@opengeni/core 2.5.3 → 2.6.3-canary.0

package/src/sandbox/fleet.ts

@@ -1,6 +1,6 @@
 // apps/api/src/sandbox/fleet.ts — the FLEET service backing the fleet MCP tools
 // (M7): list / attach / swap / run_on / provision over the heterogeneous fleet
-// (the session's Modal group box + the workspace's enrolled selfhosted machines).
+// (the session's managed group box + the workspace's enrolled selfhosted machines).
 //
 // Each operation is workspace-scoped (the caller's grant) and, for the
 // session-pointer mutations (attach/swap), session-scoped (the worker-signed
@@ -12,6 +12,7 @@
 // single op WITHOUT touching the active pointer.
 
 import type { Settings } from "@opengeni/config";
+import type { SandboxBackend } from "@opengeni/contracts";
 import {
   authorizePersonalMachineForAttempt,
   getEnrollment,
@@ -45,6 +46,7 @@ import {
   type SelfhostedOperationResourcePolicy,
 } from "@opengeni/runtime/sandbox";
 import { relayConfigFromSettings } from "./routing";
+import { managedSessionGroupBackend } from "./runtime-settings";
 
 export type FleetServices = {
   db: Database;
@@ -74,8 +76,8 @@ export type FleetContext = {
   /** The calling session (the pointer the attach/swap mutates + whose group box
    *  is the default fleet member). */
   sessionId: string;
-  /** The session's own group sandbox backend (modal/selfhosted/…). */
-  sessionBackend: string;
+  /** The session's durable home-compute policy. */
+  sessionBackend: SandboxBackend;
   /** The session's own group sandbox id (the lease group). */
   sessionGroupId: string;
 };
@@ -264,8 +266,9 @@ async function probeEnrollment(
  * List the fleet: the session's own group box when it has one (a synthetic
  * entry) + the workspace's first-class selfhosted sandboxes (each probed for
  * liveness), each with an `active` marker derived from the session's active
- * pointer. A backend:none session has no synthetic home entry; a null pointer
- * then means no compute is attached.
+ * pointer. A backend:none session and a machine-home session on a deployment
+ * without a managed provider have no synthetic group entry; a null pointer then
+ * means no compute is attached.
  */
 export async function listFleet(
   services: FleetServices,
@@ -285,8 +288,12 @@ export async function listFleet(
   };
 
   const entries: FleetSandboxEntry[] = [];
+  const groupBackend = managedSessionGroupBackend(
+    services.settings.sandboxBackend,
+    ctx.sessionBackend,
+  );
 
-  if (ctx.sessionBackend !== "none") {
+  if (groupBackend) {
     // The session's own group box (the default/home sandbox; null active pointer ==
     // this box). A session/group row is not provider existence. Online requires a
     // warm lease, observed provider existence, and verified workspace readiness.
@@ -317,17 +324,10 @@ export async function listFleet(
         ? "unavailable"
         : groupRecovering
           ? "recovering"
-          : ctx.sessionBackend === "selfhosted"
-            ? "unavailable"
-            : "wakeable";
+          : "wakeable";
     entries.push({
       id: ctx.sessionGroupId,
-      kind:
-        ctx.sessionBackend === "selfhosted"
-          ? "selfhosted"
-          : ctx.sessionBackend === "opensandbox"
-            ? "opensandbox"
-            : "modal",
+      kind: groupBackend === "opensandbox" ? "opensandbox" : "modal",
       name: "session sandbox",
       liveness: groupOnline ? "online" : groupRecovering ? "reconnecting" : "offline",
       active: groupActive,
@@ -467,10 +467,13 @@ async function resolveTarget(
 > {
   // The session's own group box → the default pointer (null).
   if (target === ctx.sessionGroupId || target === "session" || target === "default") {
-    if (ctx.sessionBackend === "none") {
+    if (!managedSessionGroupBackend(services.settings.sandboxBackend, ctx.sessionBackend)) {
       return {
         ok: false,
-        reason: "this session has no home sandbox; attach a Connected Machine",
+        reason:
+          ctx.sessionBackend === "none"
+            ? "this session has no home sandbox; attach a Connected Machine"
+            : "this deployment has no managed session sandbox; select an enrolled machine",
         code: "unsupported_backend_context",
       };
     }

package/src/sandbox/routing.ts

@@ -26,6 +26,7 @@ import {
   verifyDirectWorkspaceMutationSettlement,
   verifyRetainedProcessMutationSettlement,
   type Database,
+  type SandboxRetainedProcess,
   type SandboxWorkspaceMutationAdmission,
 } from "@opengeni/db";
 import { settleSessionBackgroundCommandForRetainedProcess } from "@opengeni/db/session-background-commands";
@@ -86,6 +87,20 @@ export function directRetainedProcessMatchesBackend(
   );
 }
 
