@opengeni/worker-bundle 0.28.3-canary.0 → 0.28.3

package/dist/activities/sandbox-lease.d.ts

@@ -2,7 +2,7 @@ import type { ProviderCommandPersistence } from "@opengeni/runtime";
 import { type OpStatus } from "@opengeni/agent-proto";
 import { listLiveModalSandboxLeaseAttributions, readLease, type ReapDrainable, type RetainedProcessProviderProof, type SandboxRetainedProcess, type LeaseSnapshot } from "@opengeni/db";
 import { type ConnectedMachineBackgroundCommandClaim, type ConnectedMachineBackgroundCommandProof } from "@opengeni/db/session-background-commands";
-import { type VerifiedHostWorkspaceArchive, createSandboxClientForBackend, inspectModalSandboxLifecycle, resolveModalCheckpointProviderBindingForSession, terminateModalSandboxById, type ModalOrphanSweepTermination, type ModalCheckpointProviderBinding, type ProviderWorkspaceCapturePolicy, type WorkspaceArchiveDescriptor, type ControlRpc } from "@opengeni/runtime/sandbox";
+import { createSandboxClientForBackend, inspectModalSandboxLifecycle, resolveModalCheckpointProviderBindingForSession, terminateModalSandboxById, type ModalOrphanSweepTermination, type ModalCheckpointProviderBinding, type ProviderWorkspaceCapturePolicy, type WorkspaceArchiveDescriptor, type ControlRpc } from "@opengeni/runtime/sandbox";
 import { type SandboxDrainActivityInput, type SandboxLeaseSweepMaintenanceInput } from "../sandbox-reaper-contract.js";
 import type { ControlActivityServices as ActivityServices } from "./types.js";
 import { type RetainedProcessReconciliationOutcome } from "../observability-metrics.js";
@@ -40,7 +40,7 @@ type CreateSandboxClientForBackendFn = typeof createSandboxClientForBackend;
  * backends with no persistWorkspace — ensures a re-arm during the snapshot window
  * aborts the terminate before client.delete()).
  */
-export type PersistArchiveFn = (archiveBase64: string | VerifiedHostWorkspaceArchive | null, archiveMetadata?: WorkspaceArchiveDescriptor, providerSession?: unknown, providerBinding?: Awaited<ReturnType<typeof resolveModalCheckpointProviderBindingForSession>> | null) => Promise<{
+export type PersistArchiveFn = (archiveBase64: string | null, archiveMetadata?: WorkspaceArchiveDescriptor, providerSession?: unknown, providerBinding?: Awaited<ReturnType<typeof resolveModalCheckpointProviderBindingForSession>> | null) => Promise<{
     wrote: boolean;
     archiveRevision?: string | null;
 }>;
@@ -60,7 +60,7 @@ export type DrainCaptureDisposition = "capture_required" | "archive_published";
  *  Test seams may return the legacy boolean shorthand. Production returns the
  *  typed outcome so the cold commit can distinguish a clean stop from definitive
  *  provider disappearance before capture. */
-export type TerminateBoxFn = (settings: ActivityServices["settings"], lease: NonNullable<Awaited<ReturnType<typeof readLease>>>, observability: ActivityServices["observability"], persistArchive: PersistArchiveFn, providerCaptureRequestId?: string, captureDisposition?: DrainCaptureDisposition, capturePolicy?: ProviderWorkspaceCapturePolicy | null, diskBackedArchives?: boolean) => Promise<boolean | ProviderTerminationOutcome>;
+export type TerminateBoxFn = (settings: ActivityServices["settings"], lease: NonNullable<Awaited<ReturnType<typeof readLease>>>, observability: ActivityServices["observability"], persistArchive: PersistArchiveFn, providerCaptureRequestId?: string, captureDisposition?: DrainCaptureDisposition, capturePolicy?: ProviderWorkspaceCapturePolicy | null) => Promise<boolean | ProviderTerminationOutcome>;
 export type SweepModalOrphansFn = (settings: ActivityServices["settings"], db: ActivityServices["db"], observability: ActivityServices["observability"]) => Promise<number>;
 export type InspectOpenSandboxKubernetesInventoryFn = (input: {
     namespace: string;
@@ -199,4 +199,4 @@ export declare function sandboxDrainReason(lease: Pick<LeaseSnapshot, "rotationR
  * draining until its adapter can prove termination. A truly instance-less or
  * `none`-backed row is a no-op.
