@opengeni/runtime 2.4.2-canary.0 → 2.4.2-canary.2

package/dist/index.js

@@ -244,7 +244,7 @@ import {
   workspaceEnvironmentInstructions,
   wrapAttemptToolDefinitions,
   wrapAttemptToolExecute
-} from "./chunk-23WUCTIT.js";
+} from "./chunk-AJGE4GG3.js";
 import {
   ActiveBackendUnresolvableError,
   BROWSER_CONTROL_ADMIN_TOKEN_FILE,
@@ -514,7 +514,7 @@ import {
   withRunCredentialsClient,
   withRunCredentialsSession,
   withoutSandboxProviderIdentity
-} from "./chunk-72SCUP4B.js";
+} from "./chunk-WATBACLT.js";
 import "./chunk-YRKIQK25.js";
 import {
   SKILL_MAX_FILES,

package/dist/sandbox/index.js

@@ -265,7 +265,7 @@ import {
   withRunCredentialsClient,
   withRunCredentialsSession,
   withoutSandboxProviderIdentity
-} from "../chunk-72SCUP4B.js";
+} from "../chunk-WATBACLT.js";
 import "../chunk-YRKIQK25.js";
 import "../chunk-ORKCCH5X.js";
 import "../chunk-PZ5AY32C.js";

package/dist/sandbox/provider-command-session.d.ts

@@ -24,6 +24,7 @@ export type ProviderCommandSession = {
     getProviderCommandOutput?(result: unknown): ProviderCommandOutput | null;
     acknowledgeCommandOutput?(result: string): Promise<void>;
 };
+export declare const MAX_PROVIDER_COMMAND_HANDLE = 2147483647;
 /** The alias is allocated by serialized workspace mutation admission, not by
  * an SDK instance or a process-writable counter. It remains route-scoped. */
 export declare function withProviderCommandHandle<T>(handle: number | undefined, fn: () => T): T;

package/dist/sandbox/providers/modal-command-control.d.ts

@@ -24,11 +24,12 @@ export type ModalProviderOutputPage = {
  * returned locator/cursors outside the command's write authority. */
 export declare class ModalCommandControl {
     private readonly client;
-    private readonly sandboxId;
+    private readonly sandboxIdentity;
     private readonly root;
     private readonly environment;
     private constructor();
-    static forSandbox(client: CommandClient, sandboxId: string, root: string, environment?: Record<string, string> | (() => Record<string, string>)): ModalCommandControl;
+    static forSandbox(client: CommandClient, sandboxId: string | (() => string), root: string, environment?: Record<string, string> | (() => Record<string, string>)): ModalCommandControl;
+    private get sandboxId();
     start(args: ChannelAExecArgs, signal?: AbortSignal): Promise<ModalProviderCommand>;
     read(command: ModalProviderCommand, yieldTimeMs: number, signal?: AbortSignal): Promise<ModalProviderOutputPage>;
     write(command: ModalProviderCommand, chars: string, messageIndex: number): Promise<void>;

package/dist/sandbox/providers/modal-command-session.d.ts

@@ -1,6 +1,6 @@
 import type { ChannelASession } from "../channel-a.js";
 import { type ProviderCommandSession } from "../provider-command-session.js";
-import { ModalCommandControl } from "./modal-command-control.js";
+import type { ModalCommandControl } from "./modal-command-control.js";
 /** Bridges the SDK's numeric/banner surface to provider-owned execution
  * locators. The local maps are only caches: a fresh adapter can adopt the same
  * handle from protected persistence and replay any unacknowledged page. */

package/dist/workspace-tool-gateway.js

@@ -1,7 +1,7 @@
 import {
   prepareAgentTools
-} from "./chunk-23WUCTIT.js";
-import "./chunk-72SCUP4B.js";
+} from "./chunk-AJGE4GG3.js";
+import "./chunk-WATBACLT.js";
 import "./chunk-YRKIQK25.js";
 import "./chunk-7K6WOXFS.js";
 import "./chunk-UZ66CGC2.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/runtime",
-  "version": "2.4.2-canary.0",
+  "version": "2.4.2-canary.2",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -62,16 +62,16 @@
     "@openai/agents": "0.14.3",
     "@openai/agents-core": "0.14.3",
     "@openai/agents-extensions": "0.14.3",
-    "@opengeni/agent-proto": "^0.5.1-canary.20",
-    "@opengeni/capabilities": "^0.3.3-canary.2",
-    "@opengeni/codemode": "^0.5.2-canary.0",
-    "@opengeni/codex": "^0.2.22-canary.2",
-    "@opengeni/config": "^1.0.3-canary.0",
-    "@opengeni/contracts": "^2.15.1-canary.0",
-    "@opengeni/network": "^0.3.1-canary.2",
-    "@opengeni/sdk": "^4.0.1-canary.0",
-    "@opengeni/tool-gateway": "^0.1.3-canary.0",
-    "@opengeni/xai-subscription": "^0.1.4-canary.2",
+    "@opengeni/agent-proto": "^0.5.1-canary.22",
+    "@opengeni/capabilities": "^0.3.3-canary.4",
+    "@opengeni/codemode": "^0.5.2-canary.2",
+    "@opengeni/codex": "^0.2.22-canary.4",
+    "@opengeni/config": "^1.0.3-canary.2",
+    "@opengeni/contracts": "^2.15.1-canary.2",
+    "@opengeni/network": "^0.3.1-canary.4",
+    "@opengeni/sdk": "^4.0.1-canary.2",
+    "@opengeni/tool-gateway": "^0.1.3-canary.2",
+    "@opengeni/xai-subscription": "^0.1.4-canary.4",
     "debug": "4.4.3",
     "modal": "0.9.0",
     "openai": "6.47.0",

