@opengeni/api-router 4.3.3-canary.39786771332001 → 4.5.0

package/dist/app.js

@@ -28,7 +28,7 @@ import {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession,
   workspaceActorContextExempt
-} from "./chunk-S5VJ3GVR.js";
+} from "./chunk-LXUAR3HS.js";
 import "./chunk-OGQDXVXY.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,

package/dist/{chunk-S5VJ3GVR.js → chunk-LXUAR3HS.js}

@@ -6515,44 +6515,30 @@ function capabilityAccountReadiness(availableRoutes, bindings) {
   return { available, accepted };
 }
 
-// src/mcp/machine-permission-card.ts
-var MACHINE_PERMISSION_REQUIRED_CODE = "personal_machine_permission_required";
-function machinePermissionCardShownReason(chatUrl) {
-  const elsewhere = chatUrl ? `If they are reading this chat somewhere else (for example Slack, or this is a worker or scheduled chat), give them this link to allow it: ${chatUrl}. ` : "If they are reading this chat somewhere else (for example Slack, or this is a worker or scheduled chat), tell them to open this chat in Opengeni to allow it. ";
-  return "This is a personal (Only me) machine, and its owner has not allowed this chat to use it yet. A card where the owner can allow it is now posted in this chat in Opengeni. If they are reading this chat in Opengeni, tell them in one short sentence that they can allow it there; do not describe buttons or steps. " + elsewhere + "Do not wait for it and do not retry: when they allow it, their message continues this chat.";
-}
-async function withMachinePermissionCard(result2, post) {
-  if (result2.code !== MACHINE_PERMISSION_REQUIRED_CODE) return result2;
+// src/mcp/user-setup-card.ts
+import {
+  userSetupBlocker,
+  userSetupCardShownMessage
+} from "@opengeni/contracts";
+import { sessionChatUrl } from "@opengeni/contracts";
+async function withUserSetupCard(result2, post) {
+  const blocker = userSetupBlocker(result2.code);
+  if (!blocker) return result2;
   let posted;
   try {
-    posted = await post();
+    posted = await post(blocker);
   } catch {
     return result2;
   }
   if (!posted) return result2;
   return {
     ...result2,
-    reason: machinePermissionCardShownReason(posted.chatUrl),
+    reason: userSetupCardShownMessage(blocker, posted.chatUrl),
     card: "shown",
     cardEventId: posted.eventId,
     ...posted.chatUrl ? { chatUrl: posted.chatUrl } : {}
   };
 }
-function sessionChatUrl(base, workspaceId, sessionId) {
-  if (!base) return null;
-  try {
-    const url = new URL(
-      `/workspaces/${encodeURIComponent(workspaceId)}/sessions/${encodeURIComponent(sessionId)}`,
-      base
-    );
-    if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password) {
-      return null;
-    }
-    return url.toString();
-  } catch {
-    return null;
-  }
-}
 
 // src/site-uploads.ts
 import { WorkspaceArtifactSourceBundle as WorkspaceArtifactSourceBundle2 } from "@opengeni/contracts";
@@ -16607,8 +16593,9 @@ import {
   buildCapabilityCatalog,
   CONNECTED_MACHINE_CAPABILITY_ID,
   EXCEL_ADDIN_CAPABILITY_ID as EXCEL_ADDIN_CAPABILITY_ID2,
+  browserExtension,
   nativeConnectionCapabilityRecommendations,
-  OPENGENI_BROWSER_EXTENSION_URL,
+  userSetupCardPayload,
   requireLiveAgentAttemptAuthorization as requireLiveAgentAttemptAuthorization7,
   requireSessionAuthorization as requireSessionAuthorization3,
   requireSessionAuthorizationListScope,
@@ -19560,7 +19547,9 @@ function sandboxArtifactRelativePath(value, workspaceRoot = "/workspace") {
   }
   if (!relative) {
     throw new HTTPException24(400, {
-      message: "sandbox artifact path must name a file inside the active workspace root"
+      // Say which root: on a connected machine the file may exist outside it,
+      // and copying it in is the way forward.