  */
-export declare function terminateProviderBox(settings: ActivityServices["settings"], lease: NonNullable<Awaited<ReturnType<typeof readLease>>>, observability: ActivityServices["observability"], persistArchive: PersistArchiveFn, createClientForBackend?: CreateSandboxClientForBackendFn, terminateModalById?: typeof terminateModalSandboxById, providerCaptureRequestId?: string, captureDisposition?: DrainCaptureDisposition, claimedCapturePolicy?: ProviderWorkspaceCapturePolicy | null, diskBackedArchives?: boolean): Promise<ProviderTerminationOutcome>;
+export declare function terminateProviderBox(settings: ActivityServices["settings"], lease: NonNullable<Awaited<ReturnType<typeof readLease>>>, observability: ActivityServices["observability"], persistArchive: PersistArchiveFn, createClientForBackend?: CreateSandboxClientForBackendFn, terminateModalById?: typeof terminateModalSandboxById, providerCaptureRequestId?: string, captureDisposition?: DrainCaptureDisposition, claimedCapturePolicy?: ProviderWorkspaceCapturePolicy | null): Promise<ProviderTerminationOutcome>;

package/dist/{activities-control-JUBMDBDZ.js → activities-control-UXGPMDL3.js}

@@ -10,16 +10,18 @@ import {
   MAX_AUTOMATIC_PROVIDER_RECOVERIES,
   assertReusableSessionRevivable,
   captureConnectedCommandOutput,
+  collectWorkspaceArchiveObjectKeys,
   createCodexCapacityActivities,
   createGoalActivities,
   createSharedActivityServices,
   currentActivityContext,
+  deleteUnpublishedWorkspaceArchiveObject,
+  deleteWorkspaceArchiveObjectKeys,
   deliverFailedChildTurnToParent,
   evaluateIncidentTelemetryPreflight,
   incidentTelemetryAuthorityFence,
   incidentTelemetryPreflightDeclaration,
   notifyParentOfChildIdle,
-  persistWorkspaceArchiveCandidate,
   providerRecoveryCountFromMetadata,
   putVersion1TarArchiveOrInline,
   reconcileAutomaticSessionTitleFanout,
@@ -31,7 +33,7 @@ import {
   scheduledUserMessagePayload,
   withFirstPartyTools,
   workflowIdForSession
-} from "./chunk-ZNIKZQMN.js";
+} from "./chunk-NNXLW6V7.js";
 import {
   inspectOpenSandboxKubernetesInventory,
   recordCreditBalanceGauges,
@@ -51,7 +53,7 @@ import {
   recordTurnsQueuedGauge,
   recordWorkerDeathRecoveryMetrics,
   runtimeMetricsHooksForObservability
-} from "./chunk-A4XQWVZK.js";
+} from "./chunk-BARTLVBK.js";
 
 // src/activities/browser-state-artifact-reaper.ts
 import {
@@ -5241,8 +5243,7 @@ import { sandboxWarmRateMicrosPerSecond } from "@opengeni/config";
 import { appendSessionCommandOutput } from "@opengeni/db/session-command-output";
 import { sandboxLeaseTelemetryKey } from "@opengeni/observability";
 import {
-  captureWorkspaceArchiveForStorage,
-  disposeWorkspaceArchive,
+  captureVerifiedWorkspaceArchive,
   cancelSelfhostedOp,
   assertConsistentSandboxProviderIdentity,
   createSandboxClientForBackend,
@@ -5361,7 +5362,7 @@ function sandboxDrainActivityAttempt() {
   }
 }
 function createSandboxLeaseActivities(services, options = {}) {
-  const terminateBox = options.terminateBox ?? (async (settings, lease, observability, persistArchive, providerCaptureRequestId, captureDisposition, capturePolicy, diskBackedArchives) => await terminateProviderBox(
+  const terminateBox = options.terminateBox ?? (async (settings, lease, observability, persistArchive, providerCaptureRequestId, captureDisposition, capturePolicy) => await terminateProviderBox(
     settings,
     lease,
     observability,
@@ -5370,8 +5371,7 @@ function createSandboxLeaseActivities(services, options = {}) {
     terminateModalSandboxById,
     providerCaptureRequestId,
     captureDisposition,
-    capturePolicy,
-    diskBackedArchives
+    capturePolicy
   ));
   const sweepModalOrphans = options.sweepModalOrphans ?? sweepModalOrphansForConfiguredBackend;
   const inspectOpenSandboxInventory = options.inspectOpenSandboxKubernetesInventory ?? inspectOpenSandboxKubernetesInventory;
