@opengeni/worker-bundle 2.2.1 → 2.3.0-canary.36935312914001

package/dist/{chunk-OWNLATJL.js → chunk-HXPW4HPN.js}

@@ -1,6 +1,6 @@
 import {
   observabilityEventBusOptions
-} from "./chunk-IJZU752L.js";
+} from "./chunk-YG27NEMX.js";
 
 // src/activity-services.ts
 import {
@@ -1254,13 +1254,15 @@ import {
 } from "@opengeni/config";
 import {
   evaluateWorkspaceModelPolicy,
-  mergeToolRefs
+  mergeToolRefs,
+  readTurnExecutionPolicyV1 as readTurnExecutionPolicyV12
 } from "@opengeni/contracts";
 import { isCodexBilledModel } from "@opengeni/codex";
 import {
   enqueueSessionWorkflowWakeIfRunnable,
   getWorkspaceModelPolicy,
   getSessionGoal,
+  getSessionTurn,
   materializeGoalContinuation,
   requireSession
 } from "@opengeni/db";
@@ -1344,6 +1346,13 @@ function startOfUtcMonth() {
   return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
 }
 
+// src/activities/agent-turn/credential-restriction.ts
+import { readTurnExecutionPolicyV1 } from "@opengeni/contracts";
+function turnCredentialRestriction(acceptedPolicy, initialSessionMetadata) {
+  const initialPolicy = readTurnExecutionPolicyV1(initialSessionMetadata);
+  return acceptedPolicy.credentialRestriction === "developer_setup" || initialPolicy.kind === "valid" && initialPolicy.policy.credentialRestriction === "developer_setup" ? "developer_setup" : void 0;
+}
+
 // src/activities/goals.ts
 function createGoalActivities(services) {
   async function enqueueGoalRetryWake(input) {
@@ -1403,6 +1412,14 @@ function createGoalActivities(services) {
       latencyMode: continuationLatencyMode,
       latencyModeSource: "continuation"
     });
+    const continuationPolicy = {
+      model: continuationModel,
+      reasoningEffort: continuationReasoningEffort,
+      latencyMode: continuationLatencyMode,
+      ...turnExecutionPolicy ? { turnExecutionPolicy } : {},
+      tools: withFirstPartyTools(settings, session.tools),
+      sandboxBackend: session.sandboxBackend
+    };
     const decision = await materializeGoalContinuation(db, {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
@@ -1419,6 +1436,18 @@ function createGoalActivities(services) {
       // pause can clear on its own; a policy pause needs a model/policy change)
       // and rides the same visible-pause channel.
       admission: async (tx, causalTurn) => {
+        const sourceTurn = causalTurn ? await getSessionTurn(tx, input.workspaceId, causalTurn.id) : null;
+        if (causalTurn && (!sourceTurn || sourceTurn.sessionId !== input.sessionId)) {
+          throw new Error("Goal continuation source turn is unavailable");
+        }
+        const sourcePolicy = readTurnExecutionPolicyV12(sourceTurn?.metadata);
+        if (turnExecutionPolicy) {
+          const credentialRestriction = turnCredentialRestriction(
+            sourcePolicy.kind === "valid" ? sourcePolicy.policy : turnExecutionPolicy,
+            session.metadata
+          );
+          continuationPolicy.turnExecutionPolicy = credentialRestriction ? { ...turnExecutionPolicy, credentialRestriction } : turnExecutionPolicy;
+        }
         const budgetBlocked = modelPolicyBlocked ? null : await goalRunBudgetBlocked(
           { ...service, settings, db: tx },
           {
@@ -1433,14 +1462,7 @@ function createGoalActivities(services) {
           budgetPausedReason: modelPolicyBlocked ? "limits" : budgetBlocked?.pausedReason ?? "limits"
         };
       },
-      policy: {
-        model: continuationModel,
-        reasoningEffort: continuationReasoningEffort,
-        latencyMode: continuationLatencyMode,
-        ...turnExecutionPolicy ? { turnExecutionPolicy } : {},
-        tools: withFirstPartyTools(settings, session.tools),
-        sandboxBackend: session.sandboxBackend
-      },
+      policy: continuationPolicy,
       // Long-wait guidance is only given when `wait_for_input` is actually in this
       // session's effective first-party selection (the same source the worker
       // signs into the delegated token and the API uses to register tools), so
@@ -8923,6 +8945,8 @@ import {
