@opengeni/worker-bundle 2.0.1 → 2.0.3-canary.36079201993001

package/dist/activities/agent-turn/failure-settlement.d.ts

@@ -1,4 +1,4 @@
-import type { Settings } from "@opengeni/config";
+import { type Settings } from "@opengeni/config";
 import type { TurnActivityServices as ActivityServices, RunAgentTurnInput, RunAgentTurnResult } from "../types.js";
 import { createTurnCredentialLeases } from "./credential-leases.js";
 import { createTurnHistorySink } from "./history-sink.js";

package/dist/activities/agent-turn/history.d.ts

@@ -49,6 +49,8 @@ export declare function pendingToolCallFromSdkEvent(event: unknown): {
 } | null;
 /** Tools whose intentional visual result must survive inline-media sanitization. */
 export declare function toolCallProducesRetainableSessionImage(name: string | null): boolean;
+/** Browser interactions can carry an image block, including opt-in observe frames. */
+export declare function retainableBrowserScreenshotToolCall(name: string | null): boolean;
 export declare function completedToolCallFromSdkEvent(event: unknown): {
     callId: string;
     resultItem: Record<string, unknown>;

package/dist/activities/agent-turn/media-artifacts.d.ts

@@ -1,5 +1,6 @@
 import { type CodemodeTokenWriterSession, type RetainableSessionImageOutputHook, type TurnToolCancellationFence } from "@opengeni/runtime";
 import type { Settings } from "@opengeni/config";
+import type { RetainedSessionScreenshotKind } from "@opengeni/contracts";
 import type { ResumedTurnSandbox } from "../../sandbox-resume.js";
 import type { SharedActivityServices } from "../types.js";
 import { type GeneratedImageOutput, type GeneratedImageReceipt } from "../generated-images.js";
@@ -35,7 +36,7 @@ export declare class TurnMediaArtifacts {
     readonly retainedScreenshotReceiptsByCallId: Map<string, {
         available: true;
         artifactId: string;
-        kind: "assistant_completion" | "computer_screenshot" | "event_media" | "file" | "generated_image" | "generated_video" | "internal_update" | "tool_result";
+        kind: "assistant_completion" | "browser_screenshot" | "computer_screenshot" | "event_media" | "file" | "generated_image" | "generated_video" | "internal_update" | "tool_result";
         contentType: string;
         originalBytes: number;
         sha256: string;
@@ -68,7 +69,7 @@ export declare class TurnMediaArtifacts {
         artifact: {
             available: true;
             artifactId: string;
-            kind: "assistant_completion" | "computer_screenshot" | "event_media" | "file" | "generated_image" | "generated_video" | "internal_update" | "tool_result";
+            kind: "assistant_completion" | "browser_screenshot" | "computer_screenshot" | "event_media" | "file" | "generated_image" | "generated_video" | "internal_update" | "tool_result";
             contentType: string;
             originalBytes: number;
             sha256: string;
@@ -98,7 +99,7 @@ export declare class TurnMediaArtifacts {
         artifact: {
             available: true;
             artifactId: string;
-            kind: "assistant_completion" | "computer_screenshot" | "event_media" | "file" | "generated_image" | "generated_video" | "internal_update" | "tool_result";
+            kind: "assistant_completion" | "browser_screenshot" | "computer_screenshot" | "event_media" | "file" | "generated_image" | "generated_video" | "internal_update" | "tool_result";
             contentType: string;
             originalBytes: number;
             sha256: string;
@@ -128,6 +129,7 @@ export declare class TurnMediaArtifacts {
     sandboxFileDownloadBackend: Settings["sandboxBackend"];
     nativeImageGenerationRetention: NativeImageGenerationRetention | null;
     readonly retainedSessionImageCallIds: Set<string>;
+    readonly retainedSessionImageKindsByCallId: Map<string, RetainedSessionScreenshotKind>;
     constructor(deps: TurnMediaArtifactDeps);
     rememberGeneratedImageCreatedThisTurn: (receipt: GeneratedImageReceipt) => void;
     private prepareGeneratedImageDownload;

