@opengeni/core 0.28.1 → 1.0.0

package/src/application/modal-native-worker-host-transport.ts

@@ -0,0 +1,263 @@
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { types } from "node:util";
+import type { Settings } from "@opengeni/config";
+import {
+  ModalNativeConfigurationCaptureRefV2,
+  ModalNativeOriginalScopeV2,
+  ModalNativeProofGrantRefV2,
+} from "@opengeni/contracts/modal-native-proof-v2";
+import { z } from "zod";
+
+// Private transport only. This module is not an ordinary access-token entry,
+// native acquisition issuer, custody authorizer, public registrar or effect CAS.
+// A successful MAC authenticates this host transport, NOT the named human,
+// live origin, grant, configuration, provider response or physical settlement.
+const PREFIX = "ogmnp2_";
+const SUBKEY_DOMAIN = "opengeni:modal-native-worker-host:transport:subkey:v2";
+const MESSAGE_DOMAIN = "opengeni:modal-native-worker-host:transport:message:v2\0";
+const TRANSPORT_TTL_SECONDS = 60;
+const MAX_BODY_BYTES = 4 * 1024 * 1024;
+const MAX_ENVELOPE_BYTES = 16_384;
+const typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype);
+const nativeByteLength = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteLength")!.get!;
+const nativeByteOffset = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteOffset")!.get!;
+const nativeBuffer = Object.getOwnPropertyDescriptor(typedArrayPrototype, "buffer")!.get!;
+const uuid = z.string().uuid();
+const revision = z.number().int().positive().safe();
+const base = {
+  protocol: z.literal("opengeni-modal-native-worker-host-proof"),
+  version: z.literal(2),
+  principalKind: z.literal("worker_host"),
+  purpose: z.literal("original-native-custody-proof"),
+  scope: ModalNativeOriginalScopeV2,
+  configurationCaptureRef: ModalNativeConfigurationCaptureRefV2,
+  proofGrantRef: ModalNativeProofGrantRefV2,
+  requestId: uuid,
+};
+const acquisition = z
+  .object({
+    claimId: uuid,
+    nonce: uuid,
+    claimRevision: revision,
+    recordRevision: revision,
+    captureId: uuid,
+    acquisitionId: uuid,
+  })
+  .strict();
+const intent = z.discriminatedUnion("action", [
+  z.object({ ...base, action: z.literal("declare_preparation") }).strict(),
+  z
+    .object({ ...base, action: z.literal("claim_namespace_read"), recordRevision: revision })
+    .strict(),
+  z
+    .object({ ...base, action: z.literal("claim_original_command_read"), recordRevision: revision })
+    .strict(),
+  z.object({ ...base, action: z.literal("capture_namespace_binding"), acquisition }).strict(),
+  z.object({ ...base, action: z.literal("capture_original_page"), acquisition }).strict(),
+  z.object({ ...base, action: z.literal("reconcile_same_capture"), acquisition }).strict(),
+  z.object({ ...base, action: z.literal("settle_original_acquisition"), acquisition }).strict(),
+]);
+const timing = z
+  .object({
+    bodySha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    issuedAt: z.number().int().nonnegative().safe(),
+    expiresAt: z.number().int().positive().safe(),
+  })
+  .strict();
+type Intent = z.infer<typeof intent>;
+export type NativeWorkerHostTransportDescriptionV2 = Intent & z.infer<typeof timing>;
+
+declare const transportBrand: unique symbol;
+export type NativeWorkerHostTransport = Readonly<{ [transportBrand]: true }>;
+declare const verifiedBrand: unique symbol;
