@opengeni/worker-bundle 0.27.3-canary.0 → 0.28.1-canary.0

package/dist/index.js

@@ -781,7 +781,7 @@ function temporalWorkflowExecutionNotFound(error) {
   return isGrpcServiceError(error) && error.code === 5;
 }
 async function createDefaultWorkerActivities(role, dependencies = {}) {
-  return role === "control" ? (await import("./activities-control-WZRFEIJH.js")).createControlActivities(dependencies) : (await import("./activities-turn-V7J34ZOF.js")).createTurnActivities(dependencies);
+  return role === "control" ? (await import("./activities-control-VVK7RA7F.js")).createControlActivities(dependencies) : (await import("./activities-turn-FOIZYY56.js")).createTurnActivities(dependencies);
 }
 function resolveOpenGeniWorkflowDefinition(moduleUrl = import.meta.url) {
   const modulePath = fileURLToPath(moduleUrl).replaceAll("\\", "/");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/worker-bundle",
-  "version": "0.27.3-canary.0",
+  "version": "0.28.1-canary.0",
   "description": "OpenGeni worker entry and reusable embedded lifecycle, shipped with a release-coherent pre-bundled Temporal workflow artifact.",
   "license": "Apache-2.0",
   "repository": {
@@ -54,22 +54,22 @@
   },
   "dependencies": {
     "@llamaindex/liteparse": "2.14.2",
-    "@opengeni/agent-proto": "^0.5.1-canary.23",
-    "@opengeni/capabilities": "^0.3.3-canary.5",
-    "@opengeni/codemode": "^0.5.3-canary.0",
-    "@opengeni/codex": "^0.2.22-canary.5",
-    "@opengeni/config": "^1.0.4-canary.0",
-    "@opengeni/contracts": "^2.15.2-canary.0",
-    "@opengeni/core": "^2.8.3-canary.0",
-    "@opengeni/db": "^4.2.2-canary.0",
-    "@opengeni/documents": "^0.8.23-canary.0",
-    "@opengeni/events": "^0.4.21-canary.0",
-    "@opengeni/github": "^0.7.7-canary.0",
-    "@opengeni/network": "^0.3.1-canary.5",
-    "@opengeni/observability": "^0.8.23-canary.0",
-    "@opengeni/runtime": "^2.4.3-canary.0",
-    "@opengeni/storage": "^0.2.124-canary.0",
-    "@opengeni/xai-subscription": "^0.1.4-canary.5",
+    "@opengeni/agent-proto": "^0.5.1-canary.24",
+    "@opengeni/capabilities": "^0.3.3-canary.6",
+    "@opengeni/codemode": "^0.5.4-canary.0",
+    "@opengeni/codex": "^0.2.22-canary.6",
+    "@opengeni/config": "^1.1.0-canary.0",
+    "@opengeni/contracts": "^3.0.0-canary.0",
+    "@opengeni/core": "^2.9.1-canary.0",
+    "@opengeni/db": "^4.3.0-canary.0",
+    "@opengeni/documents": "^0.8.24-canary.0",
+    "@opengeni/events": "^0.4.22-canary.0",
+    "@opengeni/github": "^0.7.8-canary.0",
+    "@opengeni/network": "^0.3.1-canary.6",
+    "@opengeni/observability": "^0.8.24-canary.0",
+    "@opengeni/runtime": "^2.5.1-canary.0",
+    "@opengeni/storage": "^0.2.125-canary.0",
+    "@opengeni/xai-subscription": "^0.1.4-canary.6",
     "@temporalio/activity": "^1.17.0",
     "@temporalio/client": "^1.17.0",
     "@temporalio/worker": "^1.17.0",

