@opengeni/worker-bundle 2.2.1-canary.36927100590001 → 2.2.1

package/dist/activities/agent-turn/run-credentials.d.ts

@@ -26,7 +26,6 @@ export type PrepareRunCredentialsDeps = {
     sandboxRuntime: SandboxTurnRuntime;
     turn: ClaimTurnOk["turn"];
     session: ClaimTurnOk["session"];
-    turnExecutionPolicy: ClaimTurnOk["turnExecutionPolicy"];
     fileAuthoritySubjectId: ClaimTurnOk["fileAuthoritySubjectId"];
     runSettings: GovernanceModelOk["runSettings"];
     workspaceVariableSet: Awaited<ReturnType<typeof loadWorkspaceEnvironmentForRunWithCredentials>>;
@@ -65,7 +64,6 @@ export declare function prepareRunCredentials(deps: PrepareRunCredentialsDeps):
         turnId: string;
         attemptId: string;
         executionGeneration: number;
-        credentialRestriction?: "developer_setup";
     };
     sandboxArtifactRuntime: Readonly<{
         available: boolean;

package/dist/activities/scheduled-tasks.d.ts

@@ -1,4 +1,3 @@
-import { TurnExecutionPolicyV1 } from "@opengeni/contracts";
 import { updateSessionTitleWithEvent } from "@opengeni/db";
 import type { ControlActivityServices, DispatchScheduledTaskRunInput, DispatchScheduledTaskRunResult } from "./types.js";
 import type { Database } from "@opengeni/db";
@@ -10,11 +9,43 @@ type ScheduledTemporalActivityIdentity = {
     };
     activityId: string;
 };
-export declare function scheduledTaskRunExecutionPolicy(policy: TurnExecutionPolicyV1, input: DispatchScheduledTaskRunInput, creatorRestriction?: "developer_setup"): TurnExecutionPolicyV1;
-/** Only a creator ceiling is standing; a manual caller ceiling is per-run. */
-export declare function scheduledSessionExecutionPolicyMetadata(policy: unknown, creatorRestriction?: "developer_setup"): Record<string, unknown>;
 export declare function scheduledTaskRunProducerKey(input: DispatchScheduledTaskRunInput, suppliedActivityIdentity?: ScheduledTemporalActivityIdentity): string;
 export declare function scheduledTaskGeneratedSessionCreateIdempotencyKey(producerKey: string): string;
+/**
+ * Display title for a session the scheduler generates for a task.
+ *
+ * A scheduled session's `initialMessage` is the task prompt, byte-identical for
+ * every run. The task name is the short human-chosen label that actually
+ * identifies it, so that is the title.
+ *
+ * The title is the task name and NOTHING else. It deliberately does not name the
+ * run's fire instant, for two independent reasons:
+ *
+ *   - No run mode guarantees one run per session. `reusable_session` generates
+ *     its session on the first fire and then reuses it forever, and even under
+ *     `new_session_per_run` alert-occurrence redelivery converges several runs
+ *     onto one canonical responder session. `existing_session` never generates a
+ *     session at all, so the scheduler never titles one. A run-specific fact
+ *     frozen into the title is therefore right for the generating run and a lie
+ *     for every run that lands in the same session afterwards.
+ *   - A title is one stored string shown to every viewer, while every surface
+ *     that renders a run's fire instant renders it viewer-local: the rail row
+ *     prints the title beside `relativeTimeLabel(session.updatedAt)`, and the
+ *     Schedules run list prints `formatTimestamp(run.firedAt)`, which is
+ *     `toLocaleString()`. A wall clock stored in the title therefore disagrees
+ *     with the time printed next to it for every viewer outside whichever zone
+ *     it was rendered in. The task's own `timeZone` is no escape: it labels the
+ *     schedule rule ("Mon Wed 09:00 Europe/Oslo"), not the rendering of a run,
+ *     which stays viewer-local. No stored clock can agree with a viewer-local
+ *     one, so the title carries none and the instant stays on the surfaces that
+ *     already render it correctly.
+ *
+ * Dropping the clock settles the determinism constraint outright rather than
+ * working around it: the same run titled by the normal dispatch or by a later
+ * recovery in a different worker process derives one string from `task.name`
+ * alone, with no Intl call and so no host ICU or tzdata build to make the two
+ * texts differ.
+ */
 export declare function scheduledTaskSessionTitle(taskName: string): string;
 /**
  * Title a session the scheduler generated, and emit the same `session.title_set`

