@opengeni/worker-bundle 2.2.1 → 2.3.0-canary.36935312914001

package/src/activities/scheduled-tasks.ts

@@ -10,6 +10,7 @@ import {
   SessionAgentAccess,
   SessionMemoryScope,
   normalizeAutomaticSessionTitle,
+  metadataWithTurnExecutionPolicyV1,
   scheduledOccurrencePayloadUtf8Bytes,
   stableJson,
   TurnExecutionPolicyV1,
@@ -38,6 +39,9 @@ import {
   agentConfigMayResolve,
   applySessionAgentConfigWriteThrough,
   resolveSessionAgentConfigForCreate,
+  recordSessionCreated,
+  recordUserMessageAccepted,
+  type ProductUsageMetricsSink,
 } from "@opengeni/core";
 import {
   appendSessionEvents,
@@ -126,6 +130,30 @@ type ScheduledTemporalActivityIdentity = {
   activityId: string;
 };
 
+export function scheduledTaskRunExecutionPolicy(
+  policy: TurnExecutionPolicyV1,
+  input: DispatchScheduledTaskRunInput,
+  creatorRestriction?: "developer_setup",
+): TurnExecutionPolicyV1 {
+  return creatorRestriction === "developer_setup" ||
+    (input.triggerType !== "scheduled" && input.credentialRestriction === "developer_setup")
+    ? { ...policy, credentialRestriction: "developer_setup" }
+    : policy;
+}
+
+/** Only a creator ceiling is standing; a manual caller ceiling is per-run. */
+export function scheduledSessionExecutionPolicyMetadata(
+  policy: unknown,
+  creatorRestriction?: "developer_setup",
+): Record<string, unknown> {
+  if (policy === undefined || policy === null) return {};
+  const acceptedPolicy = TurnExecutionPolicyV1.parse(policy);
+  return creatorRestriction === "developer_setup" &&
+    acceptedPolicy.credentialRestriction === "developer_setup"
+    ? metadataWithTurnExecutionPolicyV1({}, acceptedPolicy)
+    : {};
+}
+
 export function scheduledTaskRunProducerKey(
   input: DispatchScheduledTaskRunInput,
   suppliedActivityIdentity?: ScheduledTemporalActivityIdentity,
@@ -195,6 +223,15 @@ export function scheduledTaskGeneratedSessionCreateIdempotencyKey(producerKey: s
  * alone, with no Intl call and so no host ICU or tzdata build to make the two
  * texts differ.
  */
+/** A scheduler-generated run session: a service-created root session. */
+function recordScheduledSessionCreated(observability: ProductUsageMetricsSink | undefined): void {
+  recordSessionCreated(observability, {
+    surface: "scheduled",
+    createdByKind: "service",
+    parentSessionId: null,
+  });
+}
+
 export function scheduledTaskSessionTitle(taskName: string): string {
   return normalizeAutomaticSessionTitle(taskName) ?? "Scheduled run";
 }
@@ -334,6 +371,7 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
           try {
             return await recoverBoundScheduledTaskDispatch({
               db,
+              observability: baseService.observability,
               bus,
               settings,
               wakeSessionWorkflow,
@@ -994,23 +1032,28 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
             }
           }
         : undefined;
-      const turnExecutionPolicy: TurnExecutionPolicyV1 = resolveTurnExecutionPolicyV1(settings, {
-        modelId: acceptedModel,
-        requestedModelId: generatedTarget && task.agentConfig.model ? task.agentConfig.model : null,
-        modelSource: generatedTarget
-          ? task.agentConfig.model
-            ? "explicit"
-            : "deployment"
-          : "session",
-        reasoningEffort: acceptedReasoningEffort,
-        reasoningSource: generatedTarget
-          ? task.agentConfig.reasoningEffort
-            ? "explicit"
-            : "deployment"
-          : "session",
-        latencyMode: acceptedLatencyMode,
-        latencyModeSource: generatedTarget ? "deployment" : "session",
-      });
+      const turnExecutionPolicy = scheduledTaskRunExecutionPolicy(
+        resolveTurnExecutionPolicyV1(settings, {
+          modelId: acceptedModel,
+          requestedModelId:
+            generatedTarget && task.agentConfig.model ? task.agentConfig.model : null,
+          modelSource: generatedTarget
+            ? task.agentConfig.model
+              ? "explicit"
+              : "deployment"
+            : "session",
+          reasoningEffort: acceptedReasoningEffort,
+          reasoningSource: generatedTarget
+            ? task.agentConfig.reasoningEffort
+              ? "explicit"
+              : "deployment"
+            : "session",
+          latencyMode: acceptedLatencyMode,
+          latencyModeSource: generatedTarget ? "deployment" : "session",
+        }),
+        input,
+        creatorPolicy?.credentialRestriction,
+      );
       const deferredEvents: Array<{
         sessionId: string;
         events: Awaited<ReturnType<typeof appendSessionEvents>>;
@@ -1269,6 +1312,10 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                   : {}),
                 metadata: {
                   ...taskMetadata,
+                  ...scheduledSessionExecutionPolicyMetadata(
+                    turnExecutionPolicy,
+                    creatorPolicy?.credentialRestriction,
+                  ),
                   model,
                   reasoningEffort,
                   scheduledTaskId: task.id,
@@ -1364,6 +1411,7 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
               }
               session = created.session;
               sessionCreated = created.created;
+              if (sessionCreated) recordScheduledSessionCreated(baseService.observability);
               if (!sessionCreated) {
                 await bindScheduledTaskRunSessionInTransaction(dispatchDb, {
                   accountId: task.accountId,
@@ -1648,6 +1696,9 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                 run: { ...run, status: "skipped" as const, error },
               };
             }
+            if (scheduledUpdate.added) {
+              recordUserMessageAccepted(baseService.observability, { surface: "scheduled" });
+            }
             if (scheduledUpdate.added && scheduledUpdate.events.length > 0) {
               if (deferPublications) {
                 deferredEvents.push({
@@ -1791,6 +1842,9 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                 run: { ...run, status: "skipped" as const, error },
               };
             }
+            if (bundled.added) {
+              recordUserMessageAccepted(baseService.observability, { surface: "scheduled" });
+            }
             if (bundled.added && bundled.events.length > 0) {
               if (deferPublications) {
                 deferredEvents.push({
@@ -2202,6 +2256,7 @@ async function seedScheduledGeneratedSessionRoute(input: {
 
