@opengeni/runtime 0.2.2 → 0.3.0

package/dist/{chunk-2PO56VAL.js → chunk-D5KU3QUC.js}

@@ -202,6 +202,23 @@ var localProvider = {
 // src/sandbox/providers/modal.ts
 import { ModalImageSelector, ModalSandboxClient } from "@openai/agents-extensions/sandbox/modal";
 import { effectiveModalIdleTimeoutSeconds } from "@opengeni/config";
+var MODAL_ORPHAN_SWEEP_LIMIT = 50;
+var MODAL_UNATTRIBUTED_ORPHAN_GRACE_MS = 30 * 6e4;
+function modalSandboxAttributionEnvironment(input) {
+  return {
+    OPENGENI_SANDBOX_LEASE_ID: input.leaseId,
+    OPENGENI_SANDBOX_GROUP_ID: input.sandboxGroupId,
+    OPENGENI_WORKSPACE_ID: input.workspaceId
+  };
+}
+function modalSandboxAttributionTags(input) {
+  return {
+    opengeni: "true",
+    opengeni_lease_id: input.leaseId,
+    opengeni_workspace_id: input.workspaceId,
+    opengeni_sandbox_group_id: input.sandboxGroupId
+  };
+}
 var modalProvider = {
   backend: "modal",
   descriptor: CAPABILITY_DESCRIPTORS.modal,
@@ -220,8 +237,13 @@ var modalProvider = {
     const options = {
       appName: settings.modalAppName,
       timeoutMs: settings.modalTimeoutSeconds * 1e3,
+      sandboxCreateTimeoutS: Math.ceil(settings.sandboxWarmingTimeoutMs / 1e3),
       exposedPorts,
-      env: environment
+      env: environment,
+      // The Modal JS SDK's sandbox default command already sleeps until timeout
+      // or explicit termination. Do not let the Agents extension stamp a separate
+      // hardcoded sleep command; OPENGENI_MODAL_TIMEOUT_SECONDS owns lifetime.
+      useSleepCmd: false
     };
     options.idleTimeoutMs = effectiveModalIdleTimeoutSeconds(settings) * 1e3;
     if (settings.modalWorkspacePersistence) {
@@ -242,6 +264,137 @@ var modalProvider = {
     return new ModalSandboxClient(options);
   }
 };
+function modalClientOptions(settings) {
+  return {
+    ...settings.modalTokenId ? { tokenId: settings.modalTokenId } : {},
+    ...settings.modalTokenSecret ? { tokenSecret: settings.modalTokenSecret } : {},
+    ...settings.modalEnvironment ? { environment: settings.modalEnvironment } : {},
+    ...settings.modalTimeoutSeconds ? { timeoutMs: settings.modalTimeoutSeconds * 1e3 } : {}
+  };
+}
+async function createModalClient(settings) {
+  const modal = await import("modal");
+  return new modal.ModalClient(modalClientOptions(settings));
+}
+async function tagModalSandbox(settings, sandboxId, attribution) {
+  if (!sandboxId) {
+    return false;
+  }
+  const modal = await createModalClient(settings);
+  try {
+    const sandbox = await modal.sandboxes.fromId(sandboxId);
+    await sandbox.setTags(modalSandboxAttributionTags(attribution));
+    return true;
+  } finally {
+    modal.close();
+  }
+}
+async function terminateModalSandboxById(settings, sandboxId) {
+  if (!sandboxId) {
+    return true;
+  }
+  const modal = await createModalClient(settings);
+  try {
+    const sandbox = await modal.sandboxes.fromId(sandboxId);
+    await sandbox.terminate();
+    return true;
+  } finally {
+    modal.close();
+  }
+}
+function tagsFromInfo(info) {
+  const tags = {};
+  for (const tag of info.tags ?? []) {
+    if (typeof tag.tagName === "string" && typeof tag.tagValue === "string") {
+      tags[tag.tagName] = tag.tagValue;
+    }
+  }
+  return tags;
+}
+function sandboxCreatedAtMs(info) {
+  if (typeof info.createdAt !== "number" || !Number.isFinite(info.createdAt) || info.createdAt <= 0) {
+    return null;
+  }
+  return info.createdAt < 1e10 ? Math.floor(info.createdAt * 1e3) : Math.floor(info.createdAt);
+}
+function attributionKey(input) {
+  return `${input.workspaceId}:${input.sandboxGroupId}:${input.leaseId}`;
+}
+async function sweepModalOrphanSandboxes(settings, liveLeases, options = {}) {
+  const nowMs = options.now?.getTime() ?? Date.now();
+  const maxTerminations = options.maxTerminations ?? MODAL_ORPHAN_SWEEP_LIMIT;
+  const unattributedGraceMs = options.unattributedGraceMs ?? MODAL_UNATTRIBUTED_ORPHAN_GRACE_MS;
