@opengeni/worker-bundle 0.28.3 → 0.28.4-canary.0

package/dist/activities/agent-turn/mcp-operation-read-tool.d.ts

@@ -0,0 +1,16 @@
+import type { AttemptToolDefinition } from "@opengeni/codemode";
+import { z } from "zod";
+declare const selectorSchema: z.ZodUnion<readonly [z.ZodObject<{
+    operationId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    sourceTurnId: z.ZodString;
+    sourceCallId: z.ZodString;
+}, z.core.$strict>]>;
+export type McpOperationReadSelector = z.infer<typeof selectorSchema>;
+/** Attempt-local adapter. The supplied read closure owns canonical session
+ * access, current provider authority, immutable binding checks and settlement.
+ * No caller-controlled provider parameters cross this tool boundary. */
+export declare function createOperationReadAttemptToolDefinition(input: {
+    read: (selector: McpOperationReadSelector) => Promise<Record<string, unknown>>;
+}): AttemptToolDefinition;
+export {};

package/dist/activities/mcp-operation-authority.d.ts

@@ -0,0 +1,16 @@
+import type { ConnectionUseAttribution } from "@opengeni/contracts/connection-authority";
+import type { HostMcpAcceptedAuthority } from "@opengeni/contracts/host-mcp-bindings";
+import type { ResolveConnectionCredentialInput } from "@opengeni/db";
+/** Metadata only. Callers must obtain authority from a current live fence.
+ * This equality key is never authorization and never replaces physical-use checks. */
+export declare function mcpOperationAuthorityDigest(request: ResolveConnectionCredentialInput, authority: {
+    native: ConnectionUseAttribution;
+    host?: never;
+    principal?: {
+        kind: string;
+        subjectId?: string;
+    };
+} | {
+    host: HostMcpAcceptedAuthority;
+    native?: never;
+}): string;

package/dist/activities/mcp-operation-observer.d.ts

@@ -0,0 +1,14 @@
+import type { Settings } from "@opengeni/config";
+import type { AttemptToolEnvironment } from "@opengeni/codemode";
+import { type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult } from "@opengeni/runtime";
+import type { McpOperationReaderDependencies } from "./mcp-operation-reader.js";
+/** Current-attempt adapter: no credential renewal authority survives this
+ * closure. The stored digest constrains fresh authority, never establishes it. */
+export declare function createMcpOperationObserverResolver(input: {
+    settings: Pick<Settings, "mcpServers">;
+    workspaceId: string;
+    credentialSubjectId?: string;
+    assertAttempt: () => Promise<void>;
+    resolveCredential: (request: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
+    getEnvironment: () => Promise<AttemptToolEnvironment | null>;
+}): McpOperationReaderDependencies["resolveObserver"];

package/dist/activities/mcp-operation-reader.d.ts

@@ -0,0 +1,45 @@
+import type { AttemptToolResult } from "@opengeni/contracts";
+import { type McpObservationReceipt } from "@opengeni/runtime";
+import type { McpOperationReadSelector } from "./agent-turn/mcp-operation-read-tool.js";
+type TerminalReceipt = Extract<McpObservationReceipt, {
+    status: "completed";
+}>;
+/** Internal, credential-free projection loaded through canonical current
+ * attempt/session authorization. Never return this object directly to tools. */
+export type McpOperationReadRecord = {
+    operationId: string;
+    sourceTurnId: string;
+    sourceCallId: string | null;
+    serverId: string;
+    originalTool: string;
+    observerTool: string;
+    argumentDigest: string;
+    destinationDigest: string;
+    authorityDigest: string;
+    originalOutcome: "captured" | "completed" | "outcome_unknown";
+    originalResult: AttemptToolResult | null;
+    receipt: TerminalReceipt | null;
+};
+type ObserverResolution = {
+    status: "unsupported" | "auth_needed" | "binding_changed";
+} | {
+    status: "ready";
+    authorize: (phase: "before_request" | "before_delivery") => Promise<boolean>;
+    callObserver: (tool: string, args: Record<string, unknown>) => Promise<unknown>;
+};
+export type McpOperationReaderDependencies = {
+    /** Includes live attempt and original-principal/session disclosure checks. */
+    load: (selector: McpOperationReadSelector) => Promise<McpOperationReadRecord | null>;
+    claim: (operationId: string) => Promise<string | null>;
+    release: (operationId: string, claimId: string) => Promise<void>;
+    /** Claim-fenced transaction storing one immutable receipt. Must recheck
+     * canonical current authority and never rewrite the original outcome.
+     * Delivery uses the ordinary operation_read tool-result lifecycle. */
+    settle: (operationId: string, claimId: string, receipt: TerminalReceipt) => Promise<McpOperationReadRecord>;
+    /** Binds the current trusted config/connection to the persisted original
+     * digests. Model arguments may not supply or replace any of that authority. */
+    resolveObserver: (operation: McpOperationReadRecord) => Promise<ObserverResolution>;
+};
+/** One explicit read; no timer, inference wake, or mutation replay. */
+export declare function readMcpOperation(selector: McpOperationReadSelector, dependencies: McpOperationReaderDependencies): Promise<Record<string, unknown>>;
+export {};

