@opengeni/core 2.7.5-canary.6 → 2.8.0-canary.0

package/dist/model-catalog.d.ts

@@ -1,3 +1,4 @@
+import { type ConnectionModelRestrictions } from "@opengeni/db";
 import { type ConfiguredModel, type Settings } from "@opengeni/config";
 import { type ModelAvailabilityV1, type ModelCredentialReadinessV1, type WorkspaceModelPolicyContract } from "@opengeni/contracts";
 import { type Database } from "@opengeni/db";
@@ -62,6 +63,7 @@ export type ModelCredentialReadinessObservation = {
 };
 export declare const MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS: number;
 export type WorkspaceModelSelectionInput = {
+    connectionModelRestrictions?: ConnectionModelRestrictions;
     settings: Settings;
     policy: WorkspaceModelPolicyContract | null;
     codexSubscriptionActive: boolean;

package/dist/session-authorization.d.ts

@@ -1,4 +1,4 @@
-import { SessionAuthorizationActor, SessionAuthorizationListScope, type AccessGrant, type SessionAuthorizationOperation, type SessionAuthorizationSurface, type SessionAuthorizationTarget } from "@opengeni/contracts";
+import { SessionAuthorizationActor, SessionAuthorizationListScope, type AccessGrant, type SessionAgentAccess, type SessionAgentAccessViewer, type SessionAuthorizationOperation, type SessionAuthorizationSurface, type SessionAuthorizationTarget, type SessionEndUser } from "@opengeni/contracts";
 import { type Database, type SessionRlsActorContext } from "@opengeni/db";
 import type { AppDependencies } from "./dependencies.js";
 export type SessionAuthorizationDependencies = Pick<AppDependencies, "db" | "sessionAuthorization">;
@@ -19,6 +19,34 @@ export type ResolvedSessionAuthorization = {
     relatedSessionAccess: "target" | "root";
     reauthorizeAfterMs: number | null;
 };
+/** The frozen agent-access facts of one session, as the pairwise rule sees them. */
+export type SessionAgentAccessFacts = {
+    agentAccess: SessionAgentAccess;
+    endUser: SessionEndUser | null;
+};
+/**
+ * The agent-to-agent reach rule (migration 0427) for one caller/target pair
+ * that live in DIFFERENT root trees. A caller always keeps its own tree, so
+ * this is never consulted for same-root access. The most restrictive side
+ * wins: a `session` side denies everything; a `user` side requires both
+ * sessions to carry the same non-null end-user label; two `workspace` sides
+ * are today's behaviour. Humans and API keys never pass through here.
+ */
+export declare function agentAccessPermitsCrossTreeAccess(caller: SessionAgentAccessFacts, target: SessionAgentAccessFacts): boolean;
+/**
+ * The in-database list scope for one calling attempt. A `session` caller is
+ * pinned to its own root tree when the host does not narrow it. Every caller
+ * carries the viewer so `sessionAuthorizationScopeFilter` intersects the host
+ * scope with the same pairwise rule in SQL, including for session callers.
+ */
+export declare function agentAccessListScopeForViewer(viewer: SessionAgentAccessViewer, hostScope?: SessionAuthorizationListScope | null): SessionAuthorizationListScope;
+/**
+ * Whether a grant acts with live agent-attempt authority: an explicit
+ * `agent_attempt` principal kind, or (for legacy tokens without one) any
+ * worker-signed exact attempt claim. Shared by the session seam and by the
+ * narrowing fences that let a human widen a session an agent may only narrow.
+ */
+export declare function grantHasAgentAttemptAuthority(grant: AccessGrant): boolean;
 export declare function sessionRlsActorForAuthorization(authorization: ResolvedSessionAuthorization): SessionRlsActorContext;
 export declare function withResolvedSessionAuthorization<T>(authorization: ResolvedSessionAuthorization, fn: () => Promise<T>): Promise<T>;
 /**

