@opengeni/core 1.0.1 → 2.2.0-canary.0

package/src/sandbox/routing.ts

@@ -15,7 +15,7 @@ import { sandboxLifecycleTransitionWaitMs, type Settings } from "@opengeni/confi
 import {
   advanceWorkspaceGenerationForDirectRequest,
   advanceWorkspaceGenerationForRetainedProcess,
-  getEnrollment,
+  getLiveEnrollmentConnection,
   getRetainedProcess,
   getSandbox,
   markWarmLeaseInstanceLost,
@@ -28,6 +28,7 @@ import {
   type Database,
   type SandboxWorkspaceMutationAdmission,
 } from "@opengeni/db";
+import { settleSessionBackgroundCommandForRetainedProcess } from "@opengeni/db/session-background-commands";
 import { appendAndPublishEvents, type EventBus } from "@opengeni/events";
 import {
   isProviderSandboxGoneDuringRoutedOperation,
@@ -46,6 +47,7 @@ import {
   type RoutingRetainedProcessTerminalProof,
   type RoutingSandboxOperationObserver,
   type SelfhostedRelayConfig,
+  type SelfhostedConnectionBinding,
   type SelfhostedOpStreamDeps,
 } from "@opengeni/runtime/sandbox";
 
@@ -56,6 +58,34 @@ type PersistableMutationAdmission = {
   > | null;
 };
 
+type DirectRetainedProcessRoute = {
+  providerSessionId: number;
+  providerBackend: string;
+  providerInstanceId: string;
+  leaseEpoch: number;
+  routeKind: "home" | "active";
+  routeTargetId: string | null;
+  routeEpoch: number;
+};
+
+/** API-direct requests always use active-route authority. The default active
+ * pointer is represented by a null target id; it is not a home-route write. */
+export function directRetainedProcessMatchesBackend(
+  durable: DirectRetainedProcessRoute,
+  process: RoutingRetainedProcess,
+  backend: ResolvedActiveBackend,
+): boolean {
+  return (
+    durable.providerSessionId === process.providerSessionId &&
+    durable.providerBackend === backend.kind &&
+    durable.providerInstanceId === backend.providerInstanceId &&
+    durable.leaseEpoch === backend.leaseEpoch &&
+    durable.routeKind === "active" &&
+    durable.routeTargetId === backend.sandboxId &&
+    durable.routeEpoch === backend.activeEpoch
+  );
+}
+
 export type ChannelARoutingServices = {
   db: Database;
   settings: Settings;
@@ -118,24 +148,31 @@ function controlRpcFactory(bus: EventBus | undefined): () => ControlRpc {
     });
 }
 
-async function resolveSelfhostedOpStream(
+async function resolveSelfhostedConnection(
   services: ChannelARoutingServices,
-  workspaceId: string,
+  access: string | { accountId: string; workspaceId: string; subjectId: string },
   sandbox: RoutableSandbox,
-): Promise<SelfhostedOpStreamDeps | undefined> {
-  if (
-    services.settings.agentOpStreamEnabled !== true ||
-    !services.bus?.getOpStreamConnection ||
-    !sandbox.enrollmentId
-  ) {
-    return undefined;
-  }
-  const enrollment = await getEnrollment(services.db, workspaceId, sandbox.enrollmentId);
-  if (enrollment?.opStream !== true) return undefined;
+): Promise<SelfhostedConnectionBinding | null> {
+  if (!sandbox.enrollmentId) return null;
+  const enrollment = await getLiveEnrollmentConnection(services.db, access, sandbox.enrollmentId);
+  if (!enrollment?.connectionInstanceId) return null;
+  const opStream: SelfhostedOpStreamDeps | undefined =
+    services.settings.agentOpStreamEnabled === true &&
+    services.bus?.getOpStreamConnection &&
+    enrollment.opStream === true
+      ? {
+          transport: new NatsOpStreamTransport(
+            async () => services.bus?.getOpStreamConnection?.() ?? null,
+          ),
+        }
+      : undefined;
   return {
-    transport: new NatsOpStreamTransport(
-      async () => services.bus?.getOpStreamConnection?.() ?? null,
-    ),
+    connectionInstanceId: enrollment.connectionInstanceId,
+    workspaceRoot: enrollment.workspaceRoot,
+    ...(opStream ? { opStream } : {}),
+    operationResourcePolicy: enrollment.operationPolicy,
+    operationResourcePolicySupported: enrollment.agentCapabilities.operationResourcePolicy === true,
+    operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
   };
 }
 
