@opengeni/db 4.3.3-canary.0 → 4.3.3-canary.2

package/dist/plugin-packages.d.ts

@@ -26,6 +26,7 @@ export type InstalledPluginPackageSummary = {
     category: string;
     tags: string[];
     sourceUrl: string | null;
+    logoUrl: string | null;
     manifestDigest: string;
     installationVersion: number;
     componentCount: number;

package/dist/sandbox-transition-wait.d.ts

@@ -0,0 +1,10 @@
+/** Observational only: expiring a caller's wait never revokes a capture fence. */
+export declare class SandboxTransitionWaitBudget {
+    private readonly waitMs;
+    private observedCapture;
+    private currentDeadline;
+    private readonly hardDeadline;
+    constructor(waitMs: number, startedAt: number);
+    get deadline(): number;
+    observeCapture(remainingMs: number | null | undefined, now: number): void;
+}

package/dist/session-mcp-progress.d.ts

@@ -1,10 +1,17 @@
 import { type SQL, type SQLWrapper } from "drizzle-orm";
 export declare const SESSION_MCP_PROGRESS_CHARS = 600;
+export declare function sessionTextStoragePrefixChars(maxChars: number): number;
 export declare const SESSION_MCP_PROGRESS_STORAGE_CHARS: number;
 export declare const SESSION_MCP_PROGRESS_UTF16_BASE64_PATTERN = "([A-Za-z0-9+/]{8})*([A-Za-z0-9+/]{8}|[A-Za-z0-9+/]{2}[AEIMQUYcgkosw048]=|[A-Za-z0-9+/]{5}[AQgw]==)";
 /** Validate the full scalar in storage; transfer only this boolean, not its suffix. */
 export declare function sessionMcpProgressScalarIsEncodedSql(value: SQL, codecVersion: SQLWrapper): SQL<boolean>;
-/** Project only the selected scalar, never the rest of a goal.progress payload. */
+/** Project only the selected scalar, never the rest of its event payload. */
+export declare function projectSessionTextPrefix(storedPrefix: string | null, storedChars: number | null, codecVersion: number | null, scalarIsEncoded: boolean, maxChars: number): {
+    text: string | null;
+    originalChars: number | null;
+    textTruncated?: true;
+};
+/** Existing MCP progress budget, using the shared logical-text prefix projection. */
 export declare function projectSessionMcpProgressText(storedPrefix: string | null, storedChars: number | null, codecVersion: number | null, scalarIsEncoded: boolean): {
     text: string | null;
     originalChars: number | null;

