@opengeni/worker-bundle 1.0.0-canary.0 → 1.0.0

package/src/activities/automations.ts

@@ -4,18 +4,22 @@ import {
   WORKSPACE_OPENROUTER_MODEL_ID_PREFIX,
 } from "@opengeni/config";
 import {
+  applySessionAgentConfigWriteThrough,
   assertWorkspaceModelPolicyAllows,
   canonicalConfiguredModel,
+  resolveSessionAgentConfigForCreate,
   createAndStartSessionWithOutcome,
   recordWorkspaceUsage,
   resolveCatalogSettings,
   resolveWorkspaceCatalogSettings,
+  isDeveloperSetupDelegatedPermissionAllowed,
 } from "@opengeni/core";
 import {
   AutomationAuthorityRevokedError,
   assertAutomationRunAuthorityInTransaction,
   claimAutomationRun,
   settleAutomationRun,
+  requireWorkspace,
 } from "@opengeni/db";
 import { SessionSkills } from "@opengeni/contracts";
 import { agentRunAdmissionDenial } from "./agent-run-admission";
@@ -30,6 +34,8 @@ export type AutomationActivityOptions = {
   settle?: typeof settleAutomationRun;
   assertAuthority?: typeof assertAutomationRunAuthorityInTransaction;
   createSession?: typeof createAndStartSessionWithOutcome;
+  /** Workspace read for agent-configuration defaults (tests inject it). */
+  readWorkspace?: typeof requireWorkspace;
   admit?: typeof agentRunAdmissionDenial;
   assertModelPolicy?: typeof assertWorkspaceModelPolicyAllows;
   recordUsage?: typeof recordWorkspaceUsage;
@@ -43,6 +49,7 @@ export function createAutomationActivities(
   const settle = options.settle ?? settleAutomationRun;
   const assertAuthority = options.assertAuthority ?? assertAutomationRunAuthorityInTransaction;
   const createSession = options.createSession ?? createAndStartSessionWithOutcome;
+  const readWorkspace = options.readWorkspace ?? requireWorkspace;
   const admit = options.admit ?? agentRunAdmissionDenial;
   const assertModelPolicy = options.assertModelPolicy ?? assertWorkspaceModelPolicyAllows;
   const recordUsage = options.recordUsage ?? recordWorkspaceUsage;
@@ -100,6 +107,20 @@ export function createAutomationActivities(
         }
 
         const template = accepted.sessionTemplate;
+        if (
+          template.credentialRestriction === "developer_setup" &&
+          template.firstPartyMcpPermissions.some(
+            (permission) => !isDeveloperSetupDelegatedPermissionAllowed(permission),
+          )
+        ) {
+          await settle(service.db, {
+            workspaceId: input.workspaceId,
+            runId: run.id,
+            status: "failed",
+            errorCode: "credential_restriction_violation",
+          });
+          return { action: "failed", reason: "credential_restriction_violation" };
+        }
         const requestedModel = template.model ?? deploymentCatalogSettings.openaiModel;
         const catalogSettings =
           requestedModel.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX) ||
@@ -158,7 +179,49 @@ export function createAutomationActivities(
             reason: "interactive_compute_not_allowed",
           };
         }
-        const turnExecutionPolicy = resolveTurnExecutionPolicyV1(catalogSettings, {
+        // Agent configuration for the generated session (null = legacy). The
+        // template's explicit tools are its baseline; capabilities only narrow.
