@opengeni/worker-bundle 0.26.0-canary.6 → 0.26.0-canary.7

package/dist/activities/goals.d.ts

@@ -10,7 +10,6 @@ export declare function goalContinuationModelDecision(input: {
     settings: Settings;
     workspaceModelPolicy: Awaited<ReturnType<typeof getWorkspaceModelPolicy>>;
     inheritedModel: string;
-    sessionModel: string;
 }): {
     model: string;
     blocked: string | null;

package/dist/{activities-control-SHMDOQWS.js → activities-control-VMA3XMHE.js}

@@ -33,7 +33,7 @@ import {
   scheduledUserMessagePayload,
   withFirstPartyTools,
   workflowIdForSession
-} from "./chunk-O2LQWJIK.js";
+} from "./chunk-7LS42PHP.js";
 import {
   inspectOpenSandboxKubernetesInventory,
   recordCreditBalanceGauges,
@@ -7410,6 +7410,9 @@ import {
   resolveWorkspaceCodexCompactionDefault,
   SCHEDULED_TASK_OCCURRENCE_PAYLOAD_MAX_BYTES,
   ScheduledTaskRunAcceptedExecution,
+  SessionAgentAccess,
+  SessionEndUser,
+  SessionMemoryScope,
   normalizeAutomaticSessionTitle,
   scheduledOccurrencePayloadUtf8Bytes,
   stableJson,
@@ -7434,6 +7437,7 @@ import {
   enqueueSessionWorkflowWakeIfRunnable,
   failScheduledGeneratedSessionRoute,
   getScheduledTask as getScheduledTask2,
+  getScheduledTaskCreatorPolicy,
   getScheduledTaskRunAcceptedExecution,
   getScheduledTaskRunByProducerKey,
   getScheduledTargetSessionExecution,
@@ -7449,6 +7453,7 @@ import {
   getScheduledScopedRigVersionMetadata,
   getNestedAgentDepthDeploymentPolicy,
   getSessionByCreateIdempotencyKey,
+  getSessionCreationExecutionPolicy,
   getVariableSet,
   isCodexBilledModel,
   initializeSessionStartAtomically,
@@ -7470,7 +7475,11 @@ import {
   withSessionActivityRlsContext
 } from "@opengeni/db";
 import { publishDurableSessionEvents } from "@opengeni/events";
-import { resolveFirstPartyMcpToolPolicy, resolveTurnExecutionPolicyV1 as resolveTurnExecutionPolicyV12 } from "@opengeni/config";
+import {
+  allowedFirstPartyMcpToolsForSession,
+  resolveFirstPartyMcpToolPolicy,
+  resolveTurnExecutionPolicyV1 as resolveTurnExecutionPolicyV12
+} from "@opengeni/config";
 import { Context as Context2 } from "@temporalio/activity";
 import { createHash as createHash5 } from "crypto";
 