package/dist/activities/types.d.ts

@@ -343,14 +343,11 @@ export type DispatchScheduledTaskRunInput = {
     triggerType: Extract<ScheduledTaskTriggerType, "scheduled">;
     agentRunUsageIdempotencyKey?: never;
     initiator?: never;
-    credentialRestriction?: never;
 } | {
     triggerType: Extract<ScheduledTaskTriggerType, "manual" | "initial" | "provider_event" | "retry" | "repair">;
     agentRunUsageIdempotencyKey: string;
     /** Exact identity used by the API-side charge for this same trigger. */
     initiator: TurnInitiator;
-    /** Trusted API-side caller ceiling for this occurrence, not the schedule. */
-    credentialRestriction?: "developer_setup";
 });
 export type DispatchScheduledTaskRunResult = {
     action: "deleted";

package/dist/activities/workspace-capture.d.ts

@@ -108,8 +108,6 @@ export declare function captureWhileIdle(input: {
  * to release() regardless.
  */
 export declare function captureWorkspaceRevision(input: CaptureWorkspaceRevisionInput): Promise<void>;
-/** Count one committed logical capture and observe its end-to-end duration. */
-export declare function recordWorkspaceCaptureCompleted(observability: Pick<Observability, "incrementCounter" | "observeHistogram">, durationMs: number): void;
 /**
  * sha256 over the CHANGE SURFACE only — per-file (path, status, hash, deleted,
  * tooLarge), exact HEAD identity, the working diff summary, and exact committed