package/dist/activities/context-compaction.d.ts

@@ -1,5 +1,5 @@
 import { type Database } from "@opengeni/db";
-import { type CompactionItem, type CompactionProviderRejection } from "@opengeni/runtime";
+import { prepareCompactionPromptInput, type CompactionItem, type CompactionProviderRejection } from "@opengeni/runtime";
 import { type Settings } from "@opengeni/config";
 import type { SessionEvent } from "@opengeni/contracts";
 export type MaybeCompactResult = {
@@ -28,7 +28,10 @@ export type MaybeCompactResult = {
  * Codex, call Codex `/codex/responses` with `compaction_trigger` and persist the
  * opaque compaction item. Fail closed — never silently fall back to portable.
  */
-export type CompactionSummarizer = (settings: Settings, input: CompactionItem[]) => Promise<string>;
+export type CompactionSummarizer = ((settings: Settings, input: CompactionItem[]) => Promise<string>) & {
+    /** Model-visible instructions and tool schemas outside the history estimate. */
+    estimatePrefixTokens?: () => number;
+};
 /** Returns the opaque Codex remote compaction v2 item. */
 export type RemoteCompactionV2Requester = (settings: Settings, input: CompactionItem[]) => Promise<CompactionItem>;
 export declare function maybeCompactContext(db: Database, settings: Settings, scope: {
@@ -86,5 +89,10 @@ export declare function settleFailedContextCompactionLandmark(db: Database, scop
 }): Promise<Extract<MaybeCompactResult, {
     compacted: false;
 }>>;
+export declare function summarizeWithCodexOverflowTrimming(summarize: CompactionSummarizer, settings: Settings, activeHistory: CompactionItem[]): Promise<{
+    summaryBody: string;
+    preparation: ReturnType<typeof prepareCompactionPromptInput>;
+    providerCalls: number;
+}>;
 export declare function isContextWindowExceeded(error: unknown, seen?: WeakSet<object>): boolean;
 export declare function isExactContextLengthExceeded(error: unknown, seen?: WeakSet<object>): boolean;

package/dist/activities/retained-screenshots.d.ts

@@ -1,4 +1,4 @@
-import { type RetainedArtifactMetadata, type RetainedOutputUnavailableReason } from "@opengeni/contracts";
+import { type RetainedArtifactMetadata, type RetainedOutputUnavailableReason, type RetainedSessionScreenshotKind } from "@opengeni/contracts";
 import { type Database } from "@opengeni/db";
 import { type ObjectStorage } from "@opengeni/storage";
 export type TypedScreenshotToolOutput = {
@@ -68,6 +68,7 @@ export declare function retainedScreenshotIdentity(input: {
     attemptId: string;
     toolCallId: string;
     toolOutputId: string;
+    kind?: RetainedSessionScreenshotKind | undefined;
 }): {
     artifactId: string;
     settlementKey: string;
@@ -80,8 +81,9 @@ export declare function unavailableRetainedSessionImage(input: {
     toolCallId: string;
     toolOutputId: string;
     reason: RetainedOutputUnavailableReason;
+    kind?: RetainedSessionScreenshotKind | undefined;
 }): RetainedArtifactMetadata;
-export declare function retainComputerScreenshot(input: {
+export declare function retainSessionScreenshot(input: {
     db: Database;
     objectStorage: ObjectStorage | null;
     accountId: string;
@@ -90,10 +92,13 @@ export declare function retainComputerScreenshot(input: {
     turnId: string;
     attemptId: string;
     output: TypedScreenshotToolOutput;
+    kind?: RetainedSessionScreenshotKind | undefined;
     now?: Date;
     retentionMs?: number;
     workspaceQuotaBytes?: number;
 }): Promise<RetainedArtifactMetadata>;
+/** Existing computer callers keep their stable entry point. */
+export declare const retainComputerScreenshot: typeof retainSessionScreenshot;
 /** Replace only new screenshot bytes with a compact receipt before first persistence. */
 export declare function compactRetainedScreenshotHistory(history: Array<Record<string, unknown>>, receiptsByCallId: ReadonlyMap<string, RetainedArtifactMetadata>): Array<Record<string, unknown>>;
 /** Collect durable screenshot receipts before their provider-only expansion. */