package/dist/activities/mcp-operation-store.d.ts

@@ -0,0 +1,6 @@
+import type { Database } from "@opengeni/db";
+import { type McpOperationAttempt } from "@opengeni/db/mcp-operations";
+import type { McpOperationReaderDependencies } from "./mcp-operation-reader.js";
+/** All DB calls remain bound to the actual accepted worker attempt. Locators
+ * supplied to operation_read cannot replace this scope or its principal. */
+export declare function createMcpOperationReadStore(db: Database, attempt: McpOperationAttempt): Pick<McpOperationReaderDependencies, "load" | "claim" | "release" | "settle">;

package/dist/activities/sandbox-lease.d.ts

@@ -2,7 +2,7 @@ import type { ProviderCommandPersistence } from "@opengeni/runtime";
 import { type OpStatus } from "@opengeni/agent-proto";
 import { listLiveModalSandboxLeaseAttributions, readLease, type ReapDrainable, type RetainedProcessProviderProof, type SandboxRetainedProcess, type LeaseSnapshot } from "@opengeni/db";
 import { type ConnectedMachineBackgroundCommandClaim, type ConnectedMachineBackgroundCommandProof } from "@opengeni/db/session-background-commands";
-import { createSandboxClientForBackend, inspectModalSandboxLifecycle, resolveModalCheckpointProviderBindingForSession, terminateModalSandboxById, type ModalOrphanSweepTermination, type ModalCheckpointProviderBinding, type ProviderWorkspaceCapturePolicy, type WorkspaceArchiveDescriptor, type ControlRpc } from "@opengeni/runtime/sandbox";
+import { type VerifiedHostWorkspaceArchive, createSandboxClientForBackend, inspectModalSandboxLifecycle, resolveModalCheckpointProviderBindingForSession, terminateModalSandboxById, type ModalOrphanSweepTermination, type ModalCheckpointProviderBinding, type ProviderWorkspaceCapturePolicy, type WorkspaceArchiveDescriptor, type ControlRpc } from "@opengeni/runtime/sandbox";
 import { type SandboxDrainActivityInput, type SandboxLeaseSweepMaintenanceInput } from "../sandbox-reaper-contract.js";
 import type { ControlActivityServices as ActivityServices } from "./types.js";
 import { type RetainedProcessReconciliationOutcome } from "../observability-metrics.js";
@@ -40,7 +40,7 @@ type CreateSandboxClientForBackendFn = typeof createSandboxClientForBackend;
  * backends with no persistWorkspace — ensures a re-arm during the snapshot window
  * aborts the terminate before client.delete()).
  */
-export type PersistArchiveFn = (archiveBase64: string | null, archiveMetadata?: WorkspaceArchiveDescriptor, providerSession?: unknown, providerBinding?: Awaited<ReturnType<typeof resolveModalCheckpointProviderBindingForSession>> | null) => Promise<{
+export type PersistArchiveFn = (archiveBase64: string | VerifiedHostWorkspaceArchive | null, archiveMetadata?: WorkspaceArchiveDescriptor, providerSession?: unknown, providerBinding?: Awaited<ReturnType<typeof resolveModalCheckpointProviderBindingForSession>> | null) => Promise<{
     wrote: boolean;
     archiveRevision?: string | null;
 }>;
@@ -60,7 +60,7 @@ export type DrainCaptureDisposition = "capture_required" | "archive_published";
  *  Test seams may return the legacy boolean shorthand. Production returns the
  *  typed outcome so the cold commit can distinguish a clean stop from definitive
  *  provider disappearance before capture. */
-export type TerminateBoxFn = (settings: ActivityServices["settings"], lease: NonNullable<Awaited<ReturnType<typeof readLease>>>, observability: ActivityServices["observability"], persistArchive: PersistArchiveFn, providerCaptureRequestId?: string, captureDisposition?: DrainCaptureDisposition, capturePolicy?: ProviderWorkspaceCapturePolicy | null) => Promise<boolean | ProviderTerminationOutcome>;
+export type TerminateBoxFn = (settings: ActivityServices["settings"], lease: NonNullable<Awaited<ReturnType<typeof readLease>>>, observability: ActivityServices["observability"], persistArchive: PersistArchiveFn, providerCaptureRequestId?: string, captureDisposition?: DrainCaptureDisposition, capturePolicy?: ProviderWorkspaceCapturePolicy | null, diskBackedArchives?: boolean) => Promise<boolean | ProviderTerminationOutcome>;
 export type SweepModalOrphansFn = (settings: ActivityServices["settings"], db: ActivityServices["db"], observability: ActivityServices["observability"]) => Promise<number>;
 export type InspectOpenSandboxKubernetesInventoryFn = (input: {
     namespace: string;
@@ -199,4 +199,4 @@ export declare function sandboxDrainReason(lease: Pick<LeaseSnapshot, "rotationR
  * draining until its adapter can prove termination. A truly instance-less or
  * `none`-backed row is a no-op.
  */
-export declare function terminateProviderBox(settings: ActivityServices["settings"], lease: NonNullable<Awaited<ReturnType<typeof readLease>>>, observability: ActivityServices["observability"], persistArchive: PersistArchiveFn, createClientForBackend?: CreateSandboxClientForBackendFn, terminateModalById?: typeof terminateModalSandboxById, providerCaptureRequestId?: string, captureDisposition?: DrainCaptureDisposition, claimedCapturePolicy?: ProviderWorkspaceCapturePolicy | null): Promise<ProviderTerminationOutcome>;
+export declare function terminateProviderBox(settings: ActivityServices["settings"], lease: NonNullable<Awaited<ReturnType<typeof readLease>>>, observability: ActivityServices["observability"], persistArchive: PersistArchiveFn, createClientForBackend?: CreateSandboxClientForBackendFn, terminateModalById?: typeof terminateModalSandboxById, providerCaptureRequestId?: string, captureDisposition?: DrainCaptureDisposition, claimedCapturePolicy?: ProviderWorkspaceCapturePolicy | null, diskBackedArchives?: boolean): Promise<ProviderTerminationOutcome>;

