@opengeni/api-router 4.1.0 → 4.1.2-canary.36199476632001

package/src/routes/sessions.ts

@@ -1,5 +1,8 @@
 import { getRetainedProviderCommand } from "@opengeni/db/retained-provider-commands";
 import { searchSessionMessagesForSubject, SessionMessageSearchCursorError } from "@opengeni/db";
+import { listSessionEventSlices } from "@opengeni/db/session-event-slices";
+import * as sessionPreviewSchema from "@opengeni/db/schema";
+import { and, eq, sql } from "drizzle-orm";
 import { SessionMessageSearchRequest } from "@opengeni/contracts";
 import { scheduledSessionIds } from "@opengeni/db";
 import { withSiteSessionOrigin } from "@opengeni/core";
@@ -2924,6 +2927,90 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     return c.json(page.events);
   });
 
+  // Selected search hit only: never use the audit event projection here, even
+  // in summary mode (it can contain modelContext or truncate visible text).
+  app.get(
+    "/v1/workspaces/:workspaceId/sessions/:sessionId/events/:eventId/message-preview",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      await requireAccessGrant(c, deps, workspaceId, "sessions:read");
+      const sessionId = c.req.param("sessionId");
+      await assertSessionExists(db, workspaceId, sessionId);
+      const eventId = c.req.param("eventId");
+      const rawSequence = c.req.query("sequence");
+      const sequence = Number(rawSequence);
+      if (
+        !z.string().uuid().safeParse(eventId).success ||
+        rawSequence === undefined ||
+        !/^\d+$/.test(rawSequence) ||
+        !Number.isSafeInteger(sequence) ||
+        sequence < 1 ||
+        sequence > 2_147_483_647
+      )
+        throw new HTTPException(400, { message: "Invalid message preview reference" });
+
+      const notFound = () => new HTTPException(404, { message: "message not found" });
+      const maxUnits = 12_000;
+      const eventTable = sessionPreviewSchema.sessionEvents;
+      // The slice helper supports structured result views too. Check only the
+      // JSON scalar *kind* before calling it; never fetch a structured text value.
+      const candidates = await withWorkspaceRls(db, workspaceId, (tx) =>
+        tx
+          .select({ kind: sql<string | null>`jsonb_typeof(${eventTable.payload}->'text')` })
+          .from(eventTable)
+          .where(
+            and(
+              eq(eventTable.workspaceId, workspaceId),
+              eq(eventTable.sessionId, sessionId),
+              eq(eventTable.id, eventId),
+              eq(eventTable.sequence, sequence),
+              sql`${eventTable.type} in ('user.message', 'agent.message.completed')`,
+            ),
+          )
+          .limit(1),
+      );
+      if (candidates[0]?.kind !== "string") throw notFound();
+      const read = (offset: number) =>
+        listSessionEventSlices(db, workspaceId, sessionId, {
+          sourceSequence: sequence,
+          sourceOffset: offset,
+          after: sequence - 1,
+          before: sequence + 1,
+          includeTypes: ["user.message", "agent.message.completed"],
+          view: "conversation",
+        });
+      const first = await read(0);
+      const event = first.events[0];
+      const slice = first.slices?.[sequence];
+      // Includes the slice reader's duplicate, late and unclaimed-prompt gates.
+      if (!event || event.id !== eventId || event.sequence !== sequence || !slice || slice.omitted)
+        throw notFound();
+      if (slice.total > maxUnits) return c.json({ status: "unavailable" as const });
+
+      let text = slice.text;
+      let offset = slice.unit === "utf16" ? slice.text.length : Array.from(slice.text).length;
+      if (text.length > maxUnits) return c.json({ status: "unavailable" as const });
+      while (offset < slice.total) {
+        if (offset === 0) throw notFound();
+        const next = await read(offset);
+        const part = next.slices?.[sequence];
+        if (
+          next.events[0]?.id !== eventId ||
+          !part ||
+          part.omitted ||
+          part.unit !== slice.unit ||
+          part.total !== slice.total ||
+          part.offset !== offset
+        )
+          throw notFound();
+        text += part.text;
+        offset += slice.unit === "utf16" ? part.text.length : Array.from(part.text).length;
+        if (text.length > maxUnits) return c.json({ status: "unavailable" as const });
+      }
+      return c.json({ status: "available" as const, text });
+    },
+  );
+
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/events/stream", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "sessions:read");
@@ -4817,6 +4904,8 @@ export function sessionAuthorizationOperationForHttp(
     return verb === "POST" ? "session.context.write" : null;
   }
   if (suffix === "/events/stream" && verb === "GET") return "session.stream.read";
+  if (/^\/events\/[^/]+\/message-preview$/.test(suffix) && verb === "GET")
+    return "session.events.read";
   if (suffix === "/events") {
     if (verb === "GET") return "session.events.read";
     if (verb === "POST") return "session.append";