 async function recoverBoundScheduledTaskDispatch(input: {
   db: Database;
+  observability?: ProductUsageMetricsSink | undefined;
   bus: ControlActivityServices["bus"];
   settings: ControlActivityServices["settings"];
   wakeSessionWorkflow: WakeSessionWorkflowSignal | null;
@@ -2216,6 +2271,11 @@ async function recoverBoundScheduledTaskDispatch(input: {
   const generatedSession =
     task.runMode === "new_session_per_run" ||
     (task.runMode === "reusable_session" && task.reusableSessionId === null);
+  // The immutable creator policy determines standing session authority, not
+  // a manual caller's per-run ceiling. Read it for creation and recovery checks.
+  const recoveredCreatorPolicy = generatedSession
+    ? await getScheduledTaskCreatorPolicy(input.db, task.workspaceId, task.id)
+    : null;
   const frozenSlack = input.acceptedExecution.resolvedSlackBotConnection;
   if (frozenSlack) {
     const currentSlack = await requireOpenGeniSlackBotConnection(
@@ -2284,14 +2344,6 @@ async function recoverBoundScheduledTaskDispatch(input: {
     }
     const taskMetadata = { ...task.agentConfig.metadata };
     delete taskMetadata[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];
-    // Tools and permissions were frozen into the accepted execution. The
-    // creator session policy is immutable on the task row (a tombstoned task
-    // still answers), so re-reading it here is deterministic for the same run.
-    const recoveredCreatorPolicy = await getScheduledTaskCreatorPolicy(
-      input.db,
-      task.workspaceId,
-      task.id,
-    );
     const created = await createSessionWithIdempotencyKeyResult(input.db, {
       accountId: task.accountId,
       workspaceId: task.workspaceId,
@@ -2316,6 +2368,10 @@ async function recoverBoundScheduledTaskDispatch(input: {
         : {}),
       metadata: {
         ...taskMetadata,
+        ...scheduledSessionExecutionPolicyMetadata(
+          input.acceptedExecution.turnExecutionPolicy,
+          recoveredCreatorPolicy?.credentialRestriction,
+        ),
         model: input.acceptedExecution.resolvedModel,
         reasoningEffort: input.acceptedExecution.resolvedReasoningEffort,
         scheduledTaskId: task.id,
@@ -2374,6 +2430,7 @@ async function recoverBoundScheduledTaskDispatch(input: {
     });
     if (created.denied) throw new SessionSpawnDeniedDbError(created.denial);
     session = created.session;
+    if (created.created) recordScheduledSessionCreated(input.observability);
     if (!created.created) {
       await bindScheduledTaskRunSessionInTransaction(input.db, {
         accountId: task.accountId,
@@ -2447,6 +2504,10 @@ async function recoverBoundScheduledTaskDispatch(input: {
     const expectedMetadata = metadataWithAgentConfigCreateIdentity(
       {
         ...expectedTaskMetadata,
+        ...scheduledSessionExecutionPolicyMetadata(
+          input.acceptedExecution.turnExecutionPolicy,
+          recoveredCreatorPolicy?.credentialRestriction,
+        ),
         model: input.acceptedExecution.resolvedModel,
         reasoningEffort: input.acceptedExecution.resolvedReasoningEffort,
         scheduledTaskId: task.id,
@@ -2669,6 +2730,9 @@ async function recoverBoundScheduledTaskDispatch(input: {
   ) {
     return { action: "blocked", reason: "scheduled_run_terminal" };
   }
+  if (scheduledUpdate.added) {
+    recordUserMessageAccepted(input.observability, { surface: "scheduled" });
+  }
   if (scheduledUpdate.added && scheduledUpdate.events.length > 0) {
     await publishDurableSessionEvents(
       input.bus,