+export type VerifiedNativeWorkerHostTransport = Readonly<{ [verifiedBrand]: true }>;
+const transports = new WeakMap<NativeWorkerHostTransport, Buffer>();
+const verified = new WeakMap<
+  VerifiedNativeWorkerHostTransport,
+  {
+    transport: NativeWorkerHostTransport;
+    description: NativeWorkerHostTransportDescriptionV2;
+  }
+>();
+
+/** Inspect before schema parsing; getters/Proxies must not execute inside the
+ * signing boundary. This is JSON correlation, never an authority constructor. */
+function ownJson(value: unknown, depth = 0): void {
+  if (depth > 12) throw new Error("Unsupported native host transport input");
+  if (value === null || typeof value === "string" || typeof value === "boolean") return;
+  if (typeof value === "number" && Number.isFinite(value) && !Object.is(value, -0)) return;
+  if (typeof value !== "object" || types.isProxy(value))
+    throw new Error("Unsupported native host transport input");
+  const array = Array.isArray(value);
+  const prototype = Object.getPrototypeOf(value);
+  if (array ? prototype !== Array.prototype : prototype !== Object.prototype && prototype !== null)
+    throw new Error("Unsupported native host transport input");
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  const keys = Reflect.ownKeys(descriptors).filter((key) => !(array && key === "length"));
+  if (array && keys.length !== (value as unknown[]).length)
+    throw new Error("Unsupported native host transport input");
+  for (const key of keys) {
+    if (typeof key !== "string" || (array && !/^(0|[1-9][0-9]*)$/u.test(key)))
+      throw new Error("Unsupported native host transport input");
+    const descriptor = descriptors[key]!;
+    if (!descriptor.enumerable || !("value" in descriptor))
+      throw new Error("Unsupported native host transport input");
+    ownJson(descriptor.value, depth + 1);
+  }
+}
+
+function bodyHash(body: Uint8Array): string {
+  if (types.isProxy(body) || !types.isUint8Array(body))
+    throw new Error("Unsupported native host transport body");
+  // Native getters ignore caller-owned byteLength/buffer/offset overrides. Reject
+  // shared backing storage: its bytes could change concurrently during the copy.
+  const length = nativeByteLength.call(body) as number;
+  const backing = nativeBuffer.call(body) as ArrayBuffer;
+  if (length > MAX_BODY_BYTES || !types.isArrayBuffer(backing))
+    throw new Error("Unsupported native host transport body");
+  const snapshot = new Uint8Array(length);
+  try {
+    snapshot.set(new Uint8Array(backing, nativeByteOffset.call(body) as number, length));
+    return createHash("sha256").update(snapshot).digest("hex");
+  } catch {
+    throw new Error("Unsupported native host transport body");
+  } finally {
+    snapshot.fill(0);
+  }
+}
+
+function keyFor(transport: NativeWorkerHostTransport): Buffer {
+  const key = transports.get(transport);
+  if (!key) throw new Error("Native host transport is unavailable");
+  return key;
+}
+
+function mac(key: Buffer, encoded: string): Buffer {
+  return createHmac("sha256", key).update(MESSAGE_DOMAIN).update(PREFIX).update(encoded).digest();
+}
+
+/** Host startup only. Deliberately DOES NOT call resolveFirstPartyDelegationSecret:
+ * neither configured access-key substitution nor the public local/test fallback
+ * can select this new purpose root. Missing explicit deployment secret is OFF.