package/src/routes/workspace-artifacts.ts

@@ -37,6 +37,7 @@ import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
 import { readWorkspaceArtifactContent } from "../workspace-artifact-content";
+import { userContentDispositionHeaders } from "../http/user-content";
 import {
   projectWorkspaceArtifactDetailProvenance,
   projectWorkspaceArtifactMutationProvenance,
@@ -322,7 +323,15 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
         headers: {
           "Content-Type": "text/html; charset=utf-8",
           "Cache-Control": "private, no-store",
+          // A Site runs its own scripts, but only inside an opaque origin: no
+          // same-origin access to the console, and no cross-site embedding.
           "Content-Security-Policy": "sandbox allow-scripts",
+          "Cross-Origin-Resource-Policy": "same-origin",
+          "X-Content-Type-Options": "nosniff",
+          // Clients read this HTML with fetch and render it in their own frame
+          // (the console uses srcdoc). Opening the raw URL downloads it rather
+          // than running a publisher-authored page at an app-origin URL.
+          ...userContentDispositionHeaders("text/html", "site.html"),
         },
       },
     );

package/src/routes/workspace-state.ts

@@ -24,6 +24,7 @@ import { HTTPException } from "hono/http-exception";
 
 import { serializeWorkspaceStateExport } from "../workspace-state-export";
 import { projectWorkspaceState } from "../workspace-state-projection";
+import { USER_CONTENT_SECURITY_HEADERS } from "../http/user-content";
 
 async function readWorkspaceState(
   deps: ApiRouteDeps,
@@ -135,6 +136,9 @@ export function registerWorkspaceStateRoutes(app: Hono, deps: ApiRouteDeps): voi
       "content-disposition",
       `attachment; filename="workspace-state-${workspaceId}-sanitized.json"`,
     );
+    for (const [name, value] of Object.entries(USER_CONTENT_SECURITY_HEADERS)) {
+      context.header(name, value);
+    }
     return context.body(serializeWorkspaceStateExport(state));
   });
 }

