@opengeni/worker-bundle 2.2.1 → 2.3.0-canary.36935312914001

package/dist/workflows/scheduled-tasks.d.ts

@@ -1,4 +1,5 @@
 import type { TurnInitiator } from "@opengeni/contracts";
+import type { DispatchScheduledTaskRunInput } from "../activities/types.js";
 type ScheduledTaskFireWorkflowBase = {
     accountId: string;
     workspaceId: string;
@@ -8,10 +9,13 @@ export type ScheduledTaskFireWorkflowInput = ScheduledTaskFireWorkflowBase & ({
     triggerType: "scheduled";
     agentRunUsageIdempotencyKey?: never;
     initiator?: never;
+    credentialRestriction?: never;
 } | {
     triggerType: "manual" | "initial" | "provider_event" | "retry" | "repair";
     agentRunUsageIdempotencyKey: string;
     initiator: TurnInitiator;
+    credentialRestriction?: "developer_setup";
 });
+export declare function scheduledTaskDispatchInput(input: ScheduledTaskFireWorkflowInput, producerKey: string): DispatchScheduledTaskRunInput;
 export declare function scheduledTaskFireWorkflow(input: ScheduledTaskFireWorkflowInput): Promise<void>;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/worker-bundle",
-  "version": "2.2.1",
+  "version": "2.3.0-canary.36935312914001",
   "description": "OpenGeni worker entry and reusable embedded lifecycle, shipped with a release-coherent pre-bundled Temporal workflow artifact.",
   "license": "Apache-2.0",
   "repository": {
@@ -54,26 +54,26 @@
   },
   "dependencies": {
     "@llamaindex/liteparse": "2.14.2",
-    "@opengeni/agent-proto": "^0.6.1",
-    "@opengeni/capabilities": "^0.3.5",
-    "@opengeni/codemode": "^0.6.6",
-    "@opengeni/codex": "^0.2.30",
-    "@opengeni/config": "^3.2.0",
-    "@opengeni/contracts": "^5.5.0",
-    "@opengeni/core": "^5.0.1",
-    "@opengeni/db": "^6.3.0",
-    "@opengeni/documents": "^0.8.38",
-    "@opengeni/events": "^0.4.36",
-    "@opengeni/github": "^0.8.1",
-    "@opengeni/interaction": "^0.4.44",
-    "@opengeni/jev": "^0.2.1",
-    "@opengeni/network": "^0.3.1",
-    "@opengeni/observability": "^0.8.36",
-    "@opengeni/runtime": "^4.4.0",
-    "@opengeni/sdk": "^7.5.0",
-    "@opengeni/storage": "^0.2.137",
-    "@opengeni/tool-gateway": "^0.1.17",
-    "@opengeni/xai-subscription": "^0.1.5",
+    "@opengeni/agent-proto": "^0.6.1-canary.36935312914001",
+    "@opengeni/capabilities": "^0.3.5-canary.36935312914001",
+    "@opengeni/codemode": "^0.6.7-canary.36935312914001",
+    "@opengeni/codex": "^0.2.31-canary.36935312914001",
+    "@opengeni/config": "^3.2.1-canary.36935312914001",
+    "@opengeni/contracts": "^5.6.0-canary.36935312914001",
+    "@opengeni/core": "^5.1.0-canary.36935312914001",
+    "@opengeni/db": "^6.4.0-canary.36935312914001",
+    "@opengeni/documents": "^0.8.39-canary.36935312914001",
+    "@opengeni/events": "^0.4.37-canary.36935312914001",
+    "@opengeni/github": "^0.8.2-canary.36935312914001",
+    "@opengeni/interaction": "^0.4.45-canary.36935312914001",
+    "@opengeni/jev": "^0.2.1-canary.36935312914001",
+    "@opengeni/network": "^0.3.1-canary.36935312914001",
+    "@opengeni/observability": "^0.8.37-canary.36935312914001",
+    "@opengeni/runtime": "^4.5.0-canary.36935312914001",
+    "@opengeni/sdk": "^7.6.0-canary.36935312914001",
+    "@opengeni/storage": "^0.2.138-canary.36935312914001",
+    "@opengeni/tool-gateway": "^0.1.18-canary.36935312914001",
+    "@opengeni/xai-subscription": "^0.1.5-canary.36935312914001",
     "@temporalio/activity": "^1.17.0",
     "@temporalio/client": "^1.17.0",
     "@temporalio/worker": "^1.17.0",

