@opengeni/worker-bundle 0.27.3 → 0.28.3-canary.0

package/src/activities/sandbox-lease.ts

@@ -82,7 +82,10 @@ import {
   // box is typed as provider loss. Stale capture reconciliation separately uses
   // establishSandboxSessionFromEnvelope in strict resume-only mode so it can
   // reuse the runtime's provider-ready proof without ever cold-restoring.
-  captureVerifiedWorkspaceArchive,
+  captureWorkspaceArchiveForStorage,
+  disposeWorkspaceArchive,
+  type VerifiedWorkspaceArchivePayload,
+  type VerifiedHostWorkspaceArchive,
   cancelSelfhostedOp,
   assertConsistentSandboxProviderIdentity,
   createSandboxClientForBackend,
@@ -160,9 +163,7 @@ import {
 } from "../opensandbox-kubernetes-inventory";
 import type { ObjectStorage } from "@opengeni/storage";
 import {
-  collectWorkspaceArchiveObjectKeys,
-  deleteUnpublishedWorkspaceArchiveObject,
-  deleteWorkspaceArchiveObjectKeys,
+  persistWorkspaceArchiveCandidate,
   putVersion1TarArchiveOrInline,
 } from "../sandbox-archive-storage";
 
@@ -210,7 +211,7 @@ type DrainSandboxClient = {
  * aborts the terminate before client.delete()).
  */
 export type PersistArchiveFn = (
-  archiveBase64: string | null,
+  archiveBase64: string | VerifiedHostWorkspaceArchive | null,
   archiveMetadata?: WorkspaceArchiveDescriptor,
   providerSession?: unknown,
   providerBinding?: Awaited<
@@ -247,6 +248,7 @@ export type TerminateBoxFn = (
   providerCaptureRequestId?: string,
   captureDisposition?: DrainCaptureDisposition,
   capturePolicy?: ProviderWorkspaceCapturePolicy | null,
+  diskBackedArchives?: boolean,
 ) => Promise<boolean | ProviderTerminationOutcome>;
 