package/src/routes/workspaces.ts

@@ -42,6 +42,7 @@ import {
   ensureWorkspaceByExternalIdentity,
   findWorkspaceByExternalIdentity,
   getManagedUserProfilesByIds,
+  getWorkspace,
   getWorkspaceModelPolicy,
   grantWorkspaceAccess,
   listWorkspaceMembers,
@@ -95,6 +96,9 @@ import {
   requireWorkspaceSettingsGrant,
   requireFreshAccessGrant,
   resolveWorkspaceCatalogSettings,
+  creditsDefaultSessionModel,
+  resolveDefaultSessionModelForSelections,
+  resolveWorkspaceModelSelection,
 } from "@opengeni/core";
 import { requireLimit } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
@@ -107,7 +111,7 @@ import {
 import { boundedLimit } from "../http/common";
 import { ApiHttpError } from "../http/api-error";
 import { browserSseDeliveryOptions, sseWorkspaceControlStream } from "../http/sse";
-import { buildWorkspaceModelCatalog } from "../model-catalog";
+import { projectWorkspaceModelCatalog } from "../model-catalog";
 import { deleteWorkspaceForRequest } from "../workspace-deletion";
 import {
   AI_GATEWAY_REALTIME_MODELS,
@@ -441,6 +445,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
       organizationOpenRouterConnectionActive,
       organizationGatewayCustomModels,
       organizationOpenRouterCustomModels,
+      workspace,
     ] = await Promise.all([
       getWorkspaceConnectionModelRestrictions(deps.db, workspaceId, grant.subjectId),
       deps.resolveCatalogSettings(),
@@ -477,24 +482,42 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
         workspaceId,
         providerKind: "openrouter",
       }),
+      getWorkspace(deps.db, workspaceId),
     ]);
+    const selections = resolveWorkspaceModelSelection({
+      connectionModelRestrictions,
+      settings: resolvedCatalog.settings,
+      policy,
+      codexSubscriptionActive,
+      xaiSubscriptionActive,
+      workspaceGatewayConnectionActive,
+      workspaceGatewayCustomModels,
+      workspaceOpenRouterConnectionActive: openRouterConnectionActive,
+      workspaceOpenRouterCustomModels,
+      organizationGatewayConnectionActive,
+      organizationOpenRouterConnectionActive,
+      organizationGatewayCustomModels,
+      organizationOpenRouterCustomModels,
+    });
+    // The same precedence the server applies when a new chat, API create, or
+    // scheduled occurrence names no model; published so pickers show it.
+    const workspaceSettings = workspace?.settings ?? {};
+    const defaultSelection = await resolveDefaultSessionModelForSelections(deps.db, {
+      settings: resolvedCatalog.settings,
+      accountId: grant.accountId,
+      workspaceSettings,
+      selections,
+    });
     c.header("cache-control", "private, no-store");
     return c.json(
       WorkspaceModelCatalogResponse.parse(
-        buildWorkspaceModelCatalog({
-          connectionModelRestrictions,
-          settings: resolvedCatalog.settings,
-          policy,
-          codexSubscriptionActive,
-          xaiSubscriptionActive,
-          workspaceGatewayConnectionActive,
-          workspaceGatewayCustomModels,
-          workspaceOpenRouterConnectionActive: openRouterConnectionActive,
-          workspaceOpenRouterCustomModels,
-          organizationGatewayConnectionActive,
-          organizationOpenRouterConnectionActive,
-          organizationGatewayCustomModels,
-          organizationOpenRouterCustomModels,
+        projectWorkspaceModelCatalog(selections, {
+          defaultSelection,
+          creditsSelection: creditsDefaultSessionModel({
+            settings: resolvedCatalog.settings,
+            selections,
+            workspaceSettings,
+          }),
         }),
       ),
     );

package/src/sandbox/auth-callout.ts

@@ -28,6 +28,8 @@
 // on its callout timeout). The bearer's `exp` caps the minted credential's life so a
 // revoked/expired enrollment cannot outlive its bearer.
 
+import { createHash } from "node:crypto";
+import { createLogThrottle, type LogThrottle } from "@opengeni/observability";
 import {
   resolveEnrollmentSigningSecret,
   type NatsCalloutConfig,
@@ -45,7 +47,7 @@ import {
   type ResponderConnection,
 } from "@opengeni/events";
 import type { Observability } from "@opengeni/observability";
-import { observabilityEventLogger } from "../observability";
+import { observabilityEventBusOptions } from "../observability";
 import { AGENT_CONNECTION_LEASE_MS } from "./connection-authority";
 
