@opengeni/api-router 4.1.0 → 4.1.2-canary.36199476632001

package/src/observability.ts

@@ -1,6 +1,20 @@
-import type { EventLogger } from "@opengeni/events";
+import {
+  natsSubscriptionTerminationCounter,
+  type EventBusOptions,
+  type EventLogger,
+} from "@opengeni/events";
 import type { Attributes, AttributeValue, Observability } from "@opengeni/observability";
 
+/** Logger plus the closed-label subscription-termination counter for NATS connections. */
+export function observabilityEventBusOptions(
+  observability: Observability,
+): Pick<EventBusOptions, "logger" | "onSubscriptionTerminated"> {
+  return {
+    logger: observabilityEventLogger(observability),
+    onSubscriptionTerminated: natsSubscriptionTerminationCounter(observability),
+  };
+}
+
 export function observabilityEventLogger(observability: Observability): EventLogger {
   return {
     debug: (message, attributes) => observability.debug(message, eventAttributes(attributes)),

package/src/routes/billing.ts

@@ -342,7 +342,12 @@ async function handleStripeWebhookEvent(
 ): Promise<void> {
   switch (event.type) {
     case "checkout.session.completed":
-      await handleCheckoutSessionCompleted(deps, event);
+    case "checkout.session.async_payment_succeeded":
+      await handleCheckoutSessionPayment(deps, event);
+      return;
+    case "checkout.session.async_payment_failed":
+      // A delayed payment method failed. Completion reported it `unpaid`, so
+      // no credit was granted and there is nothing to reverse.
       return;
     case "checkout.session.expired":
     case "payment_intent.succeeded":
@@ -378,15 +383,69 @@ async function handleStripeWebhookEvent(
   }
 }
 
-async function handleCheckoutSessionCompleted(
+export type StripeCheckoutCreditDecision =
+  | { action: "grant"; credit: CheckoutCreditMetadata }
+  | { action: "ignore"; reason: "foreign_checkout" | "not_payment_mode" | "payment_not_paid" };
+
+/**
+ * Decides whether a Checkout Session webhook grants OpenGeni credits.
+ *
+ * Sessions created outside OpenGeni on the same Stripe account carry no
+ * `opengeni_` metadata and are acknowledged without effect. An OpenGeni
+ * session with malformed credit metadata still throws so the failure stays
+ * visible. Credits are granted only once Stripe reports the payment `paid`:
+ * on `checkout.session.completed` for immediate methods, or on
+ * `checkout.session.async_payment_succeeded` for delayed methods, whose
+ * completion event arrives `unpaid`. Both events carry the same session
+ * metadata, so the ledger idempotency key grants at most once.
+ */
+export function stripeCheckoutCreditDecision(
+  session: Stripe.Checkout.Session,
+): StripeCheckoutCreditDecision {
+  if (!Object.keys(session.metadata ?? {}).some((key) => key.startsWith("opengeni_"))) {
+    return { action: "ignore", reason: "foreign_checkout" };
+  }
+  if (session.mode !== "payment") {
+    return { action: "ignore", reason: "not_payment_mode" };
+  }
+  if (session.payment_status !== "paid") {
+    return { action: "ignore", reason: "payment_not_paid" };
+  }
+  return {
+    action: "grant",
+    credit: creditMetadata(session.metadata, `Stripe checkout session ${session.id}`),
+  };
+}
+
+async function handleCheckoutSessionPayment(
   deps: ApiRouteDeps,
   event: Stripe.Event,
 ): Promise<void> {
   const session = event.data.object as Stripe.Checkout.Session;
-  if (session.mode !== "payment" || session.payment_status !== "paid") {
+  const decision = stripeCheckoutCreditDecision(session);
+  if (decision.action === "ignore") {
+    if (decision.reason === "foreign_checkout") {
+      console.info("[api] stripe webhook ignored a checkout session not created by OpenGeni", {
+        stripeEventType: event.type,
+        livemode: event.livemode,
+      });
+    }
+    return;
+  }
+  const credit = decision.credit;
+  if (!(await getManagedAccount(deps.db, credit.accountId))) {
+    // Another OpenGeni deployment sharing the Stripe account (or an account
+    // removed before a delayed payment settled). Retrying cannot succeed, so
+    // acknowledge instead of failing the delivery for days.
+    console.info(
+      "[api] stripe webhook ignored a checkout session for an account not in this deployment",
+      {
+        stripeEventType: event.type,
+        livemode: event.livemode,
+      },
+    );
     return;
   }
-  const credit = creditMetadata(session.metadata, `Stripe checkout session ${session.id}`);
   const customerId = typeof session.customer === "string" ? session.customer : session.customer?.id;
   if (customerId) {
     await upsertBillingCustomer(deps.db, {
@@ -601,16 +660,18 @@ async function metadataForDispute(
     : charge.metadata;
 }
 
