@opengeni/worker-bundle 0.26.0-canary.6 → 0.26.0-canary.7

package/dist/index.js

@@ -781,7 +781,7 @@ function temporalWorkflowExecutionNotFound(error) {
   return isGrpcServiceError(error) && error.code === 5;
 }
 async function createDefaultWorkerActivities(role, dependencies = {}) {
-  return role === "control" ? (await import("./activities-control-SHMDOQWS.js")).createControlActivities(dependencies) : (await import("./activities-turn-GHSFZB64.js")).createTurnActivities(dependencies);
+  return role === "control" ? (await import("./activities-control-VMA3XMHE.js")).createControlActivities(dependencies) : (await import("./activities-turn-57AOUNYN.js")).createTurnActivities(dependencies);
 }
 function resolveOpenGeniWorkflowDefinition(moduleUrl = import.meta.url) {
   const modulePath = fileURLToPath(moduleUrl).replaceAll("\\", "/");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/worker-bundle",
-  "version": "0.26.0-canary.6",
+  "version": "0.26.0-canary.7",
   "description": "OpenGeni worker entry and reusable embedded lifecycle, shipped with a release-coherent pre-bundled Temporal workflow artifact.",
   "license": "Apache-2.0",
   "repository": {
@@ -54,22 +54,22 @@
   },
   "dependencies": {
     "@llamaindex/liteparse": "2.14.2",
-    "@opengeni/agent-proto": "^0.5.1-canary.16",
-    "@opengeni/capabilities": "^0.3.2-canary.7",
-    "@opengeni/codemode": "^0.4.27-canary.6",
-    "@opengeni/codex": "^0.2.21-canary.6",
-    "@opengeni/config": "^1.0.0-canary.6",
-    "@opengeni/contracts": "^2.13.0-canary.7",
-    "@opengeni/core": "^2.7.5-canary.6",
-    "@opengeni/db": "^4.0.0-canary.6",
-    "@opengeni/documents": "^0.8.19-canary.6",
-    "@opengeni/events": "^0.4.17-canary.6",
-    "@opengeni/github": "^0.7.3-canary.6",
-    "@opengeni/network": "^0.3.0-canary.7",
-    "@opengeni/observability": "^0.8.19-canary.6",
-    "@opengeni/runtime": "^2.3.0-canary.6",
-    "@opengeni/storage": "^0.2.120-canary.6",
-    "@opengeni/xai-subscription": "^0.1.3-canary.6",
+    "@opengeni/agent-proto": "^0.5.1-canary.17",
+    "@opengeni/capabilities": "^0.3.2-canary.8",
+    "@opengeni/codemode": "^0.4.27-canary.7",
+    "@opengeni/codex": "^0.2.21-canary.7",
+    "@opengeni/config": "^1.0.0-canary.7",
+    "@opengeni/contracts": "^2.13.0-canary.8",
+    "@opengeni/core": "^2.7.5-canary.7",
+    "@opengeni/db": "^4.0.0-canary.7",
+    "@opengeni/documents": "^0.8.19-canary.7",
+    "@opengeni/events": "^0.4.17-canary.7",
+    "@opengeni/github": "^0.7.3-canary.7",
+    "@opengeni/network": "^0.3.0-canary.8",
+    "@opengeni/observability": "^0.8.19-canary.7",
+    "@opengeni/runtime": "^2.3.0-canary.7",
+    "@opengeni/storage": "^0.2.120-canary.7",
+    "@opengeni/xai-subscription": "^0.1.3-canary.7",
     "@temporalio/activity": "^1.17.0",
     "@temporalio/client": "^1.17.0",
     "@temporalio/worker": "^1.17.0",