+      message: `sandbox artifact path must name a file inside this session's workspace root ${workspaceRoot}; ${path} is outside it, so copy the file into the workspace first and use that path`
     });
   }
   if (absolute.length > SANDBOX_ARTIFACT_ABSOLUTE_PATH_MAX_CHARS) {
@@ -42341,6 +42330,15 @@ var ACTION_CATALOG = [
       "PersonalGitHubOAuthStartResponse"
     ]
   },
+  {
+    "id": "recordSiteOpened",
+    "method": "POST",
+    "path": "/v1/workspaces/:workspaceId/published-artifacts/:artifactId/opened",
+    "request": [],
+    "response": [
+      "SiteOpenedResponse"
+    ]
+  },
   {
     "id": "recoverSandbox",
     "method": "POST",
@@ -46956,7 +46954,7 @@ function registerSandboxFileArtifactTool(server, deps, grant, sessionId, json2)
   server.registerTool(
     "sandbox_file_publish",
     {
-      description: "Publish one exact file from this session's /workspace into durable workspace storage. Use this before presenting a video, ZIP, CSV, JSON, Markdown, HTML, PDF, Office file, or other sandbox output as downloadable. Present the returned artifact.artifactId as [Open file](artifact:<artifactId>), or ![Preview](artifact:<artifactId>) for inline image/video/audio/PDF previews. Replace <artifactId> with the exact returned ID and use a descriptive label. Never expose a sandbox: URL as the durable result. The artifactId is also the file's workspace File ID, so tools that take workspace file IDs, such as a browser upload action, accept it. A new file gets this chat's visibility (Only me in an Only me chat, otherwise the workspace) unless you pass visibility; to change an existing file, such as a generated image, pass its artifactId and visibility instead of path. Check the result's access.whoCanOpen before sharing a link with anyone.",
+      description: "Publish one file from this session's workspace so the person can open it. Use it for every file you hand over: document, spreadsheet, PDF, image, video, archive or data. Link the result as [Descriptive label](artifact:<artifactId>), or ![Descriptive label](artifact:<artifactId>) to preview an image, video, audio or PDF inline; never give a sandbox: link instead. The artifactId is also the file's workspace file ID, which tools such as a browser upload accept. A new file gets this chat's visibility unless you pass visibility. To change who can open an existing file, such as a generated image, pass its artifactId and visibility instead of path. Check access.whoCanOpen in the result before sharing the link with anyone else.",
       inputSchema: {
         path: z47.string().min(1).max(4096).optional(),
         artifactId: z47.string().uuid().optional(),
@@ -48581,13 +48579,12 @@ function registerFleetTools(server, deps, grant, sessionId, json2) {
       ...deps.settings.ogtoolPackageSpec ? { OPENGENI_OGTOOL_PACKAGE_SPEC: deps.settings.ogtoolPackageSpec } : {}
     };
   };
-  const machinePermissionCard = (toolName, target) => async () => {
+  const userSetupCard = (toolName, target) => async (blocker) => {
     const requestedSandboxId = UUID_TARGET.test(target) ? target.toLowerCase() : null;
     if (!exactAgentAttemptClaims(grant)) return null;
     const claims = exactAgentCommandContext(grant, sessionId);
-    const item = nativeConnectionCapabilityRecommendations({ connectedMachines: true }).find(
-      (candidate) => candidate.id === CONNECTED_MACHINE_CAPABILITY_ID
-    );
+    const payload = userSetupCardPayload(blocker, { toolName, requestedSandboxId });
+    if (!payload) return null;
     const appended = await appendTurnCapabilityCardOnce(
       deps.db,
       grant.workspaceId,
@@ -48595,23 +48592,13 @@ function registerFleetTools(server, deps, grant, sessionId, json2) {
       claims.callerTurnId,
       claims.callerExecutionGeneration,
       claims.callerAttemptId,
-      item.id,
-      {
-        type: "tool.auth_needed",
-        payload: {
-          ...capabilityCardPayload(item, {
-            action: "connect",
-            rationale: "Allow this chat to use your computer.",
-            toolName
-          }),
-          ...requestedSandboxId ? { requestedSandboxId } : {}
-        }
-      },
+      blocker.capabilityId,
