@opengeni/worker-bundle 1.3.0 → 1.4.0

package/src/activities/programmatic-approvals.ts

@@ -24,3 +24,29 @@ export function programmaticContinuationNote(
     "Approval resumes the stored operation, not the earlier program's JavaScript stack. Read results with the current Codemode client's status/resume handle. Do not resubmit arguments for completed, running, waiting, or uncertain operations.",
   ].join("\n");
 }
+
+/**
+ * Recover committed programmatic approval waits/results before the first model
+ * request without turning lazy MCP preparation into a first-request barrier.
+ *
+ * Only eager servers may gate the first request. Resuming a stored operation
+ * needs the prepared attempt tool environment, so this waits for full tool
+ * preparation only when there is something to resume: an approval decision
+ * trigger, or a cheap durable read showing unfinished operations for this
+ * logical turn (which covers every recovery that has stored work). Every other
+ * turn sends its first request without waiting on any lazy server.
+ */
+export async function recoverProgrammaticOperationsBeforeFirstRequest(input: {
+  approvalDecisionId: string | undefined;
+  hasUnfinishedOperations: () => Promise<boolean>;
+  toolPreparationReady: Promise<void> | null;
+  resumeApproved: (
+    decisionOperationId: string | undefined,
+  ) => Promise<CodemodeOperation[]> | undefined;
+}): Promise<CodemodeOperation[]> {
+  if (input.approvalDecisionId === undefined && !(await input.hasUnfinishedOperations())) {
+    return [];
+  }
+  await input.toolPreparationReady;
+  return (await input.resumeApproved(input.approvalDecisionId)) ?? [];
+}

package/src/activity-services.ts

@@ -1,5 +1,6 @@
 import {
   codeSearchDeploymentPolicy,
+  resolveWebSearchProvider,
   dbSearchPath,
   getSettings,
   resolveNatsControlPlaneAuth,
@@ -52,6 +53,13 @@ export function createSharedActivityServices(
       // Child, scheduled and automation sessions created here freeze their
       // code_search decision from the same deployment policy as the API.
       configureCodeSearchDeploymentPolicy(codeSearchDeploymentPolicy(settings));
+      // A named but unusable web search provider withholds the tools; say why.
+      const webSearchProvider = resolveWebSearchProvider(settings);
+      if (webSearchProvider.status === "invalid") {
+        observability.warn("web search provider is misconfigured; web_search stays off", {
+          reason: webSearchProvider.reason,
+        });
+      }
       return {
         settings: resolvedSettings,
         catalogSourceSettings: settings,

package/src/observability-metrics.ts

@@ -1629,6 +1629,7 @@ export type TurnStartupPhase =
   | "post_tool_preparation"
   | "agent_construction"
   | "post_agent_preparation"
+  | "programmatic_operation_recovery"
   | "file_materialization"
   | "history_preparation"
   | "history_system_update_load"

package/src/sandbox-routing.ts

@@ -40,6 +40,7 @@ import {
   readActiveSandbox,
   resolvePersonalMachineConnectionForAttempt,
   SandboxRetainedProcessPromotionFencedError,
+  SandboxWorkspaceMutationOutputRejectedError,
   type Database,
   type EnrollmentRecord,
   type SandboxWorkspaceMutationAdmission,
@@ -63,6 +64,7 @@ import {
   NatsOpStreamTransport,
   RoutingBackendRecoveryRequiredError,
   RoutingSandboxSession,
+  RoutingMutationOutputRejectedError,
   resolveModalCheckpointProviderBindingForSession,
   resolveConnectedMachineWorkspaceRoot,
   sandboxProviderInstanceIdFromEnvelope,
@@ -594,21 +596,37 @@ function afterPersistableHomeMutation(
     }
     if (outcome === "outcome_unknown")
       throw new Error("Outcome-unknown command settlement requires its exact retained invocation");
-    await verifyWorkspaceMutationSettlement(services.db, {
-      accountId: fence.accountId,
-      workspaceId: ids.workspaceId,
-      sessionId: ids.sessionId,
-      turnId: fence.turnId,
-      executionGeneration: fence.executionGeneration,
-      attemptId: fence.attemptId,
-      holderId: sandboxLeaseHolderIdForAttempt(fence.attemptId),
-      sandboxGroupId: home.sandboxGroupId,
-      expectedEpoch: backend.leaseEpoch,
-      expectedInstanceId: backend.providerInstanceId,
-      admission: exactAdmission,
-      operation: op,
-      outcome,
-    });
+    try {
+      await verifyWorkspaceMutationSettlement(services.db, {
+        accountId: fence.accountId,
+        workspaceId: ids.workspaceId,
+        sessionId: ids.sessionId,
+        turnId: fence.turnId,
+        executionGeneration: fence.executionGeneration,
+        attemptId: fence.attemptId,
+        holderId: sandboxLeaseHolderIdForAttempt(fence.attemptId),
+        sandboxGroupId: home.sandboxGroupId,
+        expectedEpoch: backend.leaseEpoch,
+        expectedInstanceId: backend.providerInstanceId,
+        admission: exactAdmission,
+        operation: op,
+        outcome,
+      });
+    } catch (error) {
+      if (
+        error instanceof SandboxWorkspaceMutationOutputRejectedError &&
+        error.matchesPhysicalSettlement({
+          accountId: fence.accountId,
+          workspaceId: ids.workspaceId,
+          admission: exactAdmission,
+          operation: op,
+          outcome,
+        })
+      ) {
+        throw new RoutingMutationOutputRejectedError(op, error.code, { cause: error });
+      }
+      throw error;
+    }
   };
 }
 
@@ -661,15 +679,31 @@ function afterRetainedProcessMutation(
     ) {
       throw new Error("Retained-process mutation settlement lacked its exact admission");
     }
-    await verifyRetainedProcessMutationSettlement(services.db, {
-      accountId: fence.accountId,
-      workspaceId: ids.workspaceId,
-      sessionId: ids.sessionId,
-      processId: process.id,
-      admission: admission as SandboxWorkspaceMutationAdmission,
-      operation: op,
-      outcome,
-    });
+    try {
+      await verifyRetainedProcessMutationSettlement(services.db, {
+        accountId: fence.accountId,
+        workspaceId: ids.workspaceId,
+        sessionId: ids.sessionId,
+        processId: process.id,
+        admission: admission as SandboxWorkspaceMutationAdmission,
+        operation: op,
+        outcome,
+      });
+    } catch (error) {
+      if (
+        error instanceof SandboxWorkspaceMutationOutputRejectedError &&
+        error.matchesPhysicalSettlement({
+          accountId: fence.accountId,
+          workspaceId: ids.workspaceId,
+          admission: admission as SandboxWorkspaceMutationAdmission,
+          operation: op,
+          outcome,
+        })
+      ) {
+        throw new RoutingMutationOutputRejectedError(op, error.code, { cause: error });
+      }
+      throw error;
+    }
   };
 }