package/src/activities/agent-turn/codex-capacity.ts

@@ -1,4 +1,5 @@
 import {
+  connectionModelAllowed,
   getSessionGoal,
   acquireCodexCredentialLease,
   CodexCredentialLeaseAttemptFencedError,
@@ -126,15 +127,29 @@ export async function selectCodexTurnCapacity(
       const selectForTurn = (
         context: CodexCredentialLeaseSelectionContext,
         lockedSessionCodexState: CodexCredentialLeaseSessionState,
-      ) =>
-        selectCodexCredentialLeaseForTurn({
-          context,
+      ) => {
+        const allowed = context.accounts.filter((account) =>
+          connectionModelAllowed(account.allowedModelIds, deps.turnExecutionPolicy.productModelId),
+        );
+        if (context.accounts.length > 0 && allowed.length === 0)
+          throw new Error("This model is disabled for the connected Codex subscriptions");
+        const sessionPin = lockedSessionCodexState.pinnedCredentialId;
+        if (
+          sessionPin &&
+          lockedSessionCodexState.pinSource !== "policy" &&
+          context.accounts.some((account) => account.id === sessionPin) &&
+          !allowed.some((account) => account.id === sessionPin)
+        )
+          throw new Error("This model is disabled for the pinned Codex subscription");
+        return selectCodexCredentialLeaseForTurn({
+          context: { ...context, accounts: allowed },
           sessionId: input.sessionId,
           sessionPinnedCredentialId: lockedSessionCodexState.pinnedCredentialId,
           sessionPinSource: lockedSessionCodexState.pinSource,
           sessionLastCredentialId: lockedSessionCodexState.lastCredentialId,
           now: new Date(),
         });
+      };
 
       let leaseAcquisitionStartedAtMs = performance.now();
       let leased: CodexCredentialLeaseResult<CodexTurnLeaseDecision> =

package/src/activities/agent-turn/run.ts

@@ -1,3 +1,4 @@
+import { assertModelConnectionAllowsTurn } from "@opengeni/db";
 import {
   setSessionLastInputTokensForTurnAttempt,
   getMaterializedSandboxFileResources,
@@ -468,6 +469,13 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
         requiredGeneratedVideoFiles,
       });
       if ("exit" in governance) return governance.exit;
+      await assertModelConnectionAllowsTurn(db, {
+        workspaceId: input.workspaceId,
+        subjectId: turn.initiatingHumanSubjectId ?? "worker:model-access",
+        modelId: turnExecutionPolicy.productModelId,
+        codexCredentialId: providerTurn.effectiveCodexCredentialId,
+        xaiCredentialId: providerTurn.effectiveXaiCredentialId,
+      });
       const {
         runtimePreparationStartedAt,
         packRuntime,

package/src/activities/agent-turn/tool-environment.ts

@@ -1,3 +1,4 @@
+import { getWorkspaceConnectionModelRestrictions } from "@opengeni/db";
 import {
   beginConnectorActionExecution,
   completeConnectorActionExecution,
@@ -562,6 +563,7 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
         const currentSettings = currentCatalog.settings;
         const xaiReadinessAuthority = xaiCatalogReadinessAuthority(turn, credentialSubjectId);
         const [
+          connectionModelRestrictions,
           policy,
           codexSubscriptionActive,
           xaiSubscriptionActive,
@@ -574,6 +576,12 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
           organizationOpenRouterConnectionActive,
           organizationOpenRouterCustomModels,
         ] = await Promise.all([
+          getWorkspaceConnectionModelRestrictions(
+            db,
+            input.workspaceId,
+            xaiReadinessAuthority?.subjectId ?? credentialSubjectId ?? "worker:model-access",
+            xaiReadinessAuthority?.authoritySnapshot,
+          ),
           getWorkspaceModelPolicy(db, input.workspaceId),
           workspaceCodexSubscriptionActive(db, currentSettings, input.workspaceId),
           xaiReadinessAuthority && currentSettings.supergrokSubscriptionEnabled
@@ -615,6 +623,7 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
         ]);
         return {
           selections: resolveWorkspaceModelSelection({
+            connectionModelRestrictions,
             settings: currentSettings,
             policy,
             codexSubscriptionActive,

package/src/activities/agent-turn/xai-capacity.ts

@@ -1,3 +1,4 @@
+import { connectionModelAllowed } from "@opengeni/db";
 import {
   getSessionGoal,
   acquireXaiCredentialLease,
@@ -55,6 +56,7 @@ export async function selectXaiTurnCapacity(
       authoritySnapshot,
     });
     const leased = await acquireXaiCredentialLease(db, {
+      modelId: deps.turnExecutionPolicy.productModelId,
       accountId: input.accountId,
       workspaceId: input.workspaceId,
       subjectId,
@@ -82,6 +84,21 @@ export async function selectXaiTurnCapacity(
       leased.generation !== null &&
       leases.xai.confirmedUntilMs !== null;
     if (!providerTurn.effectiveXaiCredentialId) {
+      const relevant =
+        sessionPin?.pinnedCredentialId && sessionPin.pinSource !== "policy"
+          ? leased.accounts.filter((account) => account.id === sessionPin.pinnedCredentialId)
+          : leased.accounts;
+      if (
+        relevant.length > 0 &&
+        relevant.every(
+          (account) =>
+            !connectionModelAllowed(
+              account.allowedModelIds,
+              deps.turnExecutionPolicy.productModelId,
+            ),
+        )
+      )
+        throw new Error("This model is disabled for the selected SuperGrok subscription");
       const connected = leased.accounts.length;
       const allocatorEnabled = leased.accounts.filter((account) => account.allocatorEnabled).length;
       if (connected === 0) {

