@opengeni/worker-bundle 1.0.0-canary.1 → 1.0.0

package/dist/activities/agent-turn/failure-settlement.d.ts

@@ -1,7 +1,9 @@
-import type { Settings } from "@opengeni/config";
+import { type Settings } from "@opengeni/config";
+import { type CodexPlanEntitlementFailurePayload } from "./codex-plan-entitlement.js";
 import type { TurnActivityServices as ActivityServices, RunAgentTurnInput, RunAgentTurnResult } from "../types.js";
 import { createTurnCredentialLeases } from "./credential-leases.js";
 import { createTurnHistorySink } from "./history-sink.js";
+import { type CodexCredentialFailure } from "./errors.js";
 import type { AttemptIdentityState, BillingState, EventingState, ProviderTurnState, TurnControlState } from "./turn-context.js";
 export type TurnFailureDeps = {
     error: unknown;
@@ -44,7 +46,7 @@ type CodexCapacityWaitFailurePayload = {
  * recover the same durable turn immediately.
  */
 export declare function codexDefinitiveFailureDisposition(input: {
-    failureKind: "auth" | "forbidden" | "rate_limit" | "quota";
+    failureKind: CodexCredentialFailure["kind"];
     rotationEnabled: boolean;
     pinDisposition: "manual" | "sharded" | "clearStale" | "unpinned";
     decisionKind: "active" | "allCapped" | "none";
@@ -63,13 +65,14 @@ export declare function codexCredentialFailoverLimit(accounts: ReadonlyArray<{
 }>, servingCredentialId: string): number;
 /** Build the durable waiter payload without collapsing quota refusals into 403. */
 export declare function codexCapacityWaitFailurePayload(input: {
-    failureKind: "auth" | "forbidden" | "rate_limit" | "quota";
+    failureKind: CodexCredentialFailure["kind"];
     usageLimit: {
         resetsInSeconds: number | null;
     } | null;
     cooldownSeconds: number | null;
     detail: string;
     allAccounts: boolean;
+    planEntitlement?: CodexPlanEntitlementFailurePayload | null;
 }): CodexCapacityWaitFailurePayload;
 export declare function settleTurnFailure(deps: TurnFailureDeps): Promise<RunAgentTurnResult>;
 export {};

package/dist/activities/agent-turn/final-reply.d.ts

@@ -0,0 +1,18 @@
+/** One durable, same-logical-turn handoff, not a retry of model/tool effects. */
+export declare function finalReplyNudge(turnId: string): {
+    type: "message";
+    role: "developer";
+    content: {
+        type: "input_text";
+        text: string;
+    }[];
+};
+export declare function hasFinalReplyNudge(history: readonly unknown[], turnId: string): boolean;
+export declare function needsFinalReply(input: {
+    output: unknown;
+    inputWaitYielded: boolean;
+    interrupted: boolean;
+    maintenance: boolean;
+    toolsExecuted: boolean;
+    completedGoal: boolean;
+}): boolean;

package/dist/activities/agent-turn/finalization-monitor.d.ts

@@ -0,0 +1,17 @@
+import type { Observability } from "@opengeni/observability";
+import type { TurnHeartbeatDetails } from "../../op-journal.js";
+export declare const TURN_FINALIZATION_STAGES: readonly ["tool_writers", "credential_renewals", "credential_cleanup", "quiescence_receipt", "event_flush", "provider_leases", "workspace_capture", "tool_close", "sandbox_provisioning", "sandbox_rotation", "workspace_snapshot", "sandbox_release"];
+export type TurnFinalizationStage = (typeof TURN_FINALIZATION_STAGES)[number];
+/** Starts only after agent execution ends. A cleanup-stage deadline never caps
+ * agent work and never detaches a physical writer to manufacture quiescence. */
+export declare function startTurnFinalizationMonitor(input: {
+    observability: Observability;
+    details: TurnHeartbeatDetails;
+    heartbeat: (details: TurnHeartbeatDetails) => void;
+    requestWorkerDrain: () => void;
+    timeoutMs?: number;
+    slowAfterMs?: number;
+}): {
+    enter(next: TurnFinalizationStage): void;
+    stop(): void;
+};