package/dist/{activities-control-UXGPMDL3.js → activities-control-J5QNRWVH.js}

@@ -10,18 +10,16 @@ import {
   MAX_AUTOMATIC_PROVIDER_RECOVERIES,
   assertReusableSessionRevivable,
   captureConnectedCommandOutput,
-  collectWorkspaceArchiveObjectKeys,
   createCodexCapacityActivities,
   createGoalActivities,
   createSharedActivityServices,
   currentActivityContext,
-  deleteUnpublishedWorkspaceArchiveObject,
-  deleteWorkspaceArchiveObjectKeys,
   deliverFailedChildTurnToParent,
   evaluateIncidentTelemetryPreflight,
   incidentTelemetryAuthorityFence,
   incidentTelemetryPreflightDeclaration,
   notifyParentOfChildIdle,
+  persistWorkspaceArchiveCandidate,
   providerRecoveryCountFromMetadata,
   putVersion1TarArchiveOrInline,
   reconcileAutomaticSessionTitleFanout,
@@ -33,7 +31,7 @@ import {
   scheduledUserMessagePayload,
   withFirstPartyTools,
   workflowIdForSession
-} from "./chunk-NNXLW6V7.js";
+} from "./chunk-ZNIKZQMN.js";
 import {
   inspectOpenSandboxKubernetesInventory,
   recordCreditBalanceGauges,
@@ -53,7 +51,8 @@ import {
   recordTurnsQueuedGauge,
   recordWorkerDeathRecoveryMetrics,
   runtimeMetricsHooksForObservability
-} from "./chunk-BARTLVBK.js";
+} from "./chunk-A4XQWVZK.js";
+import "./chunk-PZ5AY32C.js";
 