@@ -157,6 +194,7 @@ export function wrapChannelABoxWithRouting(
     accountId: string;
     workspaceId: string;
     sessionId: string;
+    resourceSubjectId: string;
     homeLease?: {
       sandboxGroupId: string;
       leaseEpoch: number;
@@ -209,6 +247,7 @@ export function wrapChannelABoxWithRouting(
           sessionId: ids.sessionId,
           requestId: ids.directRequest.requestId,
           holderId: ids.directRequest.holderId,
+          initiatorSubjectId: ids.resourceSubjectId,
           sandboxGroupId: homeLease.sandboxGroupId,
           expectedEpoch: backend.leaseEpoch,
           expectedInstanceId: backend.providerInstanceId,
@@ -267,10 +306,15 @@ export function wrapChannelABoxWithRouting(
             admittedWorkspaceGeneration: exactAdmission.workspaceGeneration,
             operation: op,
             providerBinding: boundAdmission.providerBinding ?? null,
+            backgroundCommand: {
+              commandId: retainedProcess.id,
+              command: op,
+            },
             owner: {
               kind: "direct",
               requestId: ids.directRequest.requestId,
               holderId: ids.directRequest.holderId,
+              initiatorSubjectId: ids.resourceSubjectId,
               sandboxGroupId: homeLease.sandboxGroupId,
               expectedEpoch: backend.leaseEpoch,
               expectedInstanceId: backend.providerInstanceId,
@@ -286,6 +330,7 @@ export function wrapChannelABoxWithRouting(
           sessionId: ids.sessionId,
           requestId: ids.directRequest.requestId,
           holderId: ids.directRequest.holderId,
+          initiatorSubjectId: ids.resourceSubjectId,
           sandboxGroupId: homeLease.sandboxGroupId,
           expectedEpoch: backend.leaseEpoch,
           expectedInstanceId: backend.providerInstanceId,
@@ -373,16 +418,7 @@ export function wrapChannelABoxWithRouting(
           sessionId: ids.sessionId,
           processId: process.id,
         });
-        if (
-          !durable ||
-          durable.providerSessionId !== process.providerSessionId ||
-          durable.providerBackend !== backend.kind ||
-          durable.providerInstanceId !== backend.providerInstanceId ||
-          durable.leaseEpoch !== backend.leaseEpoch ||
-          durable.routeKind !== (backend.sandboxId === null ? "home" : "active") ||
-          durable.routeTargetId !== backend.sandboxId ||
-          durable.routeEpoch !== backend.activeEpoch
-        ) {
+        if (!durable || !directRetainedProcessMatchesBackend(durable, process, backend)) {
           throw new Error(
             "API retained-process settlement lost its exact durable backend identity",
           );
@@ -398,6 +434,15 @@ export function wrapChannelABoxWithRouting(
           reason: proof.reason,
           idleGraceMs: settings.sandboxIdleGraceMs,
         });
+        await settleSessionBackgroundCommandForRetainedProcess(db, {
+          accountId: ids.accountId,
+          workspaceId: ids.workspaceId,
+          sessionId: ids.sessionId,
+          retainedProcessId: process.id,
+          outcome: proof.outcome,
+          exitCode: proof.exitCode,
+          reason: proof.reason,
+        });
       }
     : undefined;
   const resolver = makeActiveBackendResolver({
@@ -405,10 +450,19 @@ export function wrapChannelABoxWithRouting(
     defaultBackend: established.session as RoutableBackendSession,
     defaultKind: established.backendId,
     getSandbox: async (sandboxId): Promise<RoutableSandbox | null> => {
-      const sandbox = await getSandbox(db, ids.workspaceId, sandboxId);
+      const sandbox = await getSandbox(
+        db,
+        {
+          accountId: ids.accountId,
+          workspaceId: ids.workspaceId,
+          subjectId: ids.resourceSubjectId,
+        },
+        sandboxId,
+      );
       return sandbox
         ? {
             id: sandbox.id,
+            workspaceId: sandbox.workspaceId,
             kind: sandbox.kind,
             name: sandbox.name,
             enrollmentId: sandbox.enrollmentId,
@@ -416,8 +470,16 @@ export function wrapChannelABoxWithRouting(
         : null;
     },
     controlRpcFactory: controlRpcFactory(bus),
-    resolveSelfhostedOpStream: (sandbox) =>
-      resolveSelfhostedOpStream(services, ids.workspaceId, sandbox),
+    resolveSelfhostedConnection: (sandbox) =>
+      resolveSelfhostedConnection(
+        services,
+        {
+          accountId: ids.accountId,
+          workspaceId: ids.workspaceId,
+          subjectId: ids.resourceSubjectId,
+        },
+        sandbox,
+      ),
     relay: relayConfigFromSettings(settings),
     selfhostedTimeoutMs: settings.sandboxSelfhostedControlTimeoutMs,
     selfhostedExecTimeoutMs: settings.sandboxSelfhostedExecTimeoutMs,