package/dist/{activities-control-4F2A734B.js → activities-control-55ECL47G.js}

@@ -34,12 +34,10 @@ import {
   warnDrainSnapshotFailure,
   withFirstPartyTools,
   workflowIdForSession
-} from "./chunk-4PJTUBWQ.js";
+} from "./chunk-OWNLATJL.js";
 import {
   inspectOpenSandboxKubernetesInventory,
-  recordActiveUserGauges,
   recordCreditBalanceGauges,
-  recordCreditGrantGauges,
   recordCreditMicros,
   recordExpiredDrainingSandboxLeaseGauges,
   recordOpenSandboxKubernetesInventoryGauges,
@@ -60,7 +58,7 @@ import {
   recordVerifiedSignupTrialSwitchGauge,
   recordWorkerDeathRecoveryMetrics,
   runtimeMetricsHooksForObservability
-} from "./chunk-YG27NEMX.js";
+} from "./chunk-IJZU752L.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/activities/knowledge-indexing.ts
@@ -719,8 +717,7 @@ import {
   createAndStartSessionWithOutcome,
   recordWorkspaceUsage,
   resolveCatalogSettings,
-  resolveWorkspaceCatalogSettings,
-  isDeveloperSetupDelegatedPermissionAllowed
+  resolveWorkspaceCatalogSettings
 } from "@opengeni/core";
 import {
   AutomationAuthorityRevokedError,
@@ -780,17 +777,6 @@ function createAutomationActivities(services, options = {}) {
           return { action: "skipped", reason: "accepted_execution_mismatch" };
         }
         const template = accepted.sessionTemplate;
-        if (template.credentialRestriction === "developer_setup" && template.firstPartyMcpPermissions.some(
-          (permission) => !isDeveloperSetupDelegatedPermissionAllowed(permission)
-        )) {
-          await settle(service.db, {
-            workspaceId: input.workspaceId,
-            runId: run.id,
-            status: "failed",
-            errorCode: "credential_restriction_violation"
-          });
-          return { action: "failed", reason: "credential_restriction_violation" };
-        }
         const requestedModel = template.model ?? deploymentCatalogSettings.openaiModel;
         const catalogSettings = requestedModel.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX) || requestedModel.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX) ? (await resolveWorkspaceCatalogSettings(service.db, catalogSourceSettings, {
           accountId: input.accountId,
@@ -878,7 +864,7 @@ function createAutomationActivities(services, options = {}) {
           });
           return { action: "failed", reason: "dispatch_failed" };
         }
-        const resolvedTurnExecutionPolicy = resolveTurnExecutionPolicyV1(catalogSettings, {
+        const turnExecutionPolicy = resolveTurnExecutionPolicyV1(catalogSettings, {
           modelId: model,
           requestedModelId: template.model,
           modelSource: template.model ? "explicit" : "deployment",
@@ -887,10 +873,6 @@ function createAutomationActivities(services, options = {}) {
           latencyMode: "standard",
           latencyModeSource: "deployment"
         });
-        const turnExecutionPolicy = template.credentialRestriction ? {
-          ...resolvedTurnExecutionPolicy,
-          credentialRestriction: template.credentialRestriction
-        } : resolvedTurnExecutionPolicy;
         const created = await createSession2({
           db: service.db,
           bus: service.bus,
@@ -914,7 +896,6 @@ function createAutomationActivities(services, options = {}) {
           workspaceId: input.workspaceId,
           initialMessage: accepted.initialMessage,
           surface: "automation",
-          metrics: service.observability,
           resources: template.resources,
           skills: SessionSkills.parse(template.skills),
           bundledSkillIds: template.bundledSkillIds,
@@ -2694,8 +2675,6 @@ import {
   deferRetainedProcessReconciliation,
   forceDrainOverLimitViewerOnlyBoxes,
   listCreditBalancesByAccount,
-  countActiveUsers,
-  readCreditGrantTotals,
   readVerifiedSignupTrialSwitch,
   listLegacyModalCheckpointSlots,
   listLiveModalSandboxLeaseAttributions,
@@ -4390,24 +4369,6 @@ async function refreshQueueLeaseAndCreditGauges(db, settings, observability, ins
         });
       }
     })(),
-    (async () => {
-      try {
-        recordActiveUserGauges(observability, await countActiveUsers(db));
-      } catch (error) {
-        observability.warn("sandbox reaper: active-user gauge refresh failed", {
-          error: error instanceof Error ? error.message : String(error)
-        });
-      }
-    })(),
-    (async () => {
-      try {
-        recordCreditGrantGauges(observability, await readCreditGrantTotals(db));
-      } catch (error) {
-        observability.warn("sandbox reaper: credit-grant gauge refresh failed", {
-          error: error instanceof Error ? error.message : String(error)
-        });
-      }
-    })(),
     (async () => {
       recordVerifiedSignupTrialDeploymentFlagGauge(
         observability,
@@ -5245,7 +5206,6 @@ import {
   SessionAgentAccess,
   SessionMemoryScope,
   normalizeAutomaticSessionTitle,
-  metadataWithTurnExecutionPolicyV1,
   scheduledOccurrencePayloadUtf8Bytes,
   stableJson,
   TurnExecutionPolicyV1,
@@ -5270,9 +5230,7 @@ import {
   swapActiveSandbox,
   agentConfigMayResolve as agentConfigMayResolve2,
   applySessionAgentConfigWriteThrough as applySessionAgentConfigWriteThrough2,
-  resolveSessionAgentConfigForCreate as resolveSessionAgentConfigForCreate2,
-  recordSessionCreated,
-  recordUserMessageAccepted
+  resolveSessionAgentConfigForCreate as resolveSessionAgentConfigForCreate2
 } from "@opengeni/core";
 import {
   addSessionSystemUpdateWithSourceMutation,
@@ -5439,14 +5397,6 @@ function canonicalLabels(value) {
 }
 