package/dist/site-session-origin.d.ts

@@ -0,0 +1,7 @@
+export type SiteSessionOrigin = {
+    siteId: string;
+    title: string;
+};
+/** Request-local provenance, set only after the API validates a published Site version. */
+export declare function withSiteSessionOrigin<T>(origin: SiteSessionOrigin, run: () => T): T;
+export declare function sessionCreationMetadata(metadata: Record<string, unknown>): Record<string, unknown>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "2.7.5-canary.6",
+  "version": "2.8.0-canary.0",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -54,17 +54,17 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/capabilities": "^0.3.2-canary.7",
-    "@opengeni/codex": "^0.2.21-canary.6",
-    "@opengeni/config": "^1.0.0-canary.6",
-    "@opengeni/contracts": "^2.13.0-canary.7",
-    "@opengeni/db": "^4.0.0-canary.6",
-    "@opengeni/documents": "^0.8.19-canary.6",
-    "@opengeni/events": "^0.4.17-canary.6",
-    "@opengeni/network": "^0.3.0-canary.7",
-    "@opengeni/observability": "^0.8.19-canary.6",
-    "@opengeni/runtime": "^2.3.0-canary.6",
-    "@opengeni/storage": "^0.2.120-canary.6",
+    "@opengeni/capabilities": "^0.3.3-canary.0",
+    "@opengeni/codex": "^0.2.22-canary.0",
+    "@opengeni/config": "^1.0.1-canary.0",
+    "@opengeni/contracts": "^2.14.0-canary.0",
+    "@opengeni/db": "^4.1.0-canary.0",
+    "@opengeni/documents": "^0.8.20-canary.0",
+    "@opengeni/events": "^0.4.18-canary.0",
+    "@opengeni/network": "^0.3.1-canary.0",
+    "@opengeni/observability": "^0.8.20-canary.0",
+    "@opengeni/runtime": "^2.4.0-canary.0",
+    "@opengeni/storage": "^0.2.121-canary.0",
     "hono": "^4.12.18",
     "zod": "^4.2.1"
   },

package/src/domain/resources.ts

@@ -100,7 +100,7 @@ export function withWorkspaceDefaultMcpTools(
   runtimeSettings: McpSettings,
   defaults: WorkspaceSessionToolDefaults | null,
 ): ToolRef[] {
-  if (!defaults) {
+  if (!defaults?.mcpServerIds) {
     return withDefaultEnabledCapabilityMcpTools(tools, settings, runtimeSettings);
   }
   return mergeToolRefs(

package/src/domain/scheduled-tasks.ts

@@ -1,4 +1,8 @@
-import { resolveFirstPartyMcpToolPolicy, type Settings } from "@opengeni/config";
+import {
+  allowedFirstPartyMcpToolsForSession,
+  resolveFirstPartyMcpToolPolicy,
+  type Settings,
+} from "@opengeni/config";
 import type {
   AccessGrant,
   McpPersonalConnectionDelegation,
@@ -17,6 +21,9 @@ import {
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
   OPENGENI_SLACK_BOT_SESSION_METADATA_KEY,
   resolveWorkspaceSessionToolDefaults,
+  SessionAgentAccess,
+  SessionEndUser,
+  SessionMemoryScope,
 } from "@opengeni/contracts";
 import {
   createScheduledTask,
@@ -41,6 +48,7 @@ import {
   withWorkspaceSubjectRls,
   resolveXaiProviderAccountAuthoritySnapshotForAcceptance,
   type Database,
+  type ScheduledTaskCreatorPolicy,
   type TemporalScheduleCleanupClaim,
   type UpdateScheduledTaskInput,
 } from "@opengeni/db";
@@ -246,6 +254,14 @@ export async function createValidatedScheduledTask(input: {
           ...scheduledConnectionSurfaceEligibility(runtimeSettings, target),
         });
   const creationInitiator = creationInitiatorForGrant(input.grant);
+  const creatorPolicy = creationInitiator.actor
+    ? await frozenScheduledTaskCreatorPolicy({
+        db: input.db,
+        settings: input.settings,
+        grant: input.grant,
+        sessionId: creationInitiator.actor.sessionId,
+      })
+    : null;
   const xaiProviderAccountAuthoritySnapshot: XaiProviderAccountAuthoritySnapshotV1 =
     creationInitiator.actor
       ? await getSessionTurnXaiProviderAccountAuthoritySnapshot(
@@ -285,6 +301,7 @@ export async function createValidatedScheduledTask(input: {
       createdByActor: creationInitiator.actor ?? null,
       personalConnectionDelegations,
       xaiProviderAccountAuthoritySnapshot,
+      creatorPolicy,
       targetSessionId: target?.id ?? null,
       variableSetId: input.payload.variableSetId ?? null,
       rigId: input.payload.rigId ?? null,
@@ -294,6 +311,59 @@ export async function createValidatedScheduledTask(input: {
   );
 }
 