   ActiveSessionHistoryLimitExceededError,
   ApprovalRunStateLimitExceededError,
   nestedPostgresSqlState,
+  databaseFailureCode,
+  isRetryablePersistenceSqlState,
   safeDatabaseErrorFacts,
   isRetryableDatabaseTransportFailure,
   isSessionEventPersistenceError,
@@ -9729,6 +9753,13 @@ function preClaimAdmissionFailure(error) {
 }
 function retryableDatabaseFailureCode(error) {
   const persistenceFailure = isSessionEventPersistenceError(error) ? error : null;
+  if (!persistenceFailure) {
+    const driver = findPostgresDriverError(error);
+    const driverSqlState = typeof driver?.code === "string" ? driver.code : null;
+    if (isRetryablePersistenceSqlState(driverSqlState)) {
+      return databaseFailureCode(driverSqlState);
+    }
+  }
   const sqlState = persistenceFailure?.details.sqlState ?? null;
   if (sqlState === null && isRetryableDatabaseTransportFailure(error)) {
     return "db_failure";
@@ -10065,6 +10096,9 @@ function findPostgresDriverError(error) {
   }
   return null;
 }
+function isRawDatabaseQueryError(error) {
+  return error instanceof Error && "query" in error && typeof error.query === "string" && "params" in error && Array.isArray(error.params);
+}
 function agentRunFailurePayload(error, options = {}) {
   const failure = baseAgentRunFailurePayload(error, options);
   const diagnostic = materializationVerificationDiagnostic(error);
@@ -10083,7 +10117,8 @@ function baseAgentRunFailurePayload(error, options = {}) {
     return { error: error.message, code: "retained_attachment_transport_limit", retryable: false };
   }
   if (error instanceof MandatoryHistoryPersistenceError) {
-    const underlying = isSessionEventPersistenceError(error.cause) ? agentRunFailurePayload(error.cause, options) : {
+    const databaseFailure = isSessionEventPersistenceError(error.cause) || findPostgresDriverError(error.cause) !== null || isRawDatabaseQueryError(error.cause);
+    const underlying = databaseFailure ? agentRunFailurePayload(error.cause, options) : {
       error: error.cause instanceof Error ? error.cause.message : String(error.cause)
     };
     return {
@@ -10091,6 +10126,18 @@ function baseAgentRunFailurePayload(error, options = {}) {
       historyPersistenceStage: error.stage
     };
   }
+  const postgresDriverError = findPostgresDriverError(error);
+  const rawOrmFailure = isRawDatabaseQueryError(error);
+  if ((postgresDriverError || rawOrmFailure) && !isSessionEventPersistenceError(error)) {
+    const database = safeDatabaseErrorFacts(postgresDriverError ?? error);
+    const sqlState = postgresDriverError ? nestedPostgresSqlState(postgresDriverError) : null;
+    return {
+      error: "OpenGeni encountered a database error.",
+      code: databaseFailureCode(sqlState),
+      sqlState,
+      ...Object.keys(database).length > 0 ? { database } : {}
+    };
+  }
   const safetyRefusalDiagnostic = providerSafetyRefusalDiagnostic(error);
   if (safetyRefusalDiagnostic !== void 0) {
     return {
@@ -10307,18 +10354,6 @@ function baseAgentRunFailurePayload(error, options = {}) {
     }
     return { error: message, code: "provider_unavailable", retryable: true };
   }
-  const postgresDriverError = findPostgresDriverError(error);
-  if (postgresDriverError) {
-    const database = safeDatabaseErrorFacts(postgresDriverError);
-    const sqlState = nestedPostgresSqlState(postgresDriverError);
-    if (sqlState !== null || Object.keys(database).length > 0) {
-      return {
-        error: message,
-        sqlState,
-        ...Object.keys(database).length > 0 ? { database } : {}
-      };
-    }
-  }
   return { error: message };
 }
 var CODEX_ALLOWANCE_FALLBACK_MS = 5 * 60 * 6e4;
@@ -10436,6 +10471,7 @@ export {
   createCodexCapacityActivities,
   agentRunAdmissionDenial,
   createDocumentActivities,
+  turnCredentialRestriction,
   createGoalActivities,
   withFirstPartyTools,
   createKnowledgeSourceSyncActivities,
@@ -10537,4 +10573,4 @@ export {
   codexUsageLimitFailurePayload,
   CODEX_USAGE_LIMIT_MAX_RESUME_MS
 };
-//# sourceMappingURL=chunk-OWNLATJL.js.map
+//# sourceMappingURL=chunk-HXPW4HPN.js.map