+        let agentWriteThrough: {
+          config: import("@opengeni/contracts").ResolvedAgentConfig | null;
+          instructions: string | undefined;
+          firstPartyMcpTools: typeof template.firstPartyMcpTools;
+          tools: typeof template.tools;
+        };
+        try {
+          const workspaceSettings = (await readWorkspace(service.db, input.workspaceId)).settings;
+          const resolution = resolveSessionAgentConfigForCreate({
+            settings: catalogSettings,
+            creator: "automation",
+            request: template.agent,
+            instructions: template.instructions ?? undefined,
+            workspaceSettings,
+            parent: null,
+            goal: false,
+          });
+          const written = applySessionAgentConfigWriteThrough({
+            config: resolution.config,
+            firstPartyMcpTools: template.firstPartyMcpTools,
+            tools: template.tools,
+            toolPolicy: { mode: "explicit", inheritedFromSessionId: null },
+            productServerIds: template.tools.map((tool) => tool.id),
+          });
+          agentWriteThrough = {
+            config: resolution.config,
+            instructions: resolution.instructions,
+            firstPartyMcpTools: written.firstPartyMcpTools,
+            tools: written.tools,
+          };
+        } catch (error) {
+          if (!isUnprocessableEntity(error)) throw error;
+          await settle(service.db, {
+            workspaceId: input.workspaceId,
+            runId: run.id,
+            status: "failed",
+            errorCode: "dispatch_failed",
+          });
+          return { action: "failed", reason: "dispatch_failed" };
+        }
+        const resolvedTurnExecutionPolicy = resolveTurnExecutionPolicyV1(catalogSettings, {
           modelId: model,
           requestedModelId: template.model,
           modelSource: template.model ? "explicit" : "deployment",
@@ -167,6 +230,12 @@ export function createAutomationActivities(
           latencyMode: "standard",
           latencyModeSource: "deployment",
         });
+        const turnExecutionPolicy = template.credentialRestriction
+          ? {
+              ...resolvedTurnExecutionPolicy,
+              credentialRestriction: template.credentialRestriction,
+            }
+          : resolvedTurnExecutionPolicy;
         const created = await createSession({
           db: service.db,
           bus: service.bus,
@@ -189,10 +258,12 @@ export function createAutomationActivities(
           accountId: input.accountId,
           workspaceId: input.workspaceId,
           initialMessage: accepted.initialMessage,
+          surface: "automation",
+          metrics: service.observability,
           resources: template.resources,
           skills: SessionSkills.parse(template.skills),
           bundledSkillIds: template.bundledSkillIds,
-          tools: template.tools,
+          tools: agentWriteThrough.tools,
           toolPolicy: { mode: "explicit", inheritedFromSessionId: null },
           model,
           reasoningEffort,
@@ -211,10 +282,11 @@ export function createAutomationActivities(
             label: accepted.serviceLabel,
           },
           createdByContext: accepted.provenance,
-          instructions: template.instructions,
+          instructions: agentWriteThrough.instructions ?? template.instructions,
           policyRole: template.policyRole,
           firstPartyMcpPermissions: template.firstPartyMcpPermissions,
-          firstPartyMcpTools: template.firstPartyMcpTools,
+          firstPartyMcpTools: agentWriteThrough.firstPartyMcpTools,
+          ...(agentWriteThrough.config ? { agentConfig: agentWriteThrough.config } : {}),
           retainWorkspaceCustomModel:
             model.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX) ||
             model.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX),

package/src/activities/browser-deadline-checkpoint.ts

@@ -0,0 +1,279 @@
+import { Context } from "@temporalio/activity";
+import {
+  environmentsEncryptionKeyBytes,
+  resolveFirstPartyDelegationSecret,
+  type Settings,
+} from "@opengeni/config";
+import { BROWSER_STATE_ARTIFACT_CONTENT_TYPE } from "@opengeni/contracts";
+import {
+  browserDeadlineCheckpoint,
+  clearSuspendedBrowserSessionController,
+  commitBrowserSessionSuspension,
+  dispatchBrowserSessionOperation,
+  failBrowserSessionSuspension,
+  listBrowserDeadlineCheckpoints,
+  readLease,
+  releaseLeaseHolder,
+  withRlsContext,
+  type BrowserDeadlineCheckpointTarget,
+} from "@opengeni/db";
+import { deriveBrowserControllerAdminToken } from "@opengeni/interaction/browser-controller-authority";
+import {
+  browserStateArtifactAad,
+  browserStateManifestDigest,
+  browserStateObjectKey,
+  deriveBrowserStateDataKey,
+  wrapBrowserStateDataKey,
+} from "@opengeni/interaction/browser-state-authority";
+import {
+  BrowserControlClient,
+  BrowserControlRequestError,
+  createSandboxClientForBackend,
+  deserializeSandboxSessionStateEnvelope,
+  resumeExactSandboxSession,
+  type BrowserControlPlacementSession,
+} from "@opengeni/runtime";
+import type { ControlActivityServices } from "./types";
+
+const UPLOAD_CLEANUP_GRACE_MS = 24 * 60 * 60_000;
+
+function heartbeat(): void {
+  try {
+    Context.current().heartbeat();
+  } catch {
+    // Direct embedded calls have no Temporal context. In-flight controller
+    // operations still settle under their exact durable database claim.
