@opengeni/worker-bundle 0.29.0-canary.0 → 0.29.0-canary.2

package/src/activities/run-input.ts

@@ -81,6 +81,7 @@ export type TurnInputOptions = {
   unavailableSandboxFilesNote?: string;
   runCredentialsNote?: string;
   mcpAvailabilityNote?: string;
+  knowledgeSourcePreparationNote?: string;
   providerApi: HistoryProviderApi;
   projectCanonicalHistory?: ModelHistoryAttachmentProjector;
   materializeModelHistory?: ModelHistoryAttachmentProjector;
@@ -509,6 +510,7 @@ export async function turnInput(
     options.unavailableSandboxFilesNote,
     options.runCredentialsNote,
     options.mcpAvailabilityNote,
+    options.knowledgeSourcePreparationNote,
   );
   if (trigger.type === "user.message") {
     const payload = trigger.payload as {

package/src/activities/scheduled-tasks.ts

@@ -41,7 +41,6 @@ import {
   getScheduledTaskRunAcceptedExecution,
   getScheduledTaskRunByProducerKey,
   getScheduledTargetSessionExecution,
-  ensureKnowledgeSourceSyncState,
   getScheduledTaskPersonalConnectionDelegations,
   getScheduledTaskRunPersonalResourceAuthority,
   getScheduledTaskPersonalResourceAuthoritySubject,
@@ -62,14 +61,12 @@ import {
   listInstalledApiIntegrationServerIdsForDelegations,
   markScheduledTaskRunFailedIfQueued,
   markScheduledTaskRunSkippedIfQueued,
-  recordKnowledgeSourceSyncWake,
   recordUsageEvent,
   requireScheduledTaskIncidentAuthorityInTransaction,
   requireSession,
   requireWorkspace,
   settleScheduledTaskRunInTransaction,
   SessionSpawnDeniedDbError,
-  updateScheduledTaskRun,
   updateSessionTitleWithEvent,
   upsertScheduledSessionGoalForRun,
   withSessionActivityRlsContext,
@@ -364,69 +361,15 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
       if (!task) {
         return { action: "deleted" };
       }
-      if (task.action.kind === "knowledge_source_sync") {
-        if (knowledgeSourceSyncEffectivelyPaused(task)) {
-          return { action: "blocked", reason: "knowledge_source_paused" };
-        }
-        const run = await createScheduledTaskRun(db, {
-          workspaceId: task.workspaceId,
-          taskId: task.id,
-          taskAuthorityRevision: task.authorityRevision,
-          taskExecutionDigest: task.executionDigest,
-          triggerType: input.triggerType,
-          producerKey: stableProducerKey,
-          scheduledAt: null,
-        });
-        await ensureKnowledgeSourceSyncState(db, task);
-        await recordKnowledgeSourceSyncWake(db, {
-          accountId: task.accountId,
-          workspaceId: task.workspaceId,
-          sourceId: task.action.sourceId,
-          scheduledTaskId: task.id,
-          scheduledTaskRunId: run.id,
-          cause: input.triggerType,
-          producerKey: stableProducerKey,
-          sourceConfigGeneration: task.action.sourceConfigGeneration,
-          sourceLifecycleGeneration: task.action.sourceLifecycleGeneration,
-        });
-        await recordUsageEvent(db, {
-          accountId: task.accountId,
-          workspaceId: task.workspaceId,
-          eventType: "knowledge_source_sync.fired",
-          quantity: 1,
-          unit: "run",
-          sourceResourceType: "scheduled_task_run",
-          sourceResourceId: run.id,
-          initiator: input.initiator ?? {
-            kind: "service",
-            subjectId: "scheduler",
-          },
-          initiatorContext: {
-            scheduledTaskId: task.id,
-            scheduledTaskRunId: run.id,
-          },
-          origin: "scheduled_task",
-          idempotencyKey: `usage:knowledge_source_sync.fired:${run.id}`,
-        });
-        if (run.status === "queued") {
-          await updateScheduledTaskRun(db, task.workspaceId, run.id, {
-            status: "dispatched",
-            actionKind: "knowledge_source_sync",
-          });
-        }
-        return {
-          action: "knowledge_source_sync",
-          accountId: task.accountId,
-          workspaceId: task.workspaceId,
-          taskId: task.id,
-          scheduledTaskRunId: run.id,
-          sourceId: task.action.sourceId,
-          overlapPolicy: task.overlapPolicy as "skip" | "buffer_one",
-        };
+      if (task.action.kind !== "agent_turn") {
+        return { action: "blocked", reason: "legacy_source_schedule_requires_migration" };
       }
       if (task.status !== "active") {
         return { action: "blocked", reason: "scheduled_task_paused" };
       }
+      if (task.agentConfig.knowledgeSource && knowledgeSourceSyncEffectivelyPaused(task)) {
+        return { action: "blocked", reason: "knowledge_source_paused" };
+      }
       const structuredAlertOccurrence = scheduledAlertOccurrenceIdentity({
         workspaceId: task.workspaceId,
         scheduledTaskId: task.id,
@@ -778,6 +721,14 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
         throw new Error("scheduled authority classes have different causal humans");
       }
       const causalHumanSubjectId = taskAuthoritySubjectId ?? xaiAuthoritySubjectId;
+      if (
+        task.agentConfig.knowledgeSource &&
+        causalHumanSubjectId !== task.agentConfig.knowledgeSource.initiatingSubjectId
+      ) {
+        throw new Error(
+          "Source schedule requires its connection owner's current human authorization; update the source schedule to authorize it",
+        );
+      }
       // Workspace/organization Variable Sets and Rigs run through ordinary
       // workspace authority; only a user-owned resource needs the exact frozen
       // human, and the database admission fence re-proves the same rule for
@@ -1084,6 +1035,12 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                 firstPartyMcpTools,
                 firstPartyMcpPermissions,
                 ...creatorSessionPolicy,
+                ...(task.agentConfig.knowledgeSource?.destination.kind === "personal"
+                  ? {
+                      visibility: "user_private" as const,
+                      scheduledSourceRunId: run.id,
+                    }
+                  : {}),
                 metadata: {
                   ...taskMetadata,
                   model,
@@ -2110,6 +2067,12 @@ async function recoverBoundScheduledTaskDispatch(input: {
       firstPartyMcpTools: input.acceptedExecution.resolvedFirstPartyMcpTools,
       firstPartyMcpPermissions: input.acceptedExecution.resolvedFirstPartyMcpPermissions,
       ...scheduledCreatorSessionPolicyInput(recoveredCreatorPolicy?.sessionPolicy ?? null),
+      ...(task.agentConfig.knowledgeSource?.destination.kind === "personal"
+        ? {
+            visibility: "user_private" as const,
+            scheduledSourceRunId: input.run.id,
+          }
+        : {}),
       metadata: {
         ...taskMetadata,
         model: input.acceptedExecution.resolvedModel,