package/src/activities/agent-turn/agent-build.ts

@@ -6,6 +6,8 @@ import {
   setXaiSessionAccountPin,
   getWorkspaceVideoGenerationPolicy,
   loadWorkspaceVercelAiGatewayCredentialLease,
+  getExternalLinkTurnAuthorization,
+  getSessionTurnForAttempt,
 } from "@opengeni/db";
 import {
   formatSkillCatalog,
@@ -569,11 +571,39 @@ export async function buildTurnAgent(deps: BuildTurnAgentDeps) {
     outcome: "completed",
     durationSeconds: (performance.now() - postToolPreparationStartedAt) / 1_000,
   });
+  const linkedToolAuthority = await getExternalLinkTurnAuthorization(
+    db,
+    {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+    },
+    turn.id,
+  );
+  if (linkedToolAuthority && !linkedToolAuthority.authorized)
+    throw new Error("Native identity link was revoked");
   const agent = (() => {
     const agentConstructionStartedAt = performance.now();
     let agentConstructionOutcome: "completed" | "failed" = "completed";
     try {
       return runtime.buildAgent(eventing.modelRunSettings, runtimeResources, {
+        ...(linkedToolAuthority
+          ? {
+              authorizeAttemptExecution: async () => {
+                const current = await getSessionTurnForAttempt(
+                  db,
+                  input.workspaceId,
+                  input.sessionId,
+                  input.attemptId,
+                );
+                if (
+                  !current ||
+                  current.id !== turn.id ||
+                  current.executionGeneration !== turn.executionGeneration
+                )
+                  throw new Error("The linked agent attempt is no longer authorized");
+              },
+            }
+          : {}),
         ...(preparedTools.inputWaitYield ? { inputWaitYield: preparedTools.inputWaitYield } : {}),
         reasoningEffort: turn.reasoningEffort,
         latencyMode: turnExecutionPolicy.latencyMode,
@@ -677,7 +707,6 @@ export async function buildTurnAgent(deps: BuildTurnAgentDeps) {
             }),
         onRetainableSessionImageOutput: media.retainSessionImageAtToolBoundary,
         skillCatalog: deps.skillCatalog,
-        serverSkillReading: true,
         ...(!structuredWorkspacePolicyActive && workspaceAgentInstructions
           ? { instructionsTemplate: workspaceAgentInstructions }
           : {}),