+/**
+ * Freeze the creating session's boundary onto an agent-created task so the
+ * sessions generated for it inherit exactly what the creator could see and
+ * do, never the deployment default. Tools are the session's effective
+ * model-visible selection under the deployment ceiling; permissions are the
+ * session's effective first-party set intersected with what the calling
+ * grant actually holds (a narrowly delegated spawn token cannot hand a
+ * schedule more than itself). The session access policy is copied from the
+ * projection when it exposes those facts; each absent fact is stored as null
+ * so a generated session keeps its own default for that key.
+ */
+async function frozenScheduledTaskCreatorPolicy(input: {
+  db: Database;
+  settings: Settings;
+  grant: AccessGrant;
+  sessionId: string;
+}): Promise<ScheduledTaskCreatorPolicy> {
+  const session = await getSession(input.db, input.grant.workspaceId, input.sessionId);
+  if (!session) {
+    throw new HTTPException(403, {
+      message: "the calling agent session is not available in this workspace",
+    });
+  }
+  const firstPartyMcpTools = allowedFirstPartyMcpToolsForSession(
+    input.settings,
+    session.firstPartyMcpTools,
+  );
+  const firstPartyMcpPermissions = (
+    session.firstPartyMcpPermissions ?? [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS]
+  ).filter((permission) => hasPermission(input.grant.permissions, permission));
+  if (firstPartyMcpPermissions.length === 0) {
+    throw new HTTPException(403, {
+      message:
+        "the calling agent session holds no first-party MCP permission it could delegate to scheduled runs",
+    });
+  }
+  // The projection facts are validated through the access-scope contract so
+  // only a well-formed value is frozen; anything else stores null for that key.
+  const projection = session as unknown as Record<string, unknown>;
+  const agentAccess = SessionAgentAccess.safeParse(projection["agentAccess"]);
+  const endUser = SessionEndUser.safeParse(projection["endUser"]);
+  const memoryScope = SessionMemoryScope.safeParse(projection["memoryScope"]);
+  return {
+    firstPartyMcpTools,
+    firstPartyMcpPermissions,
+    sessionPolicy: {
+      agentAccess: agentAccess.success ? agentAccess.data : null,
+      endUser: endUser.success ? { source: endUser.data.source, id: endUser.data.id } : null,
+      memoryScope: memoryScope.success ? memoryScope.data : null,
+    },
+  };
+}
+
 function nestedPostgresMessage(error: unknown): string | null {
   const queue: unknown[] = [error];
   const seen = new Set<unknown>();

package/src/domain/session-tool-policy.ts

@@ -188,7 +188,7 @@ export async function workspaceSessionToolPolicyDefaultServerIds(
   const availableDefaults = defaultSessionMcpServerIds(runtimeSettings.mcpServers);
   const workspace = await requireWorkspace(db, workspaceId);
   const configured = resolveWorkspaceSessionToolDefaults(workspace.settings);
-  if (!configured) return availableDefaults;
+  if (!configured?.mcpServerIds) return availableDefaults;
   const available = new Set(availableDefaults);
   return sortedIds(configured.mcpServerIds.filter((id) => available.has(id)));
 }

package/src/domain/sessions.ts

@@ -1,4 +1,5 @@
 import { CODEX_MODEL_ID_PREFIX, isCodexBilledModel } from "@opengeni/codex";
+import { sessionCreationMetadata } from "../site-session-origin";
 import {
   canonicalizeConfiguredModelId,
   configuredAllowedModels,
@@ -42,7 +43,10 @@ import {
   type ReasoningEffort,
   type ResourceRef,
   type Session,
+  type SessionAgentAccess,
   type SessionCommandReceipt,
+  type SessionEndUser,
+  type SessionMemoryScope,
   type SessionSkill,
   type SessionEvent,
   SessionMcpApprovalPolicy,
@@ -135,6 +139,7 @@ import type {
   SessionWorkflowClient,
 } from "../dependencies";
 import {
+  grantHasAgentAttemptAuthority,
   requireLiveAgentAttemptAuthorization,
   requireSessionAuthorization,
   SessionAuthorizationDeniedError,
@@ -237,11 +242,34 @@ export class SessionSpawnDeniedError extends Error {
   }
 }
 