package/src/activities/site-auth-maintenance.ts

@@ -176,6 +176,7 @@ async function dispatchMaintenanceSession(
     initialMessage: maintenancePrompt(maintenance),
     // OpenGeni's own periodic check: no human or product surface entered it.
     surface: "system",
+    metrics: service.observability,
     resources: [],
     tools: [{ kind: "mcp", id: "opengeni" }],
     toolPolicy: { mode: "explicit", inheritedFromSessionId: null },

package/src/activities/types.ts

@@ -436,6 +436,7 @@ export type DispatchScheduledTaskRunInput = {
       triggerType: Extract<ScheduledTaskTriggerType, "scheduled">;
       agentRunUsageIdempotencyKey?: never;
       initiator?: never;
+      credentialRestriction?: never;
     }
   | {
       triggerType: Extract<
@@ -445,6 +446,8 @@ export type DispatchScheduledTaskRunInput = {
       agentRunUsageIdempotencyKey: string;
       /** Exact identity used by the API-side charge for this same trigger. */
       initiator: TurnInitiator;
+      /** Trusted API-side caller ceiling for this occurrence, not the schedule. */
+      credentialRestriction?: "developer_setup";
     }
 );
 

package/src/activities/workspace-capture.ts

@@ -947,13 +947,24 @@ async function runCapture(
   }
 
   // ── 10. observe completion ────────────────────────────────────────────────
-  const durationMs = Date.now() - startedAt;
+  recordWorkspaceCaptureCompleted(observability, Date.now() - startedAt);
+}
+
+/** Count one committed logical capture and observe its end-to-end duration. */
+export function recordWorkspaceCaptureCompleted(
+  observability: Pick<Observability, "incrementCounter" | "observeHistogram">,
+  durationMs: number,
+): void {
   observability.incrementCounter({
     name: "opengeni_workspace_capture_total",
     labels: { result: "ok" },
   });
+  // Distinct from the physical `opengeni_workspace_capture_duration_seconds`
+  // {backend,outcome} histogram the runtime hook records in this same
+  // registry: one name cannot carry two label sets.
   observability.observeHistogram({
-    name: "opengeni_workspace_capture_duration_seconds",
+    name: "opengeni_workspace_capture_revision_duration_seconds",
+    help: "Turn-end logical workspace revision capture duration for committed revisions.",
     value: durationMs / 1000,
   });
 }

package/src/observability-metrics.ts

@@ -2,12 +2,18 @@ import { createHash } from "node:crypto";
 import { errorCodeToJSON } from "@opengeni/agent-proto";
 import {
   BundledSkillId,
+  CREDIT_GRANT_CLASSES,
   SandboxBackend,
   type SessionEventType,
   type SkillReadKind,
   type SkillUseSource,
 } from "@opengeni/contracts";
-import type { SessionEventAppendPhaseObservation } from "@opengeni/db";
+import {
+  ACTIVE_USER_WINDOWS,
+  type ActiveUserWindow,
+  type CreditGrantTotals,
+  type SessionEventAppendPhaseObservation,
+} from "@opengeni/db";
 import {
   natsSubscriptionTerminationCounter,
   type EventBusOptions,
@@ -1122,6 +1128,54 @@ export function recordCreditBalanceGauges(
   creditBalanceGaugeAccounts.set(observability, current);
 }
 
