@opengeni/core 0.18.1 → 0.20.2

package/dist/sandbox/fleet.d.ts

@@ -132,6 +132,8 @@ export type RunOnResult = {
     target: string;
     kind: string;
     ok: boolean;
+    /** Display name of the target sandbox when known (from the sandboxes row). */
+    targetName?: string;
     stdout?: string;
     stderr?: string;
     exitCode?: number | null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "0.18.1",
+  "version": "0.20.2",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -34,15 +34,15 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/codex": "^0.2.9",
-    "@opengeni/config": "^0.10.1",
-    "@opengeni/contracts": "^0.31.1",
-    "@opengeni/db": "^0.22.2",
-    "@opengeni/documents": "^0.2.70",
-    "@opengeni/events": "^0.3.60",
-    "@opengeni/observability": "^0.4.4",
-    "@opengeni/runtime": "^0.17.1",
-    "@opengeni/storage": "^0.2.54",
+    "@opengeni/codex": "^0.2.10",
+    "@opengeni/config": "^0.10.6",
+    "@opengeni/contracts": "^0.35.0",
+    "@opengeni/db": "^0.26.0",
+    "@opengeni/documents": "^0.3.2",
+    "@opengeni/events": "^0.3.65",
+    "@opengeni/observability": "^0.4.9",
+    "@opengeni/runtime": "^0.18.3",
+    "@opengeni/storage": "^0.2.59",
     "hono": "^4.12.18"
   },
   "engines": {

package/src/application/session-commands.ts

@@ -595,10 +595,12 @@ export async function controlHumanSessionWorkstream(
     ),
     interruptionCount: result.interruptionCount,
     wakeCount: result.wakeCount,
+    cancelledSessionCount: result.cancelledSessionCount,
+    cancelledTurnCount: result.cancelledTurnCount,
   };
-  await publishSessionEventIds(deps, context.workspaceId, context.sessionId, [
-    result.sessionControlEventId,
-  ]);
+  for (const affected of result.affectedSessionEvents) {
+    await publishSessionEventIds(deps, context.workspaceId, affected.sessionId, affected.eventIds);
+  }
   await publishWorkspaceControlEvent(deps, context.workspaceId, result.workspaceControlEventId);
   await requestControlWakeDispatch(deps, result.wakeCount);
   return response;

package/src/dependencies.ts

@@ -2,6 +2,7 @@ import type { Settings } from "@opengeni/config";
 import type {
   ConnectionCredentialsPort,
   Document,
+  DocumentAuthorityKind,
   GitHubAppApiPort,
   ScheduledTask,
   SessionAuthorizationPort,
@@ -73,6 +74,9 @@ export type DocumentIndexClient = {
     accountId: string;
     workspaceId: string;
     documentId: string;
+    authorityKind: DocumentAuthorityKind;
+    authorityWorkspaceId: string | null;
+    authoritySubjectId: string | null;
   }) => Promise<Document | void>;
 };
 

package/src/domain/resources.ts

@@ -8,6 +8,7 @@ import {
   normalizeRepositorySubpath,
   normalizeResourceMountPath,
   resourceIdentityKey,
+  resourceMountPath,
   resourceMountPathCollisionKey,
   ResourceRefConflictError,
   ResourceMountPathError,
@@ -115,7 +116,7 @@ export function normalizeResources(resources: ResourceRef[]): ResourceRef[] {
   for (const resource of resources) {
     let normalized: ResourceRef;
     if (resource.kind === "file") {
-      const mountPath = normalizeMountPath(resource.mountPath ?? `files/${resource.fileId}`);
+      const mountPath = normalizeMountPath(resourceMountPath(resource));
       normalized = {
         kind: "file",
         fileId: resource.fileId,