+/**
+ * A session's effective first-party selection as a ceiling for narrowing:
+ * the stored selection (or the deployment default for a legacy null) under
+ * the deployment ceiling, with the resume counterpart of pause authority the
+ * runtime already grants to existing sessions.
+ */
+export function effectiveFirstPartyMcpToolCeiling(
+  stored: readonly FirstPartyMcpToolName[] | null | undefined,
+  policy: {
+    default: readonly FirstPartyMcpToolName[];
+    allowed: readonly FirstPartyMcpToolName[];
+  },
+): Set<FirstPartyMcpToolName> {
+  const allowed = new Set(policy.allowed);
+  const ceiling = new Set([...(stored ?? policy.default)].filter((tool) => allowed.has(tool)));
+  if (ceiling.has("goal_pause") && allowed.has("goal_resume")) ceiling.add("goal_resume");
+  return ceiling;
+}
+
 /**
  * Resolve per-session first-party tool visibility without consulting
  * authorization. Top-level omission snapshots the complete runtime default;
  * child omission snapshots the parent's exact effective selection. Explicit
- * [] is authoritative and must never widen.
+ * [] is authoritative and must never widen. An explicit child selection may
+ * only narrow the parent's effective selection: a session that was handed a
+ * reduced catalog cannot spawn a child that sees more than it does. A
+ * top-level explicit selection keeps only the deployment ceiling (checked by
+ * the caller) because there is no creator selection to narrow.
  */
 export function resolveFirstPartyMcpToolsForCreate(
   requested: FirstPartyMcpToolName[] | undefined,
@@ -254,7 +282,18 @@ export function resolveFirstPartyMcpToolsForCreate(
     allowed: FIRST_PARTY_MCP_TOOL_NAMES,
   },
 ): FirstPartyMcpToolName[] {
-  if (requested !== undefined) return [...requested];
+  if (requested !== undefined) {
+    if (parentStored !== undefined) {
+      const parentCeiling = effectiveFirstPartyMcpToolCeiling(parentStored, policy);
+      const widened = requested.find((tool) => !parentCeiling.has(tool));
+      if (widened) {
+        throw new HTTPException(403, {
+          message: `child first-party MCP tools may only narrow the parent session selection: ${widened}`,
+        });
+      }
+    }
+    return [...requested];
+  }
   const allowed = new Set(policy.allowed);
   const inherited = parentStored === undefined ? policy.default : (parentStored ?? policy.default);
   return [...inherited].filter((tool) => allowed.has(tool));
@@ -756,6 +795,12 @@ export async function createAndStartSessionWithOutcome(input: {
   // Model-visible first-party tool names. Authorization remains controlled by
   // firstPartyMcpPermissions and the target resource checks.
   firstPartyMcpTools: FirstPartyMcpToolName[];
+  // Agent-access scope, opaque end-user label, and typed Memory selector
+  // (migration 0427), already resolved against the parent by the caller.
+  // Omitted keeps the workspace defaults for internal lifecycle callers.
+  agentAccess?: SessionAgentAccess;
+  endUser?: SessionEndUser | null;
+  memoryScope?: SessionMemoryScope;
   // Encrypted DB rows plus matching safe metadata for create-time per-session
   // MCP servers. Metadata is the only shape emitted in events/responses.
   mcpServers?: CreateSessionMcpServerInput[];
@@ -969,6 +1014,9 @@ export async function createAndStartSessionWithOutcome(input: {
       firstPartyMcpTools: input.firstPartyMcpTools,
       instructions: input.instructions ?? null,
       policyRole: input.policyRole ?? null,
+      ...(input.agentAccess ? { agentAccess: input.agentAccess } : {}),
+      ...(input.endUser !== undefined ? { endUser: input.endUser } : {}),
+      ...(input.memoryScope ? { memoryScope: input.memoryScope } : {}),
       parentSessionId: input.parentSessionId ?? null,
       createIdempotencyKey: input.createIdempotencyKey,
       selectedInstalledSkillIds: input.selectedInstalledSkillIds ?? [],
@@ -1059,6 +1107,9 @@ export async function createAndStartSessionWithOutcome(input: {
       firstPartyMcpTools: input.firstPartyMcpTools,
       instructions: input.instructions ?? null,
       policyRole: input.policyRole ?? null,
+      ...(input.agentAccess ? { agentAccess: input.agentAccess } : {}),
+      ...(input.endUser !== undefined ? { endUser: input.endUser } : {}),
+      ...(input.memoryScope ? { memoryScope: input.memoryScope } : {}),
       parentSessionId: input.parentSessionId ?? null,
       sandboxGroupId: input.sandboxGroupId ?? null,
       ...(input.sandboxOs ? { sandboxOs: input.sandboxOs } : {}),
@@ -1582,7 +1633,10 @@ export async function postUserMessageTurn(
   // model inherits the session's model downstream (always a configured id).
   assertConfiguredModel(settings, requestedModel);
   const sessionForModelGate = await requireSession(db, workspaceId, sessionId);
-  const effectiveModelForGate = requestedModel ?? sessionForModelGate.model;
+  // Acceptance already froze this policy before resource/credential validation.
+  // A different turn starting meanwhile must not change the model we gate here.
+  const effectiveModelForGate =
+    input.turnExecutionPolicy?.productModelId ?? requestedModel ?? sessionForModelGate.model;
   const freshWorkspaceCustomModel =
     requestedModel !== null &&
     isWorkspaceCustomModelId(settings, requestedModel) &&
@@ -1760,6 +1814,87 @@ export function resolveSessionCreateVisibility(input: {
   return input.requestedVisibility === "private" ? "user_private" : "workspace_shared";
 }
 
