@opengeni/worker-bundle 0.26.0-canary.5 → 0.26.0-canary.7

package/dist/{activities-turn-GHSFZB64.js → activities-turn-57AOUNYN.js}

@@ -84,7 +84,7 @@ import {
   withFirstPartyTools,
   wrapLazyTurnBoxWithRouting,
   wrapTurnBoxWithRouting
-} from "./chunk-O2LQWJIK.js";
+} from "./chunk-7LS42PHP.js";
 import {
   StreamTimingMetrics,
   makeMachineOpObserver,
@@ -116,6 +116,7 @@ import {
 import { createProductionAgentRuntime, summarizeForCompaction as summarizeForCompaction2 } from "@opengeni/runtime";
 
 // src/activities/agent-turn/run.ts
+import { assertModelConnectionAllowsTurn } from "@opengeni/db";
 import {
   setSessionLastInputTokensForTurnAttempt,
   getMaterializedSandboxFileResources as getMaterializedSandboxFileResources3,
@@ -9683,7 +9684,10 @@ function withXaiSubscriptionProvider(settings) {
   return withXaiSubscriptionCatalogProvider(settings);
 }
 async function settingsWithWorkspaceGatewayCredential(db, accountId, workspaceId, settings, retainedProductModelId) {
-  const activeCustomModels = await listWorkspaceGatewayCustomModels(db, { accountId, workspaceId });
+  const activeCustomModels = await listWorkspaceGatewayCustomModels(db, {
+    accountId,
+    workspaceId
+  });
   const retainedUpstreamModelId = retainedProductModelId?.startsWith(
     WORKSPACE_GATEWAY_MODEL_ID_PREFIX
   ) ? retainedProductModelId.slice(WORKSPACE_GATEWAY_MODEL_ID_PREFIX.length) : null;
@@ -9696,7 +9700,12 @@ async function settingsWithWorkspaceGatewayCredential(db, accountId, workspaceId
     (model) => model.upstreamModelId === retainedCustomModel.upstreamModelId
   ) ? [...activeCustomModels, retainedCustomModel] : activeCustomModels;
   const catalogSettings = withWorkspaceGatewayCatalogProvider(settings, customModels);
-  const apiKey = await loadWorkspaceVercelAiGatewayApiKey(db, settings, workspaceId);
+  const apiKey = await loadWorkspaceVercelAiGatewayApiKey(
+    db,
+    settings,
+    workspaceId,
+    retainedProductModelId
+  );
   return apiKey ? withWorkspaceGatewayCredential(catalogSettings, apiKey, customModels) : catalogSettings;
 }
 async function settingsWithWorkspaceOpenRouterCredential(db, accountId, workspaceId, settings, retainedProductModelId) {
@@ -9716,7 +9725,12 @@ async function settingsWithWorkspaceOpenRouterCredential(db, accountId, workspac
     (model) => model.upstreamModelId === retainedCustomModel.upstreamModelId
   ) ? [...activeCustomModels, retainedCustomModel] : activeCustomModels;
   const catalogSettings = withWorkspaceOpenRouterCatalogProvider(settings, customModels);
-  const apiKey = await loadWorkspaceOpenRouterApiKey(db, settings, workspaceId);
+  const apiKey = await loadWorkspaceOpenRouterApiKey(
+    db,
+    settings,
+    workspaceId,
+    retainedProductModelId
+  );
   return apiKey ? withWorkspaceOpenRouterCredential(catalogSettings, apiKey, customModels) : catalogSettings;
 }
 async function settingsWithOrganizationProviderCredentials(db, accountId, workspaceId, settings, retainedProductModelId) {
@@ -10159,6 +10173,7 @@ async function claimTurnAttempt(deps) {
 
 // src/activities/agent-turn/codex-capacity.ts
 import {
+  connectionModelAllowed,
   getSessionGoal as getSessionGoal2,
   acquireCodexCredentialLease,
   CodexCredentialLeaseAttemptFencedError,
@@ -10397,14 +10412,24 @@ async function selectCodexTurnCapacity(deps) {
     const credentialSelectionStartedAt = performance.now();
     let credentialSelectionOutcome = "completed";
     try {
-      const selectForTurn = (context, lockedSessionCodexState2) => selectCodexCredentialLeaseForTurn({
-        context,
-        sessionId: input.sessionId,
-        sessionPinnedCredentialId: lockedSessionCodexState2.pinnedCredentialId,
-        sessionPinSource: lockedSessionCodexState2.pinSource,
-        sessionLastCredentialId: lockedSessionCodexState2.lastCredentialId,
-        now: /* @__PURE__ */ new Date()
-      });
+      const selectForTurn = (context, lockedSessionCodexState2) => {
+        const allowed = context.accounts.filter(
+          (account) => connectionModelAllowed(account.allowedModelIds, deps.turnExecutionPolicy.productModelId)
+        );
+        if (context.accounts.length > 0 && allowed.length === 0)
+          throw new Error("This model is disabled for the connected Codex subscriptions");
+        const sessionPin2 = lockedSessionCodexState2.pinnedCredentialId;
+        if (sessionPin2 && lockedSessionCodexState2.pinSource !== "policy" && context.accounts.some((account) => account.id === sessionPin2) && !allowed.some((account) => account.id === sessionPin2))
+          throw new Error("This model is disabled for the pinned Codex subscription");
+        return selectCodexCredentialLeaseForTurn({
+          context: { ...context, accounts: allowed },
+          sessionId: input.sessionId,
+          sessionPinnedCredentialId: lockedSessionCodexState2.pinnedCredentialId,
+          sessionPinSource: lockedSessionCodexState2.pinSource,
+          sessionLastCredentialId: lockedSessionCodexState2.lastCredentialId,
+          now: /* @__PURE__ */ new Date()
+        });
+      };
       let leaseAcquisitionStartedAtMs = performance.now();
       let leased = await acquireCodexCredentialLease(
         db,
@@ -13552,6 +13577,7 @@ async function bindLazySandboxProvisioner(deps) {
 }
 