+      { type: "tool.auth_needed", payload },
       requestedSandboxId
     );
     await publishDurableSessionEvents(deps.bus, grant.workspaceId, sessionId, appended.events);
     if (!appended.accepted) {
-      throw new Error("The calling turn was replaced before the machine card committed.");
+      throw new Error("The calling turn was replaced before the setup card committed.");
     }
     return {
       eventId: appended.existingEventId ?? appended.events[0]?.id ?? null,
@@ -48640,9 +48627,9 @@ function registerFleetTools(server, deps, grant, sessionId, json2) {
       inputSchema: { target: z47.string().min(1) }
     },
     async ({ target }) => json2(
-      await withMachinePermissionCard(
+      await withUserSetupCard(
         await swapActiveSandbox(services, await fleetContext(), target),
-        machinePermissionCard("sandbox_attach", target)
+        userSetupCard("sandbox_attach", target)
       )
     )
   );
@@ -48653,9 +48640,9 @@ function registerFleetTools(server, deps, grant, sessionId, json2) {
       inputSchema: { target: z47.string().min(1) }
     },
     async ({ target }) => json2(
-      await withMachinePermissionCard(
+      await withUserSetupCard(
         await swapActiveSandbox(services, await fleetContext(), target),
-        machinePermissionCard("sandbox_swap", target)
+        userSetupCard("sandbox_swap", target)
       )
     )
   );
@@ -48690,12 +48677,12 @@ function registerFleetTools(server, deps, grant, sessionId, json2) {
         (subjectId) => vaultProviderRegistryFor(deps, { workspaceId: grant.workspaceId, subjectId })
       ) : null;
       return json2(
-        await withMachinePermissionCard(
+        await withUserSetupCard(
           await runOnSandbox(services, await fleetContext(), target, typedOp, {
             ...transientExecEnvironment ? { transientExecEnvironment } : {},
             ...secretResolver ? { secretResolver } : {}
           }),
-          machinePermissionCard("run_on", target)
+          userSetupCard("run_on", target)
         )
       );
     }
@@ -48712,9 +48699,10 @@ function registerFleetTools(server, deps, grant, sessionId, json2) {
     async ({ kind, name }) => {
       if (kind === "selfhosted" && exactAgentAttemptClaims(grant)) {
         await requireLiveAgentAttemptAuthorization7(deps.db, grant, sessionId);
-        const item = nativeConnectionCapabilityRecommendations({ connectedMachines: true }).find(
-          (candidate) => candidate.id === CONNECTED_MACHINE_CAPABILITY_ID
-        );
+        const item = nativeConnectionCapabilityRecommendations({
+          connectedMachines: true,
+          browserExtension: browserExtension(deps.settings)
+        }).find((candidate) => candidate.id === CONNECTED_MACHINE_CAPABILITY_ID);
         const setup = await capabilitySetupProjection(
           deps,
           grant.workspaceId,
@@ -48738,7 +48726,7 @@ function registerFleetTools(server, deps, grant, sessionId, json2) {
           kind: "selfhosted",
           status: "card_posted",
           eventId,
-          message: `${setup.status === "ready" ? `${setup.detail} The Connected Machine card lists them, so the person can choose one for this chat or connect another.` : "The Connected Machine card was posted. It shows the person what to do, so do not describe its buttons or steps; nothing is connected yet."} Check sandboxes_list after they confirm. Chrome needs the browser extension (${OPENGENI_BROWSER_EXTENSION_URL}) on the connected machine.`
+          message: `${setup.status === "ready" ? `${setup.detail} The Connected Machine card lists them, so the person can choose one for this chat or connect another.` : "The Connected Machine card was posted. It shows the person what to do, so do not describe its buttons or steps; nothing is connected yet."} Check sandboxes_list after they confirm. Chrome needs the browser extension (${browserExtension(deps.settings).installUrl}) on the connected machine.`
         });
       }
       return json2(
@@ -48754,7 +48742,7 @@ function registerConnectedMachineTools(server, deps, grant, sessionId, json2) {
   server.registerTool(
     "connected_machine_enroll_token",