+  const liveByAttribution = new Map(liveLeases.map((lease) => [attributionKey(lease), lease]));
+  const ownedClient = options.client ? null : await createModalClient(settings);
+  const modal = options.client ?? ownedClient;
+  try {
+    const app = await modal.apps.fromName(settings.modalAppName, {
+      createIfMissing: false,
+      ...settings.modalEnvironment ? { environment: settings.modalEnvironment } : {}
+    });
+    const appId = app.appId;
+    if (!appId) {
+      return { examined: 0, terminated: [], skipped: 0 };
+    }
+    let examined = 0;
+    let skipped = 0;
+    const terminated = [];
+    let beforeTimestamp;
+    while (terminated.length < maxTerminations) {
+      const response = await modal.cpClient.sandboxList({
+        appId,
+        ...beforeTimestamp !== void 0 ? { beforeTimestamp } : {},
+        includeFinished: false,
+        ...settings.modalEnvironment ? { environmentName: settings.modalEnvironment } : {},
+        tags: []
+      });
+      const sandboxes = response.sandboxes ?? [];
+      if (sandboxes.length === 0) {
+        break;
+      }
+      for (const info of sandboxes) {
+        examined += 1;
+        const tags = tagsFromInfo(info);
+        const leaseId = tags.opengeni_lease_id;
+        const workspaceId = tags.opengeni_workspace_id;
+        const sandboxGroupId = tags.opengeni_sandbox_group_id;
+        let reason = null;
+        if (leaseId && workspaceId && sandboxGroupId) {
+          const live = liveByAttribution.get(attributionKey({ leaseId, workspaceId, sandboxGroupId }));
+          if (!live || live.instanceId && live.instanceId !== info.id) {
+            reason = "stale_attribution";
+          }
+        } else {
+          const createdAtMs = sandboxCreatedAtMs(info);
+          if (createdAtMs !== null && nowMs - createdAtMs >= unattributedGraceMs) {
+            reason = "unattributed";
+          }
+        }
+        if (!reason) {
+          skipped += 1;
+          continue;
+        }
+        try {
+          const sandbox = await modal.sandboxes.fromId(info.id);
+          await sandbox.terminate();
+          terminated.push({ sandboxId: info.id, reason, tags });
+        } catch {
+          skipped += 1;
+        }
+        if (terminated.length >= maxTerminations) {
+          break;
+        }
+      }
+      beforeTimestamp = sandboxes[sandboxes.length - 1]?.createdAt;
+      if (beforeTimestamp === void 0) {
+        break;
+      }
+    }
+    return { examined, terminated, skipped };
+  } finally {
+    ownedClient?.close();
+  }
+}
 
 // src/sandbox/providers/none.ts
 var noneProvider = {
@@ -757,16 +910,24 @@ var SelfhostedSession = class {
   /** Computer-use VIEW op: capture a single PNG screenshot of the machine's desktop
    *  plus its geometry (via ScreenCaptureKit / x11). NOT consent-gated (a view op —
    *  the view/control decoupling), so it works with a display but no screen-control
-   *  consent. Returns the raw encoded bytes + width/height. */
+   *  consent. Returns the raw encoded bytes + the ENCODED width/height, plus the
+   *  NATIVE (pre-downscale) geometry: when the agent had to downscale the PNG to fit
+   *  the transport's max payload, `nativeWidth`/`nativeHeight` carry the original
+   *  capture size so the computer-use layer can scale model clicks (in encoded-pixel
+   *  space) back to native pixels. An older agent leaves them 0 → read as "same as
+   *  width/height" (no downscale). */
   async screenshot() {
     const result = await this.call({ $case: "desktopScreenshot", desktopScreenshot: {} });
     if (result.$case !== "desktopScreenshot") {
       throw new Error(`selfhosted screenshot: unexpected result ${result.$case}`);
     }
+    const s = result.desktopScreenshot;
     return {
-      png: result.desktopScreenshot.png,
-      width: result.desktopScreenshot.width,