package/dist/activities/sandbox-lease.d.ts

@@ -20,8 +20,7 @@ export type ReapSandboxLeasesResult = {
     skipped: number;
     /** Warm viewer-only leases that accrued warm-seconds this tick (P2.1). */
     metered: number;
-    /** Viewer-only boxes force-drained because their workspace is over a limit
-     *  (0 balance / over the warm cap) — turn-held boxes are never drained (P2.1). */
+    /** Holderless boxes accelerated to draining by the optional warm cap. */
     forceDrained: number;
     /** Provider-side Modal orphan sandboxes terminated by the defensive sweep. */
     modalOrphansTerminated: number;
@@ -60,7 +59,7 @@ export type DrainCaptureDisposition = "capture_required" | "archive_published";
  *  Test seams may return the legacy boolean shorthand. Production returns the
  *  typed outcome so the cold commit can distinguish a clean stop from definitive
  *  provider disappearance before capture. */
-export type TerminateBoxFn = (settings: ActivityServices["settings"], lease: NonNullable<Awaited<ReturnType<typeof readLease>>>, observability: ActivityServices["observability"], persistArchive: PersistArchiveFn, providerCaptureRequestId?: string, captureDisposition?: DrainCaptureDisposition, capturePolicy?: ProviderWorkspaceCapturePolicy | null, diskBackedArchives?: boolean, releaseFailedCapture?: () => Promise<void>, workspaceId?: string) => Promise<boolean | ProviderTerminationOutcome>;
+export type TerminateBoxFn = (settings: ActivityServices["settings"], lease: NonNullable<Awaited<ReturnType<typeof readLease>>>, observability: ActivityServices["observability"], persistArchive: PersistArchiveFn, providerCaptureRequestId?: string, captureDisposition?: DrainCaptureDisposition, capturePolicy?: ProviderWorkspaceCapturePolicy | null, diskBackedArchives?: boolean, releaseFailedCapture?: () => Promise<void>, workspaceId?: string, beforeProviderStop?: () => Promise<void>) => Promise<boolean | ProviderTerminationOutcome>;
 export type SweepModalOrphansFn = (settings: ActivityServices["settings"], db: ActivityServices["db"], observability: ActivityServices["observability"]) => Promise<number>;
 export type InspectOpenSandboxKubernetesInventoryFn = (input: {
     namespace: string;
@@ -208,4 +207,4 @@ export declare function sandboxDrainReason(lease: Pick<LeaseSnapshot, "rotationR
  * draining until its adapter can prove termination. A truly instance-less or
  * `none`-backed row is a no-op.
  */
-export declare function terminateProviderBox(settings: ActivityServices["settings"], lease: NonNullable<Awaited<ReturnType<typeof readLease>>>, observability: ActivityServices["observability"], persistArchive: PersistArchiveFn, createClientForBackend?: CreateSandboxClientForBackendFn, terminateModalById?: typeof terminateModalSandboxById, providerCaptureRequestId?: string, captureDisposition?: DrainCaptureDisposition, claimedCapturePolicy?: ProviderWorkspaceCapturePolicy | null, diskBackedArchives?: boolean, releaseFailedCapture?: () => Promise<void>, workspaceId?: string): Promise<ProviderTerminationOutcome>;
+export declare function terminateProviderBox(settings: ActivityServices["settings"], lease: NonNullable<Awaited<ReturnType<typeof readLease>>>, observability: ActivityServices["observability"], persistArchive: PersistArchiveFn, createClientForBackend?: CreateSandboxClientForBackendFn, terminateModalById?: typeof terminateModalSandboxById, providerCaptureRequestId?: string, captureDisposition?: DrainCaptureDisposition, claimedCapturePolicy?: ProviderWorkspaceCapturePolicy | null, diskBackedArchives?: boolean, releaseFailedCapture?: () => Promise<void>, workspaceId?: string, beforeProviderStop?: () => Promise<void>): Promise<ProviderTerminationOutcome>;

package/dist/{activities-control-QA6OLRQY.js → activities-control-IVTL723D.js}

@@ -33,7 +33,7 @@ import {
   warnDrainSnapshotFailure,
   withFirstPartyTools,
   workflowIdForSession
-} from "./chunk-M3NVMF2V.js";
+} from "./chunk-JMO5ZUW3.js";
 import {
   inspectOpenSandboxKubernetesInventory,
   recordCreditBalanceGauges,
@@ -58,24 +58,43 @@ import "./chunk-PZ5AY32C.js";
 
