@opengeni/api-router 3.0.2-canary.38894290271001 → 3.1.2

package/dist/index.js

@@ -14,7 +14,7 @@ import {
   startSlackInteractionPump,
   startTemporalScheduleCleanupPump,
   withAccessGrantSessionRlsContext
-} from "./chunk-GBUJ2DYZ.js";
+} from "./chunk-OT56OY4V.js";
 import "./chunk-OGQDXVXY.js";
 
 // src/index.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "3.0.2-canary.38894290271001",
+  "version": "3.1.2",
   "description": "Opengeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -44,27 +44,27 @@
     "@hono/zod-validator": "^0.7.6",
     "@llamaindex/liteparse": "2.14.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "3.0.2-canary.38894290271001",
-    "@opengeni/artifact-tool": "3.0.2-canary.38894290271001",
-    "@opengeni/capabilities": "3.0.2-canary.38894290271001",
-    "@opengeni/codemode": "3.0.2-canary.38894290271001",
-    "@opengeni/codex": "3.0.2-canary.38894290271001",
-    "@opengeni/config": "3.0.2-canary.38894290271001",
-    "@opengeni/contracts": "3.0.2-canary.38894290271001",
-    "@opengeni/core": "3.0.2-canary.38894290271001",
-    "@opengeni/db": "3.0.2-canary.38894290271001",
-    "@opengeni/documents": "3.0.2-canary.38894290271001",
-    "@opengeni/events": "3.0.2-canary.38894290271001",
-    "@opengeni/github": "3.0.2-canary.38894290271001",
-    "@opengeni/interaction": "3.0.2-canary.38894290271001",
-    "@opengeni/network": "3.0.2-canary.38894290271001",
-    "@opengeni/observability": "3.0.2-canary.38894290271001",
-    "@opengeni/runtime": "3.0.2-canary.38894290271001",
-    "@opengeni/storage": "3.0.2-canary.38894290271001",
-    "@opengeni/tool-gateway": "3.0.2-canary.38894290271001",
-    "@opengeni/vaults": "3.0.2-canary.38894290271001",
-    "@opengeni/vaults-onepassword": "3.0.2-canary.38894290271001",
-    "@opengeni/xai-subscription": "3.0.2-canary.38894290271001",
+    "@opengeni/agent-proto": "3.1.2",
+    "@opengeni/artifact-tool": "3.1.2",
+    "@opengeni/capabilities": "3.1.2",
+    "@opengeni/codemode": "3.1.2",
+    "@opengeni/codex": "3.1.2",
+    "@opengeni/config": "3.1.2",
+    "@opengeni/contracts": "3.1.2",
+    "@opengeni/core": "3.1.2",
+    "@opengeni/db": "3.1.2",
+    "@opengeni/documents": "3.1.2",
+    "@opengeni/events": "3.1.2",
+    "@opengeni/github": "3.1.2",
+    "@opengeni/interaction": "3.1.2",
+    "@opengeni/network": "3.1.2",
+    "@opengeni/observability": "3.1.2",
+    "@opengeni/runtime": "3.1.2",
+    "@opengeni/storage": "3.1.2",
+    "@opengeni/tool-gateway": "3.1.2",
+    "@opengeni/vaults": "3.1.2",
+    "@opengeni/vaults-onepassword": "3.1.2",
+    "@opengeni/xai-subscription": "3.1.2",
     "@temporalio/client": "^1.17.0",
     "ajv": "^8.20.0",
     "better-auth": "^1.6.14",

package/src/sandbox/channel-a.ts

@@ -590,10 +590,6 @@ async function withChannelAOperation<T>(
     : undefined;
   const { accountId, workspaceId, session } = ctx;
 
-  if (session.sandboxBackend === "none") {
-    throw new HTTPException(409, { message: "sandbox not available" });
-  }
-
   const sandboxGroupId = session.sandboxGroupId;
   const requestId = crypto.randomUUID();
   const holderId = `direct:${requestId}`;
@@ -607,9 +603,19 @@ async function withChannelAOperation<T>(
   // The STABLE run-environment used by both a cloud home and a machine home.
   // It also carries the per-session Codemode pointer selected below. Constants
   // only: user secrets are resolved per command (W1), never seeded here.
+  // `none` describes only the durable home. A session without a home sandbox
+  // that attached a Connected Machine runs its turns there (the worker gives
+  // such a turn the effective selfhosted backend), so its direct operations,
+  // such as opening a computer or browser on that machine, follow the same
+  // active pointer.
+  const machineOnlyHome = session.sandboxBackend === "none";
+  if (machineOnlyHome && !(await readActiveSandbox(db, workspaceId, session.id))?.activeSandboxId) {
+    throw new HTTPException(409, { message: "sandbox not available" });
+  }
+  const effectiveBackend = machineOnlyHome ? "selfhosted" : session.sandboxBackend;
   const settingsForSession =
-    session.sandboxBackend !== settings.sandboxBackend
-      ? { ...settings, sandboxBackend: session.sandboxBackend }
+    effectiveBackend !== settings.sandboxBackend
+      ? { ...settings, sandboxBackend: effectiveBackend }
       : settings;
   const environment = stableSandboxEnvironmentForRun(settingsForSession, { workspaceId });
   if (hasGitCredentialRepositorySelection(session.resources)) {
@@ -673,12 +679,15 @@ async function withChannelAOperation<T>(
   // A machine-targeted top-level session has an honest selfhosted HOME label.
   // It has no cloud provider box and therefore must not acquire or establish a
   // phantom home lease before following its active machine pointer.
-  if (session.sandboxBackend === "selfhosted") {
+  if (effectiveBackend === "selfhosted") {
     let established: EstablishedSandboxSession | undefined;
     try {
       ctx.waitSignal?.throwIfAborted();
       const pointer = await readActiveSandbox(db, workspaceId, session.id);
       if (!pointer?.activeSandboxId) {
+        if (machineOnlyHome) {
+          throw new HTTPException(409, { message: "sandbox not available" });
+        }
         // A machine-home session with no selected machine uses the deployment's
         // managed group box, exactly like the worker turn path. Keep the durable
         // home label honest; only this request's effective backend changes.