package/src/activities/types.ts

@@ -3,6 +3,7 @@ import type {
   ConnectionCredentialsPort,
   DocumentAuthorityKind,
   EntitlementsPort,
+  KnowledgeSourceSyncRunSummary,
   ScheduledTaskTriggerType,
   TurnInitiator,
 } from "@opengeni/contracts";
@@ -434,6 +435,7 @@ export type DispatchScheduledTaskRunResult =
         | "scheduled_run_terminal"
         | "scheduled_execution_unrepresentable"
         | "knowledge_source_paused"
+        | "legacy_source_schedule_requires_migration"
         | "incident_preflight_metadata_missing"
         | "incident_responder_under_capable"
         | "incident_data_source_unsuitable";
@@ -458,6 +460,9 @@ export type DispatchScheduledTaskRunResult =
     };
 
 export type RunKnowledgeSourceSyncBatchInput = {
+  /** Host-bound attempt only. Legacy control workflow inputs have none and cannot fetch. */
+  agent?: Extract<import("@opengeni/db").KnowledgeActor, { kind: "agent" }>;
+
   accountId: string;
   workspaceId: string;
   taskId: string;
@@ -479,7 +484,7 @@ export type DispatchAutomationRunResult =
   | { action: "failed"; reason: string }
   | { action: "not_found" };
 