package/src/activities/agent-turn/claim.ts

@@ -56,6 +56,7 @@ import {
 import { createTurnCredentialLeases } from "./credential-leases";
 import { createTurnMediaArtifacts } from "./media-artifacts";
 import { readTurnExecutionPolicyV1 } from "@opengeni/contracts";
+import { turnCredentialRestriction } from "./credential-restriction";
 
 import {
   credentialSubjectIdForTurnInitiator,
@@ -290,10 +291,21 @@ export async function claimTurnAttempt(deps: ClaimTurnDeps): Promise<ClaimTurnOu
   const codexAppsCredentialId = capabilitySettings.codexConnectedAppsEnabled
     ? await resolveCodexAppsCredentialIdForRun(db, input.workspaceId)
     : null;
-  const policyForAbsent =
+  const candidatePolicy =
     claimedPolicy.kind === "valid"
       ? claimedPolicy.policy
       : resolveTurnExecutionPolicyV1(capabilitySettings, legacyTurnExecutionPolicyInput(turn));
+  // This context is frozen by the accepted-turn writer from the exact source
+  // turn. Its reserved restriction field cannot come from public service JSON.
+  const credentialRestriction =
+    claimedPolicy.kind === "absent"
+      ? turn.initiatorContext?.credentialRestriction === "developer_setup"
+        ? "developer_setup"
+        : turnCredentialRestriction(candidatePolicy, session.metadata)
+      : undefined;
+  const policyForAbsent = credentialRestriction
+    ? { ...candidatePolicy, credentialRestriction }
+    : candidatePolicy;
   const installedPolicy = await installOrReadTurnExecutionPolicyForAttempt(db, {
     accountId: input.accountId,
     workspaceId: input.workspaceId,

package/src/activities/agent-turn/credential-restriction.ts

@@ -0,0 +1,14 @@
+import { readTurnExecutionPolicyV1, type TurnExecutionPolicyV1 } from "@opengeni/contracts";
+
+/** Only accepted policies establish the ceiling; ordinary metadata is not authority. */
+export function turnCredentialRestriction(
+  acceptedPolicy: TurnExecutionPolicyV1,
+  initialSessionMetadata: unknown,
+): "developer_setup" | undefined {
+  const initialPolicy = readTurnExecutionPolicyV1(initialSessionMetadata);
+  return acceptedPolicy.credentialRestriction === "developer_setup" ||
+    (initialPolicy.kind === "valid" &&
+      initialPolicy.policy.credentialRestriction === "developer_setup")
+    ? "developer_setup"
+    : undefined;
+}

package/src/activities/agent-turn/errors.ts

@@ -3,6 +3,8 @@ import {
   ActiveSessionHistoryLimitExceededError,
   ApprovalRunStateLimitExceededError,
   nestedPostgresSqlState,
+  databaseFailureCode,
+  isRetryablePersistenceSqlState,
   safeDatabaseErrorFacts,
   isRetryableDatabaseTransportFailure,
   isSessionEventPersistenceError,
@@ -352,6 +354,13 @@ function retryableDatabaseFailureCode(
   error: unknown,
 ): PostClaimDatabaseRecoveryDetail["code"] | null {
   const persistenceFailure = isSessionEventPersistenceError(error) ? error : null;
+  if (!persistenceFailure) {
+    const driver = findPostgresDriverError(error);
+    const driverSqlState = typeof driver?.code === "string" ? driver.code : null;
+    if (isRetryablePersistenceSqlState(driverSqlState)) {
+      return databaseFailureCode(driverSqlState);
+    }
+  }
   const sqlState = persistenceFailure?.details.sqlState ?? null;
   if (sqlState === null && isRetryableDatabaseTransportFailure(error)) {
     return "db_failure";
@@ -1010,6 +1019,16 @@ function findPostgresDriverError(error: unknown): Record<string, unknown> | null
   return null;
 }
 