+ * No variable lookup, provider request, config mutation or persistence occurs. */
+export function configuredNativeWorkerHostTransport(
+  settings: Pick<Settings, "delegationSecret">,
+): NativeWorkerHostTransport | null {
+  if (!settings || typeof settings !== "object" || types.isProxy(settings)) return null;
+  const descriptor = Object.getOwnPropertyDescriptor(settings, "delegationSecret");
+  if (!descriptor || !("value" in descriptor) || typeof descriptor.value !== "string") return null;
+  const secret = descriptor.value.trim();
+  if (!secret) return null;
+  const transient = Buffer.from(secret, "utf8");
+  try {
+    const key = createHmac("sha256", transient).update(SUBKEY_DOMAIN).digest();
+    const handle = Object.freeze(Object.create(null)) as NativeWorkerHostTransport;
+    transports.set(handle, key);
+    return handle;
+  } finally {
+    transient.fill(0);
+  }
+}
+
+/** Release only this transport's derived-key copy, not a config/grant/custody
+ * lifecycle or observation slot. Outstanding native I/O needs its own join. */
+export function disposeNativeWorkerHostTransport(transport: NativeWorkerHostTransport): void {
+  const key = transports.get(transport);
+  if (key) key.fill(0);
+  transports.delete(transport);
+}
+
+/** Private worker/core transport serialization. The caller MUST first establish
+ * canonical original-host admission. This helper cannot establish that admission
+ * and is intentionally not exported from the core package's public entrypoints. */
+export function signNativeWorkerHostTransport(
+  transport: NativeWorkerHostTransport,
+  input: Intent,
+  body: Uint8Array,
+  nowSeconds = Math.floor(Date.now() / 1000),
+): string {
+  const key = keyFor(transport);
+  ownJson(input);
+  const parsed = intent.safeParse(input);
+  const clock = z.number().int().nonnegative().safe().safeParse(nowSeconds);
+  if (!parsed.success || !clock.success) throw new Error("Unsupported native host transport input");
+  const timed = timing.safeParse({
+    bodySha256: bodyHash(body),
+    issuedAt: clock.data,
+    expiresAt: clock.data + TRANSPORT_TTL_SECONDS,
+  });
+  if (!timed.success) throw new Error("Unsupported native host transport input");
+  const description: NativeWorkerHostTransportDescriptionV2 = {
+    ...parsed.data,
+    ...timed.data,
+  };
+  const encoded = Buffer.from(JSON.stringify(description), "utf8").toString("base64url");
+  if (PREFIX.length + encoded.length + 1 + 43 > MAX_ENVELOPE_BYTES)
+    throw new Error("Unsupported native host transport input");
+  return `${PREFIX}${encoded}.${mac(key, encoded).toString("base64url")}`;
+}
+
+/** Only host transport authenticity is verified. A later narrow authorizer must
+ * independently source-join original live/maintenance authority, configuration,
+ * grant, claim, acquisition, body fields/cursors and exact action-specific CAS. */
+export function verifyNativeWorkerHostTransport(
+  transport: NativeWorkerHostTransport,
+  envelope: string,
+  body: Uint8Array,
+  nowSeconds = Math.floor(Date.now() / 1000),
+): VerifiedNativeWorkerHostTransport | null {
+  const key = keyFor(transport);
+  if (
+    typeof envelope !== "string" ||
+    envelope.length > MAX_ENVELOPE_BYTES ||
+    !envelope.startsWith(PREFIX)
+  )
+    return null;
+  const pieces = envelope.slice(PREFIX.length).split(".");
+  if (pieces.length !== 2) return null;
+  const [encoded, signature] = pieces as [string, string];
+  if (!/^[A-Za-z0-9_-]+$/u.test(encoded) || !/^[A-Za-z0-9_-]{43}$/u.test(signature)) return null;
+  const received = Buffer.from(signature, "base64url");
+  if (received.length !== 32 || received.toString("base64url") !== signature) return null;
+  if (!timingSafeEqual(received, mac(key, encoded))) return null;
+  try {
+    const decoded = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8")) as Record<
+      string,
+      unknown
+    >;
+    const { bodySha256, issuedAt, expiresAt, ...rawIntent } = decoded;
+    const description = {
+      ...intent.parse(rawIntent),
+      ...timing.parse({ bodySha256, issuedAt, expiresAt }),
+    };
+    if (
+      !Number.isSafeInteger(nowSeconds) ||
+      nowSeconds < 0 ||
+      description.issuedAt > nowSeconds ||
+      description.expiresAt <= nowSeconds ||
+      description.expiresAt - description.issuedAt !== TRANSPORT_TTL_SECONDS ||
+      description.bodySha256 !== bodyHash(body) ||
+      Buffer.from(JSON.stringify(description), "utf8").toString("base64url") !== encoded
+    )
+      return null;
+    const proof = Object.freeze(Object.create(null)) as VerifiedNativeWorkerHostTransport;
+    verified.set(proof, { transport, description });
+    return proof;
+  } catch {
+    return null;
+  }
+}
+
+/** Request-local inspection of a previously verified MAC, NOT current admission.