     {
-      description: "Create a single-use Connected Machine enrollment token for this workspace (expires in one hour) using existing enrollments:manage authority. Returns the token, expiry and Unix/PowerShell install commands. Use it when you can run commands on the target machine yourself (run_on, SSH, a VM you control): run the matching command there, then verify the machine with sandboxes_list. One token connects one machine; mint another for each additional machine (the same machine may rerun its command). When the person must run it on their own computer, post the Connected Machine card instead (capability_authorization_request with api:connected-machine), which mints the command in their browser; do not paste a token into the chat. Screen control is optional and defaults off; to turn it on for a machine that is already connected, use connected_machine_enable_screen_control instead of reconnecting. The token grants whole-machine access on enrollment; do not put it in public code or unrelated logs. Existing machine connections are preserved. For Chrome, the person installs the Opengeni Browser extension (" + OPENGENI_BROWSER_EXTENSION_URL + ") after the machine is connected.",
+      description: "Create a single-use Connected Machine enrollment token for this workspace (expires in one hour) using existing enrollments:manage authority. Returns the token, expiry and Unix/PowerShell install commands. Use it when you can run commands on the target machine yourself (run_on, SSH, a VM you control): run the matching command there, then verify the machine with sandboxes_list. One token connects one machine; mint another for each additional machine (the same machine may rerun its command). When the person must run it on their own computer, post the Connected Machine card instead (capability_authorization_request with api:connected-machine), which mints the command in their browser; do not paste a token into the chat. Screen control is optional and defaults off; to turn it on for a machine that is already connected, use connected_machine_enable_screen_control instead of reconnecting. The token grants whole-machine access on enrollment; do not put it in public code or unrelated logs. Existing machine connections are preserved. For Chrome, the person installs the Opengeni Browser extension (" + browserExtension(deps.settings).installUrl + ") after the machine is connected.",
       inputSchema: { allowScreenControl: z47.boolean().optional() }
     },
     async ({ allowScreenControl }) => {
@@ -48782,7 +48770,7 @@ function registerConnectedMachineTools(server, deps, grant, sessionId, json2) {
   server.registerTool(
     "connected_machine_enable_screen_control",
     {
-      description: "Turn screen control on for a machine that is already connected, in place, so agents can see and use its screen (computer and attached-Chrome tools). `target` is a sandboxes_list id or an enrollment id. Needs no human click, token, terminal or reconnect: the platform records the consent on that machine and its agent refreshes its own credentials over the live connection. status=active means it is on now. status=pending means it is allowed and turns on by itself: reason=offline when the machine next connects; reason=agent_update_required after its agent is updated (update it with the machine update action, POST /v1/workspaces/{workspaceId}/machines/{enrollmentId}/update); reason=renewal_failed: call again shortly; reason=reconnect_required: the machine's connection predates in-place changes, so rerun the connect command on it (connected_machine_enroll_token with allowScreenControl=true). On a Mac the OS must also allow Screen Recording, Accessibility and Input Monitoring for the app that runs the agent (the name macOS lists in those panes): open each pane on the Mac with run_on exec `open 'x-apple.systempreferences:com.apple.preference.security?Privacy_ScreenCapture'` (Privacy_Accessibility, Privacy_ListenEvent; also the privacy-settings machine action) and ask the person to switch that app on there, choosing Quit & Reopen if macOS asks; the machine list reports runtime.macPermissions. Chrome additionally needs the Opengeni Browser extension (" + OPENGENI_BROWSER_EXTENSION_URL + ") on that machine.",
