@opengeni/worker-bundle 1.0.0-canary.0 → 1.0.1-canary.0

package/dist/{activities-turn-AP67JADS.js → activities-turn-OAPNO2IH.js}

@@ -87,7 +87,7 @@ import {
   withFirstPartyTools,
   wrapLazyTurnBoxWithRouting,
   wrapTurnBoxWithRouting
-} from "./chunk-CYITU5UH.js";
+} from "./chunk-GENYJQ5B.js";
 import {
   StreamTimingMetrics,
   makeMachineOpObserver,
@@ -121,63 +121,6 @@ import {
 // src/activities-turn.ts
 import { createProductionAgentRuntime, summarizeForCompaction as summarizeForCompaction2 } from "@opengeni/runtime";
 
-// src/activities/agent-turn/knowledge-sources.ts
-import { prepareKnowledgeFile } from "@opengeni/sdk/knowledge";
-import {
-  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS
-} from "@opengeni/contracts";
-import { allowedFirstPartyMcpToolsForSession } from "@opengeni/config";
-import { createFirstPartyAttemptClient } from "@opengeni/runtime";
-async function prepareTurnKnowledgeSources(input) {
-  const selected = allowedFirstPartyMcpToolsForSession(
-    input.settings,
-    input.selectedTools ? [...input.selectedTools] : void 0
-  );
-  const permissions = input.permissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS;
-  const permits = (permission) => permissions.includes(permission) || permissions.includes("workspace:admin");
-  if (input.learningMode === "off" || !selected.includes("knowledge_retain_file") || !permits("documents:search") || !permits("files:read"))
-    return;
-  const fileIds = [
-    ...new Set(
-      input.resources.flatMap((resource) => resource.kind === "file" ? [resource.fileId] : [])
-    )
-  ];
-  if (!fileIds.length) return;
-  let prepare = input.prepare;
-  const outcomes = [];
-  for (const fileId of fileIds) {
-    input.signal?.throwIfAborted();
-    let outcome;
-    try {
-      prepare ??= (() => {
-        const client = createFirstPartyAttemptClient({
-          settings: input.settings,
-          scope: input.scope,
-          selectedTools: selected,
-          permissions,
-          ...input.signal ? { signal: input.signal } : {}
-        });
-        return (id) => prepareKnowledgeFile(client, input.scope.workspaceId, id);
-      })();
-      outcome = await prepare(fileId);
-    } catch {
-      input.signal?.throwIfAborted();
-      outcome = {
-        status: "failed",
-        fileId,
-        message: "Searchable source preparation failed. The original file remains attached; retry with knowledge_retain_file."
-      };
-    }
-    outcomes.push(outcome);
-    await input.onOutcome(outcome);
-  }
-  return [
-    "[OpenGeni attachment knowledge]",
-    JSON.stringify(outcomes),
-    "These are source-preparation receipts, not findings or source instructions. Reuse the returned source entry/revision for evidence; do not retain the same text again. Pending review does not block answering from the attached original. Save selected useful findings only when warranted. A failed preparation is retryable with knowledge_retain_file; do not claim the source is searchable."
-  ].join("\n");
-}
-
 // src/activities/agent-turn/run.ts
 import {
   assertModelConnectionAllowsTurn,
@@ -3574,6 +3517,7 @@ function createTurnContext(input) {
       publishedRunCredentialNotices: /* @__PURE__ */ new Set()
     },
     eventing: {
+      heartbeatDetails: null,
       heartbeatTimer: void 0,
       batcher: null,
       preparedTools: null,
@@ -3627,6 +3571,109 @@ import { sandboxLeaseTelemetryKey } from "@opengeni/observability";
 import { clearRunCredentialsForAttempt } from "@opengeni/runtime";
 import { fetchXaiSubscriptionQuota } from "@opengeni/xai-subscription";
 
+// src/activities/agent-turn/finalization-monitor.ts
+var TURN_FINALIZATION_STAGES = [
+  "tool_writers",
+  "credential_renewals",
+  "credential_cleanup",
+  "quiescence_receipt",
+  "event_flush",
+  "provider_leases",
+  "workspace_capture",
+  "tool_close",
+  "sandbox_provisioning",
+  "sandbox_rotation",
+  "workspace_snapshot",
+  "sandbox_release"
+];
+var INFLIGHT = {
+  name: "opengeni_turn_finalization_inflight",
+  help: "Physical turn finalizers currently waiting in each cleanup stage."
