authorizationOperation),
+        sourceSessionNeeded
+          ? requireSourceSession(deps, workspaceId, record.sourceSessionId)
+          : Promise.resolve(null),
+      ]);
+      if (authorized.status === "rejected") throw authorized.reason;
+      if (sourceRead.status === "rejected") throw sourceRead.reason;
+      let sourceSession: Session | null = sourceRead.value;
       if (record.session.placement?.kind === "connected_machine") {
-        sourceSession = await requireSourceSession(deps, workspaceId, record.sourceSessionId);
-        if (sourceSession.activeSandboxId !== record.session.placement.sandboxId) {
+        if (sourceSession?.activeSandboxId !== record.session.placement.sandboxId) {
           return await throwComputerSourcePlacementChanged(
             grant,
             record.sourceSessionId,
@@ -1517,6 +1579,7 @@ export function registerComputerSessionRoutes(
         throw new ComputerSessionStateError("ComputerSession controller authority changed");
       }
       const run = async (placement: ComputerPlacement): Promise<T> => {
+        authorizationReads.handOffToToolDispatch();
         // The active controller binding is the provisioning fence. Live
         // input connects to it directly instead of re-ensuring the sidecar.
         const client = connectController(grant, record, placement);

package/src/routes/insights-usage.ts

@@ -1,6 +1,8 @@
 import {
   InsightsCallsResponse,
   InsightsUsageResponse,
+  InsightsSiteUsageQuery,
+  InsightsSiteUsageResponse,
   OrganizationInsightsCallsQuery,
   OrganizationInsightsUsageQuery,
   WorkspaceInsightsCallsQuery,
@@ -10,10 +12,12 @@ import type { AccessContext } from "@opengeni/contracts";
 import {
   accountScopedApiKeyWorkspaceAuthority,
   getInsightsUsage,
+  getInsightsSiteUsage,
   hasPermission,
   listInsightsCalls,
   requireAccessContext,
   requireAccessGrant,
+  siteViewerForGrant,
   type ApiRouteDeps,
   type InsightsQueryScope,
 } from "@opengeni/core";
@@ -221,6 +225,24 @@ export function registerInsightsUsageRoutes(app: Hono, deps: ApiRouteDeps): void
     });
   }
 
+  app.get("/v1/workspaces/:workspaceId/insights/sites", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const query = InsightsSiteUsageQuery.safeParse(insightsQueryParameters(c.req.queries()));
+    if (!query.success) throw new HTTPException(400, { message: "invalid Site Insights query" });
+    const viewer = await siteViewerForGrant(deps.db, grant);
+    const response = await insightsWithFriendlyTimeout(() =>
+      getInsightsSiteUsage(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        query: query.data,
+        viewerSubjectId: viewer.subjectId,
+      }),
+    );
+    c.header("cache-control", "private, no-store");
+    return c.json(InsightsSiteUsageResponse.parse(response));
+  });
+
   app.get("/v1/workspaces/:workspaceId/insights/usage", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");

package/src/routes/organization-memberships.ts

@@ -247,6 +247,18 @@ function parseId(schema: z.ZodString, value: string, label: string): string {
 
 function rethrowMembershipError(error: unknown, resourceLimitMessage?: string): never {
   const sqlState = nestedPostgresSqlState(error);
+  if (sqlState === "P0S01") {
+    throw new HTTPException(402, {
+      res: Response.json(
+        {
+          error: "seat_limit_reached",
+          message: "Organization seat limit reached. Upgrade your plan to add people.",
+          action: { type: "upgrade", href: "/billing" },
+        },
+        { status: 402 },
+      ),
+    });
+  }
   if (sqlState === "54000" && resourceLimitMessage) {
     throw new HTTPException(409, {
       message: resourceLimitMessage,