+function isRawDatabaseQueryError(error: unknown): boolean {
+  return (
+    error instanceof Error &&
+    "query" in error &&
+    typeof error.query === "string" &&
+    "params" in error &&
+    Array.isArray(error.params)
+  );
+}
+
 export function agentRunFailurePayload(
   error: unknown,
   options: { isCodexTurn?: boolean } = {},
@@ -1060,7 +1079,11 @@ function baseAgentRunFailurePayload(
     return { error: error.message, code: "retained_attachment_transport_limit", retryable: false };
   }
   if (error instanceof MandatoryHistoryPersistenceError) {
-    const underlying = isSessionEventPersistenceError(error.cause)
+    const databaseFailure =
+      isSessionEventPersistenceError(error.cause) ||
+      findPostgresDriverError(error.cause) !== null ||
+      isRawDatabaseQueryError(error.cause);
+    const underlying = databaseFailure
       ? agentRunFailurePayload(error.cause, options)
       : {
           error: error.cause instanceof Error ? error.cause.message : String(error.cause),
@@ -1070,6 +1093,21 @@ function baseAgentRunFailurePayload(
       historyPersistenceStage: error.stage,
     };
   }
+  // Raw ORM wrappers can contain the full SQL and its parameters. Classify a
+  // real driver before provider message heuristics; the original cause stays
+  // available to internal diagnostics. This payload grants no replay authority.
+  const postgresDriverError = findPostgresDriverError(error);
+  const rawOrmFailure = isRawDatabaseQueryError(error);
+  if ((postgresDriverError || rawOrmFailure) && !isSessionEventPersistenceError(error)) {
+    const database = safeDatabaseErrorFacts(postgresDriverError ?? error);
+    const sqlState = postgresDriverError ? nestedPostgresSqlState(postgresDriverError) : null;
+    return {
+      error: "OpenGeni encountered a database error.",
+      code: databaseFailureCode(sqlState),
+      sqlState,
+      ...(Object.keys(database).length > 0 ? { database } : {}),
+    };
+  }
   const safetyRefusalDiagnostic = providerSafetyRefusalDiagnostic(error);
   if (safetyRefusalDiagnostic !== undefined) {
     return {
@@ -1362,18 +1400,6 @@ function baseAgentRunFailurePayload(
     }
     return { error: message, code: "provider_unavailable", retryable: true };
   }
-  const postgresDriverError = findPostgresDriverError(error);
-  if (postgresDriverError) {
-    const database = safeDatabaseErrorFacts(postgresDriverError);
-    const sqlState = nestedPostgresSqlState(postgresDriverError);
-    if (sqlState !== null || Object.keys(database).length > 0) {
-      return {
-        error: message,
-        sqlState,
-        ...(Object.keys(database).length > 0 ? { database } : {}),
-      };
-    }
-  }
   return { error: message };
 }
 

package/src/activities/agent-turn/run-credentials.ts

@@ -65,6 +65,7 @@ import {
   sandboxSettingsForRoute,
 } from "./sandbox-route";
 import type { ClaimTurnOk } from "./claim";
+import { turnCredentialRestriction } from "./credential-restriction";
 import type { GovernanceModelOk } from "./governance-model";
 import type { SandboxTurnRuntime } from "./sandbox-runtime";
 import type {
@@ -91,6 +92,7 @@ export type PrepareRunCredentialsDeps = {
   sandboxRuntime: SandboxTurnRuntime;
   turn: ClaimTurnOk["turn"];
   session: ClaimTurnOk["session"];
+  turnExecutionPolicy: ClaimTurnOk["turnExecutionPolicy"];
   fileAuthoritySubjectId: ClaimTurnOk["fileAuthoritySubjectId"];
   runSettings: GovernanceModelOk["runSettings"];
   workspaceVariableSet: Awaited<ReturnType<typeof loadWorkspaceEnvironmentForRunWithCredentials>>;
@@ -129,6 +131,7 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
     sandboxState,
     turn,
     session,
+    turnExecutionPolicy,
     fileAuthoritySubjectId,
     runSettings,
     workspaceVariableSet,
@@ -346,11 +349,13 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
           turn,
         })
       : undefined;
+  const credentialRestriction = turnCredentialRestriction(turnExecutionPolicy, session.metadata);
   const codemodeAuthority = {
     sessionId: input.sessionId,
     turnId: turn.id,
     attemptId: input.attemptId,
     executionGeneration: turn.executionGeneration,
+    ...(credentialRestriction ? { credentialRestriction } : {}),
   };
   const sandboxArtifactRuntime = sandboxArtifactRuntimeAdmission(
     settings,