 /** The NATS subject nats-server publishes authorization requests on (ADR-26). */
@@ -57,6 +59,44 @@ export interface AuthCalloutDeps {
   settings: Settings;
   callout: NatsCalloutConfig;
   observability?: Observability;
+  /** Bounds repeated denial warnings; defaults to one process-wide throttle. */
+  denialWarningThrottle?: LogThrottle;
+}
+
+/** A stale or revoked machine re-dials on its reconnect backoff forever, so an
+ * unthrottled denial warning repeats every few seconds per machine. Log each
+ * distinct machine's first denial, then at most once per interval with the
+ * count of denials it hid. The denial decision itself is never throttled. */
+export const AUTH_CALLOUT_DENIAL_WARNING_INTERVAL_MS = 60_000;
+const processDenialWarningThrottle = createLogThrottle({
+  intervalMs: AUTH_CALLOUT_DENIAL_WARNING_INTERVAL_MS,
+  maxKeys: 1_024,
+});
+
+/** Closed denial vocabulary. The public log projection drops identifiers, so
+ * `reason` is what tells an operator which throttle key a count belongs to. */
+type AuthCalloutDenialReason = "invalid_bearer" | "inactive_enrollment" | "duplicate_runner";
+
+function warnDenial(
+  deps: AuthCalloutDeps,
+  key: string,
+  reason: AuthCalloutDenialReason,
+  message: string,
+  attributes: Record<string, string | number> = {},
+): void {
+  const admission = (deps.denialWarningThrottle ?? processDenialWarningThrottle).admit(key);
+  if (!admission) return;
+  deps.observability?.warn?.(message, {
+    ...attributes,
+    reason,
+    ...(admission.suppressedCount > 0 ? { suppressedCount: admission.suppressedCount } : {}),
+  });
+}
+
+/** A process-local dedupe key for a rejected bearer. The digest is never
+ * logged, and the bearer value never leaves this function. */
+function rejectedBearerKey(bearer: string): string {
+  return `invalid-bearer:${createHash("sha256").update(bearer).digest("hex").slice(0, 32)}`;
 }
 
 /**
@@ -108,7 +148,12 @@ export async function handleAuthorizationRequest(
   const claims = await verifyEnrollmentBearer(secret, bearer);
   if (!claims) {
     // Invalid signature / malformed / expired bearer. NEVER log the bearer value.
-    deps.observability?.warn?.("auth-callout: rejected an invalid enrollment bearer", {});
+    warnDenial(
+      deps,
+      rejectedBearerKey(bearer),
+      "invalid_bearer",
+      "auth-callout: rejected an invalid enrollment bearer",
+    );
     return deny("invalid or expired enrollment bearer");
   }
 
@@ -116,10 +161,13 @@ export async function handleAuthorizationRequest(
   // still-unexpired bearer (the revoke path flips status; this re-checks at connect).
   const enrollment = await getEnrollment(deps.db, claims.workspaceId, claims.enrollmentId);
   if (!enrollment || enrollment.status !== "active") {
-    deps.observability?.warn?.("auth-callout: denied a revoked or unknown enrollment", {
-      workspaceId: claims.workspaceId,
-      agentId: claims.agentId,
-    });
+    warnDenial(
+      deps,
+      `inactive:${claims.workspaceId}:${claims.agentId}`,
+      "inactive_enrollment",
+      "auth-callout: denied a revoked or unknown enrollment",
+      { workspaceId: claims.workspaceId, agentId: claims.agentId },
+    );
     return deny("enrollment is not active");
   }
 
@@ -151,10 +199,13 @@ export async function handleAuthorizationRequest(
     leaseMs: AGENT_CONNECTION_LEASE_MS,
   });
   if (!claim.claimed) {
-    deps.observability?.warn?.("auth-callout: denied a duplicate live runner", {
-      workspaceId: claims.workspaceId,
-      agentId: claims.agentId,
-    });
+    warnDenial(
+      deps,
+      `duplicate:${claims.workspaceId}:${claims.agentId}`,
+      "duplicate_runner",
+      "auth-callout: denied a duplicate live runner",
+      { workspaceId: claims.workspaceId, agentId: claims.agentId },
+    );
     return deny("another runner instance currently owns this enrollment");
   }
 