package/src/routes/sessions.ts

@@ -30,7 +30,12 @@ import {
   SITE_FRAME_SESSION_CREATE_FIELDS,
   siteFrameBodyRefusal,
 } from "@opengeni/contracts/site-session-http";
-import { requireWorkspace, scheduledSessionIds } from "@opengeni/db";
+import {
+  requireWorkspace,
+  scheduledSessionIds,
+  currentSiteViewerRlsContext,
+  nestedPostgresSqlState,
+} from "@opengeni/db";
 import {
   currentSiteSessionOrigin,
   isVerifiedDelegatedHumanAuthorization,
@@ -329,6 +334,7 @@ import {
 } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import { SessionRetryConflictError } from "@opengeni/db";
+import { reauthorizeSiteSessionRequest } from "../site-publishing/session-request-authority";
 import {
   attachViewer,
   detachViewer,
@@ -761,7 +767,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
       // nothing else: the session gets the minimal Site profile. Only the Site
       // itself, running its published agent as `site:<siteId>`, chooses tools.
       const siteOrigin = origin ?? currentSiteSessionOrigin();
-      if (siteOrigin && grant.subjectId !== `site:${siteOrigin.siteId}`) {
+      if (siteOrigin && currentSiteViewerRlsContext()?.siteId !== siteOrigin.siteId) {
         const refused = siteFrameBodyRefusal("sessions.create", "/sessions", payload);
         if (refused)
           return c.json(
@@ -778,6 +784,11 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
           siteId: siteOrigin.siteId,
           versionId: siteOrigin.versionId ?? null,
         });
+        // Ordinary Site viewers use native Only-me ownership. An agent preview
+        // inherits its parent's native visibility; the Site audience binding
+        // additionally restricts that execution to the parent's real owner.
+        if (grant.principalKind !== "agent_attempt")
+          (payload as Record<string, unknown>).visibility = "private";
       }
       const create = () =>
         createSessionForRequest(deps, grant, workspaceId, payload, authorization);
@@ -993,6 +1004,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
           ...(query.includeTotals ? { includeTotals: true } : {}),
           ...(query.needsYouOnly ? { needsYouOnly: true } : {}),
           ...(query.contentArchivedOnly ? { contentArchivedOnly: true } : {}),
+          ...(query.mineOnly ? { mineOnly: true } : {}),
           ...(query.includePinned === false ? { includePinned: false } : {}),
           ...(query.archivedOnly ? { archivedOnly: true } : {}),
           ...(query.sortBy ? { sortBy: query.sortBy } : {}),
@@ -3597,6 +3609,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
         reauthorizeAfterMs:
           authorization?.reauthorizeAfterMs ?? SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS,
         reauthorize: async () => {
+          await reauthorizeSiteSessionRequest(c.req.raw);
           const freshGrant = await requireFreshAccessGrant(c, deps, workspaceId, "sessions:read");
           await requireSessionAuthorization(deps, freshGrant, {
             sessionId,
@@ -5671,7 +5684,10 @@ export function sessionTenancyHttpError(error: unknown): Error {
       retryable: false,
     });
   }
-  if (error instanceof SessionTenancyNotActivatedError) {
+  if (
+    error instanceof SessionTenancyNotActivatedError ||
+    nestedPostgresSqlState(error) === "P0793"
+  ) {
     return new ApiHttpError(409, {
       code: "conflict",
       message: "Only-me chats are not enabled for this organization.",
@@ -5820,6 +5836,7 @@ export function sessionListQuery(
   includeTotals: boolean;
   needsYouOnly: boolean;
   contentArchivedOnly: boolean;
+  mineOnly: boolean;
   archivedOnly: boolean;
   sortBy: "updatedAt" | "createdAt" | "name" | undefined;
   archiveStatus: "active" | "archived" | "all" | undefined;
@@ -5869,17 +5886,20 @@ export function sessionListQuery(
     throw new HTTPException(400, { message: 'includePinned must be "true" or "false"' });
   }
   const includePinned = query.includePinned !== "false";
-  for (const key of ["includeTotals", "needsYouOnly", "contentArchivedOnly"]) {
+  for (const key of ["includeTotals", "needsYouOnly", "contentArchivedOnly", "mineOnly"]) {
     if (query[key] !== undefined && !["true", "false"].includes(query[key]!))
       throw new HTTPException(400, { message: `${key} must be "true" or "false"` });
   }
   const includeTotals = query.includeTotals === "true";
   const needsYouOnly = query.needsYouOnly === "true";
   const contentArchivedOnly = query.contentArchivedOnly === "true";
+  const mineOnly = query.mineOnly === "true";
   if (includeTotals && (!allowCursor || (parentSessionId !== "null" && !pinsOnly)))
     throw new HTTPException(400, { message: "includeTotals requires a root page" });
   if (needsYouOnly && !allowCursor)
     throw new HTTPException(400, { message: 'needsYouOnly requires view="page"' });
+  if (mineOnly && !allowCursor)
+    throw new HTTPException(400, { message: 'mineOnly requires view="page"' });
   if (pinsOnly && !includePinned) {
     throw new HTTPException(400, { message: "pinsOnly requires includePinned" });
   }
@@ -5975,6 +5995,7 @@ export function sessionListQuery(
   const hasPageFilters =
     needsYouOnly ||
     contentArchivedOnly ||
+    mineOnly ||
     originSiteId !== undefined ||
     channelId !== undefined ||
     createdByKind !== undefined ||
@@ -6010,6 +6031,7 @@ export function sessionListQuery(
     includeTotals,
     needsYouOnly,
     contentArchivedOnly,
+    mineOnly,
     archivedOnly,
     sortBy: sortBy.data,
     archiveStatus: archiveStatus.data,
@@ -6552,7 +6574,10 @@ export function sessionCreateErrorResponse(c: Context, error: unknown): Response
       403,
     );
   }
-  if (error instanceof SessionTenancyNotActivatedError) {
+  if (
+    error instanceof SessionTenancyNotActivatedError ||
+    nestedPostgresSqlState(error) === "P0793"
+  ) {
     return c.json(
       {
         code: "SESSION_TENANCY_NOT_ACTIVATED",