package/dist/activities/agent-turn/finalization.d.ts

@@ -1,5 +1,5 @@
-import type { Settings } from "@opengeni/config";
-import type { currentActivityContext } from "../streaming.js";
+import { type Settings } from "@opengeni/config";
+import { type currentActivityContext } from "../streaming.js";
 import type { RunAgentTurnInput, TurnActivityServices as ActivityServices } from "../types.js";
 import { createModelCheckpointMemoryCollector } from "../../model-checkpoint-memory-collector.js";
 import { makeMachineOpObserver } from "../../observability-metrics.js";
@@ -16,6 +16,8 @@ export type TurnFinalizationDeps = {
     wakeSessionWorkflow: ActivityServices["wakeSessionWorkflow"];
     signalSessionAttemptQuiesced: ActivityServices["signalSessionAttemptQuiesced"];
     signalCodexCapacityWorkflow: ActivityServices["signalCodexCapacityWorkflow"];
+    requestWorkerDrain: ActivityServices["requestWorkerDrain"];
+    turnFinalizationTimeoutMs: ActivityServices["turnFinalizationTimeoutMs"];
     cancellationSignal: AbortSignal | undefined;
     sandboxResumeController: AbortController;
     activityContext: ReturnType<typeof currentActivityContext>;

package/dist/activities/agent-turn/github-repository-bindings.d.ts

@@ -76,6 +76,8 @@ export type ApplyTurnGitHubRepositoryBindingsInput = {
     workspaceId: string;
     sessionId: string;
     activeSandboxBackend: Settings["sandboxBackend"] | undefined;
+    /** Product-owned credentials take precedence over inferred platform bindings. */
+    hasCredentialProvider?: boolean;
     claimedTurnResources: readonly ResourceRef[];
     claimedRuntimeResources: readonly ResourceRef[];
     /** Publishes one attempt-fenced session event batch. */

package/dist/activities/agent-turn/governance-model.d.ts

@@ -1,7 +1,6 @@
 import { materializeRigVersionForAttempt } from "@opengeni/db";
 import { renderWorkspaceGovernanceContext, type OpenGeniRuntime } from "@opengeni/runtime";
 import { type Settings } from "@opengeni/config";
-import { resolveWorkspacePackRuntime } from "../packs.js";
 import { createModelHistoryAttachmentProjector } from "../run-input.js";
 import type { TurnActivityServices as ActivityServices, RunAgentTurnInput, RunAgentTurnResult } from "../types.js";
 import { buildCompanyBrainContributionReceipt } from "../../model-context-contributions.js";
@@ -12,6 +11,7 @@ import type { EventingState, WorkspaceRefState } from "./turn-context.js";
 export type GovernanceModelDeps = {
     input: RunAgentTurnInput;
     db: ActivityServices["db"];
+    observability: ActivityServices["observability"];
     runtime: ActivityServices["runtime"];
     objectStorage: ActivityServices["objectStorage"];
     eventing: EventingState;
@@ -35,11 +35,18 @@ export type GovernanceModelDeps = {
 };
 export type GovernanceModelOk = {
     runtimePreparationStartedAt: number;
-    packRuntime: Awaited<ReturnType<typeof resolveWorkspacePackRuntime>>;
     rigVersion: NonNullable<Awaited<ReturnType<typeof materializeRigVersionForAttempt>>>["version"] | null;
     rigName: string | null;
     agentHumanInputEnabled: boolean;
+    /** Deployment and workspace allow the Jev-backed code_search tool. */
+    codeSearchEnabled: boolean;
     workspaceAgentInstructions: string | null | undefined;
+    /**
+     * Modular composer identity tier: the explicit workspace default identity,
+     * else the frozen legacy persona without `{{core}}`. Never dropped by
+     * instruction policies (only read for sessions with an agent configuration).
+     */
+    workspaceAgentIdentity: string | null;
     workspaceGovernance: ReturnType<typeof renderWorkspaceGovernanceContext>;
     structuredWorkspacePolicyActive: boolean;
     workspaceMemory: string | null | undefined;

package/dist/activities/agent-turn/history-sink.d.ts

@@ -41,6 +41,7 @@ export type TurnHistorySinkDeps = {
 export declare class TurnHistorySink {
     private readonly deps;
     private readonly prefix;
+    private checkpointTail;
     seedHistory(input: string | readonly unknown[] | {
         readonly history: unknown[];
     }, count: number): void;
@@ -52,5 +53,6 @@ export declare class TurnHistorySink {
         skipInputOnlyRows?: boolean;
         requireDurable?: boolean;
     }) => Promise<void>;
+    private reconcile;
 }
 export declare function createTurnHistorySink(deps: TurnHistorySinkDeps): TurnHistorySink;