@@ -214,7 +265,7 @@ export async function startAuthCalloutResponder(
     (bytes) => handleAuthorizationRequest(deps, bytes),
     {
       name: "opengeni-auth-callout",
-      ...(deps.observability ? { logger: observabilityEventLogger(deps.observability) } : {}),
+      ...(deps.observability ? observabilityEventBusOptions(deps.observability) : {}),
     },
   );
   deps.observability?.info?.("OpenGeni NATS auth-callout responder started", {

package/src/sandbox/channel-a.ts

@@ -22,6 +22,7 @@ import {
   hasGitCredentialRepositorySelection,
   hasGitHubRepositorySelection,
   sandboxLifecycleTransitionWaitMs,
+  sandboxWarmRateMicrosPerSecond,
   stableSandboxEnvironmentForRun,
   type Settings,
 } from "@opengeni/config";
@@ -42,6 +43,7 @@ import {
   SandboxImageConflictError,
   SandboxProviderReadLockUnavailableError,
   SandboxRigConflictError,
+  SandboxPaidComputeAdmissionError,
   withSandboxProviderReadLock,
   type Database,
   type LeaseSnapshot,
@@ -823,6 +825,10 @@ async function withChannelAOperation<T>(
       holderId,
       subjectId: session.id,
       backend: session.sandboxBackend,
+      warmBilling: {
+        mode: settings.sandboxWarmBillingMode,
+        rateMicrosPerSecond: sandboxWarmRateMicrosPerSecond(settings, session.sandboxBackend),
+      },
       os: session.sandboxOs,
       image: sandboxRuntime.image,
       rigVersionId: session.rigVersionId,
@@ -1210,6 +1216,8 @@ async function withChannelAOperation<T>(
  *  already-HTTPException unchanged. */
 export function mapChannelAError(error: unknown, waitSignal?: AbortSignal): unknown {
   if (error instanceof HTTPException) return error;
+  if (error instanceof SandboxPaidComputeAdmissionError)
+    return new HTTPException(402, { message: error.message, cause: error });
   if (isChannelARequestCancellation(error, waitSignal))
     return new HTTPException(499 as never, {
       message: "request cancelled",

package/src/sandbox/viewer.ts

@@ -26,6 +26,7 @@ import {
   hasGitHubRepositorySelection,
   resolveStreamTokenSecret,
   sandboxLifecycleTransitionWaitMs,
+  sandboxWarmRateMicrosPerSecond,
   stableSandboxEnvironmentForRun,
 } from "@opengeni/config";
 import type { Settings } from "@opengeni/config";
@@ -37,7 +38,7 @@ import {
   getSandbox,
   getScheduledScopedRigVersionMetadata,
   getSandboxSessionEnvelope,
-  heartbeatLeaseHolder,
+  heartbeatLeaseHolderStatus,
   loadWorkspaceEnvironmentForRun,
   markSandboxProviderReady,
   markWarmLeaseInstanceLost,
@@ -47,6 +48,7 @@ import {
   releaseLeaseHolder,
   SandboxLeaseSupersededError,
   SandboxViewerAdmissionBlockedError,
+  SandboxPaidComputeAdmissionError,
   type Database,
   type LeaseSnapshot,
   type SandboxRecord,
@@ -300,6 +302,10 @@ export async function attachViewer(
       ...(attachSubjectId ? { viewerSubjectId: attachSubjectId } : {}),
       ...(attachAuthorityEpoch !== null ? { viewerAuthorityEpoch: attachAuthorityEpoch } : {}),
       backend: session.sandboxBackend,
+      warmBilling: {
+        mode: settings.sandboxWarmBillingMode,
+        rateMicrosPerSecond: sandboxWarmRateMicrosPerSecond(settings, session.sandboxBackend),
+      },
       os: session.sandboxOs,
       image: sandboxRuntime.image,
       rigVersionId: session.rigVersionId,
@@ -309,6 +315,9 @@ export async function attachViewer(
       ...(input.waitSignal ? { waitSignal: input.waitSignal } : {}),
     });
   } catch (error) {
+    if (error instanceof SandboxPaidComputeAdmissionError) {
+      throw new HTTPException(402, { message: error.message, cause: error });
+    }
     if (error instanceof SandboxViewerAdmissionBlockedError) {
       throw new HTTPException(error.reason === "balance" ? 402 : 429, {
         message:
@@ -592,7 +601,7 @@ export async function heartbeatViewer(
     expectedEpoch: number;
   },
 ): Promise<boolean> {
-  const alive = await heartbeatLeaseHolder(services.db, {
+  const status = await heartbeatLeaseHolderStatus(services.db, {
     accountId: input.accountId,
     workspaceId: input.workspaceId,
     sandboxGroupId: input.sandboxGroupId,
@@ -600,8 +609,12 @@ export async function heartbeatViewer(
     holderId: input.viewerId,
     leaseTtlMs: services.settings.sandboxLeaseTtlMs,
     expectedEpoch: input.expectedEpoch,
+    billingMode: services.settings.sandboxWarmBillingMode,
   });
-  if (!alive) return false;
+  // A funding fence stops renewing paid provider time, but the holder is
+  // deliberately kept alive while the viewer winds down or adds funds. Other
+  // fences (epoch/rotation/drain) still require the client to re-attach.
+  if (!status.leaseExtended) return status.holderAlive && status.fence === "funding";
   const lease = await readLease(services.db, input.workspaceId, input.sandboxGroupId);
   if (lease?.liveness === "warm" && lease.leaseEpoch === input.expectedEpoch && lease.instanceId) {
     await renewSandboxProviderExpiration({