+ * The narrow host authorizer must still recheck expiry and current authority/CAS.
+ * Copying a description, token or ref cannot mint grant or native-I/O authority. */
+export function nativeWorkerHostTransportDescription(
+  transport: NativeWorkerHostTransport,
+  proof: VerifiedNativeWorkerHostTransport,
+): NativeWorkerHostTransportDescriptionV2 {
+  keyFor(transport);
+  const record = verified.get(proof);
+  if (!record || record.transport !== transport)
+    throw new Error("Native host transport proof is unavailable");
+  return structuredClone(record.description);
+}

package/src/application/new-session-drafts.ts

@@ -1,3 +1,5 @@
+import { fileOwnerContextForAccess } from "../domain/file-owner";
+import { withSessionRlsActorContext } from "@opengeni/db";
 import {
   NewSessionDraft,
   SaveNewSessionDraftRequest,
@@ -11,9 +13,12 @@ import {
   getSandbox,
   getVariableSet,
   NewSessionDraftAccessError,
+  newSessionDraftModelProvided,
+  newSessionDraftSelectedProjectChannelId,
   newSessionDraftToolsProvided,
+  newSessionSelectionHistory,
   publicNewSessionDraftOptions,
-  requireFile,
+  requireFileForSubject,
   saveNewSessionDraftInTransaction,
   withWorkspaceSubjectRls,
 } from "@opengeni/db";
@@ -27,8 +32,14 @@ import {
   validateGitHubRepositorySelection,
   validateToolRefs,
 } from "../domain/resources";
-import { hasPermission } from "../access";
+import {
+  hasPermission,
+  hasVerifiedOwningUserAuthorization,
+  type AccessGrantAuthorization,
+} from "../access";
 import { assertConfiguredModel, assertWorkspaceModelPolicyAllows } from "../domain/sessions";
+import { resolveDefaultSessionModel } from "../default-session-model";
+import { canonicalizeConfiguredModelId, type Settings } from "@opengeni/config";
 
 type NewSessionDraftDependencies = Pick<AppDependencies, "settings" | "db" | "objectStorage">;
 
@@ -40,6 +51,7 @@ function mapNewSessionDraft(
   row: Awaited<ReturnType<typeof getNewSessionDraftInTransaction>>,
 ): NewSessionDraftValue | null {
   if (!row) return null;
+  const selectedProjectChannelId = newSessionDraftSelectedProjectChannelId(row);
   return NewSessionDraft.parse({
     revision: row.revision,
     text: row.text,
@@ -49,20 +61,81 @@ function mapNewSessionDraft(
     model: row.model,
     reasoningEffort: row.reasoningEffort,
     latencyMode: row.latencyMode,
+    ...(newSessionDraftModelProvided(row) !== undefined
+      ? { modelProvided: newSessionDraftModelProvided(row) }
+      : {}),
+    ...(selectedProjectChannelId !== undefined ? { selectedProjectChannelId } : {}),
     options: publicNewSessionDraftOptions(row),
+    selectionHistory: newSessionSelectionHistory(row),
     updatedAt: row.updatedAt.toISOString(),
   });
 }
 
+/**
+ * Whether a stored draft's model policy was the person's choice. A row written
+ * before the marker existed (or by an older client) counts as a choice unless
+ * it is exactly the deployment default policy (model, reasoning, standard
+ * speed), which is what an untouched composer used to save.