package/src/activities/agent-turn/run.ts

@@ -1226,6 +1226,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             sandboxRuntime,
             turn,
             session,
+            turnExecutionPolicy,
             fileAuthoritySubjectId,
             runSettings,
             workspaceVariableSet,

package/src/activities/agent-turn/tool-environment.ts

@@ -127,6 +127,7 @@ import { codeSearchToolDefinitions, codeSearchWorkspaceFromChannel } from "./cod
 import { createWorkspaceSkillTools } from "./skill-tools";
 import { loadConfiguredBundledSkills } from "./skill-selection";
 import { guardSkillFilesystem } from "./skill-transfer";
+import { turnCredentialRestriction } from "./credential-restriction";
 
 export type PrepareTurnToolPolicyDeps = {
   input: RunAgentTurnInput;
@@ -422,6 +423,7 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
   });
   const runSettings = accountRoutes.settings;
   const turnTools = accountRoutes.tools;
+  const credentialRestriction = turnCredentialRestriction(turnExecutionPolicy, session.metadata);
   const toolContextPreparationStartedAt = performance.now();
   throwIfWorkerShuttingDown();
   throwIfTurnCancelled();
@@ -1009,6 +1011,7 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
       : []),
     ...createFirstPartyInteractionAttemptToolDefinitions({
       settings: runSettings,
+      ...(credentialRestriction ? { credentialRestriction } : {}),
       scope: {
         accountId: input.accountId,
         workspaceId: input.workspaceId,
@@ -1104,6 +1107,7 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
   try {
     eventing.preparedTools = await waitForTurnOperation(
       runtime.prepareTools(githubRestMcp.settings, githubRestMcp.tools, {
+        ...(credentialRestriction ? { credentialRestriction } : {}),
         mcpAccountLabels: accountRoutes.accountLabels,
         accountId: input.accountId,
         workspaceId: input.workspaceId,

package/src/activities/automations.ts

@@ -13,6 +13,7 @@ import {
   recordWorkspaceUsage,
   resolveCatalogSettings,
   resolveWorkspaceCatalogSettings,
+  isDeveloperSetupDelegatedPermissionAllowed,
 } from "@opengeni/core";
 import {
   AutomationAuthorityRevokedError,
@@ -107,6 +108,20 @@ export function createAutomationActivities(
         }
 
         const template = accepted.sessionTemplate;
+        if (
+          template.credentialRestriction === "developer_setup" &&
+          template.firstPartyMcpPermissions.some(
+            (permission) => !isDeveloperSetupDelegatedPermissionAllowed(permission),
+          )
+        ) {
+          await settle(service.db, {
+            workspaceId: input.workspaceId,
+            runId: run.id,
+            status: "failed",
+            errorCode: "credential_restriction_violation",
+          });
+          return { action: "failed", reason: "credential_restriction_violation" };
+        }
         const requestedModel = template.model ?? deploymentCatalogSettings.openaiModel;
         const catalogSettings =
           requestedModel.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX) ||
@@ -209,7 +224,7 @@ export function createAutomationActivities(
           });
           return { action: "failed", reason: "dispatch_failed" };
         }
-        const turnExecutionPolicy = resolveTurnExecutionPolicyV1(catalogSettings, {
+        const resolvedTurnExecutionPolicy = resolveTurnExecutionPolicyV1(catalogSettings, {
           modelId: model,
           requestedModelId: template.model,
           modelSource: template.model ? "explicit" : "deployment",
@@ -218,6 +233,12 @@ export function createAutomationActivities(
           latencyMode: "standard",
           latencyModeSource: "deployment",
         });
+        const turnExecutionPolicy = template.credentialRestriction
+          ? {
+              ...resolvedTurnExecutionPolicy,
+              credentialRestriction: template.credentialRestriction,
+            }
+          : resolvedTurnExecutionPolicy;
         const created = await createSession({
           db: service.db,
           bus: service.bus,
@@ -241,6 +262,7 @@ export function createAutomationActivities(
           workspaceId: input.workspaceId,
           initialMessage: accepted.initialMessage,
           surface: "automation",
+          metrics: service.observability,
           resources: template.resources,
           skills: SessionSkills.parse(template.skills),
           bundledSkillIds: template.bundledSkillIds,