package/src/sandbox/runtime-settings.ts

@@ -0,0 +1,274 @@
+import type { Settings } from "@opengeni/config";
+import {
+  CapabilityPack,
+  type RigVersion,
+  type Session,
+  type SandboxBackend,
+} from "@opengeni/contracts";
+import {
+  getRigVersion,
+  getWorkspacePack,
+  listPackInstallations,
+  type Database,
+} from "@opengeni/db";
+import { resolveModalCheckpointProviderBinding } from "@opengeni/runtime/sandbox";
+import {
+  rigProviderImageContentHash,
+  rigProviderImageMatchesDefinition,
+  rigProviderImageProviderBindingKeyHash,
+} from "../rigs/provider-images";
+
+/** Pre-V2 Packs are the sole compatibility path where a Pack can still own a
+ * sandbox image. V2 installations select a Rig instead. Keep this predicate at
+ * the shared runtime boundary so turns, API-direct tools, viewers, Browser and
+ * Computer cannot resolve different physical machines for the same session. */
+export function packInstallationUsesLegacyRuntime(input: {
+  manifestSnapshot: unknown | null;
+  manifestDigest: string | null;
+}): boolean {
+  return input.manifestSnapshot === null && input.manifestDigest === null;
+}
+
+export async function resolveWorkspaceLegacyRuntimePacks(
+  db: Database,
+  workspaceId: string,
+): Promise<CapabilityPack[]> {
+  const installations = await listPackInstallations(db, workspaceId);
+  const packs: CapabilityPack[] = [];
+  for (const installation of installations) {
+    if (installation.status !== "active" || !packInstallationUsesLegacyRuntime(installation)) {
+      continue;
+    }
+    const registration = await getWorkspacePack(db, workspaceId, installation.packId);
+    const parsed = CapabilityPack.safeParse(registration?.pack);
+    if (parsed.success) packs.push(parsed.data);
+  }
+  return packs;
+}
+
+export function legacySandboxRuntimeFromPacks(packs: readonly CapabilityPack[]): {
+  sandboxImage: string | null;
+  sandboxProviderImages: CapabilityPack["sandboxProviderImages"] | null;
+} {
+  const imagePacks = packs.filter(
+    (pack) => typeof pack.sandboxImage === "string" && pack.sandboxImage.trim().length > 0,
+  );
+  if (imagePacks.length > 1) {
+    const ids = imagePacks
+      .map((pack) => pack.id)
+      .sort()
+      .join(", ");
+    throw new Error(
+      `Multiple enabled packs declare a sandbox image (${ids}). Only one enabled pack per workspace may declare sandboxImage; disable the others and retry.`,
+    );
+  }
+  return {
+    sandboxImage: imagePacks[0]?.sandboxImage?.trim() ?? null,
+    sandboxProviderImages: imagePacks[0]?.sandboxProviderImages ?? null,
+  };
+}
+
+export function settingsWithPackSandboxImage(
+  settings: Settings,
+  sandboxImage: string | null,
+  sandboxProviderImages: CapabilityPack["sandboxProviderImages"] | null = null,
+): Settings {
+  if (!sandboxImage) return settings;
+  return {
+    ...settings,
+    dockerImage: sandboxImage,
+    modalImageRef: sandboxImage,
+    modalImageId: sandboxProviderImages?.modal?.imageId,
+  };
+}
+
+export function settingsWithRigImage(settings: Settings, rigImage: string | null): Settings {
+  if (!rigImage) return settings;