package/src/routes/site-runtime.ts

@@ -1,5 +1,8 @@
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import {
+  ReasoningEffort,
+  LatencyMode,
+  permissionsRequiredByFirstPartyTools,
   DeleteSessionQueueItemRequest,
   EditSessionQueueItemRequest,
   matchSiteOperation,
@@ -30,6 +33,7 @@ import {
   type ToolRef,
 } from "@opengeni/contracts";
 import {
+  cancelPublishedSiteSession,
   withHostSessionUsageLimit,
   withSiteSessionOrigin,
   admissibleWorkspaceModel,
@@ -42,6 +46,7 @@ import {
   consumeSiteAuthCode,
   finishSiteRuntimeAdmission,
   withSiteRuntimeAdmission,
+  withSiteViewerRlsContext,
   createSiteAbuseReport,
   getSiteWorkspaceMemberPermissions,
   readSitePlatformUsage,
@@ -65,7 +70,6 @@ import {
   type SiteRuntimeConversationRecord,
 } from "@opengeni/db";
 import {
-  SITE_AGENT_DATA_TOOL_PERMISSIONS,
   siteAgentDataToolsForStart,
   siteAgentInstructions,
   sitePublishedDataViewer,
@@ -145,7 +149,7 @@ import {
   configuredSitesDomain,
   healSiteEdgeIfStale,
   notifySiteAbuse,
-  setSitePublishingDispatch,
+  setSitePublishingCancellation,
   siteHostMapRecord,
   sitePublishingError,
 } from "../site-publishing/service";
@@ -212,6 +216,9 @@ const CreateConversationRequest = z
   .object({
     initialMessage: z.string().trim().min(1).max(MESSAGE_MAX_CHARS),
     idempotencyKey: z.string().min(1).max(200).optional(),
+    model: z.string().min(1).optional(),
+    reasoningEffort: ReasoningEffort.optional(),
+    latencyMode: LatencyMode.optional(),
   })
   .passthrough();
 const SendMessageRequest = z
@@ -497,8 +504,8 @@ type RuntimeRequest = {
 export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
   const dispatch = async (request: Request): Promise<Response> =>
     await app.fetch(markLocalInternalDispatch(request));
-  // Publication changes cancel a Site's conversations through this dispatch.
-  setSitePublishingDispatch(deps.settings, dispatch);
+  // Lifecycle cancellation is a native internal command, never viewer dispatch.
+  setSitePublishingCancellation(deps.settings, (input) => cancelPublishedSiteSession(deps, input));
 
   const handler = async (context: Context): Promise<Response> => {
     const domain = configuredSitesDomain(deps.settings);
@@ -1232,7 +1239,7 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
     throw unsupported();
   };
 