-function creditMetadata(
-  metadata: Stripe.Metadata | null | undefined,
-  label: string,
-): {
+export type CheckoutCreditMetadata = {
   accountId: string;
   amountMicros: number;
   idempotencyKey: string;
   amountUsd?: string;
   packageId?: string;
-} {
+};
+
+function creditMetadata(
+  metadata: Stripe.Metadata | null | undefined,
+  label: string,
+): CheckoutCreditMetadata {
   const accountId = metadata?.opengeni_account_id;
   const amountMicros = Number(metadata?.opengeni_credit_micros);
   const idempotencyKey = metadata?.opengeni_credit_idempotency_key;

package/src/routes/browser-sessions.ts

@@ -3,6 +3,7 @@ import {
   environmentsEncryptionKeyBytes,
   resolveFirstPartyDelegationSecret,
   resolveStreamTokenSecret,
+  sandboxWarmRateMicrosPerSecond,
 } from "@opengeni/config";
 import {
   BROWSER_CONTROL_WEBSOCKET_BEARER_PREFIX,
@@ -20,6 +21,8 @@ import {
   BrowserDownloadSaveRequest,
   BrowserDownloadSaveResponse,
   BrowserDownloadListResponse,
+  BrowserDomReadRequest,
+  BrowserDomReadResponse,
   BrowserExternalAuthCommand,
   BrowserOpenTargetRequest,
   BrowserObservation,
@@ -31,6 +34,7 @@ import {
   BrowserSessionListResponse,
   BrowserSessionMutationResponse,
   BrowserTargetListResponse,
+  BrowserTargetState,
   CreateBrowserSessionRequest,
   ExternalAuthInteractiveRequest,
   ExternalAuthInteractiveResponse,
@@ -75,6 +79,7 @@ import {
   BrowserSessionNotFoundError,
   BrowserSessionOperationConflictError,
   BrowserSessionStateError,
+  SandboxPaidComputeAdmissionError,
   completeBrowserSessionEnd,
   completeExternalAuth,
   completeBrowserDownloadSave,
@@ -88,6 +93,8 @@ import {
   dispatchExternalAuth,
   dispatchProtectedAuthFill,
   failBrowserSessionOperation,
+  failPreparedBrowserSessionEnd,
+  failPreparedBrowserSessionSuspend,
   failBrowserSessionResume,
   failBrowserSessionResumePreparation,
   failBrowserSessionSuspension,
@@ -169,6 +176,8 @@ import {
   provisionBrowserControlClient,
   renewSandboxProviderExpiration,
   type BrowserControlPlacementSession,
+  type BrowserControlScreenshotOptions,
+  type BrowserControlFrame,
   type PlacementBrowserStateCaptureReceipt,
   type PlacementBrowserNetworkRoute,
   type PlacementBrowserTransport,
@@ -221,6 +230,7 @@ import {
 } from "../interaction-metrics";
 import { withChannelA, withChannelARead, type ChannelAOperation } from "../sandbox/channel-a";
 import { sanitizeFilename } from "./files";
+import { USER_CONTENT_SECURITY_HEADERS } from "../http/user-content";
 
 const BROWSER_DRIVER_ID = "opengeni.cdp.v1";
 const LIGHTPANDA_DRIVER_ID = "opengeni.lightpanda.cdp.v1";
@@ -952,6 +962,71 @@ export function registerBrowserSessionRoutes(app: Hono, deps: ApiRouteDeps): voi
     },
   );
 