+      description: "Turn screen control on for a machine that is already connected, in place, so agents can see and use its screen (computer and attached-Chrome tools). `target` is a sandboxes_list id or an enrollment id. Needs no human click, token, terminal or reconnect: the platform records the consent on that machine and its agent refreshes its own credentials over the live connection. status=active means it is on now. status=pending means it is allowed and turns on by itself: reason=offline when the machine next connects; reason=agent_update_required after its agent is updated (update it with the machine update action, POST /v1/workspaces/{workspaceId}/machines/{enrollmentId}/update); reason=renewal_failed: call again shortly; reason=reconnect_required: the machine's connection predates in-place changes, so rerun the connect command on it (connected_machine_enroll_token with allowScreenControl=true). On a Mac the OS must also allow Screen Recording, Accessibility and Input Monitoring for the app that runs the agent (the name macOS lists in those panes): open each pane on the Mac with run_on exec `open 'x-apple.systempreferences:com.apple.preference.security?Privacy_ScreenCapture'` (Privacy_Accessibility, Privacy_ListenEvent; also the privacy-settings machine action) and ask the person to switch that app on there, choosing Quit & Reopen if macOS asks; the machine list reports runtime.macPermissions. Chrome additionally needs the Opengeni Browser extension (" + browserExtension(deps.settings).installUrl + ") on that machine.",
       inputSchema: { target: z47.string().min(1) }
     },
     async ({ target }) => {
@@ -50609,7 +50597,8 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json2)
       const candidates = [
         ...current.items,
         ...nativeConnectionCapabilityRecommendations({
-          connectedMachines: deps.settings.sandboxSelfhostedEnabled
+          connectedMachines: deps.settings.sandboxSelfhostedEnabled,
+          browserExtension: browserExtension(deps.settings)
         })
       ];
       const ranked = searchCapabilityCatalogItems(candidates, query, limit ?? 8);
@@ -50666,7 +50655,8 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json2)
       const item = [
         ...current.items,
         ...nativeConnectionCapabilityRecommendations({
-          connectedMachines: deps.settings.sandboxSelfhostedEnabled
+          connectedMachines: deps.settings.sandboxSelfhostedEnabled,
+          browserExtension: browserExtension(deps.settings)
         })
       ].find((candidate) => candidate.id === capabilityId);
       if (!item || !capabilityCatalogItemIsTrustedForExposure(item)) {
@@ -50700,7 +50690,7 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json2)
           capabilityId: item.id,
           status: "ready",
           eventId,
-          message: `${setup.detail} The Connected Machine card is in this chat: the person can choose a machine for this chat or connect another. Chrome needs the browser extension (${OPENGENI_BROWSER_EXTENSION_URL}) on a connected machine.`
+          message: `${setup.detail} The Connected Machine card is in this chat: the person can choose a machine for this chat or connect another. Chrome needs the browser extension (${browserExtension(deps.settings).installUrl}) on a connected machine.`
         });
       }
       if (githubCardWhenReady) {
@@ -58985,11 +58975,12 @@ function subscribeSessionListHints(options) {
   let all = false;
   const ids = /* @__PURE__ */ new Set();
   let tail = Promise.resolve();
-  const emit = (available, sessionIds) => options.write({
+  const emit = (available, sessionIds, siteSessionIds = []) => options.write({
     type: "workspace.sessions.changed",
     workspaceId: options.workspaceId,
     available,
-    sessionIds
+    sessionIds,
+    ...siteSessionIds.length ? { siteSessionIds } : {}
   });
   const enqueue = (action) => {
     tail = tail.then(async () => {
@@ -59025,10 +59016,12 @@ function subscribeSessionListHints(options) {
     ids.clear();
     enqueue(async () => {
       if (observedGeneration !== generation || !connected) return;