-  /** The viewer's own agent conversations on this Site, run as `site:<siteId>`. */
+  /** The viewer's own conversations, with native member or viewer-bound outsider authority. */
   const sessions = async (
     request: RuntimeRequest,
     id: string,
@@ -1246,6 +1253,20 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
     // carries the Site and version headers the API's Site frame guard
     // validates; sessions and turns it starts record this Site and version.
     const siteOrigin = { siteId: host.site.id, title: host.site.title, versionId: host.versionId };
+    const reauthorizeViewer = async () => {
+      const liveHost = await requireServedSiteRuntimeHost(deps, host.domain, request.fields.host);
+      const liveViewer = await resolveSiteRuntimeViewer(deps, liveHost, request.fields);
+      if (
+        liveHost.site.id !== host.site.id ||
+        liveViewer.principal !== viewer.principal ||
+        liveViewer.kind !== viewer.kind ||
+        liveViewer.sessionId !== viewer.sessionId
+      )
+        throw siteNotAvailableForViewer(
+          "agent",
+          "This conversation is no longer available to this viewer",
+        );
+    };
     let pendingAdmission: { sessionId: string; admissionId: string } | undefined;
     const send = async (
       method: string,
@@ -1253,16 +1274,20 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
       body?: unknown,
       extraPermissions?: readonly Permission[],
     ) => {
+      await reauthorizeViewer();
       const execute = () =>
-        withSiteSessionOrigin(siteOrigin, async () =>
-          dispatch(
-            await siteRuntimeSessionRequest(deps, host, viewer, {
-              origin: url.origin,
-              method,
-              path,
-              ...(body === undefined ? {} : { body }),
-              ...(extraPermissions ? { extraPermissions } : {}),
-            }),
+        withSiteViewerRlsContext({ siteId: host.site.id, principal: viewer.principal }, () =>
+          withSiteSessionOrigin(siteOrigin, async () =>
+            dispatch(
+              await siteRuntimeSessionRequest(deps, host, viewer, {
+                origin: url.origin,
+                method,
+                path,
+                reauthorize: reauthorizeViewer,
+                ...(body === undefined ? {} : { body }),
+                ...(extraPermissions ? { extraPermissions } : {}),
+              }),
+            ),
           ),
         );
       const pending = pendingAdmission;
@@ -1344,6 +1369,11 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
       if (viewer.kind === "guest" || viewer.kind === "user")
         await requireSitePlatformOpen(deps, "guest_agent");
       const models = await siteViewerModels(host, viewer, limits);
+      if (input.model && !models.allowed.includes(input.model))
+        throw siteNotAvailableForViewer(
+          "agent_model",
+          "This model is not available to you on this Site",
+        );
       if (models.unavailable)
         throw siteNotAvailableForViewer(
           "agent_model",
@@ -1402,6 +1432,11 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
         }
       }
       // Settle the viewer's recent spend so the day budget sees it.
+      if (!repair && viewer.kind !== "member" && deps.settings.privacyOnlyMeAllowed === false)
+        throw siteNotAvailableForViewer(
+          "private_conversations",
+          "Private Site conversations are disabled by this deployment",
+        );
       for (const conversation of await listOwnedSiteRuntimeConversations(deps.db, host.scope, {
         siteId: host.site.id,
         viewerPrincipal: viewer.principal,
@@ -1455,7 +1490,9 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
         host.scope,
         host.site.id,
         viewer.kind,
+        viewer.kind === "member" ? (memberPermissions ?? []) : undefined,
       );
+      const dataToolPermissions = permissionsRequiredByFirstPartyTools(dataTools);
       // One transaction counts the start and reserves a per-turn estimate
       // against the visitor's and the Site's windows; only the funded allowance
       // becomes the session's usage limit, set in the create transaction. The
@@ -1491,15 +1528,14 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
       const body = {
         initialMessage: input.initialMessage,
         requestedSessionId,
+        ...(viewer.kind === "member" ? { visibility: "private" } : {}),
         startMode: "standard",
         agentAccess: "session",
         memoryScope: "off",
         rigId: null,
         // Only this Site's data tools; never management or workspace tools.
         firstPartyMcpTools: dataTools,
-        ...(dataTools.length > 0
-          ? { firstPartyMcpPermissions: [...SITE_AGENT_DATA_TOOL_PERMISSIONS] }
-          : {}),
+        ...(dataTools.length > 0 ? { firstPartyMcpPermissions: dataToolPermissions } : {}),
         agent: {
           capabilities: {
             from: "none",
@@ -1511,7 +1547,13 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
         // No sandbox: a Site's agent answers from the page and the Site's
         // data, with no shell or workspace files.
         sandboxBackend: "none",
-        ...(repair ? { model: repair.model } : models.default ? { model: models.default } : {}),
+        ...(repair
+          ? { model: repair.model }
+          : input.model || models.default
+            ? { model: input.model ?? models.default }
+            : {}),
+        ...(input.reasoningEffort === undefined ? {} : { reasoningEffort: input.reasoningEffort }),
+        ...(input.latencyMode === undefined ? {} : { latencyMode: input.latencyMode }),
         instructions: siteAgentInstructions(host, viewer, dataTools, agent.instructions),
         // Always explicit: an empty list means no workspace tools at all.
         tools: mcpTools,
@@ -1525,8 +1567,7 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
         },
         ...(input.idempotencyKey ? { idempotencyKey: `site-runtime:${requestedSessionId}` } : {}),
       };
-      const start = () =>
-        send("POST", base, body, dataTools.length > 0 ? SITE_AGENT_DATA_TOOL_PERMISSIONS : []);
+      const start = () => send("POST", base, body, dataToolPermissions);
       // Workspace members get no Site budget at all: their conversation is an
       // ordinary session under the workspace's normal limits, so no session
       // usage limit is stamped on it, whatever the Site's limits say.
@@ -1694,6 +1735,7 @@ export function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void {
         viewer,
         conversation.sessionId,
         conversation.toolIds,
+        viewer.kind === "member" ? (memberPermissions ?? []) : undefined,
       );
       const usage = await settleSiteRuntimeSpend(deps, host, conversation);
       // Clear the stamped session cap before dropping the durable conversation