package/src/sandbox-file-artifacts.ts

@@ -27,6 +27,12 @@ import {
 } from "@opengeni/db";
 import { retryWhileMissing, type ObjectHead, type ObjectStorage } from "@opengeni/storage";
 import { HTTPException } from "hono/http-exception";
+import {
+  isConnectedMachineAbsolutePath,
+  relativeConnectedMachinePath,
+  resolveConnectedMachinePath,
+  type SandboxChannelAService,
+} from "@opengeni/runtime/sandbox";
 
 import { withChannelARead } from "./sandbox/channel-a";
 import { sanitizeFilename } from "./routes/files";
@@ -98,13 +104,12 @@ async function publishSandboxFileArtifactInScope(
     });
   }
 
-  const path = sandboxArtifactRelativePath(input.path);
   const maxArtifactBytes = Math.min(SANDBOX_FILE_ARTIFACT_MAX_BYTES, storage.maxSinglePutSizeBytes);
   if (maxArtifactBytes < 1) {
     throw new HTTPException(503, { message: "object storage cannot accept artifact files" });
   }
   const readLimit = Math.min(25 * 1024 * 1024, maxArtifactBytes + FILE_READ_SENTINEL_BYTES);
-  const read = await withChannelARead(
+  const { path, sandboxPath, read } = await withChannelARead(
     {
       db: deps.db,
       settings: deps.settings,
@@ -119,7 +124,7 @@ async function publishSandboxFileArtifactInScope(
       ...(input.signal ? { waitSignal: input.signal } : {}),
       operation: "artifact.publish",
     },
-    ({ service }) => service.fsRead({ path, encoding: "base64", maxBytes: readLimit }),
+    ({ service }) => readSandboxArtifactFile(service, input.path, readLimit),
   );
   if (read.truncated || read.sizeBytes > maxArtifactBytes) {
     throw new HTTPException(413, {
@@ -234,48 +239,54 @@ async function publishSandboxFileArtifactInScope(
   });
   return SandboxFileArtifactReceipt.parse({
     type: "sandbox_file",
-    sandboxPath: `/workspace/${path}`,
+    sandboxPath,
     filename,
     artifact,
   });
 }
 