package/dist/activities/agent-turn/history.d.ts

@@ -49,6 +49,8 @@ export declare function pendingToolCallFromSdkEvent(event: unknown): {
 } | null;
 /** Tools whose intentional visual result must survive inline-media sanitization. */
 export declare function toolCallProducesRetainableSessionImage(name: string | null): boolean;
+/** Browser interactions can carry an image block, including opt-in observe frames. */
+export declare function retainableBrowserScreenshotToolCall(name: string | null): boolean;
 export declare function completedToolCallFromSdkEvent(event: unknown): {
     callId: string;
     resultItem: Record<string, unknown>;

package/dist/activities/agent-turn/input-wait-reply.d.ts

@@ -0,0 +1,41 @@
+import { type Database } from "@opengeni/db";
+import type { TurnInitiator, TurnInitiatorContext } from "@opengeni/contracts";
+type ReplyTurn = {
+    source?: string | undefined;
+    initiator: TurnInitiator;
+    initiatorContext: TurnInitiatorContext;
+};
+/**
+ * The reply `turn.completed` records when a turn ends through `wait_for_input`
+ * (read back with `turnCompletedReply` in `@opengeni/contracts`).
+ *
+ * Such a turn settles with an empty `output`: the wait, not an answer, ended
+ * it. When the turn answers a person's message, its latest assistant message
+ * is still that message's answer, for example a status reply given before
+ * waiting again on work in flight. That message shares its model response with
+ * the wait call, so it streams as commentary, which is activity everywhere
+ * else. Recording it lets unread attention and Slack treat it as the answer
+ * without relabelling the provider's phase in stored history. Turns that
+ * machine input, an agent or a worker-owned producer started only narrate
+ * progress and record nothing.
+ *
+ * The message this activity completed last is the newest. An activity that
+ * resumed the turn (after an approval, a human-input answer or a recovery) and
+ * completed none reads the turn's latest durable message instead.
+ */
+export declare function inputWaitReply(input: {
+    inputWaitYielded: boolean;
+    turn: ReplyTurn;
+    latestAssistantMessageText: string | null;
+    readLatestDurableTurnMessage: () => Promise<string | null>;
+}): Promise<string | null>;
+/**
+ * Text of the newest current `agent.message.completed` this turn persisted,
+ * or null when the session's newest completion belongs to another turn.
+ */
+export declare function latestDurableTurnMessageText(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+}): Promise<string | null>;
+export {};

package/dist/activities/agent-turn/media-artifacts.d.ts

@@ -1,5 +1,6 @@
 import { type CodemodeTokenWriterSession, type RetainableSessionImageOutputHook, type TurnToolCancellationFence } from "@opengeni/runtime";
 import type { Settings } from "@opengeni/config";
+import type { RetainedSessionScreenshotKind } from "@opengeni/contracts";
 import type { ResumedTurnSandbox } from "../../sandbox-resume.js";
 import type { SharedActivityServices } from "../types.js";
 import { type GeneratedImageOutput, type GeneratedImageReceipt } from "../generated-images.js";
@@ -35,7 +36,7 @@ export declare class TurnMediaArtifacts {
     readonly retainedScreenshotReceiptsByCallId: Map<string, {
         available: true;
         artifactId: string;
-        kind: "assistant_completion" | "computer_screenshot" | "event_media" | "file" | "generated_image" | "generated_video" | "internal_update" | "tool_result";
+        kind: "assistant_completion" | "browser_screenshot" | "computer_screenshot" | "event_media" | "file" | "generated_image" | "generated_video" | "internal_update" | "tool_result";
         contentType: string;
         originalBytes: number;
         sha256: string;
@@ -68,7 +69,7 @@ export declare class TurnMediaArtifacts {
         artifact: {
             available: true;
             artifactId: string;
-            kind: "assistant_completion" | "computer_screenshot" | "event_media" | "file" | "generated_image" | "generated_video" | "internal_update" | "tool_result";
+            kind: "assistant_completion" | "browser_screenshot" | "computer_screenshot" | "event_media" | "file" | "generated_image" | "generated_video" | "internal_update" | "tool_result";
             contentType: string;
             originalBytes: number;
             sha256: string;
@@ -98,7 +99,7 @@ export declare class TurnMediaArtifacts {
         artifact: {
             available: true;
             artifactId: string;
-            kind: "assistant_completion" | "computer_screenshot" | "event_media" | "file" | "generated_image" | "generated_video" | "internal_update" | "tool_result";
+            kind: "assistant_completion" | "browser_screenshot" | "computer_screenshot" | "event_media" | "file" | "generated_image" | "generated_video" | "internal_update" | "tool_result";
             contentType: string;
             originalBytes: number;
             sha256: string;
@@ -128,6 +129,7 @@ export declare class TurnMediaArtifacts {
     sandboxFileDownloadBackend: Settings["sandboxBackend"];
     nativeImageGenerationRetention: NativeImageGenerationRetention | null;
     readonly retainedSessionImageCallIds: Set<string>;
+    readonly retainedSessionImageKindsByCallId: Map<string, RetainedSessionScreenshotKind>;
     constructor(deps: TurnMediaArtifactDeps);
     rememberGeneratedImageCreatedThisTurn: (receipt: GeneratedImageReceipt) => void;
     private prepareGeneratedImageDownload;