 // src/activities/knowledge-indexing.ts
 import { configuredStaticUsageLimits } from "@opengeni/config";
+import { documentEmbeddingCostMicros, paidDocumentEmbedding } from "@opengeni/core";
 import {
+  applyCreditDebitAfterUse,
   appendKnowledgeIndexChunks,
   claimKnowledgeIndexJobs,
   completeKnowledgeIndexJob,
   continueKnowledgeIndexJob,
   deferKnowledgeIndexJob,
+  freezeKnowledgeIndexBillingMode,
   getBillingBalance,
+  guardPaidKnowledgeIndexPublication,
+  knowledgeIndexBillingActivationTime,
   readKnowledgeIndexSource,
   recordUsageEvent,
   sumUsageQuantity,
-  withWorkspaceUsageLock
+  withWorkspaceUsageLock,
+  waitKnowledgeIndexForFunding
 } from "@opengeni/db";
 function createKnowledgeIndexingActivities(services, resolveDocumentServices) {
+  let activationTime;
   return {
     indexKnowledge: async () => {
       const result = { completed: 0, advanced: 0, deferred: 0, unavailable: 0 };
       if (!resolveDocumentServices) return result;
       const { db, settings, observability } = await services();
+      let policyActivatedAt;
+      if (paidDocumentEmbedding(settings)) {
+        if (!settings.documentEmbeddingCreditsActivatedAt)
+          throw new Error("paid Knowledge embedding requires an activation cutoff");
+        policyActivatedAt = new Date(settings.documentEmbeddingCreditsActivatedAt);
+      } else {
+        activationTime ??= knowledgeIndexBillingActivationTime(db).catch((error) => {
+          activationTime = void 0;
+          throw error;
+        });
+        policyActivatedAt = await activationTime;
+      }
       const { embedder } = await resolveDocumentServices();
       const { knowledgeIndexChunks } = await import("@opengeni/documents");
       const claims = await claimKnowledgeIndexJobs(db, {
@@ -107,9 +126,37 @@ function createKnowledgeIndexingActivities(services, resolveDocumentServices) {
               chunks.push(chunk);
             }
             if (chunks.length) {
-              if (settings.billingMode === "stripe" || settings.usageLimitsMode === "managed") {
+              const frozenPolicy = await freezeKnowledgeIndexBillingMode(
+                lockedDb,
+                claim,
+                // Deterministic embeddings incur no provider charge; a valid
+                // credits-mode config with zero tariff must still index them.
+                // OpenAI shadow keeps its price snapshot for internal estimates.
+                settings.documentEmbeddingProvider === "openai" ? settings.documentEmbeddingBillingMode ?? "usage_only" : "usage_only",
+                policyActivatedAt,
+                settings.documentEmbeddingRateMicrosPerMillionBytes ?? 0
+              );
+              if (frozenPolicy.mode === "awaiting_review") {
+                result.deferred++;
+                return;
+              }
+              if (frozenPolicy.mode === "obsolete") {
+                result.unavailable++;
+                return;
+              }
+              if (frozenPolicy.mode === "credits" && !paidDocumentEmbedding(settings)) {
+                await deferKnowledgeIndexJob(lockedDb, claim);
+                result.deferred++;
+                return;
+              }
+              const paid = frozenPolicy.mode === "credits";
+              if (paid && current.nextIndex === 0) {
                 const balance = await getBillingBalance(lockedDb, claim.accountId);
-                if (balance.balanceMicros <= 0) throw new Error("insufficient OpenGeni credits");
+                if (balance.balanceMicros <= 0) {
+                  await waitKnowledgeIndexForFunding(lockedDb, claim);
+                  result.deferred++;
+                  return;
+                }
               }
               if (settings.usageLimitsMode === "static" || settings.usageLimitsMode === "managed") {
                 const limit = configuredStaticUsageLimits(settings).maxDocumentIndexedChunksPerWorkspace;
@@ -124,9 +171,22 @@ function createKnowledgeIndexingActivities(services, resolveDocumentServices) {
                     throw new Error("monthly document indexing limit reached");
                 }
               }
-              const vectors = await embedder.embedMany(chunks.map((chunk) => chunk.embeddingInput));
+              const inputs = chunks.map((chunk) => chunk.embeddingInput);
+              const bytes = inputs.reduce(
+                (sum, input) => sum + Buffer.byteLength(input, "utf8"),
+                0
+              );
+              const vectors = await embedder.embedMany(inputs);
               if (vectors.length !== chunks.length)