+  app.get(
+    "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/targets/:targetId/state",
+    async (context) => {
+      const { workspaceId, grant, browserSessionId } = await browserRoutePreamble(
+        context,
+        "sessions:read",
+      );
+      const targetId = requireOpaqueParam(context, "targetId");
+      const result = await withActiveBrowserController(
+        context,
+        grant,
+        workspaceId,
+        browserSessionId,
+        "session.read",
+        "browser.read",
+        async ({ sessionClient }) => await sessionClient.targetState(targetId),
+      );
+      return context.json(BrowserTargetState.parse(result));
+    },
+  );
+
+  app.post(
+    "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/targets/:targetId/dom-read",
+    async (context) => {
+      const { workspaceId, grant, browserSessionId } = await browserRoutePreamble(
+        context,
+        "sessions:read",
+      );
+      const targetId = requireOpaqueParam(context, "targetId");
+      const request = await parseJsonBody(context, BrowserDomReadRequest);
+      const result = await withActiveBrowserController(
+        context,
+        grant,
+        workspaceId,
+        browserSessionId,
+        "session.read",
+        "browser.read",
+        async ({ sessionClient }) => await sessionClient.readDom(targetId, request),
+      );
+      return context.json(BrowserDomReadResponse.parse(result));
+    },
+  );
+
+  app.get(
+    "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/targets/:targetId/screenshot",
+    async (context) => {
+      const { workspaceId, grant, browserSessionId } = await browserRoutePreamble(
+        context,
+        "sessions:read",
+      );
+      const targetId = requireOpaqueParam(context, "targetId");
+      const captureOptions = parseBrowserScreenshotOptions(new URL(context.req.url).searchParams);
+      const frame = await withActiveBrowserController(
+        context,
+        grant,
+        workspaceId,
+        browserSessionId,
+        "session.read",
+        "browser.read",
+        async ({ sessionClient }) => await sessionClient.capture(targetId, captureOptions),
+      );
+      return browserScreenshotResponse(frame);
+    },
+  );
+
   app.post(
     "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/actions",
     async (context) => {
@@ -2047,6 +2122,7 @@ export function registerBrowserSessionRoutes(app: Hono, deps: ApiRouteDeps): voi
       const request = await parseJsonBody(context, BrowserSessionLifecycleRequest);
       const startedAtMs = performance.now();
       const origin = requestOrigin(context, deps.settings);
+      let preparedForDispatch = false;
       try {
         const before = await getBrowserSessionControlRecord(deps.db, {
           accountId: grant.accountId,
@@ -2098,6 +2174,8 @@ export function registerBrowserSessionRoutes(app: Hono, deps: ApiRouteDeps): voi
           return context.json(parsed, 200);
         }
 
+        preparedForDispatch = true;
+
         const record = await getBrowserSessionControlRecord(deps.db, {
           accountId: grant.accountId,
           workspaceId,
@@ -2259,6 +2337,15 @@ export function registerBrowserSessionRoutes(app: Hono, deps: ApiRouteDeps): voi
         observeLifecycleResult(deps.observability, startedAtMs, parsed);
         return context.json(parsed, 200);
       } catch (error) {
+        if (preparedForDispatch) {
+          await failPreparedBrowserSessionSuspend(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            browserSessionId,
+            operationId: request.operationId,
+            error: interactionFailure(error),
+          });
+        }
         throw browserRouteError(error);
       }
     },
@@ -2522,6 +2609,11 @@ export function registerBrowserSessionRoutes(app: Hono, deps: ApiRouteDeps): voi
       const request = await parseJsonBody(context, BrowserSessionLifecycleRequest);
       const startedAtMs = performance.now();
       const origin = requestOrigin(context, deps.settings);
+      let endPreparation: {
+        restoreLifecycle: BrowserSessionValue["lifecycle"];
+        restoreFailureCode: string | null;
+        expectedControllerGeneration: string | null;
+      } | null = null;
       try {
         const before = await getBrowserSessionControlRecord(deps.db, {
           accountId: grant.accountId,
@@ -2536,6 +2628,9 @@ export function registerBrowserSessionRoutes(app: Hono, deps: ApiRouteDeps): voi
           browserSessionId,
           operationId: request.operationId,
           actorSubjectId: grant.subjectId,
+          expectedLifecycle: before.session.lifecycle,
+          expectedFailureCode: before.session.failureCode,
+          expectedControllerGeneration: before.session.controller?.controllerGeneration ?? null,
         });
         if (isTerminalOperation(prepared.operation.state)) {
           if (prepared.operation.state === "completed") {
@@ -2551,6 +2646,13 @@ export function registerBrowserSessionRoutes(app: Hono, deps: ApiRouteDeps): voi
           observeLifecycleResult(deps.observability, startedAtMs, parsed);
           return context.json(parsed, 200);
         }
+        if (before.session.lifecycle !== "ending") {
+          endPreparation = {
+            restoreLifecycle: before.session.lifecycle,
+            restoreFailureCode: before.session.failureCode,
+            expectedControllerGeneration: before.session.controller?.controllerGeneration ?? null,
+          };
+        }
 