package/dist/activities/agent-turn/model-call-admission.d.ts

@@ -0,0 +1,15 @@
+import type { StreamEvent } from "@openai/agents";
+/** SDK producer/consumer rendezvous. Usage stays on the sole consumer writer. */
+export declare function createModelCallAdmission(input: {
+    signal: AbortSignal;
+    admit: () => Promise<void>;
+}): {
+    beforeModelRequest: () => Promise<void>;
+    onModelResponse: (event: StreamEvent) => Promise<void>;
+    settle: (event: {
+        type: string;
+        data?: unknown;
+    }) => void;
+    fail: (error: unknown) => void;
+    close: () => void;
+};

package/dist/activities/agent-turn/model-usage.d.ts

@@ -3,6 +3,7 @@ import { modelResponseServiceTierFromSdkEvent, modelTerminalResponseFromSdkEvent
 import { type ModelUsageInput, type ModelProviderApi, type Settings } from "@opengeni/config";
 import type { TurnActivityServices as ActivityServices } from "../types.js";
 import { type LatencyMode, type ModelContextContributionSummary, type SessionEvent } from "@opengeni/contracts";
+import type { InsightsUsageClassMicros } from "@opengeni/contracts/insights-usage";
 export declare function modelUsageSourceKey(input: {
     responseId?: string | null | undefined;
     dispatchId: string | null;
@@ -171,6 +172,8 @@ export declare function emitModelCallUsage(input: {
     normalizedUsage?: ModelCallUsageNormalization;
     /** Accepted billing authority persisted for Insights repair after a soft fact-write failure. */
     billingPath?: ModelUsageBillingRecord["billingPath"];
+    /** Accepted comparisons are frozen with the event, not repriced during fact repair. */
+    billingSnapshot?: Pick<ModelUsageBillingRecord, "pricedCostMicros" | "estimatedProviderCostMicros" | "equivalentCreditCostMicros" | "pricingSource" | "listByClassMicros" | "listByClassApprox">;
     /** Validated Gateway endpoint provider persisted for exact Insights repair. */
     upstreamProvider?: string;
     servingAccountHash?: string;
@@ -192,6 +195,9 @@ export type ModelUsageBillingRecord = {
     /** Hypothetical OpenGeni credit price at the captured rate; never a debit. */
     equivalentCreditCostMicros: number | null;
     pricingSource: "configured_list_price" | "gateway_reported" | null;
+    /** Forward-only provider list class snapshot; older facts/events stay unknown. */
+    listByClassMicros?: InsightsUsageClassMicros | null;
+    listByClassApprox?: boolean;
     normalizedUsage: ModelCallUsageNormalization;
     upstreamProvider?: string;
 };

package/dist/activities/agent-turn/model-wire-dispatch.d.ts

@@ -0,0 +1,15 @@
+import type { ModelTransportDispatchClock } from "@opengeni/runtime";
+type DispatchIdentity = {
+    provider: string;
+    dispatchId: string;
+};
+/** One immutable physical fetch-entry observation per worker attempt. Generic
+ * fallback events already carry that attempt's dispatch/execution identity. */
+export declare class InitialModelWireDispatchClock {
+    private initial;
+    record(identity: DispatchIdentity, clock: ModelTransportDispatchClock): void;
+    payload(identity: DispatchIdentity): {
+        initialWireDispatchedAt?: string;
+    };
+}
+export {};