+ */
+export function draftModelProvided(
+  settings: Settings,
+  draft: Pick<NewSessionDraftValue, "model" | "reasoningEffort" | "latencyMode" | "modelProvided">,
+): boolean {
+  if (draft.modelProvided !== undefined) return draft.modelProvided;
+  return !(
+    canonicalizeConfiguredModelId(settings, draft.model) ===
+      canonicalizeConfiguredModelId(settings, settings.openaiModel) &&
+    draft.reasoningEffort === settings.openaiReasoningEffort &&
+    draft.latencyMode === "standard"
+  );
+}
+
+/** The resolved new-chat default for this actor and workspace. */
+async function actorDefaultModel(
+  deps: Pick<NewSessionDraftDependencies, "db" | "settings">,
+  grant: AccessGrant,
+  workspaceId: string,
+) {
+  return await resolveDefaultSessionModel(deps.db, deps.settings, {
+    accountId: grant.accountId,
+    workspaceId,
+    subjectId: grant.subjectId,
+  });
+}
+
+type NewSessionDraftReadOptions = {
+  /**
+   * Project a draft that follows the default onto today's resolved default.
+   * Callers that only reuse a chosen model (Slack defaults) skip the
+   * resolution; session creation resolves the default itself.
+   */
+  projectDefaultModel?: boolean;
+};
+
 async function hydrateNewSessionDraft(
   deps: Pick<NewSessionDraftDependencies, "db" | "settings">,
   grant: AccessGrant,
   workspaceId: string,
   row: Awaited<ReturnType<typeof getNewSessionDraftInTransaction>>,
+  readOptions: NewSessionDraftReadOptions = {},
 ): Promise<NewSessionDraftValue | null> {
   if (!row) return null;
-  const mapped = mapNewSessionDraft(row);
-  if (!mapped) return null;
+  const stored = mapNewSessionDraft(row);
+  if (!stored) return null;
+  // A draft that follows the default is projected onto today's default, so a
+  // later subscription connect or credit purchase replaces an untouched free
+  // model. The stored row is unchanged until the person saves again.
+  const modelProvided = draftModelProvided(deps.settings, stored);
+  let mapped: NewSessionDraftValue = { ...stored, modelProvided };
+  if (!modelProvided && readOptions.projectDefaultModel !== false) {
+    const resolved = await actorDefaultModel(deps, grant, workspaceId);
+    mapped = {
+      ...mapped,
+      model: resolved.model,
+      reasoningEffort: resolved.reasoningEffort,
+      latencyMode: resolved.model === stored.model ? stored.latencyMode : "standard",
+    };
+  }
   const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
     deps.db,
     workspaceId,
@@ -88,7 +161,12 @@ async function hydrateNewSessionDraft(
       continue;
     }
     try {
-      const file = await requireFile(deps.db, workspaceId, resource.fileId);
+      const file = await requireFileForSubject(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        fileId: resource.fileId,
+      });
       if (file.status === "ready") resources.push(resource);
     } catch {
       // Missing, foreign, failed, and pending files are stale draft state.
@@ -96,13 +174,32 @@ async function hydrateNewSessionDraft(
   }
 
   const options = { ...mapped.options };
-  if (options.variableSetId) {
-    if (
-      !hasPermission(grant.permissions, "variable-sets:use") ||
-      !(await getVariableSet(deps.db, workspaceId, options.variableSetId))
-    ) {
+  const variableSetIds = options.variableSetIds ?? [];
+  if (variableSetIds.length > 0) {
+    const selectionsAuthorized =
+      hasPermission(grant.permissions, "variable-sets:attach") &&
+      hasPermission(grant.permissions, "variable-sets:use") &&
+      (
+        await Promise.all(
+          variableSetIds.map((variableSetId) =>
+            getVariableSet(
+              deps.db,
+              { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
+              variableSetId,
+            ),
+          ),
+        )
+      ).every(Boolean);
+    if (selectionsAuthorized) {
+      options.variableSetIds = variableSetIds;
+      options.variableSetId = variableSetIds[variableSetIds.length - 1];
+    } else {
+      delete options.variableSetIds;
       delete options.variableSetId;
     }
+  } else {
+    delete options.variableSetIds;
+    delete options.variableSetId;
   }
   if (options.rigId) {
     const rig = await getRig(deps.db, workspaceId, options.rigId);