 export type SweepModalOrphansFn = (
@@ -479,6 +481,7 @@ export function createSandboxLeaseActivities(
       providerCaptureRequestId,
       captureDisposition,
       capturePolicy,
+      diskBackedArchives,
     ) =>
       await terminateProviderBox(
         settings,
@@ -490,6 +493,7 @@ export function createSandboxLeaseActivities(
         providerCaptureRequestId,
         captureDisposition,
         capturePolicy,
+        diskBackedArchives,
       ));
   const sweepModalOrphans: SweepModalOrphansFn =
     options.sweepModalOrphans ?? sweepModalOrphansForConfiguredBackend;
@@ -2675,7 +2679,7 @@ async function terminateDrainableBox(
       ? (lease.recovery.archive.current?.revision ?? null)
       : null;
   const persistArchive: PersistArchiveFn = async (
-    archiveBase64: string | null,
+    archiveBase64: string | VerifiedHostWorkspaceArchive | null,
     archiveMetadata?: WorkspaceArchiveDescriptor,
     _providerSession?: unknown,
     providerBinding?: Awaited<
@@ -2691,6 +2695,7 @@ async function terminateDrainableBox(
     const archiveMetrics = runtimeMetricsHooksForObservability(observability);
     let checkpointArtifactId: string | null = null;
     if (
+      typeof archiveBase64 === "string" &&
       archiveBase64 &&
       archiveMetadata?.version === 2 &&
       (archiveMetadata.provider === "modal_snapshot_filesystem" ||
@@ -2735,59 +2740,33 @@ async function terminateDrainableBox(
       if (!archiveMetadata) {
         throw new Error("Sandbox snapshot publication requires a verified archive descriptor");
       }
-      const priorKeys = collectWorkspaceArchiveObjectKeys(
-        (lease.resumeState as Record<string, unknown> | null | undefined) ?? null,
-      );
-      let workspaceArchiveRef:
-        | Awaited<ReturnType<typeof putVersion1TarArchiveOrInline>>["workspaceArchiveRef"]
-        | undefined;
-      try {
-        const published = await putVersion1TarArchiveOrInline({
-          backend: lease.backend,
-          objectStorage,
-          accountId,
-          workspaceId: row.workspaceId,
-          sandboxGroupId: row.sandboxGroupId,
-          archive: {
-            bytes: Buffer.from(archiveBase64, "base64"),
-            descriptor: archiveMetadata,
-            base64: archiveBase64,
-          },
-          metrics: archiveMetrics,
-        });
-        workspaceArchiveRef = published.workspaceArchiveRef;
-        result = await persistDrainSnapshot(db, {
-          ...baseInput,
-          workspaceArchiveMeta: archiveMetadata,
-          ...published,
-          ...(checkpointArtifactId ? { checkpointArtifactId } : {}),
-        });
-        if (published.workspaceArchiveRef && objectStorage) {
-          if (!result.wrote) {
-            await deleteUnpublishedWorkspaceArchiveObject(
-              objectStorage,
-              published.workspaceArchiveRef,
-              archiveMetrics,
-            );
-          } else {
-            const afterLease = await readLease(db, row.workspaceId, row.sandboxGroupId);
-            const afterKeys = collectWorkspaceArchiveObjectKeys(
-              (afterLease?.resumeState as Record<string, unknown> | null | undefined) ?? null,
-            );
-            await deleteWorkspaceArchiveObjectKeys(
-              objectStorage,
-              [...priorKeys].filter((key) => !afterKeys.has(key)),
-            ).catch(() => undefined);
-          }
-        }
-      } catch (error) {
-        await deleteUnpublishedWorkspaceArchiveObject(
-          objectStorage,
-          workspaceArchiveRef,
-          archiveMetrics,
-        );
-        throw error;
-      }
+      const published = await putVersion1TarArchiveOrInline({
+        backend: lease.backend,
+        objectStorage,
+        accountId,
+        workspaceId: row.workspaceId,
+        sandboxGroupId: row.sandboxGroupId,
+        archive:
+          typeof archiveBase64 === "object"
+            ? archiveBase64
+            : {
+                bytes: Buffer.from(archiveBase64, "base64"),
+                descriptor: archiveMetadata,
+                base64: archiveBase64,
+              },
+        metrics: archiveMetrics,
+      });
+      result = await persistWorkspaceArchiveCandidate({
+        objectStorage,
+        ...(published.workspaceArchiveRef ? { ref: published.workspaceArchiveRef } : {}),
+        persist: () =>
+          persistDrainSnapshot(db, {
+            ...baseInput,
+            workspaceArchiveMeta: archiveMetadata,
+            ...published,
+            ...(checkpointArtifactId ? { checkpointArtifactId } : {}),
+          }),
+      });
     }
     if (!result.wrote && checkpointArtifactId) {
       await markSandboxCheckpointArtifactDeletePending(db, {
@@ -2823,6 +2802,7 @@ async function terminateDrainableBox(
         captureClaim?.providerRequestId ?? attempt.operationId,
         captureDisposition,
         capturePolicy,
+        Boolean(objectStorage),
       );
   const terminated = typeof termination === "boolean" ? termination : termination.terminated;
   if (!terminated) {
@@ -2955,6 +2935,7 @@ export async function terminateProviderBox(
   providerCaptureRequestId?: string,
   captureDisposition: DrainCaptureDisposition = "capture_required",
   claimedCapturePolicy?: ProviderWorkspaceCapturePolicy | null,
+  diskBackedArchives = false,
 ): Promise<ProviderTerminationOutcome> {
   const durableBackendId = (lease.resumeBackendId ?? lease.backend) as string;
   const backend = sandboxBackendForSdkBackendId(durableBackendId) ?? durableBackendId;
@@ -3147,7 +3128,7 @@ export async function terminateProviderBox(
   // snapshot must re-throw BEFORE any terminate so files are never lost — the next
   // sweep retries, the provider idle-timeout is the backstop. A NotFound here (the
   // box raced gone between resume and persist) is success: nothing to persist.
-  let verifiedArchive: Awaited<ReturnType<typeof captureVerifiedWorkspaceArchive>> | undefined;
+  let verifiedArchive: VerifiedWorkspaceArchivePayload | undefined;
   const sessionWorkspacePersistence = (
     session as { state?: { workspacePersistence?: unknown } } | undefined
   )?.state?.workspacePersistence;
@@ -3162,10 +3143,15 @@ export async function terminateProviderBox(
       : null;
   try {
     if (captureDisposition !== "archive_published" && session?.persistWorkspace) {
-      const capture = captureVerifiedWorkspaceArchive(session, Date.now(), {
-        requestId: providerCaptureRequestId ?? randomUUID(),
-        strategy: liveCapturePolicy.strategy,
-      });
+      const capture = captureWorkspaceArchiveForStorage(
+        session,
+        Date.now(),
+        {
+          requestId: providerCaptureRequestId ?? randomUUID(),
+          strategy: liveCapturePolicy.strategy,
+        },
+        diskBackedArchives,
+      );
       verifiedArchive = await awaitProviderCaptureWithLatePublication({
         capture,
         timeoutMs: settings.sandboxSnapshotTimeoutMs,
@@ -3179,7 +3165,7 @@ export async function terminateProviderBox(
         publishLate: async (archive) => {
           try {
             const result = await persistArchive(
-              archive.base64,
+              archive.kind === "host_spool" ? archive : archive.base64,
               archive.descriptor,
               session,
               checkpointBinding,
@@ -3197,6 +3183,8 @@ export async function terminateProviderBox(
               ...logIdentity,
               error: error instanceof Error ? error.message : String(error),
             });
+          } finally {
+            await disposeWorkspaceArchive(archive);
           }
         },
         observeLateFailure: (error) => {
@@ -3237,12 +3225,17 @@ export async function terminateProviderBox(
       ...logIdentity,
     });
   } else if (verifiedArchive) {
-    const { wrote } = await persistArchive(
-      verifiedArchive.base64,
-      verifiedArchive.descriptor,
-      session,
-      checkpointBinding,
-    );
+    let wrote: boolean;
+    try {
+      ({ wrote } = await persistArchive(
+        verifiedArchive.kind === "host_spool" ? verifiedArchive : verifiedArchive.base64,
+        verifiedArchive.descriptor,
+        session,
+        checkpointBinding,
+      ));
+    } finally {
+      await disposeWorkspaceArchive(verifiedArchive);
+    }
     if (!wrote) {
       observability.info(
         "sandbox reaper: lease re-armed during persist — leaving box RUNNING (no terminate)",