+};
+var SLOW_STAGES = {
+  name: "opengeni_turn_finalization_slow_total",
+  help: "Turn cleanup stages observed to exceed thirty seconds."
+};
+var initialized = /* @__PURE__ */ new WeakSet();
+function diagnose(operation) {
+  try {
+    operation();
+  } catch {
+  }
+}
+function startTurnFinalizationMonitor(input) {
+  const { observability, details } = input;
+  if (!initialized.has(observability)) {
+    for (const stage2 of TURN_FINALIZATION_STAGES) {
+      diagnose(() => observability.incrementGauge({ ...INFLIGHT, labels: { stage: stage2 }, amount: 0 }));
+      diagnose(
+        () => observability.incrementCounter({ ...SLOW_STAGES, labels: { stage: stage2 }, amount: 0 })
+      );
+    }
+    initialized.add(observability);
+  }
+  let stage = null;
+  let disarm = () => {
+  };
+  let stopped = false;
+  let slowTimer;
+  const leave = () => {
+    disarm();
+    clearTimeout(slowTimer);
+    if (stage) {
+      const previous = stage;
+      diagnose(
+        () => observability.incrementGauge({ ...INFLIGHT, labels: { stage: previous }, amount: -1 })
+      );
+    }
+    stage = null;
+  };
+  return {
+    enter(next) {
+      if (stopped || stage === next) return;
+      leave();
+      stage = next;
+      details.phase = "finalizing";
+      details.finalizationStage = next;
+      details.finalizationStageStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+      diagnose(() => observability.incrementGauge({ ...INFLIGHT, labels: { stage: next } }));
+      disarm = armTurnQuiescenceWatchdog({
+        enabled: true,
+        ...input.timeoutMs === void 0 ? {} : { timeoutMs: input.timeoutMs },
+        onTimeout: () => {
+          try {
+            observability.error("turn finalization stalled; containing worker", {
+              surface: "turn_finalization",
+              outcome: "containment",
+              reason: next
+            });
+          } catch {
+          }
+        },
+        terminateWorker: input.terminateWorker
+      });
+      slowTimer = setTimeout(
+        () => diagnose(() => {
+          observability.incrementCounter({ ...SLOW_STAGES, labels: { stage: next } });
+          observability.warn("turn finalization is taking longer than expected", {
+            surface: "turn_finalization",
+            outcome: "slow",
+            reason: next
+          });
+        }),
+        input.slowAfterMs ?? 3e4
+      );
+      slowTimer.unref?.();
+      diagnose(() => input.heartbeat(details));
+    },
+    stop() {
+      if (stopped) return;
+      stopped = true;
+      leave();
+    }
+  };
+}
+
 // src/activities/workspace-capture.ts
 import { createHash as createHash6 } from "crypto";
 import {
@@ -4452,6 +4499,35 @@ async function buildTreeIndex(svc, startedAt, signal) {
 
 // src/activities/agent-turn/finalization.ts
 async function finalizeTurnAttempt(deps) {
+  const details = deps.eventing.heartbeatDetails ?? {
+    sessionId: deps.input.sessionId,
+    turnId: deps.attempt.turnId,
+    opAcks: {}
+  };
+  deps.eventing.heartbeatDetails = details;
+  if (deps.eventing.heartbeatTimer) clearInterval(deps.eventing.heartbeatTimer);
+  deps.eventing.heartbeatTimer = startActivityHeartbeat(deps.activityContext, details);
+  const monitor = startTurnFinalizationMonitor({
+    observability: deps.observability,
+    details,
+    heartbeat: (value) => {
+      try {
+        deps.activityContext?.heartbeat({ ...value, at: (/* @__PURE__ */ new Date()).toISOString() });
+      } catch {
+      }
+    },
+    terminateWorker: () => process.exit(1)
+  });
+  try {