+  return {
+    ...settings,
+    dockerImage: rigImage,
+    modalImageRef: rigImage,
+    modalImageId: undefined,
+  };
+}
+
+export function rigProviderImageSourceImage(
+  settings: Settings,
+  backend: SandboxBackend,
+): string | null {
+  if (backend === "modal") return settings.modalImageId ?? settings.modalImageRef ?? null;
+  if (backend === "docker") return settings.dockerImage ?? null;
+  return null;
+}
+
+export type RigProviderImageSelectionReason =
+  | "selected"
+  | "missing"
+  | "provider_unsupported"
+  | "not_ready"
+  | "not_cold_boot_validated"
+  | "content_mismatch"
+  | "provider_binding_unavailable"
+  | "provider_binding_mismatch";
+
+export function resolveRigProviderImageSelection(
+  settings: Settings,
+  version: RigVersion | null,
+  backend: SandboxBackend,
+  currentProviderBindingKeyHash: string | null,
+): {
+  settings: Settings;
+  reason: RigProviderImageSelectionReason;
+  contentHash: string | null;
+  imageId: string | null;
+} {
+  if (!version) return { settings, reason: "missing", contentHash: null, imageId: null };
+  if (backend !== "modal") {
+    return { settings, reason: "provider_unsupported", contentHash: null, imageId: null };
+  }
+  const image = version.providerImages[backend];
+  if (!image) return { settings, reason: "missing", contentHash: null, imageId: null };
+  if (image.status !== "ready" || !image.imageId) {
+    return {
+      settings,
+      reason: "not_ready",
+      contentHash: image.contentHash,
+      imageId: image.imageId,
+    };
+  }
+  if (image.coldBootValidation?.version !== 1) {
+    return {
+      settings,
+      reason: "not_cold_boot_validated",
+      contentHash: image.contentHash,
+      imageId: null,
+    };
+  }
+  const sourceImage = rigProviderImageSourceImage(settings, backend);
+  const expectedContentHash = rigProviderImageContentHash({
+    backend,
+    sourceImage,
+    definition: version,
+  });
+  if (
+    image.sourceImage !== sourceImage ||
+    image.contentHash !== expectedContentHash ||
+    !rigProviderImageMatchesDefinition(image, version)
+  ) {
+    return {
+      settings,
+      reason: "content_mismatch",
+      contentHash: expectedContentHash,
+      imageId: null,
+    };
+  }
+  if (!image.providerBindingKeyHash || !currentProviderBindingKeyHash) {
+    return {
+      settings,
+      reason: "provider_binding_unavailable",
+      contentHash: expectedContentHash,
+      imageId: null,
+    };
+  }
+  if (image.providerBindingKeyHash !== currentProviderBindingKeyHash) {
+    return {
+      settings,
+      reason: "provider_binding_mismatch",
+      contentHash: expectedContentHash,
+      imageId: null,
+    };
+  }
+  return {
+    settings: { ...settings, modalImageId: image.imageId },
+    reason: "selected",
+    contentHash: expectedContentHash,
+    imageId: image.imageId,
+  };
+}
+
+export async function resolveRigProviderImageForRun(
+  settings: Settings,
+  version: RigVersion | null,
+  backend: SandboxBackend,
+  resolveBinding: typeof resolveModalCheckpointProviderBinding = resolveModalCheckpointProviderBinding,