-      const visibleIds = reconcileAll ? null : await options.authorizeIds(pendingIds);
+      const authorized = reconcileAll ? null : await options.authorizeIds(pendingIds);
       if (observedGeneration !== generation || !connected) return;
-      if (visibleIds !== null && !visibleIds.length) return;
-      await emit(true, visibleIds);
+      if (authorized === null) return await emit(true, null);
+      const visible = Array.isArray(authorized) ? { sessionIds: authorized, siteSessionIds: [] } : authorized;
+      if (!visible.sessionIds.length && !visible.siteSessionIds.length) return;
+      await emit(true, visible.sessionIds, visible.siteSessionIds);
     });
   }, options.intervalMs);
   return () => {
@@ -60866,6 +60859,7 @@ function registerSessionRoutes(app, deps) {
           ...query.channelId !== void 0 ? { channelId: query.channelId } : {},
           ...query.originSiteId ? { originSiteId: query.originSiteId } : {},
           ...query.siteAccessId ? { siteAccessId: query.siteAccessId } : {},
+          ...query.siteConversations ? { siteConversations: query.siteConversations } : {},
           ...query.createdBy ? { createdBy: query.createdBy } : {},
           ...query.updatedFrom ? { updatedFrom: query.updatedFrom } : {},
           ...query.updatedBefore ? { updatedBefore: query.updatedBefore } : {},
@@ -65010,6 +65004,25 @@ function sessionListQuery(query, allowCursor = true) {
     });
   if (originSiteId !== void 0 && !z31.string().uuid().safeParse(originSiteId).success)
     throw new HTTPException54(400, { message: "originSiteId must be a Site id" });
+  const siteConversations = query.siteConversations;
+  if (siteConversations !== void 0) {
+    if (siteConversations !== "include" && siteConversations !== "group")
+      throw new HTTPException54(400, { message: 'siteConversations must be "include" or "group"' });
+    if (!allowCursor)
+      throw new HTTPException54(400, { message: 'siteConversations requires view="page"' });
+    if (originSiteId !== void 0 || siteAccessId !== void 0)
+      throw new HTTPException54(400, {
+        message: "siteConversations cannot be combined with a Site filter"
+      });
+    if (siteConversations === "group" && (query.parentSessionId !== "null" || query.pinsOnly === "true"))
+      throw new HTTPException54(400, {
+        message: 'siteConversations="group" requires a root page (parentSessionId=null)'
+      });
+    if (siteConversations === "group" && (query.archiveStatus === "archived" || query.archivedOnly === "true"))
+      throw new HTTPException54(400, {
+        message: 'siteConversations="group" cannot list archived sessions; use "include"'
+      });
+  }
   if (parentSessionId !== void 0 && parentSessionId !== "null" && !z31.string().uuid().safeParse(parentSessionId).success) {
     throw new HTTPException54(400, {
       message: 'parentSessionId must be a session id or the literal "null"'
@@ -65144,6 +65157,7 @@ function sessionListQuery(query, allowCursor = true) {
     limit: query.limit,
     originSiteId,
     siteAccessId,
+    siteConversations,
     parentSessionId: parentSessionId === void 0 ? void 0 : parentSessionId === "null" ? null : parentSessionId,
     cursor,
     search: search || void 0,
@@ -66565,7 +66579,8 @@ import {
   createUserPresenceRecorder,
   registerProductUsageMetricBaselines,
   stampPersonalApiKeyRequest,
-  verifiedDelegatedHumanAuthorizationForRequest as verifiedDelegatedHumanAuthorizationForRequest3
+  verifiedDelegatedHumanAuthorizationForRequest as verifiedDelegatedHumanAuthorizationForRequest3,
+  browserExtension as browserExtension2
 } from "@opengeni/core";
 
 // src/auth/new-signups-gate.ts
@@ -117726,6 +117741,16 @@ function parseBrowserScreenshotOptions(query) {
 function browserTabDiagnosisError(error) {
   if (!(error instanceof BrowserControlRequestError6)) return error;
   const code = error.error.code;
+  if (code === "resource_unavailable" && error.status >= 500 && !error.retryable && !legacyInteractionCapacityFailure(error, "browser")) {
+    const failure4 = new ApiHttpError(409, {
+      code: "conflict",
+      message: error.error.message,