package/dist/activities/agent-turn/optional-repositories.d.ts

@@ -0,0 +1,59 @@
+import type { Settings } from "@opengeni/config";
+import { type ResourceRef } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+/**
+ * Turn-time access check for automatically attached (`optional: true`) GitHub
+ * App repositories.
+ *
+ * A Slack-started session attaches the caller's recently used repositories as
+ * optional resources. The per-turn workspace-allowlist recheck and the
+ * installation-token mint both cover every GitHub repository of the session in
+ * one request, so one optional repository that loses access after the session
+ * started (an admin removes it from the allowlist, or it is deleted or removed
+ * from the App on GitHub) would fail every later turn. Before those checks, this
+ * drops each optional repository that is no longer allowlisted or no longer
+ * reachable through its installation, for this turn only, and reports it the
+ * same way a skipped optional clone is reported. It only ever removes
+ * repositories: a remaining repository still passes the unchanged strict
+ * allowlist recheck and mint, and an explicitly attached repository is never
+ * dropped, so it keeps failing the turn when its access is gone.
+ */
+export declare const OPTIONAL_REPOSITORY_ACCESS_OPERATION = "optional-repository-access";
+export type OptionalRepositoryDropReason = "not_allowlisted" | "inaccessible" | "unverified";
+export type DropUnavailableOptionalRepositoriesInput = {
+    db: Database;
+    settings: Settings;
+    workspaceId: string;
+    activeSandboxBackend: Settings["sandboxBackend"] | undefined;
+    /**
+     * True when a host `gitCredentials` port mints the Git tokens: the host may
+     * use another GitHub App, so this deployment's App is not asked.
+     */
+    hostMintsGitCredentials: boolean;
+    turnResources: readonly ResourceRef[];
+    runtimeResources: readonly ResourceRef[];
+    /** Publishes one attempt-fenced session event batch. */
+    publish: (events: Array<{
+        type: "sandbox.operation.completed";
+        payload: {
+            name: typeof OPTIONAL_REPOSITORY_ACCESS_OPERATION;
+            repositoryCount: number;
+            skippedOptionalRepositories: string[];
+        };
+    }>) => Promise<void>;
+    /** Operational log line; counts only, never repository names. */
+    warn: (message: string, fields: Record<string, string>) => void;
+    /** Test seam; defaults to the workspace allowlist under RLS. */
+    isAllowlisted?: (installationId: number, repositoryId: number) => Promise<boolean>;
+    /** Test seam; defaults to a live GitHub App token-mint probe. */
+    findInaccessible?: (installationId: number, repositoryIds: number[]) => Promise<number[]>;
+};
+export declare function dropUnavailableOptionalRepositories(input: DropUnavailableOptionalRepositoriesInput): Promise<{
+    turnResources: ResourceRef[];
+    runtimeResources: ResourceRef[];
+    /**
+     * The same decision for another view of this turn's resources (the GitHub
+     * REST tool surface is built from the unbound session resources).
+     */
+    retainsResource: (resource: ResourceRef) => boolean;
+}>;

package/dist/activities/agent-turn/provider-dispatch-barrier.d.ts

@@ -1,8 +1,19 @@
 import type { TurnHistorySink } from "./history-sink.js";
+import type { Settings } from "@opengeni/config";
+export declare class SandboxCapabilitiesChangedError extends Error {
+    readonly code = "native_capabilities_changed_this_attempt";
+    constructor();
+}
 /**
  * Persist the SDK's complete prior model/tool history before another provider
  * request can start. The first request has no prior model/tool rows to append.
  * Follow-up requests run only after the preceding complete call/result batch is
  * replay-safe.
  */
-export declare function checkpointHistoryBeforeProviderDispatch(historySink: Pick<TurnHistorySink, "reconcileConversationTruth">): Promise<void>;
+export declare function checkpointHistoryBeforeProviderDispatch(historySink: Pick<TurnHistorySink, "reconcileConversationTruth">, route?: {
+    effectiveSandboxBackend: Settings["sandboxBackend"];
+    routingEnabled: boolean;
+    readActiveSandbox: () => Promise<{
+        activeSandboxId: string | null;
+    } | null>;
+}): Promise<void>;

