@opengeni/worker-bundle 0.27.0-canary.1 → 0.27.2-canary.0

package/dist/{chunk-7LS42PHP.js → chunk-C54VDT6I.js}

@@ -1,6 +1,6 @@
 import {
   observabilityEventLogger
-} from "./chunk-D4ZEFOYH.js";
+} from "./chunk-BARTLVBK.js";
 
 // src/activity-services.ts
 import { dbSearchPath, getSettings, resolveNatsControlPlaneAuth } from "@opengeni/config";
@@ -1433,31 +1433,6 @@ async function resolveWorkspacePackRuntime(db, workspaceId) {
   if (packs.length === 0) return emptyPackRuntime;
   return workspacePackRuntimeFromPacks(packs);
 }
-async function resolveWorkspaceInstalledSkillRuntime(db, workspaceId) {
-  const installedSkills = await listInstalledPortableSkills(db, workspaceId);
-  const activations = [];
-  for (const installed of installedSkills) {
-    const artifact = buildPortableSkillArtifact(installed.files);
-    if (artifact.name !== installed.name || artifact.description !== installed.description || artifact.contentSha256 !== installed.contentSha256) {
-      throw new Error(
-        `Installed Skill artifact verification failed for ${installed.capabilityId}; reinstall it from the pinned source`
-      );
-    }
-    activations.push({
-      source: "installation",
-      id: installed.capabilityId,
-      artifact: {
-        name: artifact.name,
-        description: artifact.description,
-        files: artifact.files.map((file) => ({ path: file.path, content: file.content }))
-      },
-      version: installed.version,
-      contentSha256: artifact.contentSha256,
-      reason: installed.source === "library" ? "installed from the curated Skill library" : installed.source === "pack" ? "installed as a Pack-owned Skill" : `installed from ${installed.sourceUrl}`
-    });
-  }
-  return { activations };
-}
 function workspacePackRuntimeFromPacks(packs) {
   const sandboxRuntime = legacySandboxRuntimeFromPacks(packs);
   const skillActivations = [];
@@ -1776,6 +1751,10 @@ async function deleteWorkspaceArchiveObjectKeys(objectStorage, keys) {
 
 // src/sandbox-routing.ts
 import { sandboxLifecycleTransitionWaitMs as sandboxLifecycleTransitionWaitMs2 } from "@opengeni/config";
+import {
+  createProviderCommandRetainer,
+  retainedProviderCommandPersistence
+} from "@opengeni/db/retained-provider-commands";
 import {
   adoptConnectedMachineSessionBackgroundCommand,
   adoptManagedSessionBackgroundCommand,
@@ -3036,6 +3015,14 @@ async function waitForWarm(services, ids) {
 }
 
 // src/sandbox-routing.ts
+var retainWorkspaceProviderCommand = createProviderCommandRetainer(
+  retainWorkspaceMutationProcess,
+  (error) => error instanceof SandboxRetainedProcessPromotionFencedError ? error.process : null
+);
+function admittedCommandHandle(value) {
+  if (!value || typeof value !== "object") return void 0;
+  return value.admission?.workspaceGeneration;
+}
 function relayConfigFromSettings(settings) {
   const raw = settings.selfhostedRelayUrl?.trim();
   if (!raw) {
@@ -3205,12 +3192,13 @@ function afterPersistableHomeMutation(services, ids, home) {
     }
     if (outcome === "resolved" && retainedProcess) {
       try {
-        await retainWorkspaceMutationProcess(services.db, {
+        await retainWorkspaceProviderCommand(services.db, {
           accountId: fence.accountId,
           workspaceId: ids.workspaceId,
           sessionId: ids.sessionId,
           processId: retainedProcess.id,
           providerSessionId: retainedProcess.providerSessionId,
+          ...retainedProcess.providerCommand ? { providerCommand: retainedProcess.providerCommand } : {},