                 throw new Error("Incomplete Knowledge embeddings");
+              if (paid) {
+                const publication = await guardPaidKnowledgeIndexPublication(lockedDb, claim);
+                if (publication !== "published") {
+                  if (publication === "obsolete") result.unavailable++;
+                  else result.deferred++;
+                  return;
+                }
+              }
               const appended = await appendKnowledgeIndexChunks(
                 lockedDb,
                 claim,
@@ -147,6 +207,61 @@ function createKnowledgeIndexingActivities(services, resolveDocumentServices) {
                 sourceResourceId: claim.revisionId,
                 idempotencyKey: `knowledge.indexed:${claim.revisionId}:${claim.generation}:${current.nextIndex}`
               });
+              await recordUsageEvent(lockedDb, {
+                accountId: claim.accountId,
+                workspaceId: current.billingWorkspaceId,
+                eventType: "document.embedding_bytes",
+                quantity: bytes,
+                unit: "byte",
+                sourceResourceType: "knowledge_revision",
+                sourceResourceId: claim.revisionId,
+                idempotencyKey: `knowledge.embedding_bytes:${claim.revisionId}:${claim.generation}:${current.nextIndex}`
+              });
+              if (frozenPolicy.mode === "shadow" && frozenPolicy.rateMicrosPerMillionBytes > 0) {
+                const estimate = documentEmbeddingCostMicros(
+                  {
+                    ...settings,
+                    documentEmbeddingRateMicrosPerMillionBytes: frozenPolicy.rateMicrosPerMillionBytes
+                  },
+                  bytes
+                );
+                if (estimate > 0)
+                  await recordUsageEvent(lockedDb, {
+                    accountId: claim.accountId,
+                    workspaceId: current.billingWorkspaceId,
+                    eventType: "document.embedding_shadow_estimate",
+                    quantity: estimate,
+                    unit: "micro_usd",
+                    sourceResourceType: "knowledge_revision",
+                    sourceResourceId: claim.revisionId,
+                    idempotencyKey: `knowledge.embedding_shadow:${claim.revisionId}:${claim.generation}:${current.nextIndex}`
+                  });
+              }
+              if (paid) {
+                const cost = documentEmbeddingCostMicros(
+                  {
+                    ...settings,
+                    documentEmbeddingRateMicrosPerMillionBytes: frozenPolicy.rateMicrosPerMillionBytes
+                  },
+                  bytes
+                );
+                if (cost > 0)
+                  await applyCreditDebitAfterUse(lockedDb, {
+                    accountId: claim.accountId,
+                    workspaceId: current.billingWorkspaceId,
+                    type: "document_embedding_debit",
+                    amountMicros: cost,
+                    sourceType: "knowledge_revision",
+                    sourceId: claim.revisionId,
+                    idempotencyKey: `knowledge.embedding:${claim.revisionId}:${claim.generation}:${current.nextIndex}`,
+                    metadata: {
+                      model: claim.model,
+                      bytes,
+                      chunks: chunks.length,
+                      rateMicrosPerMillionBytes: frozenPolicy.rateMicrosPerMillionBytes
+                    }
+                  });
+              }
             }
             if (more) {
               await continueKnowledgeIndexJob(lockedDb, claim);
@@ -2241,10 +2356,10 @@ import {
   countSandboxLeasesByLiveness,
   deferRetainedProcessReconciliation,
   forceDrainOverLimitViewerOnlyBoxes,
-  getBillingBalance as getBillingBalance3,
   listCreditBalancesByAccount,
   listLegacyModalCheckpointSlots,
   listLiveModalSandboxLeaseAttributions,
+  markWarmBillingStopCutoff,
   listMeterableWarmLeases,
   listSandboxViewerForceDrainWorkspaceIds,
   markSandboxCheckpointArtifactDeletePending as markSandboxCheckpointArtifactDeletePending2,
@@ -2396,7 +2511,10 @@ function sandboxDrainActivityAttempt() {
   }
 }
 function createSandboxLeaseActivities(services, options = {}) {
-  const terminateBox = options.terminateBox ?? (async (settings, lease, observability, persistArchive, providerCaptureRequestId, captureDisposition, capturePolicy, diskBackedArchives, releaseFailedCapture, workspaceId) => await terminateProviderBox(
+  const terminateBox = (options.terminateBox ? async (...args) => {
+    await args[10]?.();
+    return options.terminateBox(...args);