package/src/sandbox/channel-a.ts

@@ -43,6 +43,7 @@ import {
   SandboxPaidComputeAdmissionError,
   withSandboxProviderReadLock,
   type Database,
+  type EnrollmentRecord,
   type LeaseSnapshot,
 } from "@opengeni/db";
 import { appendAndPublishEvents, type EventBus } from "@opengeni/events";
@@ -207,6 +208,15 @@ export type ChannelAHandle = {
    * who started an agent's turn, or the calling person. Routes that look up
    * the routed machine again must use it rather than the raw caller grant. */
   machineAuthority: () => Promise<ChannelAMachineAuthority>;
+  /** For a machine-home request, the Connected Machine and live runner this
+   * request was pinned to under `machineAuthority`. The routing session fails
+   * rather than follow a changed pointer, so a route that resolved this same
+   * sandbox can use it instead of looking the machine up again. */
+  pinnedMachine: {
+    sandboxId: string;
+    sandboxWorkspaceId: string;
+    enrollment: EnrollmentRecord;
+  } | null;
   requestId: string;
 };
 
@@ -629,6 +639,7 @@ async function withChannelAOperation<T>(
     routed: EstablishedSandboxSession,
     lease: LeaseSnapshot | null,
     homeSession: ChannelASession,
+    pinnedMachine: ChannelAHandle["pinnedMachine"] = null,
   ): Promise<T> => {
     const emit = async (events: { type: string; payload: unknown }[]): Promise<void> => {
       await appendAndPublishEvents(
@@ -667,6 +678,7 @@ async function withChannelAOperation<T>(
       homeSession,
       routingSession,
       machineAuthority,
+      pinnedMachine,
       requestId,
     });
     // The direct request has accepted the result in memory. Finalize every
@@ -770,6 +782,7 @@ async function withChannelAOperation<T>(
           enrollment.agentCapabilities.operationResourcePolicy === true,
         operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
         transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
+        browserControlHttpSupported: enrollment.agentCapabilities.browserControlHttp === true,
         ...(settings.agentOpStreamEnabled === true &&
         enrollment?.opStream === true &&
         bus.getOpStreamConnection
@@ -812,7 +825,11 @@ async function withChannelAOperation<T>(
         },
         established,
       );
-      return await runEstablished(routed, null, established.session as ChannelASession);
+      return await runEstablished(routed, null, established.session as ChannelASession, {
+        sandboxId: sandbox.id,
+        sandboxWorkspaceId: originWorkspaceId,
+        enrollment,
+      });
     } catch (error) {
       observeChannelAOperationFailure(services, {
         workspaceId,

package/src/sandbox/metrics-ingestion.ts

@@ -843,6 +843,7 @@ export function helloRuntimeCapabilities(hello: Hello): Record<string, boolean>
     operationCpuQuota: caps.operationCpuQuota === true,
     transactionalFsWrite: caps.transactionalFsWrite === true,
     credentialRenew: caps.credentialRenew === true,
+    browserControlHttp: caps.browserControlHttp === true,
     screenControl: caps.consentedScreenControl === true,
     ...(caps.macPermissions ? enrollmentMacPermissionCapabilities(caps.macPermissions) : {}),
   };