package/src/activities/capabilities.ts

@@ -149,7 +149,10 @@ export async function settingsWithWorkspaceGatewayCredential(
   settings: Settings,
   retainedProductModelId?: string | null,
 ): Promise<Settings> {
-  const activeCustomModels = await listWorkspaceGatewayCustomModels(db, { accountId, workspaceId });
+  const activeCustomModels = await listWorkspaceGatewayCustomModels(db, {
+    accountId,
+    workspaceId,
+  });
   const retainedUpstreamModelId = retainedProductModelId?.startsWith(
     WORKSPACE_GATEWAY_MODEL_ID_PREFIX,
   )
@@ -170,7 +173,12 @@ export async function settingsWithWorkspaceGatewayCredential(
       ? [...activeCustomModels, retainedCustomModel]
       : activeCustomModels;
   const catalogSettings = withWorkspaceGatewayCatalogProvider(settings, customModels);
-  const apiKey = await loadWorkspaceVercelAiGatewayApiKey(db, settings, workspaceId);
+  const apiKey = await loadWorkspaceVercelAiGatewayApiKey(
+    db,
+    settings,
+    workspaceId,
+    retainedProductModelId,
+  );
   return apiKey
     ? withWorkspaceGatewayCredential(catalogSettings, apiKey, customModels)
     : catalogSettings;
@@ -207,7 +215,12 @@ export async function settingsWithWorkspaceOpenRouterCredential(
       ? [...activeCustomModels, retainedCustomModel]
       : activeCustomModels;
   const catalogSettings = withWorkspaceOpenRouterCatalogProvider(settings, customModels);
-  const apiKey = await loadWorkspaceOpenRouterApiKey(db, settings, workspaceId);
+  const apiKey = await loadWorkspaceOpenRouterApiKey(
+    db,
+    settings,
+    workspaceId,
+    retainedProductModelId,
+  );
   return apiKey
     ? withWorkspaceOpenRouterCredential(catalogSettings, apiKey, customModels)
     : catalogSettings;

package/src/activities/goals.ts

@@ -104,7 +104,6 @@ export function createGoalActivities(services: () => Promise<ControlActivityServ
       settings,
       workspaceModelPolicy,
       inheritedModel: inheritedContinuationModel,
-      sessionModel: session.model,
     });
     continuationModel = modelDecision.model;
     let modelPolicyBlocked = modelDecision.blocked;
@@ -207,7 +206,6 @@ export function goalContinuationModelDecision(input: {
   settings: Settings;
   workspaceModelPolicy: Awaited<ReturnType<typeof getWorkspaceModelPolicy>>;
   inheritedModel: string;
-  sessionModel: string;
 }): { model: string; blocked: string | null } {
   const catalogSettings = input.settings.supergrokSubscriptionEnabled
     ? withXaiSubscriptionCatalogProvider(
@@ -224,11 +222,11 @@ export function goalContinuationModelDecision(input: {
       providerId: policyProviderIdForModel(catalogSettings, modelId),
       modelId,
     }).allowed;
-  const candidates = [...new Set([input.inheritedModel, input.sessionModel])];
-  for (const model of candidates) {
-    if (resolveModelProvider(catalogSettings, model) && !policyBlocks(model)) {
-      return { model, blocked: null };
-    }
+  if (
+    resolveModelProvider(catalogSettings, input.inheritedModel) &&
+    !policyBlocks(input.inheritedModel)
+  ) {
+    return { model: input.inheritedModel, blocked: null };
   }
   if (!resolveModelProvider(catalogSettings, input.inheritedModel)) {
     return {