+  } : null) ?? (async (settings, lease, observability, persistArchive, providerCaptureRequestId, captureDisposition, capturePolicy, diskBackedArchives, releaseFailedCapture, workspaceId, beforeProviderStop) => await terminateProviderBox(
     settings,
     lease,
     observability,
@@ -2408,7 +2526,8 @@ function createSandboxLeaseActivities(services, options = {}) {
     capturePolicy,
     diskBackedArchives,
     releaseFailedCapture,
-    workspaceId
+    workspaceId,
+    beforeProviderStop
   ));
   const sweepModalOrphans = options.sweepModalOrphans ?? sweepModalOrphansForConfiguredBackend;
   const inspectOpenSandboxInventory = options.inspectOpenSandboxKubernetesInventory ?? inspectOpenSandboxKubernetesInventory;
@@ -2598,7 +2717,7 @@ function createSandboxLeaseActivities(services, options = {}) {
       const meterResult = await accrueWarmTick(db, settings, observability);
       metered = meterResult.accrued;
       const forceDrainWorkspaceIds = /* @__PURE__ */ new Set();
-      if (settings.billingMode === "stripe" || settings.usageLimitsMode === "managed" || settings.sandboxMaxWarmSecondsPerWorkspace > 0) {
+      if (settings.sandboxWarmBillingMode === "credits" || settings.sandboxMaxWarmSecondsPerWorkspace > 0) {
         for (const workspaceId of meterResult.workspaceIds) {
           forceDrainWorkspaceIds.add(workspaceId);
         }
@@ -3209,6 +3328,16 @@ async function reconcileTerminalRetainedProcesses(db, settings, observability, p
           };
         }
       }
+      if (observation?.status === "deferred" && process.providerBackend === "modal" && !process.providerBindingKey && !process.deadlineCancellationRequestedAt) {
+        try {
+          await requestRetainedProcessDeadlineCancellation(db, processScope);
+        } catch (error) {
+          observability.warn("sandbox reaper: legacy deadline cancellation intent failed", {
+            processId: process.id,
+            error: error instanceof Error ? error.message : String(error)
+          });
+        }
+      }
       if (observation === null) {
         const lease = await readLease(db, process.workspaceId, process.sandboxGroupId).catch(
           () => null
@@ -3263,11 +3392,12 @@ async function reconcileTerminalRetainedProcesses(db, settings, observability, p
               );
               supervisionMetric("cancellation_intent");
             }
-            observation = await probe(
+            const legacyDeadlineStop = lease.rotationReason === "provider_deadline" && !supervised && !process.deadlineCancellationRequestedAt;
+            const probeOutcome = await probe(
               settings,
               lease,
               process,
-              claim.ownerState === "background_stopping" ? "cancel" : "observe",
+              claim.ownerState === "background_stopping" && !process.deadlineCancellationRequestedAt || legacyDeadlineStop ? "cancel" : "observe",
               async (result, chunkId, stream, streamFidelity) => {
                 if (typeof result !== "string" || !stream && isExecSessionLostBanner(result, process.providerSessionId))
                   return;
@@ -3285,7 +3415,14 @@ async function reconcileTerminalRetainedProcesses(db, settings, observability, p
                   await bus.publish(process.workspaceId, process.sessionId, events).catch(() => void 0);
               },
               commandPersistence
+            ).then(
+              (value) => ({ ok: true, value }),
+              (error) => ({ ok: false, error })
             );
+            if (legacyDeadlineStop && !await requestRetainedProcessDeadlineCancellation(db, processScope))
+              throw new Error("Deadline cancellation no longer owns its rotating lease");
+            if (!probeOutcome.ok) throw probeOutcome.error;
+            observation = probeOutcome.value;
             if (supervised) {
               supervisionMetric(
                 await commandPersistence.loadSupervisionReceipt() ? "proof_retained" : "proof_missing"
@@ -3489,7 +3626,11 @@ async function probeRetainedProcessAtProvider(settings, lease, process, mode = "
   if (pending) {
     if (!captureOutput) throw new Error("Pending command output requires its persistence callback");
     await captureRetainedProbeOutput(process.id, pending.result, captureOutput);
-    return classifyRetainedProcessPollResult(pending.result, process.providerSessionId);
+    const pendingObservation = classifyRetainedProcessPollResult(
+      pending.result,
+      process.providerSessionId
+    );
+    if (mode !== "cancel" || pendingObservation.status === "proved") return pendingObservation;
   }