         const record = await getBrowserSessionControlRecord(deps.db, {
           accountId: grant.accountId,
@@ -2644,6 +2746,16 @@ export function registerBrowserSessionRoutes(app: Hono, deps: ApiRouteDeps): voi
         observeLifecycleResult(deps.observability, startedAtMs, parsed);
         return context.json(parsed, 200);
       } catch (error) {
+        if (endPreparation) {
+          await failPreparedBrowserSessionEnd(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            browserSessionId,
+            operationId: request.operationId,
+            ...endPreparation,
+            error: interactionFailure(error),
+          });
+        }
         throw browserRouteError(error);
       }
     },
@@ -2792,6 +2904,12 @@ export function registerBrowserSessionRoutes(app: Hono, deps: ApiRouteDeps): voi
             resolved.kind !== "selfhosted" ||
             resolved.sandboxId !== expectedPlacement.sandboxId
           ) {
+            if (operation === "browser.create") {
+              throw new HTTPException(422, {
+                message:
+                  "The requested Connected Machine is not this session's current placement. Move the session to that machine before creating an interaction resource.",
+              });
+            }
             return await throwBrowserSourcePlacementChanged(
               grant,
               sourceSession.id,
@@ -3748,6 +3866,10 @@ async function ensureInteractionHolder(
     holderId: interactionHolderId(browserSessionId),
     subjectId: sourceSession.id,
     backend: placement.lease.backend,
+    warmBilling: {
+      mode: deps.settings.sandboxWarmBillingMode,
+      rateMicrosPerSecond: sandboxWarmRateMicrosPerSecond(deps.settings, placement.lease.backend),
+    },
     os: placement.lease.os,
     image: sandboxRuntime.image,
     rigVersionId: sourceSession.rigVersionId,
@@ -4023,6 +4145,7 @@ async function settleBrowserSessionSuspensionCaptureFailure(
   return await failBrowserSessionSuspension(deps.db, {
     ...input,
     ...(outcomeUnknown ? { state: "outcome_unknown" as const } : {}),
+    missingControllerSession: error.status === 404 && isMissingBrowserControllerSession(error),
     error: error.error,
   });
 }
@@ -4160,6 +4283,50 @@ function optionalBoundedInteger(
   return parsed;
 }
 
+export function parseBrowserScreenshotOptions(
+  query: URLSearchParams,
+): BrowserControlScreenshotOptions {
+  for (const key of ["fullPage", "format", "quality"]) {
+    if (query.getAll(key).length > 1) {
+      throw new HTTPException(400, { message: `duplicate browser screenshot ${key}` });
+    }
+  }
+  const fullPage = query.get("fullPage");
+  if (fullPage !== null && fullPage !== "true" && fullPage !== "false") {
+    throw new HTTPException(400, { message: "invalid browser screenshot fullPage" });
+  }
+  const format = query.get("format");
+  if (format !== null && format !== "jpeg" && format !== "png") {
+    throw new HTTPException(400, { message: "invalid browser screenshot format" });
+  }
+  const quality = query.get("quality");
+  const parsedQuality = quality === null ? null : optionalBoundedInteger(quality, 1, 100);
+  if (quality !== null && parsedQuality === null) {
+    throw new HTTPException(400, { message: "invalid browser screenshot quality" });
+  }
+  return {
+    ...(fullPage === null ? {} : { fullPage: fullPage === "true" }),
+    ...(format === null ? {} : { format }),
+    ...(parsedQuality === null ? {} : { quality: parsedQuality }),
+  };
+}
+
+export function browserScreenshotResponse(
+  frame: Pick<BrowserControlFrame, "data" | "mediaType" | "metadataHeader">,
+): Response {
+  // Node Buffers can be views into a larger backing allocation. Copy exactly
+  // the image bytes before constructing the Response.
+  return new Response(Uint8Array.from(frame.data).buffer, {
+    status: 200,
+    headers: {
+      "cache-control": "no-store",
+      "content-type": frame.mediaType,
+      "x-opengeni-browser-frame": frame.metadataHeader,
+      ...USER_CONTENT_SECURITY_HEADERS,
+    },
+  });
+}
+
 function isUuid(value: unknown): value is string {
   return (
     typeof value === "string" &&
@@ -4716,6 +4883,8 @@ function browserRouteError(error: unknown): HTTPException {
   const connectedMachineError = interactionControlApiError(error, "browser");
   if (connectedMachineError) return connectedMachineError;
   if (error instanceof HTTPException) return error;
+  if (error instanceof SandboxPaidComputeAdmissionError)
+    return new HTTPException(402, { message: error.message, cause: error });
   if (error instanceof BrowserSessionNotFoundError) {
     return new HTTPException(404, { message: error.message, cause: error });
   }