+  }
+}
+
+async function withActivityHeartbeat<T>(run: () => Promise<T>): Promise<T> {
+  heartbeat();
+  const timer = setInterval(heartbeat, 5_000);
+  try {
+    return await run();
+  } finally {
+    clearInterval(timer);
+  }
+}
+
+type CheckpointController = Pick<BrowserControlClient, "captureState" | "endSession">;
+type CheckpointPlacement = {
+  target: BrowserDeadlineCheckpointTarget;
+  lease: NonNullable<Awaited<ReturnType<typeof readLease>>>;
+  settings: Settings;
+  controllerRoot: string;
+};
+
+async function resumeCheckpointController({
+  target,
+  lease,
+  settings,
+  controllerRoot,
+}: CheckpointPlacement): Promise<CheckpointController> {
+  // This edge cannot create a box or route through a user's current machine.
+  const provider = createSandboxClientForBackend("modal", settings) as Parameters<
+    typeof deserializeSandboxSessionStateEnvelope
+  >[0];
+  const envelope = lease.resumeState as { sessionState?: unknown };
+  const state = await deserializeSandboxSessionStateEnvelope(
+    provider,
+    envelope.sessionState ?? lease.resumeState,
+    target.instanceId,
+  );
+  const resumed = await resumeExactSandboxSession(provider, "modal", state, target.instanceId);
+  return new BrowserControlClient(resumed.session as BrowserControlPlacementSession, {
+    adminToken: deriveBrowserControllerAdminToken({
+      rootSecret: controllerRoot,
+      accountId: target.accountId,
+      workspaceId: target.workspaceId,
+      placement: { kind: "sandbox_group", sandboxGroupId: target.sandboxGroupId },
+      placementInstanceId: target.instanceId,
+    }),
+  });
+}
+
+export function createBrowserDeadlineCheckpointActivities(
+  services: () => Promise<ControlActivityServices>,
+  connectController: (
+    placement: CheckpointPlacement,
+  ) => Promise<CheckpointController> = resumeCheckpointController,
+) {
+  return {
+    async listDueBrowserCheckpoints() {
+      return await withActivityHeartbeat(async () => {
+        const { db, settings, objectStorage } = await services();
+        if (
+          !settings.sandboxOwnershipEnabled ||
+          !objectStorage ||
+          !resolveFirstPartyDelegationSecret(settings)
+        )
+          return [];
+        const root = environmentsEncryptionKeyBytes(settings);
+        if (!root) return [];
+        root.fill(0);
+        return await listBrowserDeadlineCheckpoints(db);
+      });
+    },
+    async checkpointBrowserBeforeDeadline(target: BrowserDeadlineCheckpointTarget) {
+      return await withActivityHeartbeat(async () => {
+        const { db, settings, objectStorage } = await services();
+        const rootKey = environmentsEncryptionKeyBytes(settings);
+        const controllerRoot = resolveFirstPartyDelegationSecret(settings);
+        if (!rootKey || !objectStorage || !controllerRoot) {
+          rootKey?.fill(0);
+          throw new Error("browser deadline checkpoint storage or encryption is unavailable");
+        }
+        let dataKey: Buffer | null = null;
+        let aad: Buffer | null = null;
+        let timer: ReturnType<typeof setInterval> | null = null;
+        try {
+          const claim = await browserDeadlineCheckpoint(db, target, { prepare: true, touch: true });
+          if (!claim) return { status: "skipped" as const };
+          let pulseRunning = false;
+          let authorityLost = false;
+          const pulse = async () => {
+            if (pulseRunning) return;
+            pulseRunning = true;
+            try {
+              if (!(await browserDeadlineCheckpoint(db, target, { touch: true })))
+                authorityLost = true;
+            } finally {
+              pulseRunning = false;
+            }
+          };
+          timer = setInterval(() => {
+            void pulse().catch(() => undefined);
+          }, 5_000);
+          const lease = await readLease(db, target.workspaceId, target.sandboxGroupId);
+          if (
+            !lease ||
+            lease.instanceId !== target.instanceId ||
+            lease.leaseEpoch !== target.leaseEpoch ||
+            !lease.resumeState
+          ) {
+            throw new Error("browser deadline checkpoint placement changed");