-      height: result.desktopScreenshot.height
+      png: s.png,
+      width: s.width,
+      height: s.height,
+      nativeWidth: s.nativeWidth || s.width,
+      nativeHeight: s.nativeHeight || s.height
     };
   }
   /** A cheap liveness probe — request a Ping on the subject; returns true iff a
@@ -1343,13 +1504,16 @@ async function verifyStreamToken(secret, token, nowSeconds = Math.floor(Date.now
 // src/sandbox/display-stack.ts
 import { DESKTOP_STREAM_PORT as DESKTOP_STREAM_PORT4 } from "@opengeni/contracts";
 var STREAM_PORT = DESKTOP_STREAM_PORT4;
-var DISPLAY_STACK_TIMEOUT_MS = 6e4;
+var DISPLAY_STACK_TIMEOUT_MS = 9e4;
+var PAINT_PROBE_ATTEMPTS = 150;
+var PAINT_PROBE_INTERVAL_S = 0.2;
+var PAINT_MIN_BYTES = 6e4;
 var DEFAULT_DESKTOP_GEOMETRY = { width: 1280, height: 800, dpi: 96 };
 var DisplayStackError = class extends Error {
   exitCode;
   stage;
   constructor(exitCode, output) {
-    const stage = exitCode === 11 ? "xvfb" : exitCode === 12 ? "x11vnc" : exitCode === 13 ? "websockify" : "unknown";
+    const stage = exitCode === 11 ? "xvfb" : exitCode === 12 ? "x11vnc" : exitCode === 13 ? "websockify" : exitCode === 14 ? "paint" : "unknown";
     super(`desktop display stack failed at stage "${stage}" (exit ${exitCode})${output ? `:
 ${output}` : ""}`);
     this.name = "DisplayStackError";
@@ -1367,7 +1531,9 @@ function buildDisplayStackScript(options = {}) {
   const geometry = options.geometry ?? DEFAULT_DESKTOP_GEOMETRY;
   const port = options.port ?? DESKTOP_STREAM_PORT4;
   const env = `DESKTOP_W=${geometry.width} DESKTOP_H=${geometry.height} DESKTOP_DPI=${geometry.dpi} STREAM_PORT=${port}`;
-  return `if nc -z 127.0.0.1 ${port} >/dev/null 2>&1 && nc -z 127.0.0.1 5900 >/dev/null 2>&1; then echo "OPENGENI_DESKTOP_UP port=${port} geometry=${geometry.width}x${geometry.height} dpi=${geometry.dpi} (precheck)"; else mkdir -p /tmp/opengeni-desktop && flock -w 45 /tmp/opengeni-desktop/up.outer.lock env ${env} opengeni-desktop-up; fi`;
+  const bringUp = `if nc -z 127.0.0.1 ${port} >/dev/null 2>&1 && nc -z 127.0.0.1 5900 >/dev/null 2>&1; then echo "OPENGENI_DESKTOP_UP port=${port} geometry=${geometry.width}x${geometry.height} dpi=${geometry.dpi} (precheck)"; else mkdir -p /tmp/opengeni-desktop && flock -w 45 /tmp/opengeni-desktop/up.outer.lock env ${env} opengeni-desktop-up; fi`;
+  const paintProbe = `p=/tmp/opengeni-desktop/paint-probe.png; for i in $(seq 1 ${PAINT_PROBE_ATTEMPTS}); do if DISPLAY=:0 scrot -o "$p" >/dev/null 2>&1; then sz=$(wc -c < "$p" 2>/dev/null || echo 0); else sz=0; fi; rm -f "$p"; if [ "$sz" -ge ${PAINT_MIN_BYTES} ]; then break; fi; if [ "$i" = "${PAINT_PROBE_ATTEMPTS}" ]; then echo "OPENGENI_DESKTOP_NOT_PAINTING scrot below ${PAINT_MIN_BYTES}B after warmup (last=$sz)"; exit 14; fi; sleep ${PAINT_PROBE_INTERVAL_S}; done`;
+  return `mkdir -p /tmp/opengeni-desktop; { ${bringUp} ; } && { ${paintProbe} ; }`;
 }
 function execResultOutput(result) {
   if (typeof result === "string") {
@@ -1382,6 +1548,9 @@ function execResultExitCode(result) {
   return typeof result.exitCode === "number" ? result.exitCode : null;
 }
 function inferExitFromOutput(output) {
+  if (/OPENGENI_DESKTOP_NOT_PAINTING/.test(output)) {
+    return 14;
+  }
   if (/OPENGENI_DESKTOP_UP\b/.test(output)) {
     return 0;
   }
@@ -3289,6 +3458,21 @@ function readInstanceId(session) {
   const candidate = state.sandboxId ?? state.instanceId ?? state.id ?? state.hostId ?? state.containerId;
   return typeof candidate === "string" && candidate.length > 0 ? candidate : "";
 }
+async function terminateCreatedSandbox(client, session, sessionState) {
+  const clientWithDelete = client;
+  if (typeof clientWithDelete.delete === "function" && sessionState !== void 0) {
+    try {
+      await clientWithDelete.delete(sessionState);
+    } catch {
+    }
+    return;
+  }
+  const sess = session;
+  try {
+    await (sess.terminate ?? sess.kill ?? sess.close)?.();
+  } catch {