           admissionId: exactAdmission.id,
           admittedWorkspaceGeneration: exactAdmission.workspaceGeneration,
           operation: op,
@@ -3571,6 +3559,15 @@ function wrapTurnBoxWithRouting(services, ids, established) {
     },
     resolveActiveBackend: resolver,
     ...services.onSandboxOperation ? { onOperation: services.onSandboxOperation } : {},
+    providerCommandHandle: admittedCommandHandle,
+    ...ids.workspaceMutationFence ? {
+      providerCommandPersistence: (process) => retainedProviderCommandPersistence(db, {
+        accountId: ids.workspaceMutationFence.accountId,
+        workspaceId: ids.workspaceId,
+        sessionId: ids.sessionId,
+        processId: process.id
+      })
+    } : {},
     ...beforeMutation ? { beforeMutation } : {},
     ...afterMutation ? { afterMutation } : {},
     ...beforeProcessMutation ? { beforeProcessMutation } : {},
@@ -3759,6 +3756,15 @@ function wrapLazyTurnBoxWithRouting(services, ids, args) {
     },
     ...services.onSandboxOperation ? { onOperation: services.onSandboxOperation } : {},
     ...args.onFirstOperation ? { onFirstOperation: args.onFirstOperation } : {},
+    providerCommandHandle: admittedCommandHandle,
+    ...ids.workspaceMutationFence ? {
+      providerCommandPersistence: (process) => retainedProviderCommandPersistence(db, {
+        accountId: ids.workspaceMutationFence.accountId,
+        workspaceId: ids.workspaceId,
+        sessionId: ids.sessionId,
+        processId: process.id
+      })
+    } : {},
     ...beforeMutation ? { beforeMutation } : {},
     ...afterMutation ? { afterMutation } : {},
     ...beforeProcessMutation ? { beforeProcessMutation } : {},
@@ -4204,9 +4210,21 @@ async function reconcileAutomaticSessionTitleFanout(svc, limit = 100, overrides
 async function reconcilePendingSessionWorkflowWakes(svc, limit = 1e3, overrides = {}) {
   const claimPendingSessionWorkflowWakesFn = overrides.claimPendingSessionWorkflowWakes ?? claimPendingSessionWorkflowWakes;
   if (!svc.wakeSessionWorkflow) {
-    return { claimed: 0, delivered: 0, failed: 0 };
+    return {
+      claimed: 0,
+      signaled: 0,
+      delivered: 0,
+      pendingAdmission: 0,
+      unconfirmed: 0,
+      failed: 0,
+      pendingAdmissionBlockers: {}
+    };
   }
   const repairs = await claimPendingSessionWorkflowWakesFn(svc.db, limit);
+  let signaled = 0;
+  let pendingAdmission = 0;
+  let unconfirmed = 0;
+  const pendingAdmissionBlockers = {};
   let delivered = 0;
   let failed = 0;
   const queue = [...repairs];
@@ -4214,16 +4232,31 @@ async function reconcilePendingSessionWorkflowWakes(svc, limit = 1e3, overrides
     for (; ; ) {
       const repair = queue.shift();
       if (!repair) return;
+      let signalAccepted = false;
+      const onSignalAccepted = () => {
+        if (signalAccepted) return;
+        signalAccepted = true;
+        signaled += 1;
+      };
       try {
-        await svc.wakeSessionWorkflow({
+        const receipt = await svc.wakeSessionWorkflow({
           accountId: repair.accountId,
           workspaceId: repair.workspaceId,
           sessionId: repair.sessionId,
           workflowId: repair.temporalWorkflowId,
           wakeRevision: repair.wakeRevision,
-          ...repair.interruptionRequested ? { interruptionRequested: true } : {}
+          ...repair.interruptionRequested ? { interruptionRequested: true } : {},
+          onSignalAccepted
         });
-        delivered += 1;
+        onSignalAccepted();
+        if (receipt?.action === "acknowledged") {
+          delivered += 1;