package/src/activities/agent-turn/finalization.ts

@@ -1,5 +1,6 @@
 import {
   commitSessionAttemptQuiescence,
+  listPendingSessionTurns,
   recordCodexAccountUsageWithWakeTargets,
   releaseCodexCredentialLease,
   releaseXaiCredentialLease,
@@ -20,7 +21,11 @@ import type {
   SessionAttemptQuiescenceProof,
   TurnActivityServices as ActivityServices,
 } from "../types";
-import { captureWorkspaceRevision, openFreshWorkspaceCaptureSession } from "../workspace-capture";
+import {
+  captureWhileIdle,
+  captureWorkspaceRevision,
+  openFreshWorkspaceCaptureSession,
+} from "../workspace-capture";
 import { type ChannelASession } from "@opengeni/runtime/sandbox";
 import { createModelCheckpointMemoryCollector } from "../../model-checkpoint-memory-collector";
 import {
@@ -488,49 +493,60 @@ export async function finalizeTurnAttempt(deps: TurnFinalizationDeps): Promise<v
       deadlineRotationRequested: sandboxState.deadlineRotationRequested,
     });
     if (
+      settings.workspaceCaptureEnabled &&
       runTurnEndPersistence &&
       attempt.turnId &&
       sandboxState.resolvedSandbox &&
       sandboxState.setupBoxSession &&
       sandboxState.sandboxGroupId
     ) {
-      // Block new periodic snapshots, then drain any one already in flight.
-      // Keep the lease heartbeat itself running: capture may legitimately
-      // exceed the 90s holder TTL, and the reaper must remain unable to drain
-      // the exact box while this holder still reads it.
+      // Review reads yield to queued work. Recovery snapshots have their own
+      // physical-settlement requirement and are drained later in finalization.
       sandboxState.turnEndCaptureInProgress = true;
-      if (sandboxState.snapshotInFlight) {
-        await waitForWarmSnapshot(
-          sandboxState.snapshotInFlight,
-          settings.sandboxSnapshotTimeoutMs,
-          finalizerSignal,
-        );
-      }
-      const captureEstablished = sandboxState.resolvedSandbox.established;
-      await captureWorkspaceRevision({
-        db,
-        objectStorage,
-        settings,
-        publish: async (events) => {
-          await publishDurableSessionEvents(bus, input.workspaceId, input.sessionId, events);
-        },
-        session: sandboxState.setupBoxSession as ChannelASession,
-        openReadSession: async () =>
-          await openFreshWorkspaceCaptureSession({
-            backendId: captureEstablished.backendId,
-            client: captureEstablished.client,
-            session: sandboxState.setupBoxSession as ChannelASession,
-            expectedInstanceId: captureEstablished.instanceId,
-          }),
-        leaseEpoch: sandboxState.resolvedSandbox.leaseEpoch,
-        sandboxGroupId: sandboxState.sandboxGroupId,
-        accountId: input.accountId,
-        workspaceId: input.workspaceId,
-        sessionId: input.sessionId,
-        turnId: attempt.turnId,
-        attemptId: input.attemptId,
-        observability,
+      const captureSandbox = sandboxState.resolvedSandbox;
+      const captureSession = sandboxState.setupBoxSession as ChannelASession;
+      const captureGroupId = sandboxState.sandboxGroupId;
+      const captureTurnId = attempt.turnId;
+      await captureWhileIdle({
         ...(finalizerSignal ? { signal: finalizerSignal } : {}),
+        hasPendingWork: async () =>
+          (await listPendingSessionTurns(db, input.workspaceId, input.sessionId)).some(
+            (turn) => turn.id !== captureTurnId,
+          ),
+        capture: async (signal) => {
+          if (sandboxState.snapshotInFlight) {
+            await waitForWarmSnapshot(
+              sandboxState.snapshotInFlight,
+              settings.sandboxSnapshotTimeoutMs,
+              signal,
+            );
+          }
+          if (signal.aborted) return;
+          await captureWorkspaceRevision({
+            db,
+            objectStorage,
+            settings,
+            publish: async (events) =>
+              publishDurableSessionEvents(bus, input.workspaceId, input.sessionId, events),
+            session: captureSession,
+            openReadSession: async () =>
+              openFreshWorkspaceCaptureSession({
+                backendId: captureSandbox.established.backendId,
+                client: captureSandbox.established.client,
+                session: captureSession,
+                expectedInstanceId: captureSandbox.established.instanceId,
+              }),
+            leaseEpoch: captureSandbox.leaseEpoch,
+            sandboxGroupId: captureGroupId,
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            sessionId: input.sessionId,
+            turnId: captureTurnId,
+            attemptId: input.attemptId,
+            observability,
+            signal,
+          });
+        },
       });
     }
     eventing.toolPreparationClosing = true;

package/src/activities/agent-turn/skill-read.ts

@@ -1,9 +1,8 @@
 import type { AttemptToolDefinition } from "@opengeni/codemode";
 import {
-  assertSkillRelativePath,
+  listSkillPaths,
   PORTABLE_SKILL_MAX_FILES,
   readSkillFiles,
-  SKILL_READ_MAX_OUTPUT_BYTES,
   SKILL_READ_MAX_PATHS,
   type SkillTextFile,
 } from "@opengeni/runtime/skill-library";
@@ -74,7 +73,7 @@ export function createSkillReadAttemptToolDefinition(input: {
       const files = metadata ? metadata.files : (loaded as readonly SkillTextFile[]);
       const selected =
         args.listFiles === true
-          ? listSkillPaths(files)
+          ? listSkillPaths(files, PORTABLE_SKILL_MAX_FILES)
           : readSkillFiles(files, args.paths as string[] | undefined);
       const output = {
         ...(metadata
@@ -97,21 +96,3 @@ export function createSkillReadAttemptToolDefinition(input: {
     },
   };
 }
-
-/** Inventory never reads or serializes file bodies, including the entry point. */
-function listSkillPaths(files: readonly SkillTextFile[]): { paths: string[] } {
-  if (files.length > PORTABLE_SKILL_MAX_FILES) {
-    throw new Error(`Skill inventory exceeds ${PORTABLE_SKILL_MAX_FILES} files.`);
-  }
-  const seen = new Set<string>();
-  for (const { path } of files) {
-    assertSkillRelativePath(path);
-    if (seen.has(path)) throw new Error(`Duplicate stored Skill path: ${path}`);
-    seen.add(path);
-  }
-  const result = { paths: [...seen].sort() };
-  if (Buffer.byteLength(JSON.stringify(result), "utf8") > SKILL_READ_MAX_OUTPUT_BYTES) {
-    throw new Error("Skill inventory exceeds the read output limit.");
-  }
-  return result;
-}