package/src/activities/scheduled-tasks.ts

@@ -8,7 +8,6 @@ import {
   SCHEDULED_TASK_OCCURRENCE_PAYLOAD_MAX_BYTES,
   ScheduledTaskRunAcceptedExecution,
   SessionAgentAccess,
-  SessionEndUser,
   SessionMemoryScope,
   normalizeAutomaticSessionTitle,
   scheduledOccurrencePayloadUtf8Bytes,
@@ -2578,26 +2577,29 @@ async function replayScheduledTaskDispatch(input: {
  * facts the creating session projection exposed at task creation are set;
  * a null (or no longer valid) key leaves the generated session on its own
  * default. The field names are the session access-scope contract
- * (`agentAccess`, `endUser`, `memoryScope`) consumed by session create.
+ * (`agentAccess`, `scopeSubjectId`, `memoryScope`) consumed by session create.
  */
 function scheduledCreatorSessionPolicyInput(
   policy: {
     agentAccess: string | null;
-    endUser: { source: string; id: string } | null;
+    scopeSubjectId: string | null;
     memoryScope: string | null;
   } | null,
 ): {
   agentAccess?: SessionAgentAccess;
-  endUser?: SessionEndUser;
+  scopeSubjectId?: string;
   memoryScope?: SessionMemoryScope;
 } {
   if (!policy) return {};
   const agentAccess = SessionAgentAccess.safeParse(policy.agentAccess);
-  const endUser = SessionEndUser.safeParse(policy.endUser);
   const memoryScope = SessionMemoryScope.safeParse(policy.memoryScope);
   return {
     ...(agentAccess.success ? { agentAccess: agentAccess.data } : {}),
-    ...(endUser.success ? { endUser: endUser.data } : {}),
+    // This is a trusted DB admission input, not the public create payload.
+    // Preserve the immutable creator policy through scheduled materialization.
+    ...(policy.scopeSubjectId && /^(?:user:|external_user:).+/u.test(policy.scopeSubjectId)
+      ? { scopeSubjectId: policy.scopeSubjectId }
+      : {}),
     ...(memoryScope.success ? { memoryScope: memoryScope.data } : {}),
   };
 }