+        } else if (receipt?.action === "pending_admission") {
+          pendingAdmission += 1;
+          pendingAdmissionBlockers[receipt.blocker] = (pendingAdmissionBlockers[receipt.blocker] ?? 0) + 1;
+        } else {
+          unconfirmed += 1;
+        }
       } catch (error) {
         failed += 1;
         await markSessionWorkflowWakeFailed(
@@ -4235,7 +4268,15 @@ async function reconcilePendingSessionWorkflowWakes(svc, limit = 1e3, overrides
     }
   });
   await Promise.all(workers);
-  return { claimed: repairs.length, delivered, failed };
+  return {
+    claimed: repairs.length,
+    signaled,
+    delivered,
+    pendingAdmission,
+    unconfirmed,
+    failed,
+    pendingAdmissionBlockers
+  };
 }
 function childCompletionPayload(child, goal) {
   return {
@@ -4964,6 +5005,10 @@ function classifySandboxLogicalProvisionFailure(backend, error) {
 }
 function isLazySandboxProvisionRetryable(error) {
   const chain = sandboxProvisionErrorChain(error);
+  if (chain.some(
+    (value) => value instanceof SandboxLeaseTransitionError2 && value.reason === "rotation_in_progress"
+  ))
+    return false;
   if (chain.some(
     (value) => value instanceof SandboxImageConflictError || value instanceof SandboxRigConflictError || value instanceof SandboxLeaseRecoveryBlockedError2
   )) {
@@ -5351,6 +5396,512 @@ import {
   mcpTransportRequestFailureDiagnostic
 } from "@opengeni/runtime/mcp-network";
 import { ApplicationFailure, CancelledFailure as CancelledFailure2 } from "@temporalio/activity";
+
+// src/activities/run-input.ts
+import {
+  MODEL_ATTACHMENT_REFS_FIELD,
+  MODEL_ATTACHMENT_CATALOG_MARKER,
+  FileResourceRef,
+  resourceMountPath
+} from "@opengeni/contracts";
+import { createHash as createHash2 } from "crypto";
+import {
+  getActiveSessionHistoryItemsPaged,
+  getFilesForSubject,
+  getSandboxSessionEnvelope as getSandboxSessionEnvelope2,
+  listSessionSystemUpdatesForTurn,
+  listTurnOpenSuffixToolCalls
+} from "@opengeni/db";
+import {
+  projectHistoryForProvider,
+  projectRejectedProviderArtifactsFromSerializedRunState,
+  projectRejectedReasoningArtifact,
+  hasOpaqueProviderArtifact
+} from "@opengeni/runtime";
+function projectRejectedProviderArtifacts(rows) {
+  const out = [];
+  for (const row of rows) {
+    if (!row.providerArtifactInvalidatedAt) {
+      out.push(row.item);
+      continue;
+    }
+    const type = typeof row.item.type === "string" ? row.item.type : void 0;
+    if (type === "reasoning") {
+      out.push(projectRejectedReasoningArtifact(row.item));
+      continue;
+    }
+    if (type === "compaction") {
+      continue;
+    }
+    out.push(row.item);
+  }
+  return out;
+}
+async function measureHistoryPreparationPhase(options, phase, operation) {
+  const startedAt = performance.now();
+  let outcome = "completed";
+  try {
+    return await operation();
+  } catch (error) {
+    outcome = "failed";
+    throw error;
+  } finally {
+    try {
+      options.onPreparationPhase?.({
+        phase,
+        outcome,
+        durationSeconds: (performance.now() - startedAt) / 1e3
+      });
+    } catch {
+    }
+  }
+}
+var MAX_INLINE_MODEL_ATTACHMENT_BYTES = 20 * 1024 * 1024;
+var MAX_RETAINED_MODEL_ATTACHMENT_BYTES = 64 * 1024 * 1024;
+var RetainedAttachmentTransportLimitError = class extends Error {
+  constructor() {
+    super(
+      "Active uploaded images exceed the 64 MiB inline transport limit. History was preserved and no new image bytes were downloaded. Start a smaller conversation or fork before the image-heavy messages."