+): Promise<ReturnType<typeof resolveRigProviderImageSelection>> {
+  const image = backend === "modal" ? version?.providerImages.modal : null;
+  if (image?.status !== "ready" || !image.providerBindingKeyHash) {
+    return resolveRigProviderImageSelection(settings, version, backend, null);
+  }
+  const structural = resolveRigProviderImageSelection(
+    settings,
+    version,
+    backend,
+    image.providerBindingKeyHash,
+  );
+  if (structural.reason !== "selected") return structural;
+  let currentProviderBindingKeyHash: string | null = null;
+  try {
+    const binding = await resolveBinding(settings);
+    currentProviderBindingKeyHash = rigProviderImageProviderBindingKeyHash(binding.key);
+  } catch {
+    // A provider-native image is an optimization. The exact logical image is
+    // still the correct cold-create fallback when provider identity is absent.
+  }
+  return resolveRigProviderImageSelection(
+    settings,
+    version,
+    backend,
+    currentProviderBindingKeyHash,
+  );
+}
+
+export async function settingsWithRigProviderImage(
+  settings: Settings,
+  version: RigVersion | null,
+  backend: SandboxBackend,
+  resolveBinding: typeof resolveModalCheckpointProviderBinding = resolveModalCheckpointProviderBinding,
+): Promise<Settings> {
+  return (await resolveRigProviderImageForRun(settings, version, backend, resolveBinding)).settings;
+}
+
+export type SessionSandboxRuntime = {
+  /** Exact logical image/rig settings used to fence the durable group lease. */
+  settings: Settings;
+  image: string | null;
+  rigVersion: RigVersion | null;
+};
+
+export async function resolveSessionSandboxRuntime(
+  db: Database,
+  settings: Settings,
+  session: Pick<Session, "workspaceId" | "sandboxBackend" | "rigId" | "rigVersionId">,
+): Promise<SessionSandboxRuntime> {
+  const [packs, rigVersion] = await Promise.all([
+    resolveWorkspaceLegacyRuntimePacks(db, session.workspaceId),
+    session.rigId && session.rigVersionId
+      ? getRigVersion(db, session.workspaceId, session.rigId, session.rigVersionId)
+      : Promise.resolve(null),
+  ]);
+  if (session.rigVersionId && !rigVersion) {
+    throw new Error(`Frozen rig version ${session.rigVersionId} is unavailable`);
+  }
+  const legacy = legacySandboxRuntimeFromPacks(packs);
+  const logicalSettings = settingsWithRigImage(
+    settingsWithPackSandboxImage(settings, legacy.sandboxImage, legacy.sandboxProviderImages),
+    rigVersion?.image ?? null,
+  );
+  return {
+    settings: {
+      ...logicalSettings,
+      sandboxBackend: session.sandboxBackend,
+    },
+    image: rigProviderImageSourceImage(logicalSettings, session.sandboxBackend),
+    rigVersion,
+  };
+}
+
+/** Resolve provider-native cold-create optimization only for the single CAS
+ * winner. Ordinary API calls never perform provider identity I/O. */
+export async function providerSettingsForSessionSandboxRuntime(
+  runtime: SessionSandboxRuntime,
+  backend: SandboxBackend,
+): Promise<Settings> {
+  return await settingsWithRigProviderImage(runtime.settings, runtime.rigVersion, backend);
+}