@@ -7848,7 +7857,12 @@ function createScheduledTaskActivities(services) {
       let sandboxBackend = task.agentConfig.sandboxBackend ?? settings.sandboxBackend;
       let sandboxOs = "linux";
       const taskTools = withFirstPartyTools(settings, task.agentConfig.tools);
-      const firstPartyMcpTools = resolveFirstPartyMcpToolPolicy(settings).default;
+      const creatorPolicy = await getScheduledTaskCreatorPolicy(db, task.workspaceId, task.id);
+      const firstPartyMcpTools = creatorPolicy?.firstPartyMcpTools ? allowedFirstPartyMcpToolsForSession(settings, creatorPolicy.firstPartyMcpTools) : resolveFirstPartyMcpToolPolicy(settings).default;
+      const firstPartyMcpPermissions = creatorPolicy?.firstPartyMcpPermissions ? [...creatorPolicy.firstPartyMcpPermissions] : [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS];
+      const creatorSessionPolicy = scheduledCreatorSessionPolicyInput(
+        creatorPolicy?.sessionPolicy ?? null
+      );
       const generatedTarget = task.runMode === "new_session_per_run" || task.runMode === "reusable_session" && task.reusableSessionId === null;
       if (generatedTarget && task.agentConfig.machineTarget) {
         const access = {
@@ -8004,7 +8018,7 @@ function createScheduledTaskActivities(services) {
           } : {
             tools: taskTools,
             firstPartyMcpTools,
-            firstPartyMcpPermissions: [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS],
+            firstPartyMcpPermissions,
             variableSetId: acceptedVariableSet?.id ?? null,
             rigId: acceptedRig?.id ?? null,
             rigVersionId: acceptedRig?.activeVersion?.id ?? null,
@@ -8104,7 +8118,7 @@ function createScheduledTaskActivities(services) {
           resolvedSandboxOs: sandboxOs,
           resolvedTools: taskTools,
           resolvedFirstPartyMcpTools: firstPartyMcpTools,
-          resolvedFirstPartyMcpPermissions: [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS],
+          resolvedFirstPartyMcpPermissions: firstPartyMcpPermissions,
           resolvedVariableSet: acceptedVariableSet ? { id: acceptedVariableSet.id, generation: acceptedVariableSet.generation } : null,
           resolvedRig: acceptedRig?.activeVersion ? {
             id: acceptedRig.id,
@@ -8282,7 +8296,8 @@ function createScheduledTaskActivities(services) {
                 resources: task.agentConfig.resources,
                 tools: taskTools,
                 firstPartyMcpTools,
-                firstPartyMcpPermissions: [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS],
+                firstPartyMcpPermissions,
+                ...creatorSessionPolicy,
                 metadata: {
                   ...taskMetadata,
                   model,
@@ -9123,6 +9138,11 @@ async function recoverBoundScheduledTaskDispatch(input) {
     }
     const taskMetadata = { ...task.agentConfig.metadata };
     delete taskMetadata[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];
+    const recoveredCreatorPolicy = await getScheduledTaskCreatorPolicy(
+      input.db,
+      task.workspaceId,
+      task.id
+    );
     const created = await createSessionWithIdempotencyKeyResult(input.db, {
       accountId: task.accountId,
       workspaceId: task.workspaceId,
@@ -9131,6 +9151,7 @@ async function recoverBoundScheduledTaskDispatch(input) {
       tools: input.acceptedExecution.resolvedTools,
       firstPartyMcpTools: input.acceptedExecution.resolvedFirstPartyMcpTools,
       firstPartyMcpPermissions: input.acceptedExecution.resolvedFirstPartyMcpPermissions,
+      ...scheduledCreatorSessionPolicyInput(recoveredCreatorPolicy?.sessionPolicy ?? null),
       metadata: {
         ...taskMetadata,
         model: input.acceptedExecution.resolvedModel,
@@ -9241,6 +9262,11 @@ async function recoverBoundScheduledTaskDispatch(input) {
     }
     const generatedBinding = input.acceptedExecution.generatedSessionBinding;
     const canonicalGeneratedRunId = task.runMode === "reusable_session" && typeof session.metadata.scheduledTaskRunId === "string" ? session.metadata.scheduledTaskRunId : input.run.id;
+    const creationPolicy = await getSessionCreationExecutionPolicy(
+      input.db,
+      task.workspaceId,
+      session.id
+    );
     const expectedTaskMetadata = { ...task.agentConfig.metadata };
     delete expectedTaskMetadata[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];