package/src/activities/agent-turn/tool-environment.ts

@@ -1,6 +1,8 @@
 import { getWorkspaceConnectionModelRestrictions } from "@opengeni/db";
 import {
   beginConnectorActionExecution,
+  getExternalLinkTurnAuthorization,
+  getSessionTurnForAttempt,
   getWorkspaceVideoGenerationPolicy,
   listSkillDescriptors,
   completeConnectorActionExecution,
@@ -51,6 +53,7 @@ import {
   resolveWorkspaceModelSelection,
   withFrozenPersonalConnectionDelegations,
   resolveSessionToolPolicy,
+  hasPermission,
 } from "@opengeni/core";
 import { loadWorkspaceEnvironmentForRunWithCredentials } from "../environment";
 import { withFirstPartyTools } from "../goals";
@@ -60,7 +63,10 @@ import { ToolResultSpill } from "./tool-result-spill";
 import { createTurnMediaArtifacts } from "./media-artifacts";
 import { SandboxChannelAService } from "@opengeni/runtime/sandbox";
 import { sandboxRunAs } from "@opengeni/runtime";
-import { type ToolAuthNeededPayload } from "@opengeni/contracts";
+import {
+  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
+  type ToolAuthNeededPayload,
+} from "@opengeni/contracts";
 