package/dist/activities/agent-turn/quiescence.d.ts

@@ -49,10 +49,9 @@ export declare const QUIESCENCE_PROOF_SIGNAL_INITIAL_RETRY_MS = 250;
 export declare const QUIESCENCE_PROOF_SIGNAL_MAX_RETRY_MS = 5000;
 export declare const TURN_QUIESCENCE_WATCHDOG_MS: number;
 export declare const TURN_FINALIZER_STEP_TIMEOUT_MS = 30000;
-/** A fenced activity must never heartbeat forever while its physical writer
- * drain is stuck. The last-resort worker exit stops every in-process writer;
- * Kubernetes replaces the pod and the workflow's heartbeat-lease reconciler
- * then commits the exact quiescence receipt. */
+/** A fenced activity must never heartbeat forever while physical cleanup is
+ * stuck. The callback requests host-owned containment, which drains peer turns
+ * before applying its final exit policy. A timeout is never quiescence proof. */
 export declare function armTurnQuiescenceWatchdog(input: {
     enabled: boolean;
     timeoutMs?: number;
@@ -88,6 +87,7 @@ export declare function drainAttemptOwnedSandboxWriters(input: {
     gitCredentialRenewals: readonly Pick<GitCredentialRenewalController, "stop">[];
     codemodeTokenRenewal: Pick<CodemodeTokenRenewalController, "stop"> | null;
     runCredentialRenewal: Pick<RunCredentialRenewalController, "stop"> | null;
+    onStage?: (stage: "tool_writers" | "credential_renewals") => void;
 }): Promise<void>;
 /** Persist the exact turn's second-stage release only after the caller has
  * crossed the physical writer boundary. This wait is intentionally independent
@@ -175,7 +175,7 @@ export declare class MandatoryHistoryPersistenceError extends Error {
 }
 export declare function runMandatoryHistoryPersistenceStep<T>(stage: MandatoryHistoryPersistenceStage, operation: () => Promise<T>): Promise<T>;
 export type OpStreamFinalizer = {
-    finalizeOpStreamOps(): Promise<void>;
+    finalizeOpStreamOps(toolCallIds?: readonly string[]): Promise<void>;
 };
-/** Release retained Connected Machine output only after the turn is durable. */
-export declare function finalizeDurableTurnOpStreams(sessions: readonly unknown[], fallback: OpStreamFinalizer | null): Promise<void>;
+/** Release only durably recorded tool results, or the complete durable turn. */
+export declare function finalizeDurableTurnOpStreams(sessions: readonly unknown[], fallback: OpStreamFinalizer | null, toolCallIds?: readonly string[]): Promise<void>;

package/dist/activities/agent-turn/recovery-warning.d.ts

@@ -0,0 +1,9 @@
+import { getSandboxRecoveryDiscontinuity, type Database } from "@opengeni/db";
+/** v2 also recognizes system-selected checkpoint fallback receipts, and v3
+ * the empty-workspace continuation receipts. A worker below the version a
+ * session's receipts require cannot claim it (migrations 0526 and 0548). */
+export declare const FILESYSTEM_DISCONTINUITY_PROTOCOL: 3;
+export declare function recoveryAwareSessionInstructions(db: Database, workspaceId: string, session: {
+    id: string;
+    instructions?: string | null;
+}, readDiscontinuity?: typeof getSandboxRecoveryDiscontinuity): Promise<string>;

package/dist/activities/agent-turn/refresh-credentials.d.ts

@@ -0,0 +1,6 @@
+import type { AttemptToolDefinition } from "@opengeni/codemode";
+export declare const REFRESH_CREDENTIALS_TOOL_NAME = "refresh_credentials";
+export declare const REFRESH_CREDENTIALS_TOOL_DESCRIPTION = "Fetch fresh host-managed credentials for this sandbox now. Use it when a command fails because a token or credential file provided by the workspace has expired or been revoked. The environment variables and credential files that the host manages are replaced for the next command; commands that are already running keep what they started with.";
+export declare function createRefreshCredentialsAttemptToolDefinition(input: {
+    refresh: () => Promise<"completed" | "auth_needed" | "error" | "not_provisioned">;
+}): AttemptToolDefinition;