-export type RunKnowledgeSourceSyncBatchResult =
+export type RunKnowledgeSourceSyncBatchResult = (
   | { action: "continue" }
   | {
       action: "complete";
@@ -491,7 +496,8 @@ export type RunKnowledgeSourceSyncBatchResult =
       action: "failed";
       bufferedWake: boolean;
       bufferedScheduledTaskRunId?: string | null;
-    };
+    }
+) & { summary?: KnowledgeSourceSyncRunSummary; errorCode?: string };
 
 type DocumentIndexIdentity = {
   accountId: string;

package/src/activities/video-generation-reconciliation.ts

@@ -17,6 +17,7 @@ import {
   markVideoGenerationTerminalUpdate,
   markVideoGenerationTerminalUpdateInTransaction,
   mediaGenerationResultForStoredOperation,
+  withSessionRlsActorContext,
   rescheduleVideoGenerationOperation,
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
@@ -497,7 +498,13 @@ async function terminalPayload(
   service: TurnActivityServices,
   operation: VideoGenerationOperationWithReferences,
 ): Promise<MediaGenerationResult> {
-  return await mediaGenerationResultForStoredOperation(service.db, operation);
+  return withSessionRlsActorContext(
+    {
+      subjectId: "service:video-generation-reconciliation",
+      privateFileOwnerSubjectId: operation.privateFileOwnerSubjectId ?? null,
+    },
+    () => mediaGenerationResultForStoredOperation(service.db, operation),
+  );
 }
 
 async function requireOperation(

package/src/activities-control.ts

@@ -1,3 +1,4 @@
+import { createKnowledgeIndexingActivities } from "./activities/knowledge-indexing";
 import { createSharedActivityServices } from "./activity-services";
 import { createCodexCapacityActivities } from "./activities/codex-capacity";
 import { createBrowserStateArtifactMaintenanceActivities } from "./activities/browser-state-artifact-reaper";
@@ -29,6 +30,7 @@ export function createControlActivitiesFromServices(
   return {
     ...createAutomationActivities(services),
     ...createDocumentActivities(services, resolveDocumentServices),
+    ...createKnowledgeIndexingActivities(services, resolveDocumentServices),
     ...createKnowledgeSourceSyncActivities(services, resolveDocumentServices),
     ...createSessionStateActivities(services),
     ...createScheduledTaskActivities(services),

package/src/activities.ts

@@ -92,6 +92,7 @@ export const runAgentTurn = defaultTurnActivities.runAgentTurn;
 export const reconcileVideoGenerationOperation =
   defaultTurnActivities.reconcileVideoGenerationOperation;
 export const indexDocument = defaultControlActivities.indexDocument;
+export const indexKnowledge = defaultControlActivities.indexKnowledge;
 export const failSessionAttempt = defaultControlActivities.failSessionAttempt;
 export const settleSessionInterruptions = defaultControlActivities.settleSessionInterruptions;
 export const persistSessionAttemptQuiescence =

package/src/index.ts

@@ -118,6 +118,8 @@ export {
 // no-op — so the Schedule is registered EXACTLY ONCE per deployment regardless
 // of replica count.
 const SANDBOX_REAPER_SCHEDULE_ID = "opengeni-sandbox-lease-reaper";
+export const KNOWLEDGE_INDEXING_SCHEDULE_ID = "opengeni-knowledge-indexing";
+export const KNOWLEDGE_INDEXING_PERIOD_MS = 15_000;
 export const FILE_UPLOAD_REAPER_SCHEDULE_ID = "opengeni-file-upload-reaper";
 export const FILE_UPLOAD_REAPER_PERIOD_MS = 15 * 60 * 1_000;
 export const SITE_AUTH_MAINTENANCE_SCHEDULE_ID = "opengeni-site-auth-maintenance";
@@ -615,6 +617,46 @@ export async function registerSandboxReaperSchedule(
   }
 }
 