@@ -151,10 +248,11 @@ async function hydrateNewSessionDraft(
 }
 
 /** Read the authenticated actor's server-authoritative pre-session composer state. */
-export async function getActorNewSessionDraft(
+async function getActorNewSessionDraftInFileScope(
   deps: Pick<NewSessionDraftDependencies, "settings" | "db">,
   grant: AccessGrant,
   workspaceId: string,
+  readOptions: NewSessionDraftReadOptions = {},
 ): Promise<NewSessionDraftValue> {
   const row = await withWorkspaceSubjectRls(deps.db, workspaceId, grant.subjectId, (scoped) =>
     getNewSessionDraftInTransaction(scoped, {
@@ -162,20 +260,26 @@ export async function getActorNewSessionDraft(
       subjectId: grant.subjectId,
     }),
   );
-  return (
-    (await hydrateNewSessionDraft(deps, grant, workspaceId, row)) ?? {
-      revision: 0,
-      text: "",
-      resources: [],
-      tools: [],
-      toolsProvided: false,
-      model: deps.settings.openaiModel,
-      reasoningEffort: deps.settings.openaiReasoningEffort,
-      latencyMode: "standard",
-      options: {},
-      updatedAt: null,
-    }
-  );
+  const hydrated = await hydrateNewSessionDraft(deps, grant, workspaceId, row, readOptions);
+  if (hydrated) return hydrated;
+  const resolved =
+    readOptions.projectDefaultModel === false
+      ? { model: deps.settings.openaiModel, reasoningEffort: deps.settings.openaiReasoningEffort }
+      : await actorDefaultModel(deps, grant, workspaceId);
+  return {
+    revision: 0,
+    text: "",
+    resources: [],
+    tools: [],
+    toolsProvided: false,
+    model: resolved.model,
+    reasoningEffort: resolved.reasoningEffort,
+    latencyMode: "standard",
+    modelProvided: false,
+    options: {},
+    selectionHistory: { projects: [] },
+    updatedAt: null,
+  };
 }
 
 /**
@@ -185,11 +289,19 @@ export async function getActorNewSessionDraft(
  * draft may represent incomplete options, while no invalid option can become a
  * session without passing that single canonical create boundary.
  */
-export async function saveActorNewSessionDraft(
+async function saveActorNewSessionDraftInFileScope(
   deps: NewSessionDraftDependencies,
   grant: AccessGrant,
   workspaceId: string,
   rawInput: unknown,
+  /**
+   * `AccessGrantAuthorization.canonicalManagedHumanSession` — did this request
+   * authenticate as the canonical managed cookie that owns `grant.subjectId`?
+   * Defaults to false so every caller that has not proven it fails closed onto
+   * the historical bare-membership fence.
+   */
+  canonicalManagedHumanSession = false,
+  externalAuthorization?: AccessGrantAuthorization,
 ): Promise<NewSessionDraftValue> {
   const input = SaveNewSessionDraftRequest.parse(rawInput);
   // The pre-marker client contract required `tools` and had no
@@ -207,9 +319,20 @@ export async function saveActorNewSessionDraft(
   const tools = toolsProvided ? validateToolRefs(input.tools, runtimeSettings) : [];
   await validateGitHubRepositorySelection(deps.db, workspaceId, resources);
   if (resources.some((resource) => resource.kind === "file") && !deps.objectStorage) {
-    throw new HTTPException(503, { message: "object storage is not configured" });
+    throw new HTTPException(503, {
+      message: "object storage is not configured",
+    });
   }
-  await validateFileResources(deps.db, workspaceId, resources);
+  await validateFileResources(
+    deps.db,
+    grant.accountId,
+    workspaceId,
+    grant.subjectId,
+    resources,
+    externalAuthorization
+      ? await fileOwnerContextForAccess(deps, externalAuthorization, "sessions:create")
+      : undefined,
+  );
   assertConfiguredModel(deps.settings, input.model);
   await assertWorkspaceModelPolicyAllows(deps.db, deps.settings, workspaceId, input.model);
 
@@ -228,16 +351,31 @@ export async function saveActorNewSessionDraft(
           model: input.model,
           reasoningEffort: input.reasoningEffort,
           latencyMode: input.latencyMode,
+          ...(input.modelProvided !== undefined ? { modelProvided: input.modelProvided } : {}),
+          ...(input.selectedProjectChannelId !== undefined
+            ? { selectedProjectChannelId: input.selectedProjectChannelId }
+            : {}),
           options: input.options,
           // Only managed people are removed through removeWorkspaceMember().
