@opengeni/worker-bundle 0.27.3 → 0.28.1-canary.0

package/dist/activities/mcp-credentials.d.ts

@@ -1,6 +1,6 @@
 import type { Settings } from "@opengeni/config";
 import type { ConnectionCredentialsPort } from "@opengeni/contracts";
-import { resolveAcceptedConnectionUse, sessionTenancyProductActivated, type Database, type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult, type SessionTurnForExecution } from "@opengeni/db";
+import { getSessionTurnForAttempt, resolveAcceptedConnectionUse, sessionTenancyProductActivated, type Database, type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult, type SessionTurnForExecution } from "@opengeni/db";
 import { type Observability } from "@opengeni/observability";
 export declare function connectionTokenResolverForTurn(input: {
     db: Database;
@@ -13,6 +13,8 @@ export declare function connectionTokenResolverForTurn(input: {
     attemptId: string;
     turn: SessionTurnForExecution;
     authorizeAcceptedUse?: typeof resolveAcceptedConnectionUse;
+    /** Test seam; production always reads the canonical active-attempt projection. */
+    getHostTurnForAttempt?: typeof getSessionTurnForAttempt;
     /** Test seam for the activation fence on pre-snapshot workspace refs. */
     isSessionTenancyProductActivated?: typeof sessionTenancyProductActivated;
     /** Optional; used only for content-free compatibility-lane counters. */

package/dist/activities/workspace-capture.d.ts

@@ -92,6 +92,15 @@ export declare function openFreshWorkspaceCaptureSession(input: {
 /** One discovered repository is all-or-nothing capture authority. A provider
  * transport failure must never be represented as an authoritative empty diff. */
 export declare function readCaptureRepository(svc: Pick<SandboxChannelAService, "gitStatus" | "gitDiff">, root: string): Promise<CaptureRepositoryReadResult>;
+/** Review work may use idle time, but must yield to the next turn. Poll durable
+ * queue state rather than relying on best-effort event delivery. The capture
+ * already fences every continuation on this signal; no replacement writer is
+ * admitted until its caller returns. */
+export declare function captureWhileIdle(input: {
+    hasPendingWork: () => Promise<boolean>;
+    capture: (signal: AbortSignal) => Promise<void>;
+    signal?: AbortSignal;
+}): Promise<void>;
 /**
  * Turn-end entrypoint. Gates on the flag + configured object storage, races the
  * whole capture against a 120s cap, and swallows every failure ("turn outcome
@@ -110,6 +119,8 @@ export declare function captureWorkspaceRevision(input: CaptureWorkspaceRevision
 export declare function changeFingerprint(repos: WorkspaceCaptureRepo[], files: WorkspaceCaptureFile[]): string;
 /** Join a repo-root-relative path onto its workspace-relative repo root. */
 export declare function joinRepoPath(repoRoot: string, repoRelPath: string): string;
-/** Content-addressed after-image blob key (shared across revisions → GC input). */
+/** Content-addressed after-image blob key, optionally in a unique capture namespace. */
 export declare function blobKey(workspaceId: string, sessionId: string, sha256Hex: string): string;
+/** Only pass the latest retained revision's keys: older refs may be under deletion. */
+export declare function retainedCaptureBlobRefs(workspaceId: string, sessionId: string, latestKeys: string[]): Map<string, string>;
 export {};

package/dist/{activities-control-WZRFEIJH.js → activities-control-VVK7RA7F.js}

@@ -33,7 +33,7 @@ import {
   scheduledUserMessagePayload,
   withFirstPartyTools,
   workflowIdForSession
-} from "./chunk-C54VDT6I.js";
+} from "./chunk-AKP6BKM2.js";
 import {
   inspectOpenSandboxKubernetesInventory,
   recordCreditBalanceGauges,
@@ -7448,7 +7448,6 @@ import {
   SCHEDULED_TASK_OCCURRENCE_PAYLOAD_MAX_BYTES,
   ScheduledTaskRunAcceptedExecution,
   SessionAgentAccess,
-  SessionEndUser,
   SessionMemoryScope,
   normalizeAutomaticSessionTitle,
   scheduledOccurrencePayloadUtf8Bytes,
@@ -9564,11 +9563,12 @@ async function replayScheduledTaskDispatch(input) {
 function scheduledCreatorSessionPolicyInput(policy) {
   if (!policy) return {};
   const agentAccess = SessionAgentAccess.safeParse(policy.agentAccess);
-  const endUser = SessionEndUser.safeParse(policy.endUser);
   const memoryScope = SessionMemoryScope.safeParse(policy.memoryScope);
   return {
     ...agentAccess.success ? { agentAccess: agentAccess.data } : {},
-    ...endUser.success ? { endUser: endUser.data } : {},
+    // This is a trusted DB admission input, not the public create payload.
+    // Preserve the immutable creator policy through scheduled materialization.
+    ...policy.scopeSubjectId && /^(?:user:|external_user:).+/u.test(policy.scopeSubjectId) ? { scopeSubjectId: policy.scopeSubjectId } : {},
     ...memoryScope.success ? { memoryScope: memoryScope.data } : {}
   };
 }
@@ -10350,4 +10350,4 @@ export {
   createControlActivities,
   createControlActivitiesFromServices
 };
-//# sourceMappingURL=activities-control-WZRFEIJH.js.map
+//# sourceMappingURL=activities-control-VVK7RA7F.js.map