package/drizzle/0460_host_export_message_attribution.sql

@@ -0,0 +1,177 @@
+-- deployment-mode: rolling
+-- Attribute accepted user messages through their exact triggering turn. The
+-- source event deliberately has no turn_id; the deferred INSERT trigger runs
+-- after the accepting transaction has installed its turn. Never infer a sender
+-- from the session creator or from arbitrary payload fields. Existing immutable
+-- export rows and consumer checkpoints are unchanged.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+DO $migration$
+DECLARE target_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_private.enqueue_host_session_event_export()
+    RETURNS trigger
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    DECLARE
+      v_enabled boolean;
+      v_initiator jsonb;
+      v_context jsonb := '{}'::jsonb;
+      v_origin text;
+      v_attribution_turn_id uuid;
+      v_source_payload_bytes integer;
+      v_export_payload jsonb;
+      v_export_payload_codec_version smallint;
+      v_payload_bytes integer;
+    BEGIN
+      IF NEW.type IN (
+        'agent.message.delta', 'agent.reasoning.delta',
+        'sandbox.command.output.delta', 'terminal.pty.output.delta'
+      ) THEN
+        RETURN NEW;
+      END IF;
+
+      SELECT c.session_events_enabled INTO v_enabled
+      FROM %1$I.host_export_config c WHERE c.id = 1
+      FOR SHARE;
+      IF coalesce(v_enabled, false) = false THEN
+        RETURN NEW;
+      END IF;
+
+      v_attribution_turn_id := NEW.turn_id;
+      IF v_attribution_turn_id IS NULL AND NEW.type = 'user.message' THEN
+        SELECT min(t.id::text)::uuid INTO v_attribution_turn_id
+        FROM %1$I.session_turns t
+        WHERE t.account_id = NEW.account_id
+          AND t.workspace_id = NEW.workspace_id
+          AND t.session_id = NEW.session_id
+          AND t.trigger_event_id = NEW.id
+        HAVING count(*) = 1;
+      END IF;
+
+      IF v_attribution_turn_id IS NOT NULL THEN
+        SELECT
+          CASE WHEN octet_length(t.initiator_subject_id) <= 1024 THEN
+            jsonb_strip_nulls(jsonb_build_object(
+              'kind', t.initiator_kind,
+              'subjectId', t.initiator_subject_id,
+              'label', CASE
+                WHEN jsonb_typeof(t.initiator_context -> 'label') = 'string'
+                THEN left(t.initiator_context ->> 'label', 256)
+                ELSE NULL
+              END
+            ))
+          ELSE NULL END,
+          jsonb_strip_nulls(jsonb_build_object(
+            'label', CASE
+              WHEN jsonb_typeof(t.initiator_context -> 'label') = 'string'
+              THEN left(t.initiator_context ->> 'label', 256)
+              ELSE NULL
+            END,
+            'backfill', CASE
+              WHEN jsonb_typeof(t.initiator_context -> 'backfill') = 'boolean'
+              THEN t.initiator_context -> 'backfill'
+              ELSE NULL
+            END,
+            'attributionOmitted', CASE
+              WHEN octet_length(t.initiator_subject_id) > 1024 THEN 'subject_id_too_large'
+              ELSE NULL
+            END
+          )),
+          t.source
+        INTO v_initiator, v_context, v_origin
+        FROM %1$I.session_turns t
+        WHERE t.account_id = NEW.account_id
+          AND t.workspace_id = NEW.workspace_id
+          AND t.session_id = NEW.session_id
+          AND t.id = v_attribution_turn_id;
+      ELSIF NEW.type = 'session.created' THEN
+        SELECT
+          CASE WHEN octet_length(s.created_by_subject_id) <= 1024 THEN
+            jsonb_strip_nulls(jsonb_build_object(
+              'kind', s.created_by_kind,
+              'subjectId', s.created_by_subject_id,
+              'label', CASE
+                WHEN jsonb_typeof(s.created_by_context -> 'label') = 'string'
+                THEN left(s.created_by_context ->> 'label', 256)
+                ELSE NULL
+              END
+            ))
+          ELSE NULL END,
+          jsonb_strip_nulls(jsonb_build_object(
+            'label', CASE
+              WHEN jsonb_typeof(s.created_by_context -> 'label') = 'string'
+              THEN left(s.created_by_context ->> 'label', 256)
+              ELSE NULL
+            END,
+            'backfill', CASE
+              WHEN jsonb_typeof(s.created_by_context -> 'backfill') = 'boolean'
+              THEN s.created_by_context -> 'backfill'
+              ELSE NULL
+            END,
+            'attributionOmitted', CASE
+              WHEN octet_length(s.created_by_subject_id) > 1024 THEN 'subject_id_too_large'
+              ELSE NULL
+            END
+          )),
+          NULL
+        INTO v_initiator, v_context, v_origin
+        FROM %1$I.sessions s
+        WHERE s.workspace_id = NEW.workspace_id AND s.id = NEW.session_id;
+      END IF;
+
+      v_source_payload_bytes := octet_length(NEW.payload::text);
+      v_export_payload := NEW.payload;
+      v_export_payload_codec_version := NEW.payload_codec_version;
+      IF v_source_payload_bytes > 65536 THEN
+        v_export_payload := jsonb_build_object(
+          '_hostExport', jsonb_build_object(
+            'payloadMode', 'summary',
+            'payloadTruncated', true,
+            'originalBytes', v_source_payload_bytes,
+            'sourceEventId', NEW.id,
+            'fullPayload', 'retained in canonical session event'
+          ),
+          'preview', '[host-export payload omitted at bounded projection boundary]'
+        );
+        -- The projection is literal PostgreSQL JSON, not an application-codec
+        -- envelope. Preserve codec truth only when the original payload is kept.
+        v_export_payload_codec_version := NULL;
+      END IF;
+
+      v_payload_bytes := octet_length(v_export_payload::text)
+        + octet_length(NEW.type)
+        + coalesce(octet_length(NEW.client_event_id), 0)
+        + coalesce(octet_length(NEW.turn_association), 0)
+        + coalesce(octet_length(NEW.duplicate_reason), 0)
+        + octet_length(coalesce(v_initiator, 'null'::jsonb)::text)
+        + octet_length(v_context::text)
+        + 768;
+      INSERT INTO %1$I.host_export_outbox (
+        export_kind, source_id, account_id, workspace_id, session_id,
+        turn_id, turn_generation, turn_attempt_id, session_sequence,
+        client_event_id, turn_association, duplicate_of_event_id, duplicate_reason,
+        event_type, idempotency_key, initiator, initiator_context, origin,
+        payload, payload_codec_version, envelope_bytes, occurred_at,
+        source_recorded_at, enqueued_at
+      ) VALUES (
+        'session_event', NEW.id, NEW.account_id, NEW.workspace_id, NEW.session_id,
+        NEW.turn_id, NEW.turn_generation, NEW.turn_attempt_id, NEW.sequence,
+        NEW.client_event_id, NEW.turn_association, NEW.duplicate_of_event_id,
+        NEW.duplicate_reason,
+        NEW.type, 'session_event:' || NEW.id::text, v_initiator,
+        coalesce(v_context, '{}'::jsonb), v_origin, v_export_payload,
+        v_export_payload_codec_version, greatest(1, v_payload_bytes), NEW.occurred_at,
+        NEW.created_at, clock_timestamp()
+      )
+      ON CONFLICT (export_kind, source_id) DO NOTHING;
+      RETURN NEW;
+    END $function$;
+  $create$, target_schema);
+END
+$migration$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "4.3.3-canary.0",
+  "version": "4.3.3-canary.2",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -98,11 +98,11 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codemode": "^0.5.6-canary.0",
-    "@opengeni/codex": "^0.2.22-canary.8",
-    "@opengeni/config": "^1.1.2-canary.0",
-    "@opengeni/contracts": "^3.0.2-canary.0",
-    "@opengeni/network": "^0.3.1-canary.8",
+    "@opengeni/codemode": "^0.5.6-canary.2",
+    "@opengeni/codex": "^0.2.22-canary.10",
+    "@opengeni/config": "^1.1.2-canary.2",
+    "@opengeni/contracts": "^3.0.2-canary.2",
+    "@opengeni/network": "^0.3.1-canary.10",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },

package/src/codex-selection-diagnostics.ts

@@ -0,0 +1,25 @@
+/** Observations about this session, never allocator inputs or failover policy. */
+export function codexSelectionDiagnostics(input: {
+  previousCredentialId: string | null;
+  credentialId: string;
+  reusedLease: boolean;
+  pinnedCredentialId: string | null;
+  pinSource?: "manual" | "policy" | null;
+}) {
+  const transition =
+    input.previousCredentialId === input.credentialId
+      ? ("unchanged" as const)
+      : input.previousCredentialId === null
+        ? ("assigned" as const)
+        : ("switched" as const);
+  const source =
+    input.pinnedCredentialId === input.credentialId && input.pinSource !== "policy"
+      ? ("manual_pin" as const)
+      : ("allocator" as const);
+  const reason = input.reusedLease
+    ? ("lease_reused" as const)
+    : transition === "unchanged"
+      ? ("affinity_reused" as const)
+      : transition;
+  return { transition, source, reason };
+}

package/src/computer-sessions.ts

@@ -504,7 +504,11 @@ export async function prepareComputerSessionCreate(
           state: "prepared",
           actorSubjectId: input.actorSubjectId,
         })
-        .onConflictDoNothing({ target: schema.interactionOperations.operationId })
+        // The operation also has a workspace/operation unique index. Concurrent
+        // speculative inserts can collide there even when the primary-key
+        // arbiter would deduplicate them. Arbitrate every constraint, then use
+        // the scoped lookup and immutable request checks below to authorize replay.
+        .onConflictDoNothing()
         .returning();
       if (!insertedOperation) {
         const existing = await loadOperation(tx, input.workspaceId, input.operationId);