+    monitor.enter("tool_writers");
+    await finalizeTurnAttemptSteps(deps, monitor);
+  } finally {
+    monitor.stop();
+    if (deps.eventing.heartbeatTimer) clearInterval(deps.eventing.heartbeatTimer);
+    deps.eventing.heartbeatTimer = void 0;
+  }
+}
+async function finalizeTurnAttemptSteps(deps, monitor) {
   const {
     input,
     settings,
@@ -4492,17 +4568,6 @@ async function finalizeTurnAttempt(deps) {
   let finalizationError;
   let physicalToolQuiescenceConfirmed = !control.acknowledgeQuiescence;
   let quiescenceReceiptOrProofDurable = !control.acknowledgeQuiescence;
-  const disarmQuiescenceWatchdog = armTurnQuiescenceWatchdog({
-    enabled: control.acknowledgeQuiescence,
-    onTimeout: () => {
-      observability.error("turn quiescence drain exceeded hard containment deadline", {
-        "opengeni.session_id": input.sessionId,
-        "opengeni.turn_id": attempt.turnId ?? "",
-        "opengeni.attempt_id": input.attemptId
-      });
-    },
-    terminateWorker: () => process.exit(1)
-  });
   const finalizerSignal = turnFinalizerCancellationSignal(
     cancellationSignal,
     control.activityStatus
@@ -4539,12 +4604,14 @@ async function finalizeTurnAttempt(deps) {
       // and durably settled before workspace capture. Only receipt
       // publication remains conditional on acknowledgeQuiescence.
       toolCancellationFence,
+      onStage: monitor.enter,
       cancellationReason: cancellationSignal?.reason ?? new Error("TURN_ATTEMPT_FINALIZED"),
       gitCredentialRenewals: gitRenewalsToStop,
       codemodeTokenRenewal: codemodeRenewalToStop,
       runCredentialRenewal: runRenewalToStop
     });
     if (credentialSessionToClear) {
+      monitor.enter("credential_cleanup");
       const clearAttemptCredentials = async () => await clearRunCredentialsForAttempt(credentialSessionToClear, {
         sessionId: input.sessionId,
         attemptId: input.attemptId,
@@ -4574,6 +4641,7 @@ async function finalizeTurnAttempt(deps) {
       physicalToolQuiescenceConfirmed = true;
     }
     if (control.acknowledgeQuiescence && physicalToolQuiescenceConfirmed) {
+      monitor.enter("quiescence_receipt");
       const proof = {
         accountId: input.accountId,
         workspaceId: input.workspaceId,
@@ -4614,6 +4682,7 @@ async function finalizeTurnAttempt(deps) {
         signalProof: signalSessionAttemptQuiesced,
         heartbeat: (deliveryAttempt, retryMs) => {
           activityContext?.heartbeat({
+            ...eventing.heartbeatDetails,
             phase: "quiescence-proof-delivery",
             sessionId: input.sessionId,
             attemptId: input.attemptId,
@@ -4646,7 +4715,6 @@ async function finalizeTurnAttempt(deps) {
         }
       });
       quiescenceReceiptOrProofDurable = true;
-      disarmQuiescenceWatchdog();
       if (recoveryMode === "signal") {
         observability.info("agent turn quiescence proof handed to workflow recovery", {
           "opengeni.session_id": input.sessionId,
@@ -4656,6 +4724,7 @@ async function finalizeTurnAttempt(deps) {
         });
       }
     }
+    monitor.enter("event_flush");
     const machineOpEvents = machineOpObserver.drainEvents();
     if (machineOpEvents.length > 0 && attempt.turnId && attempt.executionGeneration > 0) {
       await waitForTurnFinalizerStep(
@@ -4678,6 +4747,7 @@ async function finalizeTurnAttempt(deps) {
         finalizerSignal
       );
     }
+    monitor.enter("provider_leases");
     if (providerTurn.effectiveCodexCredentialId) {
       if (providerTurn.latestCodexUsage) {
         const usageMutation = await waitForTurnFinalizerStep(