package/dist/activities/agent-turn/run-credentials.d.ts

@@ -1,7 +1,8 @@
-import { type GitCredentialTokenWriterSession, type NormalizedRunCredentialMaterial, type RunCredentialCommandSession, type CodemodeTokenWriterSession } from "@opengeni/runtime";
+import { type GitCredentialTokenWriterSession, type NormalizedRunCredentialMaterial, type RunCredentialCommandSession, type CodemodeTokenWriterSession, RunMcpCredentials } from "@opengeni/runtime";
 import { type Settings } from "@opengeni/config";
 import { type GitHubTokenMintAuthorization, type MintedRunGitCredentials, type loadWorkspaceEnvironmentForRunWithCredentials } from "../environment.js";
 import type { mergeResourceRefs } from "../common.js";
+import type { withFirstPartyTools } from "../goals.js";
 import type { TurnActivityServices as ActivityServices, RunAgentTurnInput } from "../types.js";
 import { type ResumedTurnSandbox } from "../../sandbox-resume.js";
 import type { ClaimTurnOk } from "./claim.js";
@@ -9,6 +10,8 @@ import type { GovernanceModelOk } from "./governance-model.js";
 import type { SandboxTurnRuntime } from "./sandbox-runtime.js";
 import type { AttemptIdentityState, EventingState, RenewalState, SandboxRuntimeState } from "./turn-context.js";
 export type PrepareRunCredentialsDeps = {
+    localMcpServerIds?: readonly string[];
+    turnTools: ReturnType<typeof withFirstPartyTools>;
     input: RunAgentTurnInput;
     settings: Settings;
     db: ActivityServices["db"];
@@ -23,6 +26,7 @@ export type PrepareRunCredentialsDeps = {
     sandboxRuntime: SandboxTurnRuntime;
     turn: ClaimTurnOk["turn"];
     session: ClaimTurnOk["session"];
+    turnExecutionPolicy: ClaimTurnOk["turnExecutionPolicy"];
     fileAuthoritySubjectId: ClaimTurnOk["fileAuthoritySubjectId"];
     runSettings: GovernanceModelOk["runSettings"];
     workspaceVariableSet: Awaited<ReturnType<typeof loadWorkspaceEnvironmentForRunWithCredentials>>;
@@ -49,18 +53,19 @@ export type PrepareRunCredentialsDeps = {
     runWorkspaceMutationForSandbox: SandboxTurnRuntime["runWorkspaceMutationForSandbox"];
 };
 export declare function prepareRunCredentials(deps: PrepareRunCredentialsDeps): Promise<{
+    runMcpCredentials: RunMcpCredentials;
     runCredentialResolver: import("../run-credentials.js").BoundRunCredentialResolver | null;
     establishPolicy: "eager" | "on-demand";
     initialRunCredentialMaterial: NormalizedRunCredentialMaterial | null;
     runCredentialsNote: string | undefined;
     authorizeGitHubTokenMint: GitHubTokenMintAuthorization;
-    hostCredentialRootSessionId: string | null;
     gitCredentialAuthority: import("../environment.js").GitCredentialAuthority | undefined;
     codemodeAuthority: {
         sessionId: string;
         turnId: string;
         attemptId: string;
         executionGeneration: number;
+        credentialRestriction?: "developer_setup";
     };
     sandboxArtifactRuntime: Readonly<{
         available: boolean;
@@ -79,6 +84,6 @@ export declare function prepareRunCredentials(deps: PrepareRunCredentialsDeps):
     startRunGitCredentialsMint: () => Promise<MintedRunGitCredentials | undefined>;
     attachGitCredentialRenewal: (tokenSession: GitCredentialTokenWriterSession, initial: MintedRunGitCredentials | undefined, initialSandbox?: ResumedTurnSandbox) => Promise<void>;
     attachCodemodeTokenRenewal: (tokenSession?: CodemodeTokenWriterSession, initialExpiresAt?: Date | undefined, initialSandbox?: ResumedTurnSandbox) => Promise<void>;
-    attachRunCredentialRenewal: (credentialSession: RunCredentialCommandSession, initialMaterial: NormalizedRunCredentialMaterial | null, initialSandbox?: ResumedTurnSandbox) => Promise<void>;
+    attachRunCredentialRenewal: (credentialSession: RunCredentialCommandSession | undefined, initialMaterial: NormalizedRunCredentialMaterial | null, initialSandbox?: ResumedTurnSandbox) => Promise<void>;
 }>;
 export type PrepareRunCredentialsOk = Awaited<ReturnType<typeof prepareRunCredentials>>;

package/dist/activities/agent-turn/sandbox-establish.d.ts

@@ -4,7 +4,7 @@ import { type GitCredentialTokenWriterSession, type NormalizedRunCredentialMater
 import { type Settings } from "@opengeni/config";
 import { mergeResourceRefs } from "../common.js";
 import { type MintedRunGitCredentials, type SandboxCodemodeAuthority } from "../environment.js";
-import { rigProviderImageSourceImage } from "../packs.js";
+import { rigProviderImageSourceImage } from "../sandbox-images.js";
 import type { TurnActivityServices as ActivityServices, RunAgentTurnInput } from "../types.js";
 import type { currentActivityContext } from "../streaming.js";
 import { type ResumedTurnSandbox } from "../../sandbox-resume.js";
@@ -35,6 +35,7 @@ export type SandboxRouteOk = {
     machinePrimary: boolean;
     groupBoxBackend: Settings["sandboxBackend"];
     groupBoxImage: ReturnType<typeof rigProviderImageSourceImage>;
+    groupBoxImagePolicy: "new_creates_only";
     sandboxCreationBackend: Settings["sandboxBackend"];
     effectiveRunCredentialBackend: Settings["sandboxBackend"];
 };

package/dist/activities/agent-turn/sandbox-provision.d.ts

@@ -81,8 +81,10 @@ export declare function createTurnSandboxProvisioner<T>(establish: () => Promise
  *   - legacy/built-in OpenAI or Azure Responses fallback (resolvedModel null);
  *   - resolved built-in OpenAI/Azure providers;
  *   - ChatGPT/Codex subscription backend (its strict allowlist permits the field).
+ *   - native Anthropic Messages (maps the internal key to Claude session identity;
+ *     the OpenAI field is never sent on that wire).
  *
- * Registry API-key providers are intentionally excluded. Fireworks' prompt-cache
+ * Other registry API-key providers are intentionally excluded. Fireworks' prompt-cache
  * docs prescribe `user` or `x-session-affinity`, not `prompt_cache_key`; Z.AI/GLM
  * documents automatic context caching plus `user_id`. Sending OpenAI-only fields
  * to unknown OpenAI-compatible providers risks unsupported-parameter 400s.