package/src/routes/client-errors.ts

@@ -0,0 +1,182 @@
+// Minimal first-party web-client error beacon.
+//
+// The browser reports only a closed error kind, the matched route PATTERN
+// (never a concrete URL), and its bundle revision. No message, stack, URL,
+// identifier, user content, or credential is accepted, and the route admits
+// anonymous callers so a failure before sign-in is still counted. Each
+// accepted report increments one closed-label counter and writes one bounded
+// structured log line. This is an operational lower bound, not exception
+// capture: blocked requests, closed tabs, and the per-process admission bound
+// all drop reports. Because the route is anonymous, any HTTP client that omits
+// or forges `Origin` can still send reports up to the admission ceiling, so
+// alert on rates and ratios, not on absolute counts.
+import type { Settings } from "@opengeni/config";
+import {
+  CLIENT_ERROR_KINDS,
+  CLIENT_ERROR_REPORT_MAX_BYTES,
+  CLIENT_ERROR_REVISION_PATTERN,
+  CLIENT_ERROR_ROUTE_PATTERN,
+  CLIENT_ERRORS_PATH,
+  type ClientErrorKind,
+} from "@opengeni/contracts/client-error-report";
+import type { Observability } from "@opengeni/observability";
+import type { Context, Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+import { z } from "zod";
+
+import { isAllowedBrowserOrigin } from "../http/cors";
+
+export {
+  CLIENT_ERROR_KINDS,
+  CLIENT_ERROR_REPORT_MAX_BYTES,
+  CLIENT_ERRORS_PATH,
+  type ClientErrorKind,
+};
+
+const CLIENT_ERROR_REJECTION_REASONS = ["invalid", "too_large", "origin", "rate_limited"] as const;
+type ClientErrorRejectionReason = (typeof CLIENT_ERROR_REJECTION_REASONS)[number];
+
+export const ClientErrorReport = z
+  .object({
+    kind: z.enum(CLIENT_ERROR_KINDS),
+    route: z.string().regex(CLIENT_ERROR_ROUTE_PATTERN),
+    revision: z.string().regex(CLIENT_ERROR_REVISION_PATTERN),
+  })
+  .strict();
+export type ClientErrorReport = z.infer<typeof ClientErrorReport>;
+
+const CLIENT_ERRORS_METRIC = {
+  name: "opengeni_client_errors_total",
+  help: "Web client errors reported by browsers, by closed kind. Admission is bounded per API process, so this is a lower bound.",
+} as const;
+const CLIENT_ERROR_REJECTIONS_METRIC = {
+  name: "opengeni_client_error_reports_rejected_total",
+  help: 'Web client error reports the API refused, by closed reason and kind ("unknown" when the body was not read or not valid).',
+} as const;
+
+export type ClientErrorAdmission = { admit(kind: ClientErrorKind): boolean };
+
+/**
+ * One token bucket per closed kind bounds counter inflation and log volume
+ * from any caller, including an anonymous one, without per-client state.
+ */
+export function createClientErrorAdmission(
+  options: { capacity?: number; refillPerSecond?: number; now?: () => number } = {},
+): ClientErrorAdmission {
+  const capacity = options.capacity ?? 30;
+  const refillPerMs = (options.refillPerSecond ?? 0.5) / 1_000;
+  const now = options.now ?? Date.now;
+  const buckets = new Map<ClientErrorKind, { tokens: number; updatedAt: number }>();
+  return {
+    admit(kind) {
+      const at = now();
+      const bucket = buckets.get(kind) ?? { tokens: capacity, updatedAt: at };
+      bucket.tokens = Math.min(
+        capacity,
+        bucket.tokens + Math.max(0, at - bucket.updatedAt) * refillPerMs,
+      );
+      bucket.updatedAt = at;
+      buckets.set(kind, bucket);
+      if (bucket.tokens < 1) return false;
+      bucket.tokens -= 1;
+      return true;
+    },
+  };
+}
+
+export function parseClientErrorReport(body: string | null): ClientErrorReport | null {
+  if (body === null || new TextEncoder().encode(body).byteLength > CLIENT_ERROR_REPORT_MAX_BYTES) {
+    return null;
+  }
+  let value: unknown;
+  try {
+    value = JSON.parse(body);
+  } catch {
+    return null;
+  }
+  const parsed = ClientErrorReport.safeParse(value);
+  return parsed.success ? parsed.data : null;
+}
+
+/**
+ * The exact beacon request. The app-wide request-body limit skips it because