+/** Register the deployment-wide worker for rebuildable Knowledge search projections. */
+export async function registerKnowledgeIndexingSchedule(
+  settings: Settings,
+  observability: Observability,
+): Promise<{ registered: boolean; close: () => Promise<void> }> {
+  const connection = await Connection.connect(temporalConnectionOptions(settings));
+  const temporal = new TemporalClient({ connection, namespace: settings.temporalNamespace });
+  try {
+    await temporal.schedule.create({
+      scheduleId: KNOWLEDGE_INDEXING_SCHEDULE_ID,
+      spec: { intervals: [{ every: KNOWLEDGE_INDEXING_PERIOD_MS }] },
+      action: {
+        type: "startWorkflow",
+        workflowType: "knowledgeIndexingWorkflow",
+        taskQueue: settings.temporalTaskQueue,
+        args: [],
+      },
+      policies: {
+        overlap: ScheduleOverlapPolicy.SKIP,
+        catchupWindow: "1m",
+        pauseOnFailure: false,
+      },
+    });
+    observability.info("Registered the global Knowledge indexer Schedule", {
+      scheduleId: KNOWLEDGE_INDEXING_SCHEDULE_ID,
+      indexingPeriodMs: KNOWLEDGE_INDEXING_PERIOD_MS,
+    });
+    return { registered: true, close: async () => connection.close() };
+  } catch (error) {
+    if (error instanceof ScheduleAlreadyRunning) {
+      observability.info("Global Knowledge indexer Schedule already registered", {
+        scheduleId: KNOWLEDGE_INDEXING_SCHEDULE_ID,
+      });
+      return { registered: false, close: async () => connection.close() };
+    }
+    await connection.close().catch(() => undefined);
+    throw error;
+  }
+}
+
 /**
  * Register the one provider-neutral expired direct-upload cleanup Schedule.
  * Unlike sandbox GC this is always registered: file uploads can be enabled in
@@ -913,6 +955,13 @@ export async function createOpenGeniWorkerService(
           { ...retryOptions, onRetry },
         ),
       );
+      schedules.push(
+        await retryStartupDependency(
+          "Temporal schedule (Knowledge indexing)",
+          () => registerKnowledgeIndexingSchedule(settings, observability),
+          { ...retryOptions, onRetry },
+        ),
+      );
       schedules.push(
         await retryStartupDependency(
           "Temporal schedule (file upload reaper)",

package/src/pr-review-credentials.ts

@@ -5,7 +5,7 @@ import type {
   GitCredentialsRequest,
 } from "@opengeni/contracts";
 import { prReviewRegistrationIdFromCredentialBinding } from "@opengeni/core";
-import { createRemoteMcpCredentialsPort } from "@opengeni/core/remote-mcp-credentials";
+import { createNativeRemoteMcpCredentialsPort } from "@opengeni/core/remote-mcp-credentials";
 import { decryptVariableSetValue, resolvePrReviewGitCredential, type Database } from "@opengeni/db";
 import {
   createGitHubAppInstallationTokenWithExpiry,
@@ -19,7 +19,7 @@ export function createStandaloneConnectionCredentialsPort(
   db: Database,
 ): ConnectionCredentialsPort {
   return {
-    ...createRemoteMcpCredentialsPort(settings),
+    ...createNativeRemoteMcpCredentialsPort(settings, db),
     gitCredentials: async (request) => await resolveStandaloneGitCredentials(settings, db, request),
   };
 }

package/src/workflows/knowledge-indexing.ts

@@ -0,0 +1,12 @@
+import { proxyActivities } from "@temporalio/workflow";
+import type * as activities from "../activities";
+
+const indexing = proxyActivities<Pick<typeof activities, "indexKnowledge">>({
+  startToCloseTimeout: "5 minutes",
+  retry: { maximumAttempts: 1 },
+});
+
+/** Rebuild derived search projections; this is not a source-ingestion task. */
+export async function knowledgeIndexingWorkflow(): Promise<void> {
+  await indexing.indexKnowledge();
+}

package/src/workflows.ts

@@ -1,3 +1,4 @@
+export { knowledgeIndexingWorkflow } from "./workflows/knowledge-indexing";
 export { documentIndexWorkflow, type DocumentIndexWorkflowInput } from "./workflows/document-index";
 export {
   approvalDecision,