+/**
+ * Distinct managed people with authenticated browser activity in each fixed
+ * window (migration 0565 presence). Every control worker publishes the same
+ * global value, so dashboards must aggregate with `max()` across pods, never
+ * `sum()`. API keys, services and embedded hosts are never counted.
+ */
+export function recordActiveUserGauges(
+  observability: Observability,
+  counts: Record<ActiveUserWindow, number>,
+): void {
+  for (const window of ACTIVE_USER_WINDOWS) {
+    observability.setGauge({
+      name: "opengeni_active_users",
+      help: "Distinct managed users with authenticated activity within the window (global; use max across pods).",
+      labels: { window },
+      value: counts[window],
+    });
+  }
+}
+
+/**
+ * Positive credit grants observed by the ledger trigger since migration 0565,
+ * by closed class. These are cumulative database totals published as gauges by
+ * every control worker: aggregate with `max()` across pods, then `increase()`.
+ * Counting in the database covers the grants no application process writes:
+ * the verified-signup trial grant (a setup trigger) and operator grants.
+ */
+export function recordCreditGrantGauges(
+  observability: Observability,
+  totals: CreditGrantTotals,
+): void {
+  for (const grantClass of CREDIT_GRANT_CLASSES) {
+    const total = totals[grantClass];
+    observability.setGauge({
+      name: "opengeni_credit_grants_total",
+      help: "Positive credit grants observed in the ledger since migration 0565, by grant class (global cumulative; use max across pods).",
+      labels: { grant_class: grantClass },
+      value: total.count,
+    });
+    observability.setGauge({
+      name: "opengeni_credit_granted_micros_total",
+      help: "Credit micros granted in the ledger since migration 0565, by grant class (global cumulative; use max across pods).",
+      labels: { grant_class: grantClass },
+      value: total.micros,
+    });
+  }
+}
+
 /**
  * The deployment-level runtime switch for the one-time verified signup trial
  * credit (migration 0521): 1 while it allows grants, 0 when an operator has

package/src/workflows/scheduled-tasks.ts

@@ -7,6 +7,7 @@ import {
   WorkflowIdReusePolicy,
 } from "@temporalio/workflow";
 import type { TurnInitiator } from "@opengeni/contracts";
+import type { DispatchScheduledTaskRunInput } from "../activities/types";
 import { scheduledTaskActivity } from "./activities";
 import {
   knowledgeSourceSyncWake,
@@ -26,14 +27,38 @@ export type ScheduledTaskFireWorkflowInput = ScheduledTaskFireWorkflowBase &
         triggerType: "scheduled";
         agentRunUsageIdempotencyKey?: never;
         initiator?: never;
+        credentialRestriction?: never;
       }
     | {
         triggerType: "manual" | "initial" | "provider_event" | "retry" | "repair";
         agentRunUsageIdempotencyKey: string;
         initiator: TurnInitiator;
+        credentialRestriction?: "developer_setup";
       }
   );
 
+export function scheduledTaskDispatchInput(
+  input: ScheduledTaskFireWorkflowInput,
+  producerKey: string,
+): DispatchScheduledTaskRunInput {
+  const base = {
+    workspaceId: input.workspaceId,
+    taskId: input.taskId,
+    producerKey,
+  };
+  return input.triggerType !== "scheduled"
+    ? {
+        ...base,
+        triggerType: input.triggerType,
+        agentRunUsageIdempotencyKey: input.agentRunUsageIdempotencyKey,
+        initiator: input.initiator,
+        ...(input.credentialRestriction === "developer_setup"
+          ? { credentialRestriction: input.credentialRestriction }
+          : {}),
+      }
+    : { ...base, triggerType: "scheduled" };
+}
+
 export async function scheduledTaskFireWorkflow(
   input: ScheduledTaskFireWorkflowInput,
 ): Promise<void> {
@@ -47,20 +72,8 @@ export async function scheduledTaskFireWorkflow(
   ) {
     return;
   }
-  const base = {
-    workspaceId: input.workspaceId,
-    taskId: input.taskId,
-    producerKey: workflowInfo().workflowId,
-  };
   const result = await scheduledTaskActivity.dispatchScheduledTaskRun(
-    input.triggerType !== "scheduled"
-      ? {
-          ...base,
-          triggerType: input.triggerType,
-          agentRunUsageIdempotencyKey: input.agentRunUsageIdempotencyKey,
-          initiator: input.initiator,
-        }
-      : { ...base, triggerType: "scheduled" },
+    scheduledTaskDispatchInput(input, workflowInfo().workflowId),
   );
   if (result.action !== "knowledge_source_sync") return;