+export type SessionCreateScope = {
+  agentAccess: SessionAgentAccess;
+  endUser: SessionEndUser | null;
+  memoryScope: SessionMemoryScope;
+};
+
+const AGENT_ACCESS_WIDTH: Record<SessionAgentAccess, number> = {
+  session: 0,
+  user: 1,
+  workspace: 2,
+};
+
+const MEMORY_SCOPE_WIDTH: Record<SessionMemoryScope, number> = {
+  off: 0,
+  session: 1,
+  user: 2,
+  workspace: 3,
+};
+
+/**
+ * Resolve a new session's agent-access scope, end-user label, and Memory
+ * selector (migration 0427). A top-level request takes its own values. An
+ * agent-created child inherits every omitted value from its trusted parent
+ * and may only NARROW an explicit one: agent access workspace > user >
+ * session, memory workspace > user > session > off, and the label must equal
+ * the parent's. Widening is a 403 because the parent's declared reach is a
+ * security boundary the child's own request cannot cross; a memory `user`
+ * selector without a label is a 422 in either position.
+ */
+export function resolveSessionCreateScope(input: {
+  requested: {
+    agentAccess: SessionAgentAccess;
+    agentAccessProvided: boolean;
+    endUser: SessionEndUser | null;
+    endUserProvided: boolean;
+    memoryScope: SessionMemoryScope;
+    memoryScopeProvided: boolean;
+  };
+  parent: SessionCreateScope | null;
+}): SessionCreateScope {
+  const { requested, parent } = input;
+  let resolved: SessionCreateScope;
+  if (!parent) {
+    resolved = {
+      agentAccess: requested.agentAccess,
+      endUser: requested.endUser,
+      memoryScope: requested.memoryScope,
+    };
+  } else {
+    const agentAccess = requested.agentAccessProvided ? requested.agentAccess : parent.agentAccess;
+    if (AGENT_ACCESS_WIDTH[agentAccess] > AGENT_ACCESS_WIDTH[parent.agentAccess]) {
+      throw new HTTPException(403, {
+        message: "child agent access may only narrow the parent session",
+      });
+    }
+    if (requested.endUserProvided) {
+      const same =
+        requested.endUser !== null &&
+        parent.endUser !== null &&
+        requested.endUser.source === parent.endUser.source &&
+        requested.endUser.id === parent.endUser.id;
+      if (!same) {
+        throw new HTTPException(403, {
+          message: "child end-user label must equal the parent session label",
+        });
+      }
+    }
+    const memoryScope = requested.memoryScopeProvided ? requested.memoryScope : parent.memoryScope;
+    if (MEMORY_SCOPE_WIDTH[memoryScope] > MEMORY_SCOPE_WIDTH[parent.memoryScope]) {
+      throw new HTTPException(403, {
+        message: "child memory scope may only narrow the parent session",
+      });
+    }
+    resolved = { agentAccess, endUser: parent.endUser, memoryScope };
+  }
+  if (resolved.memoryScope === "user" && resolved.endUser === null) {
+    throw new HTTPException(422, { message: 'memoryScope "user" requires an endUser label' });
+  }
+  return resolved;
+}
+
 async function resolveWorkspaceModelBoundarySettings(
   deps: Pick<ApiRouteDeps, "db" | "settings" | "catalogSourceSettings">,
   grant: AccessGrant,
@@ -1832,6 +1967,7 @@ export async function createSessionForRequestWithOutcome(
   agentChildPresentation?: AgentChildSessionCreatePresentation,
 ): Promise<CreateSessionRequestOutcome> {
   const payload = CreateSessionRequest.parse(rawPayload);
+  payload.metadata = sessionCreationMetadata(payload.metadata);
   if (hasReservedOpenGeniSlackBotSessionMetadata(payload.metadata)) {
     throw new HTTPException(422, {
       message: `${OPENGENI_SLACK_BOT_SESSION_METADATA_KEY} is reserved for scheduler routing`,
@@ -1902,6 +2038,27 @@ export async function createSessionForRequestWithOutcome(
       message: error instanceof Error ? error.message : "invalid child visibility",
     });
   }
+  // Agent-access/end-user/memory scope inherit and narrow exactly like
+  // visibility: presence is read from the raw request because the Zod
+  // defaults erase absent-vs-explicit, and the parent side comes from the
+  // durable row rather than anything the caller sent.
+  const sessionScope = resolveSessionCreateScope({
+    requested: {
+      agentAccess: payload.agentAccess,
+      agentAccessProvided: hasOwnProperty(rawPayload, "agentAccess"),
+      endUser: payload.endUser ?? null,
+      endUserProvided: hasOwnProperty(rawPayload, "endUser"),
+      memoryScope: payload.memoryScope,
+      memoryScopeProvided: hasOwnProperty(rawPayload, "memoryScope"),
+    },
+    parent: parentAuthority
+      ? {
+          agentAccess: parentAuthority.agentAccess,
+          endUser: parentAuthority.endUser,
+          memoryScope: parentAuthority.memoryScope,
+        }
+      : null,
+  });
   const creationInitiator = creationInitiatorForGrant(grant);
   const parentCallingTurn =
     parentSession && creationInitiator.actor
@@ -2434,7 +2591,7 @@ export async function createSessionForRequestWithOutcome(
       message: `first-party MCP tool is disabled by deployment policy: ${disallowedFirstPartyMcpTool}`,
     });
   }
-  const workspaceFirstPartyDefaults = workspaceSessionToolDefaults?.firstPartyMcpTools.filter(
+  const workspaceFirstPartyDefaults = workspaceSessionToolDefaults?.firstPartyMcpTools?.filter(
     (tool) => deploymentFirstPartyMcpToolPolicy.allowed.includes(tool),
   );
   const firstPartyMcpTools = resolveFirstPartyMcpToolsForCreate(
@@ -2821,6 +2978,9 @@ export async function createSessionForRequestWithOutcome(
       // time. Not surfaced as an event.
       instructions: payload.instructions ?? null,
       policyRole: payload.policyRole ?? null,
+      agentAccess: sessionScope.agentAccess,
+      endUser: sessionScope.endUser,
+      memoryScope: sessionScope.memoryScope,
       firstPartyMcpPermissions,
       firstPartyMcpTools,
       mcpServers: sessionMcpServers.dbServers,
@@ -3532,6 +3692,7 @@ export async function updateSessionToolPolicy(
     surface: "core",
   });
   requirePermission(grant, "sessions:control");
+  const agentAttemptCaller = grantHasAgentAttemptAuthority(grant);
 