+    );
+    this.name = "RetainedAttachmentTransportLimitError";
+  }
+};
+var MODEL_IMAGE_CONTENT_TYPES = /* @__PURE__ */ new Set(["image/gif", "image/jpeg", "image/png", "image/webp"]);
+var MODEL_FILE_CONTENT_TYPES = /* @__PURE__ */ new Set([
+  "application/json",
+  "application/pdf",
+  "application/x-yaml",
+  "application/yaml"
+]);
+var BLOCKED_TEXT_CONTENT_TYPES = /* @__PURE__ */ new Set([
+  "text/css",
+  "text/html",
+  "text/javascript",
+  "text/xml"
+]);
+function safeErrorType(error) {
+  if (!(error instanceof Error)) return typeof error;
+  const name = error.name.trim();
+  return /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(name) ? name : "Error";
+}
+function modelAttachmentDescriptor(contentType) {
+  const normalized = contentType.toLowerCase().split(";", 1)[0]?.trim() ?? "";
+  if (MODEL_IMAGE_CONTENT_TYPES.has(normalized)) {
+    return { kind: "image", contentType: normalized };
+  }
+  if (MODEL_FILE_CONTENT_TYPES.has(normalized) || normalized.startsWith("text/") && !BLOCKED_TEXT_CONTENT_TYPES.has(normalized)) {
+    return { kind: "file", contentType: normalized };
+  }
+  return null;
+}
+async function modelAttachmentContentForFiles(files, readFileBytes, options = {}) {
+  const selected = [];
+  let remainingBytes = options.retainAll ? Number.POSITIVE_INFINITY : MAX_INLINE_MODEL_ATTACHMENT_BYTES;
+  for (const file of files) {
+    const descriptor = modelAttachmentDescriptor(file.contentType);
+    const checksum = file.sha256?.trim().toLowerCase() ?? "";
+    if (file.status !== "ready" || !descriptor || descriptor.kind !== "image" || file.sizeBytes > MAX_INLINE_MODEL_ATTACHMENT_BYTES || file.sizeBytes > remainingBytes || !/^[a-f0-9]{64}$/.test(checksum)) {
+      continue;
+    }
+    selected.push({ file, descriptor, checksum });
+    remainingBytes -= file.sizeBytes;
+  }
+  const attachments = new Array(selected.length);
+  let cursor = 0;
+  const worker = async () => {
+    while (cursor < selected.length) {
+      const index = cursor++;
+      const { file, descriptor, checksum } = selected[index];
+      try {
+        const bytes = await readFileBytes(file);
+        if (bytes.byteLength !== file.sizeBytes) {
+          console.error("model attachment bytes did not match finalized metadata", {
+            fileId: file.id,
+            expectedSizeBytes: file.sizeBytes,
+            actualSizeBytes: bytes.byteLength
+          });
+          continue;
+        }
+        if (createHash2("sha256").update(bytes).digest("hex") !== checksum) {
+          console.error("model attachment checksum did not match finalized metadata", {
+            fileId: file.id
+          });
+          continue;
+        }
+        attachments[index] = {
+          kind: descriptor.kind,
+          fileId: file.id,
+          filename: file.safeFilename,
+          contentType: descriptor.contentType,
+          dataUrl: `data:${descriptor.contentType};base64,${Buffer.from(bytes).toString("base64")}`
+        };
+      } catch (error) {
+        console.error("model attachment content read failed; retaining sandbox path fallback", {
+          fileId: file.id,
+          errorType: safeErrorType(error)
+        });
+      }
+    }
+  };
+  await Promise.all(
+    Array.from({ length: Math.min(8, selected.length) }, async () => await worker())
+  );
+  return attachments.filter(
+    (attachment) => attachment !== void 0
+  );
+}
+function attachmentRefsFromItem(item) {
+  const raw = item[MODEL_ATTACHMENT_REFS_FIELD];
+  if (!Array.isArray(raw)) return [];
+  const refs = [];
+  for (const candidate of raw) {
+    const parsed = FileResourceRef.safeParse(candidate);
+    if (parsed.success) refs.push(parsed.data);
+  }
+  return refs;
+}
+function attachmentReceiptText(ref, file) {
+  if (!file) {
+    return `[Earlier attachment: fileId=${ref.fileId}; mountDirectory=${resourceMountPath(ref)}. Use the existing file there, or call files__files_get_download_url with this fileId and download it with the shell.]`;
