@opengeni/runtime 2.4.2-canary.1 → 2.4.3-canary.0

package/dist/index.js

@@ -244,7 +244,7 @@ import {
   workspaceEnvironmentInstructions,
   wrapAttemptToolDefinitions,
   wrapAttemptToolExecute
-} from "./chunk-D3NTOAWT.js";
+} from "./chunk-P5AEIDAS.js";
 import {
   ActiveBackendUnresolvableError,
   BROWSER_CONTROL_ADMIN_TOKEN_FILE,
@@ -514,7 +514,7 @@ import {
   withRunCredentialsClient,
   withRunCredentialsSession,
   withoutSandboxProviderIdentity
-} from "./chunk-7DAVK6Y5.js";
+} from "./chunk-WATBACLT.js";
 import "./chunk-YRKIQK25.js";
 import {
   SKILL_MAX_FILES,

package/dist/sandbox/index.js

@@ -265,7 +265,7 @@ import {
   withRunCredentialsClient,
   withRunCredentialsSession,
   withoutSandboxProviderIdentity
-} from "../chunk-7DAVK6Y5.js";
+} from "../chunk-WATBACLT.js";
 import "../chunk-YRKIQK25.js";
 import "../chunk-ORKCCH5X.js";
 import "../chunk-PZ5AY32C.js";

package/dist/sandbox/providers/modal-command-control.d.ts

@@ -24,11 +24,12 @@ export type ModalProviderOutputPage = {
  * returned locator/cursors outside the command's write authority. */
 export declare class ModalCommandControl {
     private readonly client;
-    private readonly sandboxId;
+    private readonly sandboxIdentity;
     private readonly root;
     private readonly environment;
     private constructor();
-    static forSandbox(client: CommandClient, sandboxId: string, root: string, environment?: Record<string, string> | (() => Record<string, string>)): ModalCommandControl;
+    static forSandbox(client: CommandClient, sandboxId: string | (() => string), root: string, environment?: Record<string, string> | (() => Record<string, string>)): ModalCommandControl;
+    private get sandboxId();
     start(args: ChannelAExecArgs, signal?: AbortSignal): Promise<ModalProviderCommand>;
     read(command: ModalProviderCommand, yieldTimeMs: number, signal?: AbortSignal): Promise<ModalProviderOutputPage>;
     write(command: ModalProviderCommand, chars: string, messageIndex: number): Promise<void>;

package/dist/workspace-tool-gateway.js

@@ -1,7 +1,7 @@
 import {
   prepareAgentTools
-} from "./chunk-D3NTOAWT.js";
-import "./chunk-7DAVK6Y5.js";
+} from "./chunk-P5AEIDAS.js";
+import "./chunk-WATBACLT.js";
 import "./chunk-YRKIQK25.js";
 import "./chunk-7K6WOXFS.js";
 import "./chunk-UZ66CGC2.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/runtime",
-  "version": "2.4.2-canary.1",
+  "version": "2.4.3-canary.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -62,16 +62,16 @@
     "@openai/agents": "0.14.3",
     "@openai/agents-core": "0.14.3",
     "@openai/agents-extensions": "0.14.3",
-    "@opengeni/agent-proto": "^0.5.1-canary.21",
-    "@opengeni/capabilities": "^0.3.3-canary.3",
-    "@opengeni/codemode": "^0.5.2-canary.1",
-    "@opengeni/codex": "^0.2.22-canary.3",
-    "@opengeni/config": "^1.0.3-canary.1",
-    "@opengeni/contracts": "^2.15.1-canary.1",
-    "@opengeni/network": "^0.3.1-canary.3",
-    "@opengeni/sdk": "^4.0.1-canary.1",
-    "@opengeni/tool-gateway": "^0.1.3-canary.1",
-    "@opengeni/xai-subscription": "^0.1.4-canary.3",
+    "@opengeni/agent-proto": "^0.5.1-canary.23",
+    "@opengeni/capabilities": "^0.3.3-canary.5",
+    "@opengeni/codemode": "^0.5.3-canary.0",
+    "@opengeni/codex": "^0.2.22-canary.5",
+    "@opengeni/config": "^1.0.4-canary.0",
+    "@opengeni/contracts": "^2.15.2-canary.0",
+    "@opengeni/network": "^0.3.1-canary.5",
+    "@opengeni/sdk": "^4.0.2-canary.0",
+    "@opengeni/tool-gateway": "^0.1.4-canary.0",
+    "@opengeni/xai-subscription": "^0.1.4-canary.5",
     "debug": "4.4.3",
     "modal": "0.9.0",
     "openai": "6.47.0",