 // src/activities/scheduled-tasks.ts
-function scheduledTaskRunExecutionPolicy(policy, input, creatorRestriction) {
-  return creatorRestriction === "developer_setup" || input.triggerType !== "scheduled" && input.credentialRestriction === "developer_setup" ? { ...policy, credentialRestriction: "developer_setup" } : policy;
-}
-function scheduledSessionExecutionPolicyMetadata(policy, creatorRestriction) {
-  if (policy === void 0 || policy === null) return {};
-  const acceptedPolicy = TurnExecutionPolicyV1.parse(policy);
-  return creatorRestriction === "developer_setup" && acceptedPolicy.credentialRestriction === "developer_setup" ? metadataWithTurnExecutionPolicyV1({}, acceptedPolicy) : {};
-}
 function scheduledTaskRunProducerKey(input, suppliedActivityIdentity) {
   if (input.producerKey) return input.producerKey;
   if (input.triggerType !== "scheduled") return input.agentRunUsageIdempotencyKey;
@@ -5472,13 +5422,6 @@ function scheduledTaskGeneratedSessionCreateIdempotencyKey(producerKey) {
   const digest = createHash3("sha256").update("scheduled-task-run\0", "utf8").update(producerKey, "utf8").digest("hex");
   return `scheduled-task-run:${digest}`;
 }
-function recordScheduledSessionCreated(observability) {
-  recordSessionCreated(observability, {
-    surface: "scheduled",
-    createdByKind: "service",
-    parentSessionId: null
-  });
-}
 function scheduledTaskSessionTitle(taskName) {
   return normalizeAutomaticSessionTitle(taskName) ?? "Scheduled run";
 }
@@ -5553,7 +5496,6 @@ function createScheduledTaskActivities(services) {
           try {
             return await recoverBoundScheduledTaskDispatch({
               db,
-              observability: baseService.observability,
               bus,
               settings: settings2,
               wakeSessionWorkflow,
@@ -6055,19 +5997,15 @@ function createScheduledTaskActivities(services) {
           );
         }
       } : void 0;
-      const turnExecutionPolicy = scheduledTaskRunExecutionPolicy(
-        resolveTurnExecutionPolicyV12(settings, {
-          modelId: acceptedModel,
-          requestedModelId: generatedTarget && task.agentConfig.model ? task.agentConfig.model : null,
-          modelSource: generatedTarget ? task.agentConfig.model ? "explicit" : "deployment" : "session",
-          reasoningEffort: acceptedReasoningEffort,
-          reasoningSource: generatedTarget ? task.agentConfig.reasoningEffort ? "explicit" : "deployment" : "session",
-          latencyMode: acceptedLatencyMode,
-          latencyModeSource: generatedTarget ? "deployment" : "session"
-        }),
-        input,
-        creatorPolicy?.credentialRestriction
-      );
+      const turnExecutionPolicy = resolveTurnExecutionPolicyV12(settings, {
+        modelId: acceptedModel,
+        requestedModelId: generatedTarget && task.agentConfig.model ? task.agentConfig.model : null,
+        modelSource: generatedTarget ? task.agentConfig.model ? "explicit" : "deployment" : "session",
+        reasoningEffort: acceptedReasoningEffort,
+        reasoningSource: generatedTarget ? task.agentConfig.reasoningEffort ? "explicit" : "deployment" : "session",
+        latencyMode: acceptedLatencyMode,
+        latencyModeSource: generatedTarget ? "deployment" : "session"
+      });
       const deferredEvents = [];
       const executeDispatch = async (dispatchDb, deferPublications) => {
         const admittedRunId = crypto.randomUUID();
@@ -6278,10 +6216,6 @@ function createScheduledTaskActivities(services) {
                 } : {},
                 metadata: {
                   ...taskMetadata,
-                  ...scheduledSessionExecutionPolicyMetadata(
-                    turnExecutionPolicy,
-                    creatorPolicy?.credentialRestriction
-                  ),
                   model,
                   reasoningEffort,
                   scheduledTaskId: task.id,
@@ -6371,7 +6305,6 @@ function createScheduledTaskActivities(services) {
               }
               session = created.session;
               sessionCreated = created.created;
-              if (sessionCreated) recordScheduledSessionCreated(baseService.observability);
               if (!sessionCreated) {
                 await bindScheduledTaskRunSessionInTransaction(dispatchDb, {
                   accountId: task.accountId,
@@ -6607,9 +6540,6 @@ function createScheduledTaskActivities(services) {
                 run: { ...run, status: "skipped", error }