   const envelopeBackend = lease.resumeState.backendId;
   if (envelopeBackend !== void 0 && (typeof envelopeBackend !== "string" || sandboxBackendForSdkBackendId(envelopeBackend) !== process.providerBackend)) {
@@ -3570,6 +3711,7 @@ async function probeRetainedProcessAtProvider(settings, lease, process, mode = "
   if (typeof session.writeStdin !== "function") {
     return { status: "deferred", reason: "backend_unsupported" };
   }
+  let legacyPty = false;
   if (process.providerBackend === "modal") {
     let liveBinding;
     try {
@@ -3596,6 +3738,7 @@ async function probeRetainedProcessAtProvider(settings, lease, process, mode = "
     if (!command || !providerPersistence || !session.bindProviderCommand)
       return { status: "deferred", reason: "process_observation_unavailable" };
     session.bindProviderCommand(process.providerSessionId, command, providerPersistence);
+    legacyPty = command.pty === true;
   }
   const capturePage = async (value) => {
     if (!captureOutput) {
@@ -3627,7 +3770,9 @@ async function probeRetainedProcessAtProvider(settings, lease, process, mode = "
     result = await withRetainedProcessProbeTimeout(
       session.writeStdin({
         sessionId: process.providerSessionId,
-        chars: mode === "cancel" && !supervisedCancelled ? "" : "",
+        // Ctrl-C is a signal only through a PTY. For a non-PTY command it is
+        // ordinary stdin data and can corrupt the command's input.
+        chars: mode === "cancel" && !supervisedCancelled && (process.providerBackend !== "modal" || legacyPty) ? "" : "",
         yieldTimeMs: 1e3,
         maxOutputTokens: 2e3
       })
@@ -3653,7 +3798,7 @@ async function probeRetainedProcessAtProvider(settings, lease, process, mode = "
   }
   await capturePage(result);
   const observation = classifyRetainedProcessPollResult(result, process.providerSessionId, session);
-  if (observation.status === "deferred" && observation.reason === "provider_running" && lease.rotationRequestedAt !== null && !await providerPersistence?.load().then((command) => command?.kind === "modal-router-v1" && command.supervision)) {
+  if (observation.status === "deferred" && observation.reason === "provider_running" && lease.rotationRequestedAt !== null && mode !== "cancel" && !process.cancellationRequestedAt && legacyPty && !await providerPersistence?.load().then((command) => command?.kind === "modal-router-v1" && command.supervision)) {
     try {
       const interrupted = await withRetainedProcessProbeTimeout(
         session.writeStdin({
@@ -3730,19 +3875,22 @@ async function accrueWarmTick(db, settings, observability) {
   }
   await forEachWithConcurrency(leases, SANDBOX_MAINTENANCE_ITEM_CONCURRENCY, async (lease) => {
     try {
-      const rate = sandboxWarmRateMicrosPerSecond(settings, lease.backend);
+      const rate = settings.sandboxWarmBillingMode === "usage_only" ? 0 : sandboxWarmRateMicrosPerSecond(settings, lease.backend);
       const result = await accrueWarmSeconds(db, {
         accountId: lease.accountId,
         workspaceId: lease.workspaceId,
         sandboxGroupId: lease.sandboxGroupId,
         expectedEpoch: lease.leaseEpoch,
         warmRateMicrosPerSecond: rate,
+        billingMode: settings.sandboxWarmBillingMode,
         subjectId: lease.sandboxGroupId
       });
       if (result.accrued) {
         accrued += 1;
       }
-      recordCreditMicros(observability, "usage", result.costMicros);
+      if (result.costMicros > 0 && settings.sandboxWarmBillingMode === "credits") {
+        recordCreditMicros(observability, "usage", result.costMicros);
+      }
     } catch (error) {
       observability.warn("sandbox reaper: warm-seconds accrual failed for lease", {
         workspaceId: lease.workspaceId,
@@ -3841,7 +3989,7 @@ async function refreshSandboxInventoryGauge(observability, domain, diagnosticNam
   }
 }
 async function forceDrainOverLimitWorkspaces(db, settings, workspaceIds, observability) {
-  const enforceBalance = settings.billingMode === "stripe" || settings.usageLimitsMode === "managed";
+  const enforceBalance = false;
   const cap = settings.sandboxMaxWarmSecondsPerWorkspace;
   let forceDrained = 0;
   await forEachWithConcurrency(
@@ -3849,11 +3997,8 @@ async function forceDrainOverLimitWorkspaces(db, settings, workspaceIds, observa
     SANDBOX_MAINTENANCE_ITEM_CONCURRENCY,
     async (workspaceId) => {
       try {
-        const { accountId } = await rlsContextForWorkspace(db, workspaceId);
-        const balance = enforceBalance ? await getBillingBalance3(db, accountId) : { balanceMicros: 1 };
         const result = await forceDrainOverLimitViewerOnlyBoxes(db, {