+  }
+  const path = sandboxFilePath(ref, file);
+  return `[Attachment: ${file.safeFilename}; fileId=${file.id}; type=${file.contentType}; bytes=${file.sizeBytes}; path=${path}. If the local path is absent, call files__files_get_download_url with this fileId and download it with the shell.]`;
+}
+function createModelHistoryAttachmentProjector(policy, readFileBytes, loadAuthorizedFiles) {
+  const contentById = /* @__PURE__ */ new Map();
+  const attemptedContentIds = /* @__PURE__ */ new Set();
+  const fileById = /* @__PURE__ */ new Map();
+  const resolvedFileIds = /* @__PURE__ */ new Set();
+  const retainedByteSizes = /* @__PURE__ */ new Map();
+  return async (items, options = {}) => {
+    for (const file of options.inlineFiles ?? []) {
+      fileById.set(file.id, file);
+      resolvedFileIds.add(file.id);
+    }
+    const refsByIndex = /* @__PURE__ */ new Map();
+    const orderedFileIds = [];
+    const seenFileIds = /* @__PURE__ */ new Set();
+    for (let index = 0; index < items.length; index += 1) {
+      const refs = attachmentRefsFromItem(items[index]);
+      if (refs.length === 0) continue;
+      refsByIndex.set(index, refs);
+      for (const ref of refs) {
+        if (items[index][MODEL_ATTACHMENT_CATALOG_MARKER] === true || seenFileIds.has(ref.fileId))
+          continue;
+        seenFileIds.add(ref.fileId);
+        orderedFileIds.push(ref.fileId);
+      }
+    }
+    if (refsByIndex.size === 0) return items;
+    const unresolved = orderedFileIds.filter((id) => !resolvedFileIds.has(id));
+    if (loadAuthorizedFiles && unresolved.length > 0) {
+      const files = await loadAuthorizedFiles(unresolved);
+      for (const file of files) fileById.set(file.id, file);
+      for (const id of unresolved) resolvedFileIds.add(id);
+    }
+    if (readFileBytes) {
+      const admitted = new Map(retainedByteSizes);
+      let requestImageBytes = 0;
+      for (const [index, refs] of refsByIndex) {
+        if (items[index][MODEL_ATTACHMENT_CATALOG_MARKER] === true) continue;
+        for (const ref of refs) {
+          const file = fileById.get(ref.fileId);
+          if (!file || !policy.supportsImageInput || file.status !== "ready" || file.sizeBytes > MAX_INLINE_MODEL_ATTACHMENT_BYTES || modelAttachmentDescriptor(file.contentType)?.kind !== "image" || !/^[a-f0-9]{64}$/i.test(file.sha256?.trim() ?? ""))
+            continue;
+          requestImageBytes += file.sizeBytes;
+          admitted.set(file.id, file.sizeBytes);
+        }
+      }
+      const turnImageBytes = [...admitted.values()].reduce((sum, bytes) => sum + bytes, 0);
+      if (requestImageBytes > MAX_RETAINED_MODEL_ATTACHMENT_BYTES || turnImageBytes > MAX_RETAINED_MODEL_ATTACHMENT_BYTES) {
+        throw new RetainedAttachmentTransportLimitError();
+      }
+      for (const [id, bytes] of admitted) retainedByteSizes.set(id, bytes);
+      const readable = [...orderedFileIds].reverse().map((id) => fileById.get(id)).filter((file) => {
+        if (!file || attemptedContentIds.has(file.id)) return false;
+        const descriptor = modelAttachmentDescriptor(file.contentType);
+        return Boolean(descriptor && descriptor.kind === "image" && policy.supportsImageInput);
+      });
+      for (const file of readable) attemptedContentIds.add(file.id);
+      const content = await modelAttachmentContentForFiles(readable, readFileBytes, {
+        retainAll: true
+      });
+      const loadedIds = new Set(content.map((entry) => entry.fileId));
+      for (const file of readable) {
+        if (file.status === "ready" && file.sizeBytes <= MAX_INLINE_MODEL_ATTACHMENT_BYTES && /^[a-f0-9]{64}$/i.test(file.sha256 ?? "") && !loadedIds.has(file.id)) {
+          for (const candidate of readable) attemptedContentIds.delete(candidate.id);
+          throw new Error(`Retained attachment bytes unavailable or invalid: ${file.id}`);
+        }