package/dist/activities/agent-turn/sandbox-route.d.ts

@@ -60,6 +60,9 @@ export declare function shouldPrefetchManagedSandbox(input: {
     machinePrimary: boolean;
     groupBoxBackend: Settings["sandboxBackend"];
     hasRepositoryResources: boolean;
+    /** A committed automatic post-loss recovery decision still awaits its box.
+     * Rematerialize now instead of leaving the group pinned until a tool call. */
+    automaticRecoveryPending?: boolean;
 }): boolean;
 /**
  * Classify a persisted active-sandbox pointer for TURN-START RECONCILE (issue #341
@@ -109,15 +112,6 @@ export declare function reconcileActiveSandboxPointer(db: ActivityServices["db"]
     type: SessionEventType;
     payload: unknown;
 }>) => Promise<void> | void): Promise<LoadedActivePointer>;
-/**
- * Warm the Modal private-registry image for the image ref this turn actually
- * resolved, not only the deployment-global OPENGENI_MODAL_IMAGE_REF warmed at
- * worker boot. A provider-native modalImageId bypasses registry import and is
- * resolved by ModalImageSelector.fromId during create. Otherwise packs can
- * override `modalImageRef` per workspace/turn, so a private pack image must be
- * resolved before sandbox creation or Modal falls back to the unauthenticated
- * `fromTag` path.
- */
 export declare function ensureTurnModalRegistryImage(runSettings: Settings, sandboxCreationBackend: Settings["sandboxBackend"] | undefined, ensureRegistryImage?: (settings: Settings) => Promise<void>): Promise<void>;
 export declare const SANDBOX_ARTIFACT_RUNTIME_MANIFEST = "/opt/opengeni/artifact-runtime/installation.json";
 export declare const SANDBOX_ARTIFACT_TOOL_ENTRY = "/opt/opengeni/artifact-runtime/skill-facade-entry.mjs";
@@ -125,17 +119,6 @@ export type SandboxArtifactRuntimeAdmission = Readonly<{
     available: boolean;
     environment: Readonly<Record<string, string>>;
 }>;
-/**
- * Admit the optional native standalone-file runtime only for the deployment's
- * exact base sandbox image contract. A pack/rig image override is an
- * independent filesystem and therefore fails closed even when the deployment
- * base image is capable. Collaborative artifact skills are admitted separately
- * from the frozen canonical tool catalog.
- *
- * This keeps lazy provisioning intact: CI/release proves the image closure,
- * while a before-agent-start doctor verifies the actual box before any model
- * call. No speculative sandbox is created merely to populate the skill index.
- */
 export declare function sandboxArtifactRuntimeAdmission(deploymentSettings: Settings, runSettings: Settings, backend: Settings["sandboxBackend"] | undefined, options?: Readonly<{
     production?: boolean;
 }>): SandboxArtifactRuntimeAdmission;

package/dist/activities/agent-turn/sandbox-runtime.d.ts

@@ -36,11 +36,11 @@ export declare function preemptSandboxTurnForDeadlineRotation(input: {
 export declare function createSandboxTurnRuntime(deps: SandboxTurnRuntimeDeps): {
     releaseLateSandbox: (sandbox: ResumedTurnSandbox) => Promise<void>;
     requireResolvedSandboxForMutation: (message: string) => ResumedTurnSandbox;
-    finalizeTurnOpStreamOps: () => Promise<void>;
+    finalizeTurnOpStreamOps: (toolCallIds?: readonly string[]) => Promise<void>;
     onHomeSandboxRebound: (rebound: {
         established: EstablishedSandboxSession;
         leaseEpoch: number;
-    }) => void;
+    }) => Promise<void>;
     runWorkspaceMutationForSandbox: <T>(sandbox: ResumedTurnSandbox, operation: string, mutation: () => Promise<T>, observePhase?: (measurement: {
         phase: "admission" | "provider" | "settlement" | "snapshot_wait";
         outcome: "completed" | "failed";