 import {
   rollingSafeToolAuthNeededPayload,
@@ -508,6 +514,21 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
         };
       })()
     : undefined;
+  const linkedAuthority = await getExternalLinkTurnAuthorization(
+    db,
+    {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+    },
+    turn.id,
+  );
+  if (linkedAuthority && !linkedAuthority.authorized)
+    throw new Error("Native identity link was revoked");
+  const effectiveFirstPartyPermissions = linkedAuthority
+    ? (session.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS).filter(
+        (permission) => hasPermission(linkedAuthority.permissions, permission),
+      )
+    : session.firstPartyMcpPermissions;
   const selectedFirstPartyMcpTools = allowedFirstPartyMcpToolsForSession(
     runSettings,
     session.firstPartyMcpTools,
@@ -519,16 +540,21 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
       title: session.title,
       titleSource: session.titleSource,
       firstPartyMcpTools: selectedFirstPartyMcpTools,
-      firstPartyMcpPermissions: session.firstPartyMcpPermissions,
+      firstPartyMcpPermissions: effectiveFirstPartyPermissions,
     }),
     parallelGenerationAvailable: typeof runtime.generateSessionTitle === "function",
   });
   const googleDrivePublicationAllowed =
     selectedFirstPartyMcpTools.includes("editable_artifact_export") &&
     selectedFirstPartyMcpTools.includes("editable_artifact_export_status") &&
-    (!session.firstPartyMcpPermissions?.length ||
-      (session.firstPartyMcpPermissions.includes("artifacts:read") &&
-        session.firstPartyMcpPermissions.includes("artifacts:publish")));
+    hasPermission(
+      [...(effectiveFirstPartyPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS)],
+      "artifacts:read",
+    ) &&
+    hasPermission(
+      [...(effectiveFirstPartyPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS)],
+      "artifacts:publish",
+    );
   const googleDriveConnectorBindings: readonly AttemptConnectorActionBinding[] =
     googleDrivePublicationTool && googleDrivePublicationTarget && googleDrivePublicationAllowed
       ? [
@@ -760,9 +786,7 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
         attemptId: input.attemptId,
         executionGeneration: attempt.executionGeneration,
       },
-      ...(session.firstPartyMcpPermissions?.length
-        ? { permissions: session.firstPartyMcpPermissions }
-        : {}),
+      ...(effectiveFirstPartyPermissions ? { permissions: effectiveFirstPartyPermissions } : {}),
       selectedTools: selectedFirstPartyMcpTools,
       subjectId: "worker:first-party-mcp",
       subjectLabel: "OpenGeni worker",
@@ -852,6 +876,24 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
         ...(credentialSubjectId ? { credentialSubjectId } : {}),
         ...(codexAppsAuth ? { codexAppsAuth } : {}),
         resolveCredential,
+        ...(linkedAuthority
+          ? {
+              authorizeAttemptExecution: async () => {
+                const current = await getSessionTurnForAttempt(
+                  db,
+                  input.workspaceId,
+                  input.sessionId,
+                  input.attemptId,
+                );
+                if (
+                  !current ||
+                  current.id !== turn.id ||
+                  current.executionGeneration !== attempt.executionGeneration
+                )
+                  throw new Error("The linked agent attempt is no longer authorized");
+              },
+            }
+          : {}),
         onAuthNeeded: publishToolAuthNeeded,
         materializeConnectorAttachments,
         refreshOwnedCommand: async (commandId) => {
@@ -885,8 +927,8 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
         },
         // Manager-style sessions carry a creation-validated permission set
         // for their first-party MCP token; null keeps the fixed default.
-        ...(session.firstPartyMcpPermissions?.length
-          ? { firstPartyPermissions: session.firstPartyMcpPermissions }
+        ...(effectiveFirstPartyPermissions
+          ? { firstPartyPermissions: effectiveFirstPartyPermissions }
           : {}),
         firstPartyTools: titleToolPlan.remoteFirstPartyMcpTools,
         nestedAgentDepth: session.nestedAgentDepth,

package/src/activities/mcp-credentials.ts

@@ -3,6 +3,8 @@ import type { ConnectionCredentialsPort } from "@opengeni/contracts";
 import {
   buildConnectionTokenResolver,
   buildHostConnectionTokenResolver,
+  getSessionTurnForAttempt,
+  authorizeDirectHostMcpUse,
   resolveAcceptedConnectionUse,
   sessionTenancyProductActivated,
   type Database,
@@ -26,13 +28,18 @@ export function connectionTokenResolverForTurn(input: {
   attemptId: string;
   turn: SessionTurnForExecution;
   authorizeAcceptedUse?: typeof resolveAcceptedConnectionUse;
+  /** Test seam; production always reads the canonical active-attempt projection. */
+  getHostTurnForAttempt?: typeof getSessionTurnForAttempt;
   /** Test seam for the activation fence on pre-snapshot workspace refs. */
   isSessionTenancyProductActivated?: typeof sessionTenancyProductActivated;
   /** Optional; used only for content-free compatibility-lane counters. */
   observability?: Observability | null | undefined;
 }): (request: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult> {
   const hostResolver = input.connectionCredentials?.mcpCredentials;
-  const baseResolver = hostResolver
+  const readHostTurn = input.getHostTurnForAttempt ?? getSessionTurnForAttempt;
+  const hostDb = input.db;
+  const nativeResolver = buildConnectionTokenResolver(input.db, input.settings);
+  const configuredResolver = hostResolver
     ? buildHostConnectionTokenResolver(hostResolver, {
         accountId: input.accountId,
         workspaceId: input.workspaceId,
@@ -44,8 +51,40 @@ export function connectionTokenResolverForTurn(input: {
         initiator: input.turn.initiator,
         initiatorContext: input.turn.initiatorContext,
         surface: "model",
+        // Only immutable captured direct-turn authority is currently supported.
+        // Direct, scheduled and exact causal/child snapshots are validated;
+        // no authority follows merely from a binding or creator identity.
+        authorizeDurableBinding: (request) => authorizeDirectHostMcpUse(hostDb, request),
+        authorizeExecution: async (request) => {
+          // Native UUID references already pass the accepted-use boundary below.
+          // Legacy opaque host IDs retain their compatibility path, but not a
+          // right to execute after their accepted attempt has stopped.
+          if (
+            request.connectionRef.authoritySource !== "host" &&
+            (!request.connectionRef.connectionId ||
+              OPENGENI_CONNECTION_ID_PATTERN.test(request.connectionRef.connectionId))
+          )
+            return true;
+          if (!request.attemptId) return false;
+          const current = await readHostTurn(
+            hostDb,
+            request.workspaceId,
+            request.sessionId,
+            request.attemptId,
+          );
+          return (
+            current !== null &&
+            current.id === request.turnId &&
+            current.executionGeneration === request.executionGeneration
+          );
+        },
       })
-    : buildConnectionTokenResolver(input.db, input.settings);
+    : nativeResolver;
+  const baseResolver = (request: ResolveConnectionCredentialInput) =>
+    input.connectionCredentials?.mcpAuthoritySource === "host" &&
+    request.connectionRef.authoritySource !== "host"
+      ? nativeResolver(request)
+      : configuredResolver(request);
   return async (request) => {
     // Host-owned refs carry explicit provenance because their opaque ids may
     // themselves be valid UUIDs. They never enter OpenGeni's native connection
@@ -76,6 +115,7 @@ export function connectionTokenResolverForTurn(input: {
     // so UUID-shaped host ids are unambiguous.
     if (
       hostResolver &&
+      input.connectionCredentials?.mcpAuthoritySource !== "host" &&
       request.connectionRef.connectionId &&
       !OPENGENI_CONNECTION_ID_PATTERN.test(request.connectionRef.connectionId)
     ) {