+      }
+      for (const attachment of content) contentById.set(attachment.fileId, attachment);
+    }
+    const projected = [...items];
+    for (const [index, refs] of refsByIndex) {
+      const original = items[index];
+      const existingContent = Array.isArray(original.content) ? [...original.content] : [{ type: "input_text", text: String(original.content ?? "") }];
+      const attachmentParts = refs.flatMap((ref) => {
+        const currentFile = original[MODEL_ATTACHMENT_CATALOG_MARKER] === true ? void 0 : fileById.get(ref.fileId);
+        const attachment = currentFile ? contentById.get(ref.fileId) : void 0;
+        const receipt = {
+          type: "input_text",
+          text: attachmentReceiptText(ref, currentFile)
+        };
+        if (!attachment || attachment.kind !== "image") {
+          return [receipt];
+        }
+        return [receipt, { type: "input_image", image: attachment.dataUrl }];
+      });
+      const clone = {
+        ...original,
+        content: [...existingContent, ...attachmentParts]
+      };
+      delete clone[MODEL_ATTACHMENT_REFS_FIELD];
+      projected[index] = clone;
+    }
+    return projected;
+  };
+}
+function withCurrentUserAttachmentRefs(historyItems, refs) {
+  if (refs.length === 0) return historyItems;
+  for (let index = historyItems.length - 1; index >= 0; index -= 1) {
+    const item = historyItems[index];
+    if (item.type !== "message" || item.role !== "user") continue;
+    const existing = attachmentRefsFromItem(item);
+    const existingIds = new Set(existing.map((ref) => ref.fileId));
+    const additions = refs.filter((ref) => !existingIds.has(ref.fileId));
+    if (additions.length === 0) return historyItems;
+    const projected = [...historyItems];
+    projected[index] = { ...item, [MODEL_ATTACHMENT_REFS_FIELD]: [...existing, ...additions] };
+    return projected;
+  }
+  return historyItems;
+}
+async function turnInput(db, runtime, agent, trigger, options) {
+  if (!trigger) {
+    throw new Error("Missing trigger event");
+  }
+  const updates = await measureHistoryPreparationPhase(
+    options,
+    "system_update_load",
+    async () => await listSessionSystemUpdatesForTurn(
+      db,
+      trigger.workspaceId,
+      trigger.sessionId,
+      options.turnId
+    )
+  );
+  if (updates.some((update) => !update.deliveredHistoryItemId)) {
+    throw new Error("Delivered internal update has no durable model-memory batch");
+  }
+  const internalContext = joinInternalContext(
+    options.recovering ? [
+      "[OpenGeni inference recovery]",
+      "Continue the same inference from durable conversation and sandbox state. A previous execution stopped before it could finish. Do not repeat completed side effects; inspect actual state when uncertain."
+    ].join("\n") : void 0,
+    options.unavailableSandboxFilesNote,
+    options.runCredentialsNote,
+    options.mcpAvailabilityNote
+  );
+  if (trigger.type === "user.message") {
+    const payload = trigger.payload;
+    const hasAnnotations = Array.isArray(payload.annotations) && payload.annotations.length > 0;
+    if (typeof payload.text !== "string" || payload.text.trim().length === 0 && !hasAnnotations) {
+      throw new Error("user.message payload is missing text and annotations");
+    }
+    const resources = Array.isArray(payload.resources) ? payload.resources : [];
+    const fileAttachments = await measureHistoryPreparationPhase(
+      options,
+      "current_attachment_resolution",
+      async () => await resolveUserMessageFileAttachments(
+        db,
+        options.fileAuthority.accountId,
+        trigger.workspaceId,
+        options.fileAuthority.subjectId,
+        resources
+      )
+    );
+    const attachmentContext = userMessageAttachmentsContext(fileAttachments);
+    return await messageInput(
+      db,
+      runtime,
+      agent,
+      trigger,
+      void 0,
+      joinInternalContext(internalContext, attachmentContext),