           // API keys and delegated service actors (for example the first-party
           // worker MCP principal) legitimately have no workspace_memberships
           // row, so they must not be rejected by the human-removal fence.
           requireWorkspaceMembership: grant.subjectId.startsWith("user:"),
+          // A managed human's own personal workspace has no membership row at
+          // all, so the human-removal fence above must fall back to the
+          // organization-membership pointer for them — and only for the
+          // verified owning-user authorization for this exact grant.
+          personalWorkspaceOwnerException:
+            canonicalManagedHumanSession ||
+            (externalAuthorization?.grant === grant &&
+              hasVerifiedOwningUserAuthorization(externalAuthorization)),
         }),
       ),
     );
-    return mapNewSessionDraft(saved)!;
+    // Report the same model-policy marker a read of this row reports, so the
+    // save response and the next GET agree for old and new clients alike.
+    const mapped = mapNewSessionDraft(saved)!;
+    return { ...mapped, modelProvided: draftModelProvided(deps.settings, mapped) };
   } catch (error) {
     if (error instanceof NewSessionDraftAccessError) {
       throw new HTTPException(403, { message: error.message });
@@ -245,3 +383,58 @@ export async function saveActorNewSessionDraft(
     throw error;
   }
 }
+
+export async function getActorNewSessionDraft(
+  deps: Parameters<typeof getActorNewSessionDraftInFileScope>[0],
+  grant: AccessGrant,
+  workspaceId: string,
+  authorization?: AccessGrantAuthorization,
+  readOptions: NewSessionDraftReadOptions = {},
+): Promise<NewSessionDraftValue> {
+  const actor = authorization
+    ? await fileOwnerContextForAccess(deps, authorization, "sessions:read")
+    : { subjectId: grant.subjectId, privateFileOwnerSubjectId: null };
+  return withSessionRlsActorContext(actor, () =>
+    getActorNewSessionDraftInFileScope(deps, grant, workspaceId, readOptions),
+  );
+}
+export async function saveActorNewSessionDraft(
+  ...args: Parameters<typeof saveActorNewSessionDraftInFileScope>
+): Promise<NewSessionDraftValue> {
+  const [deps, grant, , , , authorization] = args;
+  const actor = authorization
+    ? await fileOwnerContextForAccess(deps, authorization, "sessions:create")
+    : { subjectId: grant.subjectId, privateFileOwnerSubjectId: null };
+  return withSessionRlsActorContext(actor, () => saveActorNewSessionDraftInFileScope(...args));
+}
+
+/**
+ * The model policy the person explicitly chose in the website composer, or an
+ * empty object when their draft follows the default.
+ *
+ * Only the model policy is reused. Connectors, repositories, Variable Sets,
+ * Sandbox Environment and compute target in the draft are the person's last
+ * explicit narrowing of one website chat, so surfaces that start work without
+ * the composer (Slack) resolve those from workspace defaults instead of
+ * silently inheriting that narrowing.
+ */
+export async function getActorNewSessionModelChoice(
+  deps: Parameters<typeof getActorNewSessionDraft>[0],
+  grant: AccessGrant,
+  workspaceId: string,
+): Promise<
+  Pick<NewSessionDraftValue, "model" | "reasoningEffort" | "latencyMode"> | Record<string, never>
+> {
+  // A draft that follows the default is not projected here; session creation
+  // resolves the default itself, once.
+  const draft = await getActorNewSessionDraft(deps, grant, workspaceId, undefined, {
+    projectDefaultModel: false,
+  });
+  return draft.revision > 0 && draft.modelProvided === true
+    ? {
+        model: draft.model,
+        reasoningEffort: draft.reasoningEffort,
+        latencyMode: draft.latencyMode,
+      }
+    : {};
+}