+          }
+          const placement = {
+            kind: "sandbox_group" as const,
+            sandboxGroupId: target.sandboxGroupId,
+          };
+          const client = await connectController({ target, lease, settings, controllerRoot });
+          if (authorityLost || !(await browserDeadlineCheckpoint(db, target, { touch: true }))) {
+            throw new Error("browser deadline checkpoint authority changed");
+          }
+          if (claim.state !== "completed") {
+            const scope = { ...target, operationId: claim.operationId };
+            const objectKey = browserStateObjectKey(target.workspaceId, claim.operationId);
+            dataKey = deriveBrowserStateDataKey(rootKey, { ...scope, objectKey });
+            aad = browserStateArtifactAad({ ...scope, objectKey });
+            await dispatchBrowserSessionOperation(db, {
+              ...scope,
+              deadlineTarget: target,
+              stateUpload: {
+                objectKey,
+                cleanupAfter: new Date(Date.now() + UPLOAD_CLEANUP_GRACE_MS),
+              },
+            });
+            const signed = await objectStorage.createPutUrl({
+              key: objectKey,
+              contentType: BROWSER_STATE_ARTIFACT_CONTENT_TYPE,
+              audience: "sandbox",
+            });
+            const receipt = await client
+              .captureState({
+                ...scope,
+                objectKey,
+                afterCapture: "stop",
+                dataKey,
+                aad,
+                upload: {
+                  url: signed.url,
+                  requiredHeaders: signed.requiredHeaders,
+                  expiresAt: signed.expiresAt.toISOString(),
+                },
+              })
+              .catch(async (error: unknown) => {
+                if (
+                  error instanceof BrowserControlRequestError &&
+                  (error.error.code === "outcome_unknown" || !error.error.retryable)
+                ) {
+                  await failBrowserSessionSuspension(db, { ...scope, error: error.error });
+                }
+                throw error;
+              });
+            if (authorityLost) throw new Error("browser deadline checkpoint authority changed");
+            const portable = receipt.manifest.profileCrypto !== "platform_bound";
+            await commitBrowserSessionSuspension(db, {
+              ...scope,
+              deadlineTarget: target,
+              artifact: {
+                kind: "chromium_profile",
+                format: receipt.format,
+                objectKey,
+                artifactDigest: receipt.artifactDigest,
+                contentDigest: receipt.contentDigest,
+                manifestDigest: browserStateManifestDigest(receipt.manifest),
+                sizeBytes: receipt.sizeBytes,
+                encryptedDataKey: wrapBrowserStateDataKey(rootKey, dataKey, {
+                  ...scope,
+                  objectKey,
+                  artifactDigest: receipt.artifactDigest,
+                  contentDigest: receipt.contentDigest,
+                }),
+                materialization: {
+                  portability: portable ? "portable" : "placement_bound",
+                  reason: portable
+                    ? null
+                    : "Profile encryption depends on the source operating-system credential store.",
+                  platform: receipt.manifest.platform,
+                  architecture: receipt.manifest.architecture,
+                  engine: receipt.manifest.engine,
+                  engineVersion: receipt.manifest.engineVersion,
+                  driverId: receipt.manifest.driverId,
+                  driverSchemaVersion: receipt.manifest.driverSchemaVersion,
+                  profileCrypto: receipt.manifest.profileCrypto,
+                  providerId: null,
+                  placement: portable ? null : placement,
+                },
+              },
+            });
+          }
+          // Only remove the local profile after the encrypted artifact and its
+          // authority committed. A crash resumes this cleanup, never capture.