package/src/domain/sessions.ts

@@ -514,6 +514,8 @@ export async function createAndStartSession(input: {
   accountId: string;
   workspaceId: string;
   initialMessage: string;
+  /** Create the session shell without an initial user event/agent turn. */
+  deferInitialTurn?: boolean;
   turnInstructions?: string | null;
   resources: ResourceRef[];
   skills?: SessionSkill[];
@@ -546,6 +548,9 @@ export async function createAndStartSession(input: {
   // workspace agentInstructions at turn time; never emitted as a timeline event.
   // Null/omitted ⇒ the session carries none.
   instructions?: string | null;
+  // Immutable normalized prompt-policy role. This never derives from a
+  // workspace membership role; null retains the bounded metadata.role fallback.
+  policyRole?: string | null;
   // Validated against the creating grant before this is called.
   firstPartyMcpPermissions?: Permission[] | null;
   // Model-visible first-party tool names. Authorization remains controlled by
@@ -626,6 +631,7 @@ export async function createAndStartSession(input: {
       firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
       firstPartyMcpTools: input.firstPartyMcpTools,
       instructions: input.instructions ?? null,
+      policyRole: input.policyRole ?? null,
       parentSessionId: input.parentSessionId ?? null,
       createIdempotencyKey: input.createIdempotencyKey,
       sandboxGroupId: input.sandboxGroupId ?? null,
@@ -672,6 +678,7 @@ export async function createAndStartSession(input: {
       firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
       firstPartyMcpTools: input.firstPartyMcpTools,
       instructions: input.instructions ?? null,
+      policyRole: input.policyRole ?? null,
       parentSessionId: input.parentSessionId ?? null,
       sandboxGroupId: input.sandboxGroupId ?? null,
       ...(input.sandboxOs ? { sandboxOs: input.sandboxOs } : {}),
@@ -702,6 +709,7 @@ async function finishStartSession(
     bus: EventBus;
     workflowClient: SessionWorkflowClient;
     initialMessage: string;
+    deferInitialTurn?: boolean;
     turnInstructions?: string | null;
     resources: ResourceRef[];
     tools: ToolRef[];
@@ -781,6 +789,7 @@ async function finishStartSession(
         }
       : null,
     consumeNewSessionDraft: input.consumeNewSessionDraft ?? null,
+    deferInitialTurn: input.deferInitialTurn === true,
   });
   await publishDurableSessionEvents(input.bus, session.workspaceId, session.id, started.events);
   if (started.workflowWakeRevision !== null) {
@@ -1255,9 +1264,10 @@ export async function createSessionForRequest(
         payload.variableSetId,
       )
     : null;
-  // RIG BINDING (M3). Resolve the rig this session rides — the EXPLICIT payload
-  // rigId when given, else the workspace default rig (workspaces.default_rig_id)
-  // — and FREEZE both the rig id and its currently-ACTIVE version onto the row.
+  // RIG BINDING (M3). Resolve the rig this session rides — a UUID binds that
+  // rig, null explicitly opts out, and omission inherits the workspace default
+  // (workspaces.default_rig_id) — then FREEZE both the rig id and its currently-
+  // ACTIVE version onto the row.
   // The session then rides that exact version for its whole life; a later
   // promote never moves it. Rig-less (both null) when neither resolves, which is
   // byte-for-byte today's behavior (zero extra work, zero row change).
@@ -1265,7 +1275,8 @@ export async function createSessionForRequest(
   //   - A stale workspace-default rig (deleted → FK-nulled, or somehow with no
   //     active version) degrades SILENTLY to rig-less: an operator-side default
   //     must never brick every create in the workspace.
-  const requestedRigId = payload.rigId ?? (await getWorkspaceDefaultRigId(db, workspaceId));
+  const requestedRigId =
+    payload.rigId === undefined ? await getWorkspaceDefaultRigId(db, workspaceId) : payload.rigId;
   let frozenRigId: string | null = null;
   let frozenRigVersionId: string | null = null;
   if (requestedRigId) {
@@ -1598,13 +1609,15 @@ export async function createSessionForRequest(
       }
     }
   }
-  await requireLimit(deps, {
-    accountId: grant.accountId,
-    workspaceId,
-    action: "agent_run:create",
-    quantity: 1,
-    model,
-  });
+  if (payload.startMode !== "realtime") {
+    await requireLimit(deps, {
+      accountId: grant.accountId,
+      workspaceId,
+      action: "agent_run:create",
+      quantity: 1,
+      model,
+    });
+  }
   const creationInitiator = creationInitiatorForGrant(grant);
   let session: CreateSessionResponse;
   try {
@@ -1615,7 +1628,8 @@ export async function createSessionForRequest(
       workflowClient,
       accountId: grant.accountId,
       workspaceId,
-      initialMessage: payload.initialMessage,
+      initialMessage: payload.initialMessage ?? "",
+      deferInitialTurn: payload.startMode === "realtime",
       turnInstructions: payload.turnInstructions ?? null,
       resources,
       skills,
@@ -1651,6 +1665,7 @@ export async function createSessionForRequest(
       // contracts schema). Persisted on the row; composed system-level at turn
       // time. Not surfaced as an event.
       instructions: payload.instructions ?? null,
+      policyRole: payload.policyRole ?? null,
       firstPartyMcpPermissions,
       firstPartyMcpTools,
       mcpServers: sessionMcpServers.dbServers,
@@ -1687,21 +1702,23 @@ export async function createSessionForRequest(
     }
     throw error;
   }
-  await recordWorkspaceUsage(deps, {
-    accountId: grant.accountId,
-    workspaceId,
-    subjectId: grant.subjectId,
-    eventType: "agent_run.created",
-    quantity: 1,
-    unit: "run",
-    sourceResourceType: "session",
-    sourceResourceId: session.id,
-    sessionId: session.id,
-    initiator: session.createdBy,
-    initiatorContext: session.createdByContext,
-    origin: creationInitiator.actor ? "system" : "user",
-    idempotencyKey: `agent_run.created:${workspaceId}:${session.id}`,
-  });
+  if (payload.startMode !== "realtime") {
+    await recordWorkspaceUsage(deps, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      eventType: "agent_run.created",
+      quantity: 1,
+      unit: "run",
+      sourceResourceType: "session",
+      sourceResourceId: session.id,
+      sessionId: session.id,
+      initiator: session.createdBy,
+      initiatorContext: session.createdByContext,
+      origin: creationInitiator.actor ? "system" : "user",
+      idempotencyKey: `agent_run.created:${workspaceId}:${session.id}`,
+    });
+  }
   return session;
 }
 