 // src/activities/browser-state-artifact-reaper.ts
 import {
@@ -5243,7 +5242,8 @@ import { sandboxWarmRateMicrosPerSecond } from "@opengeni/config";
 import { appendSessionCommandOutput } from "@opengeni/db/session-command-output";
 import { sandboxLeaseTelemetryKey } from "@opengeni/observability";
 import {
-  captureVerifiedWorkspaceArchive,
+  captureWorkspaceArchiveForStorage,
+  disposeWorkspaceArchive,
   cancelSelfhostedOp,
   assertConsistentSandboxProviderIdentity,
   createSandboxClientForBackend,
@@ -5362,7 +5362,7 @@ function sandboxDrainActivityAttempt() {
   }
 }
 function createSandboxLeaseActivities(services, options = {}) {
-  const terminateBox = options.terminateBox ?? (async (settings, lease, observability, persistArchive, providerCaptureRequestId, captureDisposition, capturePolicy) => await terminateProviderBox(
+  const terminateBox = options.terminateBox ?? (async (settings, lease, observability, persistArchive, providerCaptureRequestId, captureDisposition, capturePolicy, diskBackedArchives) => await terminateProviderBox(
     settings,
     lease,
     observability,
@@ -5371,7 +5371,8 @@ function createSandboxLeaseActivities(services, options = {}) {
     terminateModalSandboxById,
     providerCaptureRequestId,
     captureDisposition,
-    capturePolicy
+    capturePolicy,
+    diskBackedArchives
   ));
   const sweepModalOrphans = options.sweepModalOrphans ?? sweepModalOrphansForConfiguredBackend;
   const inspectOpenSandboxInventory = options.inspectOpenSandboxKubernetesInventory ?? inspectOpenSandboxKubernetesInventory;
@@ -7044,7 +7045,7 @@ async function terminateDrainableBox(db, settings, row, observability, terminate
     }
     const archiveMetrics = runtimeMetricsHooksForObservability(observability);
     let checkpointArtifactId = null;
-    if (archiveBase64 && archiveMetadata?.version === 2 && (archiveMetadata.provider === "modal_snapshot_filesystem" || archiveMetadata.provider === "modal_snapshot_directory")) {
+    if (typeof archiveBase64 === "string" && archiveBase64 && archiveMetadata?.version === 2 && (archiveMetadata.provider === "modal_snapshot_filesystem" || archiveMetadata.provider === "modal_snapshot_directory")) {
       if (!providerBinding) {
         throw new Error("Modal native snapshot has no exact session provider identity");
       }
@@ -7084,57 +7085,29 @@ async function terminateDrainableBox(db, settings, row, observability, terminate
       if (!archiveMetadata) {
         throw new Error("Sandbox snapshot publication requires a verified archive descriptor");
       }
-      const priorKeys = collectWorkspaceArchiveObjectKeys(
-        lease.resumeState ?? null
-      );
-      let workspaceArchiveRef;
-      try {
-        const published = await putVersion1TarArchiveOrInline({
-          backend: lease.backend,
-          objectStorage,
-          accountId,
-          workspaceId: row.workspaceId,
-          sandboxGroupId: row.sandboxGroupId,
-          archive: {
-            bytes: Buffer.from(archiveBase64, "base64"),
-            descriptor: archiveMetadata,
-            base64: archiveBase64
-          },
-          metrics: archiveMetrics
-        });
-        workspaceArchiveRef = published.workspaceArchiveRef;
-        result = await persistDrainSnapshot(db, {
+      const published = await putVersion1TarArchiveOrInline({
+        backend: lease.backend,
+        objectStorage,
+        accountId,
+        workspaceId: row.workspaceId,
+        sandboxGroupId: row.sandboxGroupId,
+        archive: typeof archiveBase64 === "object" ? archiveBase64 : {
+          bytes: Buffer.from(archiveBase64, "base64"),
+          descriptor: archiveMetadata,
+          base64: archiveBase64
+        },
+        metrics: archiveMetrics
+      });
+      result = await persistWorkspaceArchiveCandidate({
+        objectStorage,
+        ...published.workspaceArchiveRef ? { ref: published.workspaceArchiveRef } : {},
+        persist: () => persistDrainSnapshot(db, {
           ...baseInput,
           workspaceArchiveMeta: archiveMetadata,
           ...published,
           ...checkpointArtifactId ? { checkpointArtifactId } : {}
-        });
-        if (published.workspaceArchiveRef && objectStorage) {
-          if (!result.wrote) {
-            await deleteUnpublishedWorkspaceArchiveObject(
-              objectStorage,
-              published.workspaceArchiveRef,
-              archiveMetrics
-            );
-          } else {
-            const afterLease = await readLease(db, row.workspaceId, row.sandboxGroupId);
-            const afterKeys = collectWorkspaceArchiveObjectKeys(