+export function retainedProcessBackgroundSettlement(
+  process: Pick<SandboxRetainedProcess, "state" | "exitCode" | "settlementReason">,
+  fallback: RoutingRetainedProcessTerminalProof,
+): { outcome: "exited" | "lost"; exitCode: number | null; reason: string } {
+  if (process.state === "active") {
+    throw new Error("Retained-process settlement returned an active durable process");
+  }
+  return {
+    outcome: process.state,
+    exitCode: process.exitCode,
+    reason: process.settlementReason ?? fallback.reason,
+  };
+}
+
 export type ChannelARoutingServices = {
   db: Database;
   settings: Settings;
@@ -423,7 +438,7 @@ export function wrapChannelABoxWithRouting(
             "API retained-process settlement lost its exact durable backend identity",
           );
         }
-        await settleRetainedProcess(db, {
+        const settlement = await settleRetainedProcess(db, {
           accountId: ids.accountId,
           workspaceId: ids.workspaceId,
           sessionId: ids.sessionId,
@@ -434,14 +449,13 @@ export function wrapChannelABoxWithRouting(
           reason: proof.reason,
           idleGraceMs: settings.sandboxIdleGraceMs,
         });
+        const backgroundSettlement = retainedProcessBackgroundSettlement(settlement.process, proof);
         await settleSessionBackgroundCommandForRetainedProcess(db, {
           accountId: ids.accountId,
           workspaceId: ids.workspaceId,
           sessionId: ids.sessionId,
           retainedProcessId: process.id,
-          outcome: proof.outcome,
-          exitCode: proof.exitCode,
-          reason: proof.reason,
+          ...backgroundSettlement,
         });
       }
     : undefined;

package/src/sandbox/runtime-settings.ts

@@ -4,6 +4,7 @@ import {
   type RigVersion,
   type Session,
   type SandboxBackend,
+  type SandboxOs,
 } from "@opengeni/contracts";
 import {
   getRigVersion,
@@ -18,6 +19,37 @@ import {
   rigProviderImageProviderBindingKeyHash,
 } from "../rigs/provider-images";
 
+export type ManagedSessionGroupBackend = Exclude<SandboxBackend, "none" | "selfhosted">;
+
+/**
+ * Resolve the provider backend behind a session's synthetic managed group.
+ *
+ * A machine-home session keeps `selfhosted` as its durable policy while a
+ * non-null active pointer selects the enrolled machine. Clearing that pointer
+ * is an explicit switch to the deployment's managed group, so API readiness,
+ * viewer attachment, Channel-A, and worker turns must all select the same
+ * provider. Deployments configured with `none` or `selfhosted` have no managed
+ * fallback to expose.
+ */
+export function managedSessionGroupBackend(
+  deploymentBackend: SandboxBackend,
+  sessionBackend: SandboxBackend,
+): ManagedSessionGroupBackend | null {
+  if (sessionBackend === "none") return null;
+  const backend = sessionBackend === "selfhosted" ? deploymentBackend : sessionBackend;
+  return backend === "none" || backend === "selfhosted" ? null : backend;
+}
+
+/** A machine-home row carries the machine's host OS; its managed group uses the
+ * platform's canonical managed-sandbox OS instead. Ordinary sessions preserve
+ * their explicitly selected OS. */
+export function managedSessionGroupOs(
+  sessionBackend: SandboxBackend,
+  sessionOs: SandboxOs,
+): SandboxOs {
+  return sessionBackend === "selfhosted" ? "linux" : sessionOs;
+}
+
 /** Pre-V2 Packs are the sole compatibility path where a Pack can still own a
  * sandbox image. V2 installations select a Rig instead. Keep this predicate at
  * the shared runtime boundary so turns, API-direct tools, viewers, Browser and