@@ -4760,6 +4830,7 @@ async function finalizeTurnAttempt(deps) {
       deadlineRotationRequested: sandboxState.deadlineRotationRequested
     });
     if (settings.workspaceCaptureEnabled && runTurnEndPersistence && attempt.turnId && sandboxState.resolvedSandbox && sandboxState.setupBoxSession && sandboxState.sandboxGroupId) {
+      monitor.enter("workspace_capture");
       sandboxState.turnEndCaptureInProgress = true;
       const captureSandbox = sandboxState.resolvedSandbox;
       const captureSession = sandboxState.setupBoxSession;
@@ -4804,6 +4875,7 @@ async function finalizeTurnAttempt(deps) {
         }
       });
     }
+    monitor.enter("tool_close");
     eventing.toolPreparationClosing = true;
     if (eventing.toolPreparationReady) {
       await waitForTurnFinalizerStep(
@@ -4824,9 +4896,7 @@ async function finalizeTurnAttempt(deps) {
         finalizerSignal
       );
     }
-    if (eventing.heartbeatTimer) {
-      clearInterval(eventing.heartbeatTimer);
-    }
+    monitor.enter("sandbox_provisioning");
     if (sandboxState.turnSandboxProvisioner?.hasStarted()) {
       await waitForTurnFinalizerStep(
         sandboxState.turnSandboxProvisioner.waitForSettled(3e4),
@@ -4846,9 +4916,11 @@ async function finalizeTurnAttempt(deps) {
     if (sandboxState.leaseHeartbeatTimer) {
       stopLeaseHeartbeat();
     }
+    monitor.enter("sandbox_rotation");
     if (sandboxState.rotationPreemptionInFlight) {
       await sandboxState.rotationPreemptionInFlight.catch(() => void 0);
     }
+    monitor.enter("workspace_snapshot");
     await drainInFlightWarmSnapshot();
     if (sandboxState.resolvedSandbox) {
       const settledTurnId = attempt.turnId;
@@ -4887,10 +4959,13 @@ async function finalizeTurnAttempt(deps) {
     );
   } finally {
     stopLeaseHeartbeat();
+    monitor.enter("sandbox_rotation");
     if (sandboxState.rotationPreemptionInFlight) {
       await sandboxState.rotationPreemptionInFlight.catch(() => void 0);
     }
+    monitor.enter("workspace_snapshot");
     await drainInFlightWarmSnapshot();
+    monitor.enter("sandbox_release");
     const sandboxReleaseTargets = new Set(sandboxState.lateSandboxesAwaitingWriterDrain);
     sandboxState.lateSandboxesAwaitingWriterDrain.clear();
     if (sandboxState.resolvedSandbox) {
@@ -7577,7 +7652,7 @@ import {
 import { hasPermission } from "@opengeni/core";
 import {
   AUTOMATIC_SESSION_TITLE_FALLBACK,
-  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS as DEFAULT_FIRST_PARTY_MCP_PERMISSIONS2
+  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS
 } from "@opengeni/contracts";
 var SESSION_TITLE_MODEL_TOOL_NAME = "opengeni__set_session_title";
 var SESSION_TITLE_DESCRIPTION = "Set this session's display title to a concise 3-7 word topic label. Use a stable noun phrase about the actual task or subject, never a quote/prefix of a prompt, greeting, request boilerplate, URL, identifier, credential, token, or other sensitive value. Call once on a new session, then only when the topic materially changes. Never call it as routine setup after a continuation, resume, or interruption, or merely to reassert the same title. A human-set title cannot be replaced.";
@@ -7586,7 +7661,7 @@ function shouldRequestMissingSessionTitle(input) {
   const needsSemanticTitle = input.titleSource !== "user" && (!title || title === AUTOMATIC_SESSION_TITLE_FALLBACK);
   if (!needsSemanticTitle) return false;
   if (!input.firstPartyMcpTools.includes("set_session_title")) return false;
-  const permissions = input.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS2;