package/src/sandbox/providers/modal-command-control.ts

@@ -117,14 +117,14 @@ function decodePage(prior: string, input: Uint8Array[], terminal: boolean) {
 export class ModalCommandControl {
   private constructor(
     private readonly client: ControlPlane,
-    private readonly sandboxId: string,
+    private readonly sandboxIdentity: string | (() => string),
     private readonly root: string,
     private readonly environment: Record<string, string> | (() => Record<string, string>) = {},
   ) {}
 
   static forSandbox(
     client: CommandClient,
-    sandboxId: string,
+    sandboxId: string | (() => string),
     root: string,
     environment: Record<string, string> | (() => Record<string, string>) = {},
   ): ModalCommandControl {
@@ -133,16 +133,24 @@ export class ModalCommandControl {
     return new ModalCommandControl(commandControlPlane(client), sandboxId, root, environment);
   }
 
+  private get sandboxId(): string {
+    return typeof this.sandboxIdentity === "function"
+      ? this.sandboxIdentity()
+      : this.sandboxIdentity;
+  }
+
   async start(args: ChannelAExecArgs, signal?: AbortSignal): Promise<ModalProviderCommand> {
     signal?.throwIfAborted();
     const workdir = posix.resolve(this.root, args.workdir ?? this.root);
     if (workdir !== this.root && !workdir.startsWith(`${this.root.replace(/\/$/u, "")}/`))
       throw new Error("Command workdir is outside the sandbox workspace");
-    const task = await this.client.sandboxGetTaskId(
-      { sandboxId: this.sandboxId },
-      signal ? { signal } : undefined,
-    );
+    // Hydration replaces the SDK sandbox. Freeze its current identity for this
+    // start so an asynchronous replacement cannot relabel the returned locator.
+    const sandboxId = this.sandboxId;
+    const task = await this.client.sandboxGetTaskId({ sandboxId }, signal ? { signal } : undefined);
     if (!task.taskId || task.taskResult) throw new Error("Modal command task is unavailable");
+    if (sandboxId !== this.sandboxId)
+      throw new Error("Modal sandbox changed during command preparation");
     const login = args.shell ? (args.login ?? true) : false;
     let command = [args.shell ?? "/bin/sh", login ? "-lc" : "-c", args.cmd];
     if (args.runAs) {
@@ -194,7 +202,7 @@ export class ModalCommandControl {
     if (!result.execId) throw new Error("Modal command start returned no execution identity");
     return {
       kind: "modal-control-v1",
-      sandboxId: this.sandboxId,
+      sandboxId,
       taskId: task.taskId,
       execId: result.execId,
       ...(args.tty ? { pty: true } : {}),

package/src/sandbox/providers/modal.ts

@@ -562,7 +562,11 @@ export function installOpenGeniModalSnapshotPolicy<T extends object>(session: T)
           profile: mutable.modal.profile,
           ...(mutable.modal.logger ? { logger: mutable.modal.logger } : {}),
         },
-        mutable.state.sandboxId,
+        () => {
+          const sandboxId = mutable.state?.sandboxId;
+          if (!sandboxId) throw new Error("Modal session sandbox identity is unavailable");
+          return sandboxId;
+        },
         mutable.state.manifest.root,
         () => mutable.state?.environment ?? {},
       ),