   const existingSession = await requireSession(deps.db, grant.workspaceId, sessionId);
   const workspace = await requireWorkspace(deps.db, grant.workspaceId);
@@ -3585,7 +3746,7 @@ export async function updateSessionToolPolicy(
     runtimeSettings,
   );
   const workspaceDefaultFirstPartyTools = [
-    ...(workspaceSessionToolDefaults?.firstPartyMcpTools.filter((tool) =>
+    ...(workspaceSessionToolDefaults?.firstPartyMcpTools?.filter((tool) =>
       deploymentFirstPartyMcpToolPolicy.allowed.includes(tool),
     ) ?? deploymentFirstPartyMcpToolPolicy.default),
   ];
@@ -3670,6 +3831,41 @@ export async function updateSessionToolPolicy(
             ? workspaceDefaultFirstPartyTools
             : explicitRequestedFirstPartyTools!;
         nextPolicy = { mode: requestedMode, inheritedFromSessionId: null };
+        if (agentAttemptCaller) {
+          // A human or API key may widen a top-level session; a live agent
+          // attempt may only narrow relative to the session's CURRENT
+          // effective policy, in either mode. Adopting workspace defaults is a
+          // widen whenever it adds a server or tool the session does not hold.
+          const sessionTracksWorkspaceDefaults = session.toolPolicy?.mode === "workspace_default";
+          const currentEffectiveTools = withFirstPartyTools(
+            sessionTracksWorkspaceDefaults
+              ? withWorkspaceDefaultMcpTools(
+                  availableToolRefs(session.tools, runtimeSettings),
+                  deps.settings,
+                  runtimeSettings,
+                  workspaceSessionToolDefaults,
+                )
+              : session.tools,
+            runtimeSettings,
+          );
+          assertToolRefsSubset(
+            nextTools,
+            currentEffectiveTools,
+            "an agent may only narrow its session tool policy",
+          );
+          const currentFirstPartyCeiling = effectiveFirstPartyMcpToolCeiling(
+            session.firstPartyMcpTools,
+            deploymentFirstPartyMcpToolPolicy,
+          );
+          const widenedFirstPartyTool = nextFirstPartyMcpTools.find(
+            (tool) => !currentFirstPartyCeiling.has(tool),
+          );
+          if (widenedFirstPartyTool) {
+            throw new HTTPException(403, {
+              message: `an agent may only narrow its session OpenGeni tools: ${widenedFirstPartyTool}`,
+            });
+          }
+        }
       }
 