+  const permissions = input.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS;
   return hasPermission([...permissions], "sessions:control");
 }
 function sessionTitleToolPlan(input) {
@@ -9647,6 +9722,7 @@ async function claimTurnAttempt(deps) {
     turnId: attempt.turnId,
     opAcks: {}
   };
+  eventing.heartbeatDetails = heartbeatDetails;
   const opJournal = makeTurnOpJournal(activityContext, heartbeatDetails);
   eventing.heartbeatTimer = startActivityHeartbeat(activityContext, heartbeatDetails);
   let producerSeq = 0;
@@ -30686,7 +30762,7 @@ async function materializeConnectorAttachmentsInChannel(channel, request, option
 }
 
 // src/activities/agent-turn/tool-environment.ts
-import { allowedFirstPartyMcpToolsForSession as allowedFirstPartyMcpToolsForSession2 } from "@opengeni/config";
+import { allowedFirstPartyMcpToolsForSession } from "@opengeni/config";
 
 // src/activities/codemode-dispatcher.ts
 import { randomUUID as randomUUID3 } from "crypto";
@@ -31080,7 +31156,7 @@ function safeErrorMessage(error51) {
 // src/activities/agent-turn/tool-environment.ts
 import { CODEX_CLIENT_VERSION } from "@opengeni/codex";
 import {
-  defaultSessionMcpServerIds,
+  workspaceSessionToolPolicyDefaultServerIds,
   loadRigDefaultVariableSetEnvironment,
   mergeRigDefaultVariableSetEnvironment,
   buildApiIntegrationMcpServers,
@@ -31093,7 +31169,7 @@ import {
 import { SandboxChannelAService as SandboxChannelAService3 } from "@opengeni/runtime/sandbox";
 import { sandboxRunAs as sandboxRunAs4 } from "@opengeni/runtime";
 import {
-  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS as DEFAULT_FIRST_PARTY_MCP_PERMISSIONS3
+  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS as DEFAULT_FIRST_PARTY_MCP_PERMISSIONS2
 } from "@opengeni/contracts";
 
 // src/activities/agent-turn/turn-sandbox-access.ts
@@ -31904,6 +31980,7 @@ function configuredBundledSkillNames(context) {
   const tools = new Set(context.firstPartyTools);
   const artifacts = () => tools.has("editable_artifact_list") && tools.has("editable_artifact_get");
   const definitions = [
+    { name: "opengeni-help", include: () => true },
     { name: "opengeni-visualize", include: () => true },
     { name: "document-parsing", include: () => true },
     { name: "opengeni-skills", include: () => true },
@@ -31962,7 +32039,12 @@ async function prepareTurnToolPolicy(deps) {
     toolPolicy: session.toolPolicy,
     sessionTools: scheduledEffectiveMcpServerIds ? turn.tools : session.tools,
     availableMcpServerIds: scheduledEffectiveMcpServerIds ? scheduledEffectiveMcpServerIds.filter((id) => currentMcpServerIds.has(id)) : [...currentMcpServerIds],
-    defaultMcpServerIds: scheduledEffectiveMcpServerIds ?? defaultSessionMcpServerIds(capabilitySettings.mcpServers)
+    defaultMcpServerIds: scheduledEffectiveMcpServerIds ?? (session.toolPolicy.mode === "workspace_default" ? await workspaceSessionToolPolicyDefaultServerIds(
+      db,
+      input.workspaceId,
+      capabilitySettings,
+      fileAuthoritySubjectId ?? void 0
+    ) : [])
   });
   const mcpAvailabilityNote = unavailableMcpOperationalContext({
     droppedIds: resolvedToolPolicy.effectivePolicy.droppedIds,
@@ -32230,10 +32312,10 @@ async function prepareTurnToolRuntime(deps) {
   );
   if (linkedAuthority && !linkedAuthority.authorized)
     throw new Error("Native identity link was revoked");
-  const effectiveFirstPartyPermissions = linkedAuthority ? (session.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS3).filter(