 // src/activities/agent-turn/xai-capacity.ts
+import { connectionModelAllowed as connectionModelAllowed2 } from "@opengeni/db";
 import {
   getSessionGoal as getSessionGoal3,
   acquireXaiCredentialLease,
@@ -13601,6 +13627,7 @@ async function selectXaiTurnCapacity(deps) {
       authoritySnapshot
     });
     const leased = await acquireXaiCredentialLease(db, {
+      modelId: deps.turnExecutionPolicy.productModelId,
       accountId: input.accountId,
       workspaceId: input.workspaceId,
       subjectId,
@@ -13619,6 +13646,14 @@ async function selectXaiTurnCapacity(deps) {
     leases.xai.confirmedUntilMs = leased.leasedUntil ? leaseStartedAtMs + XAI_CREDENTIAL_LEASE_TTL_MS2 : null;
     leases.xai.held = providerTurn.effectiveXaiCredentialId !== null && leased.holderId !== null && leased.generation !== null && leases.xai.confirmedUntilMs !== null;
     if (!providerTurn.effectiveXaiCredentialId) {
+      const relevant = sessionPin?.pinnedCredentialId && sessionPin.pinSource !== "policy" ? leased.accounts.filter((account) => account.id === sessionPin.pinnedCredentialId) : leased.accounts;
+      if (relevant.length > 0 && relevant.every(
+        (account) => !connectionModelAllowed2(
+          account.allowedModelIds,
+          deps.turnExecutionPolicy.productModelId
+        )
+      ))
+        throw new Error("This model is disabled for the selected SuperGrok subscription");
       const connected = leased.accounts.length;
       const allocatorEnabled = leased.accounts.filter((account) => account.allocatorEnabled).length;
       if (connected === 0) {
@@ -14672,6 +14707,7 @@ async function prepareRunCredentials(deps) {
 }
 
 // src/activities/agent-turn/tool-environment.ts
+import { getWorkspaceConnectionModelRestrictions } from "@opengeni/db";
 import {
   beginConnectorActionExecution,
   completeConnectorActionExecution,
@@ -16879,6 +16915,7 @@ async function prepareTurnToolRuntime(deps) {
         const currentSettings = currentCatalog.settings;
         const xaiReadinessAuthority = xaiCatalogReadinessAuthority(turn, credentialSubjectId);
         const [
+          connectionModelRestrictions,
           policy,
           codexSubscriptionActive,
           xaiSubscriptionActive,
@@ -16891,6 +16928,12 @@ async function prepareTurnToolRuntime(deps) {
           organizationOpenRouterConnectionActive,
           organizationOpenRouterCustomModels
         ] = await Promise.all([
+          getWorkspaceConnectionModelRestrictions(
+            db,
+            input.workspaceId,
+            xaiReadinessAuthority?.subjectId ?? credentialSubjectId ?? "worker:model-access",
+            xaiReadinessAuthority?.authoritySnapshot
+          ),
           getWorkspaceModelPolicy2(db, input.workspaceId),
           workspaceCodexSubscriptionActive3(db, currentSettings, input.workspaceId),
           xaiReadinessAuthority && currentSettings.supergrokSubscriptionEnabled ? workspaceXaiSubscriptionActiveForAuthority(db, currentSettings, {
@@ -16930,6 +16973,7 @@ async function prepareTurnToolRuntime(deps) {
         ]);
         return {
           selections: resolveWorkspaceModelSelection({
+            connectionModelRestrictions,
             settings: currentSettings,
             policy,
             codexSubscriptionActive,
@@ -19377,6 +19421,13 @@ function createRunAgentTurnActivity(services) {
         requiredGeneratedVideoFiles
       });
       if ("exit" in governance) return governance.exit;
+      await assertModelConnectionAllowsTurn(db, {
+        workspaceId: input.workspaceId,
+        subjectId: turn.initiatingHumanSubjectId ?? "worker:model-access",
+        modelId: turnExecutionPolicy.productModelId,
+        codexCredentialId: providerTurn.effectiveCodexCredentialId,
+        xaiCredentialId: providerTurn.effectiveXaiCredentialId
+      });
       const {
         runtimePreparationStartedAt,
         packRuntime,
@@ -21506,4 +21557,4 @@ export {
   createTurnActivities,
   createTurnActivitiesFromServices
 };
-//# sourceMappingURL=activities-turn-GHSFZB64.js.map
+//# sourceMappingURL=activities-turn-57AOUNYN.js.map