     const expectedMetadata = {
@@ -9257,7 +9283,7 @@ async function recoverBoundScheduledTaskDispatch(input) {
       label: "OpenGeni scheduler",
       scheduledTaskId: task.id,
       scheduledTaskRunId: canonicalGeneratedRunId
-    }) || task.runMode === "new_session_per_run" && input.acceptedExecution.alertOccurrenceLabels === null && (session.metadata.scheduledTaskRunId !== input.run.id || session.createdByContext.scheduledTaskRunId !== input.run.id) || session.model !== input.acceptedExecution.resolvedModel || session.reasoningEffort !== input.acceptedExecution.resolvedReasoningEffort || session.latencyMode !== input.acceptedExecution.resolvedLatencyMode || session.sandboxBackend !== input.acceptedExecution.resolvedSandboxBackend || session.sandboxOs !== input.acceptedExecution.resolvedSandboxOs || session.activeSandboxId !== (task.agentConfig.machineTarget?.targetSandboxId ?? null) || stableJson(session.resources) !== stableJson(task.agentConfig.resources) || stableJson(session.tools) !== stableJson(input.acceptedExecution.resolvedTools) || stableJson(session.firstPartyMcpTools) !== stableJson(input.acceptedExecution.resolvedFirstPartyMcpTools) || stableJson(session.firstPartyMcpPermissions) !== stableJson(input.acceptedExecution.resolvedFirstPartyMcpPermissions) || session.maxNestedAgentDepthOverride !== (task.agentConfig.maxNestedAgentDepth ?? null) || (session.variableSetId ?? null) !== (input.acceptedExecution.resolvedVariableSet?.id ?? null) || (session.rigId ?? null) !== (input.acceptedExecution.resolvedRig?.id ?? null) || (session.rigVersionId ?? null) !== (input.acceptedExecution.resolvedRig?.versionId ?? null) || scheduledSlackBotConnectionId(session.metadata) !== (frozenSlack?.id ?? null)) {
+    }) || task.runMode === "new_session_per_run" && input.acceptedExecution.alertOccurrenceLabels === null && (session.metadata.scheduledTaskRunId !== input.run.id || session.createdByContext.scheduledTaskRunId !== input.run.id) || creationPolicy?.model !== input.acceptedExecution.resolvedModel || creationPolicy.reasoningEffort !== input.acceptedExecution.resolvedReasoningEffort || creationPolicy.latencyMode !== input.acceptedExecution.resolvedLatencyMode || session.sandboxBackend !== input.acceptedExecution.resolvedSandboxBackend || session.sandboxOs !== input.acceptedExecution.resolvedSandboxOs || session.activeSandboxId !== (task.agentConfig.machineTarget?.targetSandboxId ?? null) || stableJson(session.resources) !== stableJson(task.agentConfig.resources) || stableJson(session.tools) !== stableJson(input.acceptedExecution.resolvedTools) || stableJson(session.firstPartyMcpTools) !== stableJson(input.acceptedExecution.resolvedFirstPartyMcpTools) || stableJson(session.firstPartyMcpPermissions) !== stableJson(input.acceptedExecution.resolvedFirstPartyMcpPermissions) || session.maxNestedAgentDepthOverride !== (task.agentConfig.maxNestedAgentDepth ?? null) || (session.variableSetId ?? null) !== (input.acceptedExecution.resolvedVariableSet?.id ?? null) || (session.rigId ?? null) !== (input.acceptedExecution.resolvedRig?.id ?? null) || (session.rigVersionId ?? null) !== (input.acceptedExecution.resolvedRig?.versionId ?? null) || scheduledSlackBotConnectionId(session.metadata) !== (frozenSlack?.id ?? null)) {
       throw new ScheduledRunTerminalAuthorityError(
         "scheduled_generated_session_changed",
         "scheduled generated session differs from accepted execution"
@@ -9496,6 +9522,17 @@ async function replayScheduledTaskDispatch(input) {
   }
   return result;
 }
+function scheduledCreatorSessionPolicyInput(policy) {
+  if (!policy) return {};
+  const agentAccess = SessionAgentAccess.safeParse(policy.agentAccess);
+  const endUser = SessionEndUser.safeParse(policy.endUser);
+  const memoryScope = SessionMemoryScope.safeParse(policy.memoryScope);
+  return {
+    ...agentAccess.success ? { agentAccess: agentAccess.data } : {},
+    ...endUser.success ? { endUser: endUser.data } : {},
+    ...memoryScope.success ? { memoryScope: memoryScope.data } : {}
+  };
+}
 function knowledgeSourceSyncEffectivelyPaused(task) {
   if (task.status === "paused") return true;
   const value = task.metadata.knowledgeSourceSync;
@@ -10236,4 +10273,4 @@ export {
   createControlActivities,
   createControlActivitiesFromServices
 };
-//# sourceMappingURL=activities-control-SHMDOQWS.js.map
+//# sourceMappingURL=activities-control-VMA3XMHE.js.map