package/src/session-authorization.ts

@@ -67,52 +67,16 @@ function grantHasAgentAttemptAuthority(grant: AccessGrant): boolean {
 }
 
 /**
- * Read-only access an immediate child may use against its parent. Upstream
- * mutation is deliberately limited to `session.append`: letting a child Pause,
- * Steer, or otherwise mutate its parent would let it influence siblings through
- * the parent's recursive control and shared state.
+ * Live agent attempts may address any workspace session that later private,
+ * Slack-owner, and optional host checks still allow. Parent/child lineage is
+ * not an access deny. Cross-session projections stay exact-target so a peer
+ * read does not receive another session's derived metadata.
  */
-const AGENT_PARENT_READ_OPERATIONS = new Set<SessionAuthorizationOperation>([
-  "session.read",
-  "session.events.read",
-  "session.stream.read",
-  "session.turns.read",
-  "session.queue.read",
-  "session.composer.read",
-  "session.lineage.read",
-  "session.capture.read",
-  "session.files.read",
-  "session.git.read",
-  "session.terminal.read",
-  "session.viewer.read",
-  "session.goal.read",
-  "session.human_input.read",
-]);
-
-function enforceAgentSessionHierarchy(
+function relatedSessionAccessForAgentAttempt(
   actor: Extract<SessionAuthorizationActor, { kind: "agent_attempt" }>,
-  callerParentSessionId: string | null,
-  target: ResolvedSessionAuthorizationTarget,
-  operation: SessionAuthorizationOperation,
+  targetSessionId: string,
 ): "target" | "root" {
-  if (target.target.sessionId === actor.callerSessionId) return "root";
-
-  // A manager may inspect and operate an immediate child. Existing permission
-  // and host-policy checks still apply; lineage never grants a capability.
-  if (target.parentSessionId === actor.callerSessionId) return "target";
-
-  // A child may report to and inspect its immediate parent, but cannot mutate
-  // the parent except through the canonical machine-input message boundary.
-  if (callerParentSessionId === target.target.sessionId) {
-    if (operation === "session.append" || AGENT_PARENT_READ_OPERATIONS.has(operation)) {
-      return "target";
-    }
-    throw new SessionAuthorizationDeniedError("forbidden");
-  }
-
-  // Siblings, skipped generations, other branches, and unrelated roots are
-  // never cross-session authority for a live agent attempt.
-  throw new SessionAuthorizationDeniedError("forbidden");
+  return targetSessionId === actor.callerSessionId ? "root" : "target";
 }
 
 export function sessionRlsActorForAuthorization(
@@ -201,14 +165,18 @@ export async function requireSessionAuthorization(
   const target = resolvedTarget.target;
   const agentRelatedSessionAccess =
     actor.kind === "agent_attempt"
-      ? enforceAgentSessionHierarchy(
-          actor,
-          resolvedActor.callerParentSessionId,
-          resolvedTarget,
-          input.operation,
-        )
+      ? relatedSessionAccessForAgentAttempt(actor, target.sessionId)
       : null;
 
+  // Tool approvals are a human decision. An agent attempt may answer another
+  // session's structured human-input request (`session.human_input.write`,
+  // through `session_human_input_respond`) but may never approve or reject a
+  // pending tool approval on any session, including a child it spawned; an
+  // embedding-host port cannot widen this.
+  if (actor.kind === "agent_attempt" && input.operation === "session.approval.write") {
+    throw new SessionAuthorizationDeniedError("forbidden");
+  }
+
   if (authority.visibility === "user_private") {
     const allowed =
       authority.ownerSubjectId !== null &&