+ * the route enforces its own 512-byte limit on the streamed body; the generic
+ * ceiling would otherwise buffer a chunked body of many megabytes on an
+ * anonymous route before this one could refuse it.
+ */
+export function isClientErrorReportRequest(method: string, pathname: string): boolean {
+  return method === "POST" && pathname === CLIENT_ERRORS_PATH;
+}
+
+export function registerClientErrorRoutes(
+  app: Hono,
+  deps: {
+    observability: Observability;
+    settings: Pick<Settings, "corsAllowOriginRegex" | "publicBaseUrl" | "webBaseUrl">;
+    admission?: ClientErrorAdmission;
+  },
+): void {
+  const { observability, settings } = deps;
+  const admission = deps.admission ?? createClientErrorAdmission();
+  // Publish the finite series at zero so the first failure after a deploy is
+  // an increase from a baseline rather than a series appearing from nothing.
+  for (const kind of CLIENT_ERROR_KINDS) {
+    observability.incrementCounter({ ...CLIENT_ERRORS_METRIC, labels: { kind }, amount: 0 });
+    observability.incrementCounter({
+      ...CLIENT_ERROR_REJECTIONS_METRIC,
+      labels: { reason: "rate_limited", kind },
+      amount: 0,
+    });
+  }
+  for (const reason of CLIENT_ERROR_REJECTION_REASONS) {
+    if (reason === "rate_limited") continue;
+    observability.incrementCounter({
+      ...CLIENT_ERROR_REJECTIONS_METRIC,
+      labels: { reason, kind: "unknown" },
+      amount: 0,
+    });
+  }
+  // A rate-limited refusal keeps its kind, so accepted plus rejected is the
+  // true per-kind arrival rate even while a bucket is empty.
+  const reject = (
+    c: Context,
+    reason: ClientErrorRejectionReason,
+    status: 400 | 403 | 413 | 429,
+    kind: ClientErrorKind | "unknown" = "unknown",
+  ) => {
+    observability.incrementCounter({ ...CLIENT_ERROR_REJECTIONS_METRIC, labels: { reason, kind } });
+    c.header("cache-control", "no-store");
+    return c.body(null, status);
+  };
+
+  app.post(
+    CLIENT_ERRORS_PATH,
+    // Enforced on the streamed body, so a chunked request without a
+    // Content-Length is refused after 512 bytes rather than buffered.
+    bodyLimit({
+      maxSize: CLIENT_ERROR_REPORT_MAX_BYTES,
+      onError: (c) => reject(c, "too_large", 413),
+    }),
+    async (c) => {
+      c.header("cache-control", "no-store");
+      // Browsers always send Origin on this cross- or same-origin POST. A
+      // foreign page therefore cannot spend the admission budget or inflate
+      // the counter through its visitors' browsers.
+      const origin = c.req.header("origin");
+      if (origin !== undefined && !isAllowedBrowserOrigin(origin, settings)) {
+        return reject(c, "origin", 403);
+      }
+      const report = parseClientErrorReport(await c.req.text().catch(() => null));
+      if (!report) return reject(c, "invalid", 400);
+      if (!admission.admit(report.kind)) return reject(c, "rate_limited", 429, report.kind);
+      observability.incrementCounter({ ...CLIENT_ERRORS_METRIC, labels: { kind: report.kind } });
+      observability.warn("Web client error reported", {
+        surface: "web",
+        reason: report.kind,
+        clientRoute: report.route,
+        clientRevision: report.revision,
+      });
+      return c.body(null, 204);
+    },
+  );
+}

package/src/routes/company-brain.ts

@@ -36,6 +36,7 @@ import { z } from "zod";
 
 import { createCompanyBrainOkfPackage, serializeCompanyBrainOkf } from "../company-brain-okf";
 import { projectWorkspaceState } from "../workspace-state-projection";
+import { USER_CONTENT_SECURITY_HEADERS } from "../http/user-content";
 
 const inspectorQuery = z
   .object({
@@ -235,6 +236,9 @@ export function registerCompanyBrainRoutes(app: Hono, deps: ApiRouteDeps): void
       "content-disposition",
       `attachment; filename="company-brain-${workspaceId}.okf.md"`,
     );
+    for (const [name, value] of Object.entries(USER_CONTENT_SECURITY_HEADERS)) {
+      context.header(name, value);
+    }
     return context.body(serializeCompanyBrainOkf(result));
   });