+          await client.endSession(target, { removeState: true }).catch((error: unknown) => {
+            if (!(error instanceof BrowserControlRequestError && error.status === 404)) throw error;
+          });
+          await withRlsContext(
+            db,
+            target,
+            async (tx) => {
+              if ((await browserDeadlineCheckpoint(tx, target))?.state !== "completed") {
+                throw new Error("browser deadline checkpoint cleanup authority changed");
+              }
+              await clearSuspendedBrowserSessionController(tx, {
+                ...target,
+                expectedControllerGeneration: target.controllerGeneration,
+              });
+              // One transaction prevents a human resume from acquiring a new
+              // same-browser holder between clearing and releasing the old one.
+              await releaseLeaseHolder(tx, {
+                ...target,
+                kind: "interaction",
+                holderId: `browser-session:${target.browserSessionId}`,
+                idleGraceMs: settings.sandboxIdleGraceMs,
+              });
+            },
+            undefined,
+            "none",
+          );
+          return { status: "suspended" as const };
+        } finally {
+          if (timer) clearInterval(timer);
+          dataKey?.fill(0);
+          aad?.fill(0);
+          rootKey.fill(0);
+        }
+      });
+    },
+  };
+}

package/src/activities/capabilities.ts

@@ -1,3 +1,9 @@
+import {
+  CLAUDE_CONNECTION_KINDS,
+  claudeProviderId,
+  withClaudeConnectionCatalog,
+  withClaudeConnectionCredential,
+} from "@opengeni/config";
 import {
   environmentsEncryptionKeyBytes,
   type Settings,
@@ -22,6 +28,7 @@ import {
   getWorkspaceOpenRouterCustomModelForExecution,
   listSessionMcpServerMetadata,
   listSessionMcpServersForRun,
+  getSessionAttemptMcpApprovalPolicies,
   listWorkspaceGatewayCustomModels,
   listWorkspaceOpenRouterCustomModels,
   workspaceCodexSubscriptionActive,
@@ -30,6 +37,9 @@ import {
   listOrganizationModelProviderCustomModelsForWorkspace,
   getOrganizationModelProviderCustomModelForExecution,
   loadOrganizationModelProviderApiKey,
+  listWorkspaceProviderCustomModels,
+  getWorkspaceProviderCustomModelForExecution,
+  loadWorkspaceProviderApiKey,
   type Database,
   type SessionMcpServerForRun,
 } from "@opengeni/db";
@@ -47,10 +57,40 @@ export async function settingsWithSessionMcpServersForRun(
   },
 ): Promise<Settings> {
   const encryptionKey = environmentsEncryptionKeyBytes(settings);
+  let policies: Awaited<ReturnType<typeof getSessionAttemptMcpApprovalPolicies>>;
+  let resolvedServers: SessionMcpServerForRun[] | undefined;
+  if (encryptionKey && typeof (db as Database & { rollback?: unknown }).rollback !== "function") {
+    // Both readers independently fence this exact active attempt. The server
+    // read must remain fresh for credential renewal; it does not consume the
+    // policy read's result. Root-pool RLS transactions may overlap, whereas
+    // nested scopes on a transaction handle must retain serial savepoints.
+    const [policyResult, serverResult] = await Promise.allSettled([
+      (async () =>
+        await getSessionAttemptMcpApprovalPolicies(db, workspaceId, sessionId, attemptId))(),
+      (async () =>
+        await listSessionMcpServersForRun(db, workspaceId, sessionId, attemptId, encryptionKey))(),
+    ]);
+    // Observe both reads before returning or propagating an error. Preserve the
+    // previous policy-first diagnostic priority, including synchronous ports.