-export function sandboxArtifactRelativePath(value: string): string {
+/** Use the root captured by the same fenced Channel-A service that reads bytes,
+ * not the session's placement-home label or a caller-supplied root. */
+export async function readSandboxArtifactFile(
+  service: Pick<SandboxChannelAService, "capabilities" | "fsRead">,
+  value: string,
+  maxBytes: number,
+) {
+  const root = service.capabilities().FileSystem.root;
+  const path = sandboxArtifactRelativePath(value, root);
+  const sandboxPath = resolveConnectedMachinePath(root, path);
+  const read = await service.fsRead({ path, encoding: "base64", maxBytes });
+  return { path, sandboxPath, read };
+}
+
+export function sandboxArtifactRelativePath(value: string, workspaceRoot = "/workspace"): string {
   let path = value.trim();
   if (path.startsWith("sandbox:")) {
     path = path.slice("sandbox:".length);
   }
-  if (path === "/workspace" || path === "/workspace/") {
+  if (!path || /[\\/]$/.test(path)) {
     throw new HTTPException(400, { message: "sandbox artifact path must name a file" });
   }
-  if (path.startsWith("/workspace/")) {
-    path = path.slice("/workspace/".length);
-  } else if (path.startsWith("/")) {
+  let absolute: string;
+  let relative: string | null;
+  try {
+    if (!isConnectedMachineAbsolutePath(workspaceRoot)) throw new Error("Missing workspace root");
+    absolute = resolveConnectedMachinePath(workspaceRoot, path);
+    relative = relativeConnectedMachinePath(workspaceRoot, absolute);
+  } catch {
     throw new HTTPException(400, {
-      message: "sandbox artifact path must be inside /workspace",
+      message: "sandbox artifact path is invalid for this workspace",
     });
   }
-  if (!path) {
-    throw new HTTPException(400, { message: "sandbox artifact path must name a file" });
-  }
-  if (path.includes("\0")) {
-    throw new HTTPException(400, { message: "sandbox artifact path is invalid" });
-  }
-  const normalized = posix.normalize(path);
-  if (
-    normalized === "." ||
-    normalized === ".." ||
-    normalized.startsWith("../") ||
-    normalized.endsWith("/")
-  ) {
+  if (!relative) {
     throw new HTTPException(400, {
-      message: "sandbox artifact path must canonically name a file inside /workspace",
+      message: "sandbox artifact path must name a file inside the active workspace root",
     });
   }
-  if (`/workspace/${normalized}`.length > SANDBOX_ARTIFACT_ABSOLUTE_PATH_MAX_CHARS) {
+  if (absolute.length > SANDBOX_ARTIFACT_ABSOLUTE_PATH_MAX_CHARS) {
     throw new HTTPException(400, { message: "sandbox artifact path is too long" });
   }
-  return normalized;
+  return relative;
 }
 
 export function sandboxArtifactSafeFilename(filename: string): string {

package/src/site-uploads.ts

@@ -11,6 +11,7 @@ import {
   prepareWorkspaceArtifactContent,
   type PreparedWorkspaceArtifactContent,
 } from "./workspace-artifact-content";
+import { userContentSignedGetUrlOptions } from "./http/user-content";
 type Storage = NonNullable<ObjectStorageDependency>;
 export const MAX_SITE_SOURCE_BYTES = 64 * 1024 * 1024;
 
@@ -205,7 +206,13 @@ export async function workspaceArtifactDownloads(
   audience: "sandbox" | "public",
 ) {
   const [html, source] = await Promise.all([
-    storage.createGetUrl({ key: ref.contentKey, audience }),
+    // Site HTML runs publisher scripts; opened directly from storage it would
+    // render outside the console's opaque-origin frame, so it downloads.
+    storage.createGetUrl({
+      key: ref.contentKey,
+      audience,
+      ...userContentSignedGetUrlOptions("text/html", "site.html"),
+    }),
     ref.sourceKey ? storage.createGetUrl({ key: ref.sourceKey, audience }) : null,
   ]);
   return {

package/src/workspace-tool-gateway.ts

@@ -299,6 +299,7 @@ async function prepareWorkspaceToolGatewayForGrantInternal(
               routeDeps.getDocumentServices(),
               {
                 knowledge: await knowledgeContextForGateway(routeDeps, grant),
+                settings: gatewaySettings,
               },
             ),
           ),