@@ -7044,7 +7044,7 @@ async function terminateDrainableBox(db, settings, row, observability, terminate
     }
     const archiveMetrics = runtimeMetricsHooksForObservability(observability);
     let checkpointArtifactId = null;
-    if (typeof archiveBase64 === "string" && archiveBase64 && archiveMetadata?.version === 2 && (archiveMetadata.provider === "modal_snapshot_filesystem" || archiveMetadata.provider === "modal_snapshot_directory")) {
+    if (archiveBase64 && archiveMetadata?.version === 2 && (archiveMetadata.provider === "modal_snapshot_filesystem" || archiveMetadata.provider === "modal_snapshot_directory")) {
       if (!providerBinding) {
         throw new Error("Modal native snapshot has no exact session provider identity");
       }
@@ -7084,29 +7084,57 @@ async function terminateDrainableBox(db, settings, row, observability, terminate
       if (!archiveMetadata) {
         throw new Error("Sandbox snapshot publication requires a verified archive descriptor");
       }
-      const published = await putVersion1TarArchiveOrInline({
-        backend: lease.backend,
-        objectStorage,
-        accountId,
-        workspaceId: row.workspaceId,
-        sandboxGroupId: row.sandboxGroupId,
-        archive: typeof archiveBase64 === "object" ? archiveBase64 : {
-          bytes: Buffer.from(archiveBase64, "base64"),
-          descriptor: archiveMetadata,
-          base64: archiveBase64
-        },
-        metrics: archiveMetrics
-      });
-      result = await persistWorkspaceArchiveCandidate({
-        objectStorage,
-        ...published.workspaceArchiveRef ? { ref: published.workspaceArchiveRef } : {},
-        persist: () => persistDrainSnapshot(db, {
+      const priorKeys = collectWorkspaceArchiveObjectKeys(
+        lease.resumeState ?? null
+      );
+      let workspaceArchiveRef;
+      try {
+        const published = await putVersion1TarArchiveOrInline({
+          backend: lease.backend,
+          objectStorage,
+          accountId,
+          workspaceId: row.workspaceId,
+          sandboxGroupId: row.sandboxGroupId,
+          archive: {
+            bytes: Buffer.from(archiveBase64, "base64"),
+            descriptor: archiveMetadata,
+            base64: archiveBase64
+          },
+          metrics: archiveMetrics
+        });
+        workspaceArchiveRef = published.workspaceArchiveRef;
+        result = await persistDrainSnapshot(db, {
           ...baseInput,
           workspaceArchiveMeta: archiveMetadata,
           ...published,
           ...checkpointArtifactId ? { checkpointArtifactId } : {}
-        })
-      });
+        });
+        if (published.workspaceArchiveRef && objectStorage) {
+          if (!result.wrote) {
+            await deleteUnpublishedWorkspaceArchiveObject(
+              objectStorage,
+              published.workspaceArchiveRef,
+              archiveMetrics
+            );
+          } else {
+            const afterLease = await readLease(db, row.workspaceId, row.sandboxGroupId);
+            const afterKeys = collectWorkspaceArchiveObjectKeys(
+              afterLease?.resumeState ?? null
+            );
+            await deleteWorkspaceArchiveObjectKeys(
+              objectStorage,
+              [...priorKeys].filter((key) => !afterKeys.has(key))
+            ).catch(() => void 0);
+          }
+        }
+      } catch (error) {
+        await deleteUnpublishedWorkspaceArchiveObject(
+          objectStorage,
+          workspaceArchiveRef,
+          archiveMetrics
+        );
+        throw error;
+      }
     }
     if (!result.wrote && checkpointArtifactId) {
       await markSandboxCheckpointArtifactDeletePending2(db, {
@@ -7129,8 +7157,7 @@ async function terminateDrainableBox(db, settings, row, observability, terminate
     persistArchive,