-              afterLease?.resumeState ?? null
-            );
-            await deleteWorkspaceArchiveObjectKeys(
-              objectStorage,
-              [...priorKeys].filter((key) => !afterKeys.has(key))
-            ).catch(() => void 0);
-          }
-        }
-      } catch (error) {
-        await deleteUnpublishedWorkspaceArchiveObject(
-          objectStorage,
-          workspaceArchiveRef,
-          archiveMetrics
-        );
-        throw error;
-      }
+        })
+      });
     }
     if (!result.wrote && checkpointArtifactId) {
       await markSandboxCheckpointArtifactDeletePending2(db, {
@@ -7157,7 +7130,8 @@ async function terminateDrainableBox(db, settings, row, observability, terminate
     persistArchive,
     captureClaim?.providerRequestId ?? attempt.operationId,
     captureDisposition,
-    capturePolicy
+    capturePolicy,
+    Boolean(objectStorage)
   );
   const terminated = typeof termination === "boolean" ? termination : termination.terminated;
   if (!terminated) {
@@ -7213,7 +7187,7 @@ function providerDrainLogIdentity(lease, backend) {
     instanceId: lease.instanceId
   };
 }
-async function terminateProviderBox(settings, lease, observability, persistArchive, createClientForBackend = createSandboxClientForBackend, terminateModalById = terminateModalSandboxById, providerCaptureRequestId, captureDisposition = "capture_required", claimedCapturePolicy) {
+async function terminateProviderBox(settings, lease, observability, persistArchive, createClientForBackend = createSandboxClientForBackend, terminateModalById = terminateModalSandboxById, providerCaptureRequestId, captureDisposition = "capture_required", claimedCapturePolicy, diskBackedArchives = false) {
   const durableBackendId = lease.resumeBackendId ?? lease.backend;
   const backend = sandboxBackendForSdkBackendId(durableBackendId) ?? durableBackendId;
   const logIdentity = providerDrainLogIdentity(lease, backend);
@@ -7335,10 +7309,15 @@ async function terminateProviderBox(settings, lease, observability, persistArchi
   ) : null;
   try {
     if (captureDisposition !== "archive_published" && session?.persistWorkspace) {
-      const capture = captureVerifiedWorkspaceArchive(session, Date.now(), {
-        requestId: providerCaptureRequestId ?? randomUUID2(),
-        strategy: liveCapturePolicy.strategy
-      });
+      const capture = captureWorkspaceArchiveForStorage(
+        session,
+        Date.now(),
+        {
+          requestId: providerCaptureRequestId ?? randomUUID2(),
+          strategy: liveCapturePolicy.strategy
+        },
+        diskBackedArchives
+      );
       verifiedArchive = await awaitProviderCaptureWithLatePublication({
         capture,
         timeoutMs: settings.sandboxSnapshotTimeoutMs,
@@ -7352,7 +7331,7 @@ async function terminateProviderBox(settings, lease, observability, persistArchi
         publishLate: async (archive) => {
           try {
             const result = await persistArchive(
-              archive.base64,
+              archive.kind === "host_spool" ? archive : archive.base64,
               archive.descriptor,
               session,
               checkpointBinding
@@ -7368,6 +7347,8 @@ async function terminateProviderBox(settings, lease, observability, persistArchi
               ...logIdentity,
               error: error instanceof Error ? error.message : String(error)
             });
+          } finally {
+            await disposeWorkspaceArchive(archive);
           }
         },
         observeLateFailure: (error) => {
@@ -7399,12 +7380,17 @@ async function terminateProviderBox(settings, lease, observability, persistArchi
       ...logIdentity
     });
   } else if (verifiedArchive) {
-    const { wrote } = await persistArchive(
-      verifiedArchive.base64,
-      verifiedArchive.descriptor,
-      session,
-      checkpointBinding
-    );
+    let wrote;
+    try {
+      ({ wrote } = await persistArchive(
+        verifiedArchive.kind === "host_spool" ? verifiedArchive : verifiedArchive.base64,
+        verifiedArchive.descriptor,
+        session,
+        checkpointBinding
+      ));
+    } finally {
+      await disposeWorkspaceArchive(verifiedArchive);
+    }
     if (!wrote) {
       observability.info(
         "sandbox reaper: lease re-armed during persist \u2014 leaving box RUNNING (no terminate)",
@@ -10350,4 +10336,4 @@ export {
   createControlActivities,
   createControlActivitiesFromServices
 };
-//# sourceMappingURL=activities-control-UXGPMDL3.js.map
+//# sourceMappingURL=activities-control-J5QNRWVH.js.map