               };
             }
-            if (scheduledUpdate.added) {
-              recordUserMessageAccepted(baseService.observability, { surface: "scheduled" });
-            }
             if (scheduledUpdate.added && scheduledUpdate.events.length > 0) {
               if (deferPublications) {
                 deferredEvents.push({
@@ -6734,9 +6664,6 @@ function createScheduledTaskActivities(services) {
                 run: { ...run, status: "skipped", error }
               };
             }
-            if (bundled.added) {
-              recordUserMessageAccepted(baseService.observability, { surface: "scheduled" });
-            }
             if (bundled.added && bundled.events.length > 0) {
               if (deferPublications) {
                 deferredEvents.push({
@@ -7078,7 +7005,6 @@ async function recoverBoundScheduledTaskDispatch(input) {
     throw new Error("scheduled run is not an exact queued recovery");
   }
   const generatedSession = task.runMode === "new_session_per_run" || task.runMode === "reusable_session" && task.reusableSessionId === null;
-  const recoveredCreatorPolicy = generatedSession ? await getScheduledTaskCreatorPolicy(input.db, task.workspaceId, task.id) : null;
   const frozenSlack = input.acceptedExecution.resolvedSlackBotConnection;
   if (frozenSlack) {
     const currentSlack = await requireOpenGeniSlackBotConnection(
@@ -7138,6 +7064,11 @@ async function recoverBoundScheduledTaskDispatch(input) {
     }
     const taskMetadata = { ...task.agentConfig.metadata };
     delete taskMetadata[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];
+    const recoveredCreatorPolicy = await getScheduledTaskCreatorPolicy(
+      input.db,
+      task.workspaceId,
+      task.id
+    );
     const created = await createSessionWithIdempotencyKeyResult(input.db, {
       accountId: task.accountId,
       workspaceId: task.workspaceId,
@@ -7156,10 +7087,6 @@ async function recoverBoundScheduledTaskDispatch(input) {
       } : {},
       metadata: {
         ...taskMetadata,
-        ...scheduledSessionExecutionPolicyMetadata(
-          input.acceptedExecution.turnExecutionPolicy,
-          recoveredCreatorPolicy?.credentialRestriction
-        ),
         model: input.acceptedExecution.resolvedModel,
         reasoningEffort: input.acceptedExecution.resolvedReasoningEffort,
         scheduledTaskId: task.id,
@@ -7212,7 +7139,6 @@ async function recoverBoundScheduledTaskDispatch(input) {
     });
     if (created.denied) throw new SessionSpawnDeniedDbError(created.denial);
     session = created.session;
-    if (created.created) recordScheduledSessionCreated(input.observability);
     if (!created.created) {
       await bindScheduledTaskRunSessionInTransaction(input.db, {
         accountId: task.accountId,
@@ -7279,10 +7205,6 @@ async function recoverBoundScheduledTaskDispatch(input) {
     const expectedMetadata = metadataWithAgentConfigCreateIdentity(
       {
         ...expectedTaskMetadata,
-        ...scheduledSessionExecutionPolicyMetadata(
-          input.acceptedExecution.turnExecutionPolicy,
-          recoveredCreatorPolicy?.credentialRestriction
-        ),
         model: input.acceptedExecution.resolvedModel,
         reasoningEffort: input.acceptedExecution.resolvedReasoningEffort,
         scheduledTaskId: task.id,
@@ -7436,9 +7358,6 @@ async function recoverBoundScheduledTaskDispatch(input) {
   if (scheduledUpdate.reason === "session_cancelled" || scheduledUpdate.reason === "session_not_idle") {
     return { action: "blocked", reason: "scheduled_run_terminal" };
   }
-  if (scheduledUpdate.added) {
-    recordUserMessageAccepted(input.observability, { surface: "scheduled" });
-  }
   if (scheduledUpdate.added && scheduledUpdate.events.length > 0) {
     await publishDurableSessionEvents(
       input.bus,
@@ -7694,7 +7613,6 @@ async function dispatchMaintenanceSession(service, maintenance, dependencies) {
     initialMessage: maintenancePrompt(maintenance),
     // OpenGeni's own periodic check: no human or product surface entered it.
     surface: "system",
-    metrics: service.observability,
     resources: [],
     tools: [{ kind: "mcp", id: "opengeni" }],
     toolPolicy: { mode: "explicit", inheritedFromSessionId: null },
@@ -8388,4 +8306,4 @@ export {
   createControlActivities,
   createControlActivitiesFromServices
 };
-//# sourceMappingURL=activities-control-4F2A734B.js.map
+//# sourceMappingURL=activities-control-55ECL47G.js.map