package/src/sandbox/provider-command-session.ts

@@ -30,12 +30,13 @@ export type ProviderCommandSession = {
 };
 
 const admission = new AsyncLocalStorage<number>();
+export const MAX_PROVIDER_COMMAND_HANDLE = 2147483647;
 
 /** The alias is allocated by serialized workspace mutation admission, not by
  * an SDK instance or a process-writable counter. It remains route-scoped. */
 export function withProviderCommandHandle<T>(handle: number | undefined, fn: () => T): T {
   if (handle === undefined) return fn();
-  if (!Number.isSafeInteger(handle) || handle <= 0 || handle > 2147483647)
+  if (!Number.isSafeInteger(handle) || handle <= 0 || handle > MAX_PROVIDER_COMMAND_HANDLE)
     throw new Error("Invalid admitted provider command handle");
   return admission.run(handle, fn);
 }

package/src/sandbox/providers/modal-command-control.ts

@@ -117,14 +117,14 @@ function decodePage(prior: string, input: Uint8Array[], terminal: boolean) {
 export class ModalCommandControl {
   private constructor(
     private readonly client: ControlPlane,
-    private readonly sandboxId: string,
+    private readonly sandboxIdentity: string | (() => string),
     private readonly root: string,
     private readonly environment: Record<string, string> | (() => Record<string, string>) = {},
   ) {}
 
   static forSandbox(
     client: CommandClient,
-    sandboxId: string,
+    sandboxId: string | (() => string),
     root: string,
     environment: Record<string, string> | (() => Record<string, string>) = {},
   ): ModalCommandControl {
@@ -133,16 +133,24 @@ export class ModalCommandControl {
     return new ModalCommandControl(commandControlPlane(client), sandboxId, root, environment);
   }
 
+  private get sandboxId(): string {
+    return typeof this.sandboxIdentity === "function"
+      ? this.sandboxIdentity()
+      : this.sandboxIdentity;
+  }
+
   async start(args: ChannelAExecArgs, signal?: AbortSignal): Promise<ModalProviderCommand> {
     signal?.throwIfAborted();
     const workdir = posix.resolve(this.root, args.workdir ?? this.root);
     if (workdir !== this.root && !workdir.startsWith(`${this.root.replace(/\/$/u, "")}/`))
       throw new Error("Command workdir is outside the sandbox workspace");
-    const task = await this.client.sandboxGetTaskId(
-      { sandboxId: this.sandboxId },
-      signal ? { signal } : undefined,
-    );
+    // Hydration replaces the SDK sandbox. Freeze its current identity for this
+    // start so an asynchronous replacement cannot relabel the returned locator.
+    const sandboxId = this.sandboxId;
+    const task = await this.client.sandboxGetTaskId({ sandboxId }, signal ? { signal } : undefined);
     if (!task.taskId || task.taskResult) throw new Error("Modal command task is unavailable");
+    if (sandboxId !== this.sandboxId)
+      throw new Error("Modal sandbox changed during command preparation");
     const login = args.shell ? (args.login ?? true) : false;
     let command = [args.shell ?? "/bin/sh", login ? "-lc" : "-c", args.cmd];
     if (args.runAs) {
@@ -194,7 +202,7 @@ export class ModalCommandControl {
     if (!result.execId) throw new Error("Modal command start returned no execution identity");
     return {
       kind: "modal-control-v1",
-      sandboxId: this.sandboxId,
+      sandboxId,
       taskId: task.taskId,
       execId: result.execId,
       ...(args.tty ? { pty: true } : {}),

package/src/sandbox/providers/modal-command-session.ts

@@ -1,15 +1,16 @@
 import { randomUUID } from "node:crypto";
 import { truncateOutput } from "@openai/agents-core/sandbox/internal";
 import type { ChannelASession } from "../channel-a";
-import { markTypedExecHandleLoss } from "../exec-banner";
 import { ModalProcessObservationUnavailableError } from "../errors";
+import { markTypedExecHandleLoss, parseExecResponseBanner } from "../exec-banner";
 import {
-  admittedProviderCommandHandle,
+  MAX_PROVIDER_COMMAND_HANDLE,
   type ProviderCommandOutput,
   type ProviderCommandPersistence,
   type ProviderCommandSession,
+  admittedProviderCommandHandle,
 } from "../provider-command-session";
-import { ModalCommandControl, type ModalProviderCommand } from "./modal-command-control";
+import type { ModalCommandControl, ModalProviderCommand } from "./modal-command-control";
 