           workspaceId,
-          balanceMicros: balance.balanceMicros,
           enforceBalance,
           maxWarmSecondsPerWorkspace: cap,
           idleGraceMs: settings.sandboxIdleGraceMs
@@ -4239,6 +4384,17 @@ async function terminateDrainableBox(db, settings, row, observability, terminate
   })) {
     return false;
   }
+  let stopCutoffMarked = false;
+  const beforeProviderStop = async () => {
+    const cutoff = await markWarmBillingStopCutoff(db, {
+      accountId,
+      workspaceId: row.workspaceId,
+      sandboxGroupId: row.sandboxGroupId,
+      expectedEpoch: row.leaseEpoch
+    });
+    if (!cutoff) throw new Error("sandbox stop cutoff was fenced before provider termination");
+    stopCutoffMarked = true;
+  };
   const termination = providerMissingBeforeCapture ? { terminated: true, providerMissingBeforeCapture: true } : await terminateBox(
     settings,
     lease,
@@ -4259,12 +4415,35 @@ async function terminateDrainableBox(db, settings, row, observability, terminate
         expectedInstanceId: lease.instanceId
       });
     },
-    row.workspaceId
+    row.workspaceId,
+    beforeProviderStop
   );
   const terminated = typeof termination === "boolean" ? termination : termination.terminated;
   if (!terminated) {
     return false;
   }
+  const providerMissingDuringStop = providerMissingBeforeCapture || typeof termination !== "boolean" && termination.providerMissingBeforeCapture;
+  if (!stopCutoffMarked && !providerMissingDuringStop) {
+    if (managedProvider && lease.instanceId) {
+      throw new Error("managed sandbox stopped without a warm usage cutoff");
+    }
+    await beforeProviderStop();
+  }
+  const finalRate = settings.sandboxWarmBillingMode === "usage_only" ? 0 : sandboxWarmRateMicrosPerSecond(settings, backend);
+  if (!providerMissingDuringStop) {
+    const finalTick = await accrueWarmSeconds(db, {
+      accountId,
+      workspaceId: row.workspaceId,
+      sandboxGroupId: row.sandboxGroupId,
+      expectedEpoch: row.leaseEpoch,
+      warmRateMicrosPerSecond: finalRate,
+      billingMode: settings.sandboxWarmBillingMode,
+      finalDrain: true
+    });
+    if (finalTick.costMicros > 0 && settings.sandboxWarmBillingMode === "credits") {
+      recordCreditMicros(observability, "usage", finalTick.costMicros);
+    }
+  }
   const providerMissing = providerMissingBeforeCapture || (typeof termination === "boolean" ? false : termination.providerMissingBeforeCapture);
   const { wentCold } = await confirmDrainCold(db, {
     accountId,
@@ -4315,7 +4494,7 @@ function providerDrainLogIdentity(lease, backend) {
     instanceId: lease.instanceId
   };
 }
-async function terminateProviderBox(settings, lease, observability, persistArchive, createClientForBackend = createSandboxClientForBackend, terminateModalById = terminateModalSandboxById, providerCaptureRequestId, captureDisposition = "capture_required", claimedCapturePolicy, diskBackedArchives = false, releaseFailedCapture, workspaceId) {
+async function terminateProviderBox(settings, lease, observability, persistArchive, createClientForBackend = createSandboxClientForBackend, terminateModalById = terminateModalSandboxById, providerCaptureRequestId, captureDisposition = "capture_required", claimedCapturePolicy, diskBackedArchives = false, releaseFailedCapture, workspaceId, beforeProviderStop) {
   const durableBackendId = lease.resumeBackendId ?? lease.backend;
   const backend = sandboxBackendForSdkBackendId(durableBackendId) ?? durableBackendId;
   const logIdentity = providerDrainLogIdentity(lease, backend);
@@ -4379,6 +4558,7 @@ async function terminateProviderBox(settings, lease, observability, persistArchi
       return { terminated: false, providerMissingBeforeCapture: false };
     }
     try {
+      await beforeProviderStop?.();
       await terminateModalById(settings, lease.instanceId);
     } catch (error) {
       if (!isProviderSandboxNotFoundError("modal", error)) {
@@ -4548,6 +4728,7 @@ async function terminateProviderBox(settings, lease, observability, persistArchi
       throw new Error(`sandbox backend ${backend} returned no terminable session state`);
     }
     prepareProviderForTeardownAfterCapture(backend, session);
+    await beforeProviderStop?.();
     await terminateManagedSandboxSession2(client, sessionState, session);
     return { terminated: true, providerMissingBeforeCapture: false };
   } catch (error) {
@@ -7498,4 +7679,4 @@ export {
   createControlActivities,
   createControlActivitiesFromServices
 };
-//# sourceMappingURL=activities-control-QA6OLRQY.js.map
+//# sourceMappingURL=activities-control-IVTL723D.js.map