+      fileAttachments,
+      options.providerApi,
+      options.projectCanonicalHistory,
+      options.materializeModelHistory,
+      options.projectModelHistory,
+      options.loadActiveHistory,
+      options
+    );
+  }
+  if (trigger.type === "system.update.delivered") {
+    if (updates.length === 0) {
+      throw new Error("Internal update inference has no delivered updates");
+    }
+    return await messageInput(
+      db,
+      runtime,
+      agent,
+      trigger,
+      void 0,
+      internalContext,
+      [],
+      options.providerApi,
+      options.projectCanonicalHistory,
+      options.materializeModelHistory,
+      options.projectModelHistory,
+      options.loadActiveHistory,
+      options
+    );
+  }
+  if (trigger.type === "user.approvalDecision" || trigger.type === "user.humanInputResponse") {
+    return await openSuffixMessageInput(db, runtime, agent, trigger, internalContext, options);
+  }
+  throw new Error(`Unsupported trigger event type: ${trigger.type}`);
+}
+function joinInternalContext(...parts) {
+  const content = parts.map((part) => part?.trim()).filter((part) => Boolean(part));
+  return content.length > 0 ? content.join("\n\n") : void 0;
+}
+async function openSuffixMessageInput(db, runtime, agent, trigger, internalContext, options) {
+  const suffixRows = await listTurnOpenSuffixToolCalls(
+    db,
+    trigger.workspaceId,
+    trigger.sessionId,
+    options.turnId
+  );
+  if (suffixRows.length === 0) {
+    throw new Error("Open suffix resume has no interruption rows");
+  }
+  if (suffixRows.some((row) => row.resultItem == null)) {
+    throw new Error("Open suffix resume still has unresolved members");
+  }
+  return await messageInput(
+    db,
+    runtime,
+    agent,
+    trigger,
+    void 0,
+    internalContext,
+    [],
+    options.providerApi,
+    options.projectCanonicalHistory,
+    options.materializeModelHistory,
+    options.projectModelHistory,
+    options.loadActiveHistory,
+    options
+  );
+}
+async function messageInput(db, runtime, agent, trigger, text, internalContext, currentAttachments = [], providerApi = "responses", projectCanonicalHistory, materializeModelHistory, projectModelHistory, loadActiveHistory = getActiveSessionHistoryItemsPaged, preparationOptions = {}) {
+  const currentAttachmentRefs = currentAttachments.map((attachment) => attachment.resource);
+  const [stored, envelope] = await Promise.all([
+    measureHistoryPreparationPhase(
+      preparationOptions,
+      "durable_history_load",
+      async () => loadActiveHistory(db, trigger.workspaceId, trigger.sessionId)
+    ),
+    measureHistoryPreparationPhase(
+      preparationOptions,
+      "sandbox_envelope_load",
+      async () => getSandboxSessionEnvelope2(db, trigger.workspaceId, trigger.sessionId)
+    )
+  ]);
+  const canonicalView = await measureHistoryPreparationPhase(
+    preparationOptions,
+    "canonical_projection",
+    async () => {
+      const active = projectRejectedProviderArtifacts(stored);
+      return projectCanonicalHistory ? await projectCanonicalHistory(active) : active;
+    }
+  );
+  const providerView = await measureHistoryPreparationPhase(
+    preparationOptions,
+    "provider_projection",
+    () => projectHistoryForProvider(canonicalView, providerApi)
+  );
+  const referencedHistory = await measureHistoryPreparationPhase(
+    preparationOptions,
+    "attachment_ref_projection",
+    () => withCurrentUserAttachmentRefs(providerView, currentAttachmentRefs)
+  );
+  const materializedHistory = await measureHistoryPreparationPhase(
+    preparationOptions,
+    "screenshot_materialization",
+    async () => materializeModelHistory ? await materializeModelHistory(referencedHistory) : referencedHistory
+  );
+  const historyItems = await measureHistoryPreparationPhase(
+    preparationOptions,
+    "model_attachment_projection",