       const currentPolicy = session.toolPolicy;

package/src/index.ts

@@ -114,3 +114,4 @@ export * from "./editable-artifact-live";
 
 // Transport-neutral editable-artifact domain service, ports, and contracts.
 export * from "./editable-artifacts";
+export { withSiteSessionOrigin } from "./site-session-origin";

package/src/model-catalog.ts

@@ -1,3 +1,4 @@
+import { modelAllowedByConnections, type ConnectionModelRestrictions } from "@opengeni/db";
 import {
   applyModelCatalogDocument,
   configuredGatewayWorkspaceProductModelIds,
@@ -379,6 +380,7 @@ export type ModelCredentialReadinessObservation =
 export const MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS = 5 * 60_000;
 
 export type WorkspaceModelSelectionInput = {
+  connectionModelRestrictions?: ConnectionModelRestrictions;
   settings: Settings;
   policy: WorkspaceModelPolicyContract | null;
   codexSubscriptionActive: boolean;
@@ -708,10 +710,11 @@ export function resolveWorkspaceModelSelection(
 
   return configuredModels(catalogSettings).map((model) => {
     const provider = providers.get(model.providerId);
-    const policyAllowed = evaluateWorkspaceModelPolicy(input.policy, {
-      providerId: model.providerId,
-      modelId: model.id,
-    }).allowed;
+    const policyAllowed =
+      evaluateWorkspaceModelPolicy(input.policy, {
+        providerId: model.providerId,
+        modelId: model.id,
+      }).allowed && modelAllowedByConnections(input.connectionModelRestrictions ?? {}, model.id);
     const credentialReadiness = credentialReadinessFor({
       model,
       provider,