+  }
+}
 async function establishSandboxSessionFromEnvelope(settings, envelope, opts) {
   const envelopeBackend = typeof envelope?.backendId === "string" ? envelope.backendId : void 0;
   const backend = opts.backendOverride ?? envelopeBackend ?? settings.sandboxBackend;
@@ -3305,32 +3489,60 @@ async function establishSandboxSessionFromEnvelope(settings, envelope, opts) {
   const workspaceArchive = readWorkspaceArchiveFromEnvelopeSessionState(envelopeSessionState);
   const coldRestore = async (resumeFallbackState) => {
     const restored = await client.create({ manifest: createManifest });
+    let restoredState = restored.state;
+    let established = {
+      client,
+      session: restored,
+      sessionState: restoredState ?? resumeFallbackState,
+      instanceId: readInstanceId(restored),
+      backendId: client.backendId
+    };
+    if (opts.onSandboxCreated) {
+      try {
+        await opts.onSandboxCreated(established);
+      } catch (createCallbackError) {
+        await terminateCreatedSandbox(client, restored, restoredState);
+        throw createCallbackError;
+      }
+    }
     if (workspaceArchive) {
       const hydrate = restored.hydrateWorkspace;
       if (typeof hydrate === "function") {
         try {
           await hydrate.call(restored, workspaceArchive);
         } catch (hydrateError) {
-          const restoredState2 = restored.state;
-          const clientWithDelete = client;
-          if (typeof clientWithDelete.delete === "function" && restoredState2 !== void 0) {
-            try {
-              await clientWithDelete.delete(restoredState2);
-            } catch {
-            }
-          } else {
-            const sess = restored;
+          await terminateCreatedSandbox(client, restored, restoredState);
+          throw hydrateError;
+        }
+        const hydratedState = restored.state;
+        const hydratedInstanceId = readInstanceId(restored);
+        if (hydratedInstanceId && hydratedInstanceId !== established.instanceId) {
+          established = {
+            client,
+            session: restored,
+            sessionState: hydratedState ?? resumeFallbackState,
+            instanceId: hydratedInstanceId,
+            backendId: client.backendId
+          };
+          if (opts.onSandboxCreated) {
             try {
-              await (sess.terminate ?? sess.close)?.();
-            } catch {
+              await opts.onSandboxCreated(established);
+            } catch (createCallbackError) {
+              await terminateCreatedSandbox(client, restored, hydratedState);
+              throw createCallbackError;
             }
           }
-          throw hydrateError;
         }
       }
     }
-    const restoredState = restored.state;
-    return { client, session: restored, sessionState: restoredState ?? resumeFallbackState, instanceId: readInstanceId(restored), backendId: client.backendId };
+    restoredState = restored.state;
+    return {
+      client,
+      session: restored,
+      sessionState: restoredState ?? resumeFallbackState,
+      instanceId: readInstanceId(restored),
+      backendId: client.backendId
+    };
   };
   const envelopeProviderState = envelopeSessionState && typeof envelopeSessionState === "object" ? envelopeSessionState.providerState : void 0;
   const hasResumableInstance = Boolean(
@@ -3388,6 +3600,11 @@ export {
   assertDescriptorRegistryInvariants,
   SandboxConfigError,
   SandboxProviderUnavailableError,
+  modalSandboxAttributionEnvironment,
+  modalSandboxAttributionTags,
+  tagModalSandbox,
+  terminateModalSandboxById,
+  sweepModalOrphanSandboxes,
   subjectFor,
   SelfhostedControlError,
   agentErrorToControlError,
@@ -3475,4 +3692,4 @@ export {
   collectSandboxEnvironment2 as collectSandboxEnvironment,
   parseExposedPorts2 as parseExposedPorts
 };
-//# sourceMappingURL=chunk-2PO56VAL.js.map
+//# sourceMappingURL=chunk-D5KU3QUC.js.map