package/src/sandbox/fleet.ts

@@ -510,6 +510,8 @@ export type RunOnResult = {
   target: string;
   kind: string;
   ok: boolean;
+  /** Display name of the target sandbox when known (from the sandboxes row). */
+  targetName?: string;
   stdout?: string;
   stderr?: string;
   exitCode?: number | null;
@@ -628,6 +630,7 @@ export async function runOnSandbox(
   if (sandbox.kind !== "selfhosted" || !sandbox.enrollmentId) {
     return {
       target,
+      targetName: sandbox.name,
       kind: op.kind,
       ok: false,
       reason: `run_on routes one-off ops to enrolled selfhosted machines; ${sandbox.kind} targets are reached via the active sandbox (swap to it first)`,
@@ -635,10 +638,16 @@ export async function runOnSandbox(
   }
   const enrollment = await getEnrollment(services.db, ctx.workspaceId, sandbox.enrollmentId);
   if (!enrollment || enrollment.status !== "active") {
-    return { target, kind: op.kind, ok: false, reason: `sandbox ${target} is not enrolled/active` };
+    return {
+      target,
+      targetName: sandbox.name,
+      kind: op.kind,
+      ok: false,
+      reason: `sandbox ${target} is not enrolled/active`,
+    };
   }
 
-  return executeRunOnSelfhostedMachine(
+  const result = await executeRunOnSelfhostedMachine(
     {
       workspaceId: ctx.workspaceId,
       agentId: sandbox.enrollmentId,
@@ -650,6 +659,7 @@ export async function runOnSandbox(
     target,
     op,
   );
+  return { ...result, targetName: sandbox.name };
 }
 
 export type ProvisionResult =