 type Entry = {
   command: ModalProviderCommand;
@@ -37,11 +38,33 @@ export function installModalCommandSession(
 ): void {
   markTypedExecHandleLoss(session);
   const originalExec = session.execCommand?.bind(session);
+  const originalWrite = session.writeStdin?.bind(session);
   const cancelLegacyStart = session.cancelPendingExecCommand?.bind(session);
   const pendingStarts = new Set<AbortController>();
   const entries = new Map<number, Entry>();
+  // Current SDK setup commands are not retained/admitted commands. Give their
+  // live observer handles a disjoint, adapter-local range; never use a missing
+  // retained alias as permission to poll an unrelated SDK process with that id.
+  const setupHandles = new Map<number, number>();
+  let nextSetupHandle = MAX_PROVIDER_COMMAND_HANDLE + 1;
   const receipts = new Map<string, { handle: number; page: ProviderCommandOutput }>();
 
+  const setupPage = (raw: string, handle: number, sdkHandle: number): string => {
+    const banner = parseExecResponseBanner(raw);
+    if (banner.kind === "exited") {
+      setupHandles.delete(handle);
+      return raw;
+    }
+    if (banner.kind !== "running" || banner.sessionId !== sdkHandle)
+      throw new ModalProcessObservationUnavailableError(handle);
+    // The parser validated the unique status in the metadata header, before
+    // command-controlled Output. Replace only that first trusted status line.
+    return raw.replace(
+      /^Process running with session ID \d+(?=\r?$)/mu,
+      `Process running with session ID ${handle}`,
+    );
+  };
+
   const formatPage = (
     handle: number,
     page: ProviderCommandOutput,
@@ -83,11 +106,17 @@ export function installModalCommandSession(
 
   session.execCommand = async (args) => {
     const handle = admittedProviderCommandHandle();
-    // SDK-internal setup/readiness commands have no mutation admission. They
-    // retain their existing foreground path and never publish durable handles.
+    // Setup/readiness may yield too. Retain only its original local observer,
+    // without publishing a durable locator or replaying its command.
     if (handle === undefined) {
       if (!originalExec) throw new Error("Modal command requires mutation admission");
-      return originalExec(args);
+      if (!Number.isSafeInteger(nextSetupHandle)) throw new Error("Modal setup handles exhausted");
+      const setupHandle = nextSetupHandle++;
+      const raw = await originalExec(args);
+      const banner = parseExecResponseBanner(raw);
+      if (banner.kind !== "running") return raw;
+      setupHandles.set(setupHandle, banner.sessionId);
+      return setupPage(raw, setupHandle, banner.sessionId);
     }
     if (entries.has(handle)) throw new Error("Modal command handle is already bound");
     const cancellation = new AbortController();
@@ -106,7 +135,11 @@ export function installModalCommandSession(
       } catch {
         // Start succeeded. A failed/cancelled first observation must still
         // publish the known locator for durable retention and exact cleanup.
-        return formatPage(handle, { command: entry.command, chunks: [], exitCode: null });
+        return formatPage(handle, {
+          command: entry.command,
+          chunks: [],
+          exitCode: null,
+        });
       }
     } finally {
       pendingStarts.delete(cancellation);
@@ -128,7 +161,7 @@ export function installModalCommandSession(
     return entry ? structuredClone(entry.command) : null;
   };
   session.bindProviderCommand = (handle, command, persistence) => {
-    if (!Number.isSafeInteger(handle) || handle <= 0)
+    if (!Number.isSafeInteger(handle) || handle <= 0 || handle > MAX_PROVIDER_COMMAND_HANDLE)
       throw new Error("Invalid retained Modal command handle");
     const existing = entries.get(handle);
     if (existing && !sameExecution(existing.command, command))
@@ -150,6 +183,11 @@ export function installModalCommandSession(
     receipts.delete(result);
   };
   session.writeStdin = async (args) => {
+    const sdkHandle = setupHandles.get(args.sessionId);
+    if (sdkHandle !== undefined && originalWrite) {
+      const raw = await originalWrite({ ...args, sessionId: sdkHandle });
+      return setupPage(raw, args.sessionId, sdkHandle);
+    }
     const entry = entries.get(args.sessionId);
     if (!entry?.persistence)
       throw new ModalProcessObservationUnavailableError(args.sessionId, {

package/src/sandbox/providers/modal.ts

@@ -562,7 +562,11 @@ export function installOpenGeniModalSnapshotPolicy<T extends object>(session: T)
           profile: mutable.modal.profile,
           ...(mutable.modal.logger ? { logger: mutable.modal.logger } : {}),
         },
-        mutable.state.sandboxId,
+        () => {
+          const sandboxId = mutable.state?.sandboxId;
+          if (!sandboxId) throw new Error("Modal session sandbox identity is unavailable");
+          return sandboxId;
+        },
         mutable.state.manifest.root,
         () => mutable.state?.environment ?? {},
       ),