+      retryable: false,
+      outcomeUnknown: false
+    });
+    failure4.cause = error;
+    return failure4;
+  }
   if (code !== "tab_not_responding" && code !== "tab_crashed") return error;
   const failure3 = new ApiHttpError(409, {
     code,
@@ -122905,7 +122930,7 @@ import {
   listInteractionInterventions,
   listNetworkRoutes,
   listSiteAuthConnections,
-  listVisibleSessionInvalidationIds,
+  listVisibleSessionInvalidationHints,
   sessionListChangesFor,
   resolveInteractionIntervention,
   updateNetworkRoute,
@@ -122966,7 +122991,7 @@ function registerInteractionResourceRoutes(app, deps) {
               freshGrant,
               "http"
             );
-            return await listVisibleSessionInvalidationIds(deps.db, workspaceId, ids, {
+            return await listVisibleSessionInvalidationHints(deps.db, workspaceId, ids, {
               subjectId: freshGrant.subjectId,
               ...authorizationScope ? { authorizationScope } : {},
               personalWorkspaceOwnerException: hasVerifiedOwningUserAuthorization2(authorization)
@@ -132329,6 +132354,7 @@ import {
   PublishWorkspaceArtifactVersionRequest as PublishWorkspaceArtifactVersionRequest2,
   RollbackWorkspaceArtifactRequest as RollbackWorkspaceArtifactRequest2,
   SetWorkspaceArtifactStatusRequest as SetWorkspaceArtifactStatusRequest2,
+  SiteOpenedResponse,
   UpdateWorkspaceArtifactVisibilityRequest as UpdateWorkspaceArtifactVisibilityRequest2,
   UpdateWorkspaceArtifactVisibilityResponse,
   WORKSPACE_ARTIFACT_TITLE_MAX_CHARS,
@@ -132347,6 +132373,7 @@ import {
   resolveSiteAudienceChange,
   SessionAuthorizationDeniedError as SessionAuthorizationDeniedError16,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError14,
+  currentSiteSessionOrigin as currentSiteSessionOrigin6,
   siteViewerForGrant as siteViewerForGrant8
 } from "@opengeni/core";
 import {
@@ -132355,6 +132382,7 @@ import {
   getWorkspaceArtifact as getWorkspaceArtifact3,
   getWorkspaceArtifactContentRef as getWorkspaceArtifactContentRef4,
   listWorkspaceArtifacts as listWorkspaceArtifacts2,
+  recordSiteOpened,
   nestedPostgresSqlState as nestedPostgresSqlState18,
   publishWorkspaceArtifactVersion as publishWorkspaceArtifactVersion2,
   rollbackWorkspaceArtifact as rollbackWorkspaceArtifact2,
@@ -132498,6 +132526,30 @@ function registerWorkspaceArtifactRoutes(app, deps) {
       return workspaceArtifactErrorResponse(context, error);
     }
   });
+  app.post(`${base}/:artifactId/opened`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const grant = await requireAccessGrant57(context, deps, workspaceId, "artifacts:read");
+    if (currentSiteSessionOrigin6())
+      throw new HTTPException121(403, { message: "A Site page cannot record opening a Site" });
+    const siteId3 = artifactId(context);
+    const viewer = await siteViewerForGrant8(deps.db, grant);
+    if (!viewer.subjectId)
+      throw new HTTPException121(403, { message: "A signed-in person is required" });
+    try {
+      return context.json(
+        SiteOpenedResponse.parse(
+          await recordSiteOpened(deps.db, {
+            workspaceId,
+            subjectId: viewer.subjectId,
+            viewer,
+            siteId: siteId3
+          })
+        )
+      );
+    } catch (error) {
+      return workspaceArtifactErrorResponse(context, error);
+    }
+  });
   app.get(base, async (context) => {
     const workspaceId = context.req.param("workspaceId");
     const grant = await requireAccessGrant57(context, deps, workspaceId, "artifacts:read");
@@ -149957,6 +150009,7 @@ function createAppComposition(deps) {
         deploymentRevision: deps.settings.deploymentRevision,
         claudeSubscriptionEnabled: deps.settings.claudeSubscriptionEnabled,
         connectedMachines: deps.settings.sandboxSelfhostedEnabled,
+        browserExtension: browserExtension2(deps.settings),
         apiContractRevision: OPENGENI_API_CONTRACT_REVISION5,
         ...deps.settings.serverVersion ? { serverVersion: deps.settings.serverVersion } : {},
         defaultModel,
@@ -152239,4 +152292,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-S5VJ3GVR.js.map
+//# sourceMappingURL=chunk-LXUAR3HS.js.map