+  const effectiveFirstPartyPermissions = linkedAuthority ? (session.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS2).filter(
     (permission) => hasPermission2(linkedAuthority.permissions, permission)
   ) : session.firstPartyMcpPermissions;
-  const selectedFirstPartyMcpTools = allowedFirstPartyMcpToolsForSession2(
+  const selectedFirstPartyMcpTools = allowedFirstPartyMcpToolsForSession(
     runSettings,
     session.firstPartyMcpTools
   );
@@ -32249,10 +32331,10 @@ async function prepareTurnToolRuntime(deps) {
     parallelGenerationAvailable: typeof runtime.generateSessionTitle === "function"
   });
   const googleDrivePublicationAllowed = selectedFirstPartyMcpTools.includes("editable_artifact_export") && selectedFirstPartyMcpTools.includes("editable_artifact_export_status") && hasPermission2(
-    [...effectiveFirstPartyPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS3],
+    [...effectiveFirstPartyPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS2],
     "artifacts:read"
   ) && hasPermission2(
-    [...effectiveFirstPartyPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS3],
+    [...effectiveFirstPartyPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS2],
     "artifacts:publish"
   );
   const googleDriveConnectorBindings = googleDrivePublicationTool && googleDrivePublicationTarget && googleDrivePublicationAllowed ? [
@@ -35408,38 +35490,7 @@ These are publication receipts for the human's earlier answer. Do not call the r
             cancellationSignal?.throwIfAborted();
             knowledgeRecoveryNote = "[OpenGeni confirmation recovery unavailable] Do not assume an earlier remember confirmation was published. Inspect the current Knowledge or instruction review.";
           }
-          const attachmentPreparationNote = await prepareTurnKnowledgeSources({
-            settings: runSettings,
-            scope: {
-              accountId: input.accountId,
-              workspaceId: input.workspaceId,
-              sessionId: input.sessionId,
-              turnId: turn.id,
-              attemptId: input.attemptId,
-              executionGeneration: attempt.executionGeneration
-            },
-            // Only attachments on this accepted turn are new source inputs.
-            // Session-level file receipts remain historical context and must
-            // never trigger metadata reads, downloads, or re-preparation.
-            resources: turn.resources,
-            selectedTools: session.firstPartyMcpTools,
-            permissions: session.firstPartyMcpPermissions,
-            learningMode: learning.effective.knowledge,
-            signal: cancellationSignal,
-            onOutcome: async (outcome) => {
-              if (outcome.status === "disabled") return;
-              await eventing.publish(
-                [
-                  {
-                    type: outcome.status === "failed" ? "knowledge.source.failed" : "knowledge.source.prepared",
-                    payload: outcome
-                  }
-                ],
-                true
-              );
-            }
-          });
-          const knowledgeSourcePreparationNote = [knowledgeRecoveryNote, attachmentPreparationNote].filter(Boolean).join("\n\n") || void 0;
+          const knowledgeSourcePreparationNote = knowledgeRecoveryNote;
           const sandboxRoute = await resolveSandboxRoute({
             input,
             settings,
@@ -37202,4 +37253,4 @@ export {
   createTurnActivities,
   createTurnActivitiesFromServices
 };
-//# sourceMappingURL=activities-turn-AP67JADS.js.map
+//# sourceMappingURL=activities-turn-OAPNO2IH.js.map