package/src/activities/scheduled-tasks.ts

@@ -7,6 +7,9 @@ import {
   resolveWorkspaceCodexCompactionDefault,
   SCHEDULED_TASK_OCCURRENCE_PAYLOAD_MAX_BYTES,
   ScheduledTaskRunAcceptedExecution,
+  SessionAgentAccess,
+  SessionEndUser,
+  SessionMemoryScope,
   normalizeAutomaticSessionTitle,
   scheduledOccurrencePayloadUtf8Bytes,
   stableJson,
@@ -35,6 +38,7 @@ import {
   enqueueSessionWorkflowWakeIfRunnable,
   failScheduledGeneratedSessionRoute,
   getScheduledTask,
+  getScheduledTaskCreatorPolicy,
   getScheduledTaskRunAcceptedExecution,
   getScheduledTaskRunByProducerKey,
   getScheduledTargetSessionExecution,
@@ -50,6 +54,7 @@ import {
   getScheduledScopedRigVersionMetadata,
   getNestedAgentDepthDeploymentPolicy,
   getSessionByCreateIdempotencyKey,
+  getSessionCreationExecutionPolicy,
   getVariableSet,
   isCodexBilledModel,
   initializeSessionStartAtomically,
@@ -71,7 +76,11 @@ import {
   withSessionActivityRlsContext,
 } from "@opengeni/db";
 import { publishDurableSessionEvents } from "@opengeni/events";
-import { resolveFirstPartyMcpToolPolicy, resolveTurnExecutionPolicyV1 } from "@opengeni/config";
+import {
+  allowedFirstPartyMcpToolsForSession,
+  resolveFirstPartyMcpToolPolicy,
+  resolveTurnExecutionPolicyV1,
+} from "@opengeni/config";
 import { Context } from "@temporalio/activity";
 import { createHash } from "node:crypto";
 import {
@@ -504,7 +513,21 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
       let sandboxBackend = task.agentConfig.sandboxBackend ?? settings.sandboxBackend;
       let sandboxOs: "linux" | "macos" | "windows" = "linux";
       const taskTools = withFirstPartyTools(settings, task.agentConfig.tools);
-      const firstPartyMcpTools = resolveFirstPartyMcpToolPolicy(settings).default;
+      // A task created by a live agent attempt froze its creator's effective
+      // first-party selection, permission set, and session access policy;
+      // its generated sessions inherit that boundary under today's
+      // deployment ceiling. A human/API-created task (null policy) keeps the
+      // deployment default exactly as before.
+      const creatorPolicy = await getScheduledTaskCreatorPolicy(db, task.workspaceId, task.id);
+      const firstPartyMcpTools = creatorPolicy?.firstPartyMcpTools
+        ? allowedFirstPartyMcpToolsForSession(settings, creatorPolicy.firstPartyMcpTools)
+        : resolveFirstPartyMcpToolPolicy(settings).default;
+      const firstPartyMcpPermissions = creatorPolicy?.firstPartyMcpPermissions
+        ? [...creatorPolicy.firstPartyMcpPermissions]
+        : [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS];
+      const creatorSessionPolicy = scheduledCreatorSessionPolicyInput(
+        creatorPolicy?.sessionPolicy ?? null,
+      );
       const generatedTarget =
         task.runMode === "new_session_per_run" ||
         (task.runMode === "reusable_session" && task.reusableSessionId === null);
@@ -700,7 +723,7 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
             : {
                 tools: taskTools,
                 firstPartyMcpTools,
-                firstPartyMcpPermissions: [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS],
+                firstPartyMcpPermissions,
                 variableSetId: acceptedVariableSet?.id ?? null,
                 rigId: acceptedRig?.id ?? null,
                 rigVersionId: acceptedRig?.activeVersion?.id ?? null,
@@ -847,7 +870,7 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
           resolvedSandboxOs: sandboxOs,
           resolvedTools: taskTools,
           resolvedFirstPartyMcpTools: firstPartyMcpTools,
-          resolvedFirstPartyMcpPermissions: [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS],
+          resolvedFirstPartyMcpPermissions: firstPartyMcpPermissions,
           resolvedVariableSet: acceptedVariableSet
             ? { id: acceptedVariableSet.id, generation: acceptedVariableSet.generation }
             : null,
@@ -1059,7 +1082,8 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                 resources: task.agentConfig.resources,
                 tools: taskTools,
                 firstPartyMcpTools,
-                firstPartyMcpPermissions: [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS],
+                firstPartyMcpPermissions,
+                ...creatorSessionPolicy,
                 metadata: {
                   ...taskMetadata,
                   model,
@@ -2068,6 +2092,14 @@ async function recoverBoundScheduledTaskDispatch(input: {
     }
     const taskMetadata = { ...task.agentConfig.metadata };
     delete taskMetadata[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];
+    // Tools and permissions were frozen into the accepted execution. The
+    // creator session policy is immutable on the task row (a tombstoned task
+    // still answers), so re-reading it here is deterministic for the same run.
+    const recoveredCreatorPolicy = await getScheduledTaskCreatorPolicy(
+      input.db,
+      task.workspaceId,
+      task.id,
+    );
     const created = await createSessionWithIdempotencyKeyResult(input.db, {
       accountId: task.accountId,
       workspaceId: task.workspaceId,
@@ -2076,6 +2108,7 @@ async function recoverBoundScheduledTaskDispatch(input: {
       tools: input.acceptedExecution.resolvedTools,
       firstPartyMcpTools: input.acceptedExecution.resolvedFirstPartyMcpTools,
       firstPartyMcpPermissions: input.acceptedExecution.resolvedFirstPartyMcpPermissions,
+      ...scheduledCreatorSessionPolicyInput(recoveredCreatorPolicy?.sessionPolicy ?? null),
       metadata: {
         ...taskMetadata,
         model: input.acceptedExecution.resolvedModel,
@@ -2197,6 +2230,13 @@ async function recoverBoundScheduledTaskDispatch(input: {
       task.runMode === "reusable_session" && typeof session.metadata.scheduledTaskRunId === "string"
         ? session.metadata.scheduledTaskRunId
         : input.run.id;
+    // The public Session policy follows the latest started turn. Recovery must
+    // instead validate the immutable creation binding accepted by this run.
+    const creationPolicy = await getSessionCreationExecutionPolicy(
+      input.db,
+      task.workspaceId,
+      session.id,
+    );
     const expectedTaskMetadata = { ...task.agentConfig.metadata };
     delete expectedTaskMetadata[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];
     const expectedMetadata = {
@@ -2242,9 +2282,9 @@ async function recoverBoundScheduledTaskDispatch(input: {
         input.acceptedExecution.alertOccurrenceLabels === null &&
         (session.metadata.scheduledTaskRunId !== input.run.id ||
           session.createdByContext.scheduledTaskRunId !== input.run.id)) ||
-      session.model !== input.acceptedExecution.resolvedModel ||
-      session.reasoningEffort !== input.acceptedExecution.resolvedReasoningEffort ||
-      session.latencyMode !== input.acceptedExecution.resolvedLatencyMode ||
+      creationPolicy?.model !== input.acceptedExecution.resolvedModel ||
+      creationPolicy.reasoningEffort !== input.acceptedExecution.resolvedReasoningEffort ||
+      creationPolicy.latencyMode !== input.acceptedExecution.resolvedLatencyMode ||
       session.sandboxBackend !== input.acceptedExecution.resolvedSandboxBackend ||
       session.sandboxOs !== input.acceptedExecution.resolvedSandboxOs ||
       session.activeSandboxId !== (task.agentConfig.machineTarget?.targetSandboxId ?? null) ||
@@ -2531,6 +2571,35 @@ async function replayScheduledTaskDispatch(input: {
   return result;
 }
 