+    if (policyResult.status === "rejected") throw policyResult.reason;
+    if (serverResult.status === "rejected") throw serverResult.reason;
+    policies = policyResult.value;
+    resolvedServers = serverResult.value;
+  } else {
+    policies = await getSessionAttemptMcpApprovalPolicies(db, workspaceId, sessionId, attemptId);
+  }
+  const policySettings = {
+    ...settings,
+    mcpServers: settings.mcpServers.map((server) =>
+      Object.hasOwn(policies, server.id)
+        ? { ...server, requireApproval: policies[server.id] }
+        : server,
+    ),
+  };
   if (!encryptionKey) {
     const metadata = await listSessionMcpServerMetadata(db, workspaceId, sessionId);
     if (metadata.length === 0) {
-      return settings;
+      return policySettings;
     }
     if (metadata.some((server) => server.headerNames.length > 0)) {
       throw new Error(
@@ -58,18 +98,20 @@ export async function settingsWithSessionMcpServersForRun(
       );
     }
   }
-  const servers = await listSessionMcpServersForRun(
-    db,
-    workspaceId,
-    sessionId,
-    attemptId,
-    encryptionKey ?? null,
-  );
+  const servers =
+    resolvedServers ??
+    (await listSessionMcpServersForRun(
+      db,
+      workspaceId,
+      sessionId,
+      attemptId,
+      encryptionKey ?? null,
+    ));
   // Keep credential provenance coupled to the exact decrypted rows that are
   // overlaid into settings. A session projection read earlier in the turn can
   // be stale after a concurrent mcpCredentialUpdates renewal.
   options?.onResolvedServers?.(servers);
-  return settingsWithSessionMcpServers(settings, servers);
+  return settingsWithSessionMcpServers(policySettings, servers);
 }
 
 export function settingsWithSessionMcpServers(
@@ -233,7 +275,10 @@ export async function settingsWithOrganizationProviderCredentials(
   settings: Settings,
   retainedProductModelId?: string | null,
 ): Promise<Settings> {
-  const buildModels = async (providerKind: "vercel_gateway" | "openrouter", prefix: string) => {
+  const buildModels = async (
+    providerKind: "vercel_gateway" | "openrouter" | "anthropic" | "claude_subscription",
+    prefix: string,
+  ) => {
     const active = await listOrganizationModelProviderCustomModelsForWorkspace(db, {
       accountId,
       workspaceId,
@@ -269,7 +314,59 @@ export async function settingsWithOrganizationProviderCredentials(
     workspaceId,
     providerKind: "openrouter",
   });
-  return openRouterKey
+  let result = openRouterKey
     ? withOrganizationOpenRouterCredential(gatewaySettings, openRouterKey, openRouterModels)
     : withOrganizationOpenRouterCatalogProvider(gatewaySettings, openRouterModels);
+  for (const kind of CLAUDE_CONNECTION_KINDS) {
+    if (kind === "claude_subscription" && !settings.claudeSubscriptionEnabled) continue;
+    const models = await buildModels(kind, claudeProviderId(kind) + "/");
+    result = withClaudeConnectionCatalog(result, { [kind]: { models } });
+    const credential =
+      kind === "claude_subscription"
+        ? null
+        : await loadOrganizationModelProviderApiKey(db, settings, {
+            accountId,
+            workspaceId,
+            providerKind: kind,
+          });
+    if (credential)
+      result = withClaudeConnectionCredential(result, kind, credential, "organization", undefined);
+    const workspaceModels = await listWorkspaceProviderCustomModels(db, {
+      accountId,
+      workspaceId,
+      providerKind: kind,
+    });
+    const workspacePrefix = claudeProviderId(kind, "workspace") + "/";
+    const workspaceModelId = retainedProductModelId?.startsWith(workspacePrefix)
+      ? retainedProductModelId
+      : null;
+    if (workspaceModelId) {
+      const retained = await getWorkspaceProviderCustomModelForExecution(db, {
+        accountId,
+        workspaceId,
+        providerKind: kind,
+        upstreamModelId: workspaceModelId.slice(workspacePrefix.length),
+      });
+      if (retained && !workspaceModels.some((model) => model.id === retained.id))
+        workspaceModels.push(retained);
+    }
+    result = withClaudeConnectionCatalog(
+      result,
+      { [kind]: { models: workspaceModels } },
+      "workspace",
+    );
+    const workspaceCredential =
+      kind === "claude_subscription"
+        ? null
+        : await loadWorkspaceProviderApiKey(db, settings, workspaceId, kind, workspaceModelId);
+    if (workspaceCredential)
+      result = withClaudeConnectionCredential(
+        result,
+        kind,
+        workspaceCredential,
+        "workspace",
+        undefined,
+      );
+  }
+  return result;
 }