+    async () => projectModelHistory ? await projectModelHistory(materializedHistory, {
+      inlineFiles: currentAttachments.map((attachment) => attachment.file)
+    }) : materializedHistory
+  );
+  const prepared = await measureHistoryPreparationPhase(
+    preparationOptions,
+    "runtime_input_assembly",
+    async () => await runtime.prepareInput(agent, {
+      kind: "message",
+      ...text ? { text } : {},
+      ...internalContext ? { internalContext } : {},
+      historyItems,
+      sandboxEnvelope: envelope,
+      ...projectModelHistory ? { modelInputAlreadyProjected: true } : {}
+    })
+  );
+  const providerArtifactCandidates = await measureHistoryPreparationPhase(
+    preparationOptions,
+    "artifact_candidate_scan",
+    () => {
+      const preparedItems = Array.isArray(prepared.input) ? new Set(prepared.input) : /* @__PURE__ */ new Set();
+      return {
+        knownHistoryItemIds: stored.map((row) => row.id),
+        historyItemIds: stored.filter(
+          (row) => row.providerArtifactInvalidatedAt === null && hasOpaqueProviderArtifact(row.item) && preparedItems.has(row.item)
+        ).map((row) => row.id)
+      };
+    }
+  );
+  return {
+    input: prepared,
+    persistedHistoryCount: prepared.persistedHistoryCount,
+    providerArtifactCandidates
+  };
+}
+async function resolveUserMessageFileAttachments(db, accountId, workspaceId, subjectId, resources) {
+  const fileResources = resources.filter(
+    (resource) => resource.kind === "file"
+  );
+  if (fileResources.length === 0) return [];
+  const files = await getFilesForSubject(db, {
+    accountId,
+    workspaceId,
+    subjectId,
+    fileIds: fileResources.map((resource) => resource.fileId)
+  });
+  const fileById = new Map(files.map((file) => [file.id, file]));
+  return fileResources.map((resource) => {
+    const file = fileById.get(resource.fileId);
+    if (!file) throw new Error(`File not found: ${resource.fileId}`);
+    return { resource, file };
+  });
+}
+function userMessageAttachmentsContext(attachments) {
+  const attachedFiles = attachments.map(
+    ({ resource, file }) => `- ${file.filename} (${file.contentType}, ${file.sizeBytes} bytes): ${sandboxFilePath(resource, file)}`
+  );
+  if (attachedFiles.length === 0) {
+    return void 0;
+  }
+  return ["Attached files are available in the sandbox:", ...attachedFiles].join("\n");
+}
+function sandboxFilePath(resource, file) {
+  return `${resourceMountPath(resource)}/${file.safeFilename}`;
+}
+
+// src/activities/agent-turn/errors.ts
 import {
   CodexReloginRequired,
   classifyCodexResponseTimeoutError,
@@ -5782,6 +6333,9 @@ function findPostgresDriverError(error) {
   return null;
 }
 function agentRunFailurePayload(error, options = {}) {
+  if (error instanceof RetainedAttachmentTransportLimitError) {
+    return { error: error.message, code: "retained_attachment_transport_limit", retryable: false };
+  }
   if (error instanceof MandatoryHistoryPersistenceError) {
     const underlying = isSessionEventPersistenceError(error.cause) ? agentRunFailurePayload(error.cause, options) : {
       error: error.cause instanceof Error ? error.cause.message : String(error.cause)
@@ -6079,7 +6633,6 @@ export {
   rigProviderImageSourceImage,
   settingsWithPackSandboxImage,
   resolveWorkspacePackRuntime,
-  resolveWorkspaceInstalledSkillRuntime,
   createRuntimeBatcher,
   currentActivityContext,
   startActivityHeartbeat,
@@ -6114,6 +6667,9 @@ export {
   incidentTelemetryAuthorityFence,
   resolveIncidentTelemetryResponderMetadata,
   validateIncidentTelemetrySystemUpdateAuthority,
+  projectRejectedProviderArtifacts,
+  createModelHistoryAttachmentProjector,
+  turnInput,
   SandboxDeadlineRotationError,
   turnOperationCancellationFailure,
   throwIfTurnOperationCancelled,
@@ -6166,4 +6722,4 @@ export {
   codexUsageLimitFailurePayload,
   CODEX_USAGE_LIMIT_MAX_RESUME_MS
 };
-//# sourceMappingURL=chunk-7LS42PHP.js.map
+//# sourceMappingURL=chunk-C54VDT6I.js.map