     captureClaim?.providerRequestId ?? attempt.operationId,
     captureDisposition,
-    capturePolicy,
-    Boolean(objectStorage)
+    capturePolicy
   );
   const terminated = typeof termination === "boolean" ? termination : termination.terminated;
   if (!terminated) {
@@ -7186,7 +7213,7 @@ function providerDrainLogIdentity(lease, backend) {
     instanceId: lease.instanceId
   };
 }
-async function terminateProviderBox(settings, lease, observability, persistArchive, createClientForBackend = createSandboxClientForBackend, terminateModalById = terminateModalSandboxById, providerCaptureRequestId, captureDisposition = "capture_required", claimedCapturePolicy, diskBackedArchives = false) {
+async function terminateProviderBox(settings, lease, observability, persistArchive, createClientForBackend = createSandboxClientForBackend, terminateModalById = terminateModalSandboxById, providerCaptureRequestId, captureDisposition = "capture_required", claimedCapturePolicy) {
   const durableBackendId = lease.resumeBackendId ?? lease.backend;
   const backend = sandboxBackendForSdkBackendId(durableBackendId) ?? durableBackendId;
   const logIdentity = providerDrainLogIdentity(lease, backend);
@@ -7308,15 +7335,10 @@ async function terminateProviderBox(settings, lease, observability, persistArchi
   ) : null;
   try {
     if (captureDisposition !== "archive_published" && session?.persistWorkspace) {
-      const capture = captureWorkspaceArchiveForStorage(
-        session,
-        Date.now(),
-        {
-          requestId: providerCaptureRequestId ?? randomUUID2(),
-          strategy: liveCapturePolicy.strategy
-        },
-        diskBackedArchives
-      );
+      const capture = captureVerifiedWorkspaceArchive(session, Date.now(), {
+        requestId: providerCaptureRequestId ?? randomUUID2(),
+        strategy: liveCapturePolicy.strategy
+      });
       verifiedArchive = await awaitProviderCaptureWithLatePublication({
         capture,
         timeoutMs: settings.sandboxSnapshotTimeoutMs,
@@ -7330,7 +7352,7 @@ async function terminateProviderBox(settings, lease, observability, persistArchi
         publishLate: async (archive) => {
           try {
             const result = await persistArchive(
-              archive.kind === "host_spool" ? archive : archive.base64,
+              archive.base64,
               archive.descriptor,
               session,
               checkpointBinding
@@ -7346,8 +7368,6 @@ async function terminateProviderBox(settings, lease, observability, persistArchi
               ...logIdentity,
               error: error instanceof Error ? error.message : String(error)
             });
-          } finally {
-            await disposeWorkspaceArchive(archive);
           }
         },
         observeLateFailure: (error) => {
@@ -7379,17 +7399,12 @@ async function terminateProviderBox(settings, lease, observability, persistArchi
       ...logIdentity
     });
   } else if (verifiedArchive) {
-    let wrote;
-    try {
-      ({ wrote } = await persistArchive(
-        verifiedArchive.kind === "host_spool" ? verifiedArchive : verifiedArchive.base64,
-        verifiedArchive.descriptor,
-        session,
-        checkpointBinding
-      ));
-    } finally {
-      await disposeWorkspaceArchive(verifiedArchive);
-    }
+    const { wrote } = await persistArchive(
+      verifiedArchive.base64,
+      verifiedArchive.descriptor,
+      session,
+      checkpointBinding
+    );
     if (!wrote) {
       observability.info(
         "sandbox reaper: lease re-armed during persist \u2014 leaving box RUNNING (no terminate)",
@@ -10335,4 +10350,4 @@ export {
   createControlActivities,
   createControlActivitiesFromServices
 };
-//# sourceMappingURL=activities-control-JUBMDBDZ.js.map
+//# sourceMappingURL=activities-control-UXGPMDL3.js.map