+/**
+ * Session-create fields carried by a frozen creator session policy. Only the
+ * facts the creating session projection exposed at task creation are set;
+ * a null (or no longer valid) key leaves the generated session on its own
+ * default. The field names are the session access-scope contract
+ * (`agentAccess`, `endUser`, `memoryScope`) consumed by session create.
+ */
+function scheduledCreatorSessionPolicyInput(
+  policy: {
+    agentAccess: string | null;
+    endUser: { source: string; id: string } | null;
+    memoryScope: string | null;
+  } | null,
+): {
+  agentAccess?: SessionAgentAccess;
+  endUser?: SessionEndUser;
+  memoryScope?: SessionMemoryScope;
+} {
+  if (!policy) return {};
+  const agentAccess = SessionAgentAccess.safeParse(policy.agentAccess);
+  const endUser = SessionEndUser.safeParse(policy.endUser);
+  const memoryScope = SessionMemoryScope.safeParse(policy.memoryScope);
+  return {
+    ...(agentAccess.success ? { agentAccess: agentAccess.data } : {}),
+    ...(endUser.success ? { endUser: endUser.data } : {}),
+    ...(memoryScope.success ? { memoryScope: memoryScope.data } : {}),
+  };
+}
+
 function knowledgeSourceSyncEffectivelyPaused(task: {
   status: "active" | "paused";
   metadata: Record<string, unknown>;