package/src/activities/scheduled-tasks.ts

@@ -8,7 +8,6 @@ import {
   SCHEDULED_TASK_OCCURRENCE_PAYLOAD_MAX_BYTES,
   ScheduledTaskRunAcceptedExecution,
   SessionAgentAccess,
-  SessionEndUser,
   SessionMemoryScope,
   normalizeAutomaticSessionTitle,
   scheduledOccurrencePayloadUtf8Bytes,
@@ -2578,26 +2577,29 @@ async function replayScheduledTaskDispatch(input: {
  * facts the creating session projection exposed at task creation are set;
  * a null (or no longer valid) key leaves the generated session on its own
  * default. The field names are the session access-scope contract
- * (`agentAccess`, `endUser`, `memoryScope`) consumed by session create.
+ * (`agentAccess`, `scopeSubjectId`, `memoryScope`) consumed by session create.
  */
 function scheduledCreatorSessionPolicyInput(
   policy: {
     agentAccess: string | null;
-    endUser: { source: string; id: string } | null;
+    scopeSubjectId: string | null;
     memoryScope: string | null;
   } | null,
 ): {
   agentAccess?: SessionAgentAccess;
-  endUser?: SessionEndUser;
+  scopeSubjectId?: string;
   memoryScope?: SessionMemoryScope;
 } {
   if (!policy) return {};
   const agentAccess = SessionAgentAccess.safeParse(policy.agentAccess);
-  const endUser = SessionEndUser.safeParse(policy.endUser);
   const memoryScope = SessionMemoryScope.safeParse(policy.memoryScope);
   return {
     ...(agentAccess.success ? { agentAccess: agentAccess.data } : {}),
-    ...(endUser.success ? { endUser: endUser.data } : {}),
+    // This is a trusted DB admission input, not the public create payload.
+    // Preserve the immutable creator policy through scheduled materialization.
+    ...(policy.scopeSubjectId && /^(?:user:|external_user:).+/u.test(policy.scopeSubjectId)
+      ? { scopeSubjectId: policy.scopeSubjectId }
+      : {}),
     ...(memoryScope.success ? { memoryScope: memoryScope.data } : {}),
   };
 }