package/src/activities/goals.ts

@@ -14,6 +14,7 @@ import {
 import {
   evaluateWorkspaceModelPolicy,
   mergeToolRefs,
+  readTurnExecutionPolicyV1,
   type SessionGoal,
   type ToolRef,
 } from "@opengeni/contracts";
@@ -22,6 +23,7 @@ import {
   enqueueSessionWorkflowWakeIfRunnable,
   getWorkspaceModelPolicy,
   getSessionGoal,
+  getSessionTurn,
   materializeGoalContinuation,
   requireSession,
 } from "@opengeni/db";
@@ -36,6 +38,7 @@ import {
   resolveWorkspaceCatalogSettings,
 } from "@opengeni/core";
 import { agentRunAdmissionDenial } from "./agent-run-admission";
+import { turnCredentialRestriction } from "./agent-turn/credential-restriction";
 
 export function createGoalActivities(services: () => Promise<ControlActivityServices>) {
   async function enqueueGoalRetryWake(input: MaybeContinueGoalInput): Promise<void> {
@@ -124,6 +127,16 @@ export function createGoalActivities(services: () => Promise<ControlActivityServ
           latencyMode: continuationLatencyMode,
           latencyModeSource: "continuation",
         });
+    const continuationPolicy: NonNullable<
+      Parameters<typeof materializeGoalContinuation>[1]["policy"]
+    > = {
+      model: continuationModel,
+      reasoningEffort: continuationReasoningEffort,
+      latencyMode: continuationLatencyMode,
+      ...(turnExecutionPolicy ? { turnExecutionPolicy } : {}),
+      tools: withFirstPartyTools(settings, session.tools),
+      sandboxBackend: session.sandboxBackend,
+    };
     const decision = await materializeGoalContinuation(db, {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
@@ -140,6 +153,25 @@ export function createGoalActivities(services: () => Promise<ControlActivityServ
       // pause can clear on its own; a policy pause needs a model/policy change)
       // and rides the same visible-pause channel.
       admission: async (tx, causalTurn) => {
+        // The materializer selects this exact causal row under its session/goal
+        // locks and freezes policy only after admission returns. Never infer
+        // credential authority from the generated continuation's payload.
+        const sourceTurn = causalTurn
+          ? await getSessionTurn(tx, input.workspaceId, causalTurn.id)
+          : null;
+        if (causalTurn && (!sourceTurn || sourceTurn.sessionId !== input.sessionId)) {
+          throw new Error("Goal continuation source turn is unavailable");
+        }
+        const sourcePolicy = readTurnExecutionPolicyV1(sourceTurn?.metadata);
+        if (turnExecutionPolicy) {
+          const credentialRestriction = turnCredentialRestriction(
+            sourcePolicy.kind === "valid" ? sourcePolicy.policy : turnExecutionPolicy,
+            session.metadata,
+          );
+          continuationPolicy.turnExecutionPolicy = credentialRestriction
+            ? { ...turnExecutionPolicy, credentialRestriction }
+            : turnExecutionPolicy;
+        }
         const budgetBlocked = modelPolicyBlocked
           ? null
           : await goalRunBudgetBlocked(
@@ -158,14 +190,7 @@ export function createGoalActivities(services: () => Promise<ControlActivityServ
             : (budgetBlocked?.pausedReason ?? "limits"),
         };
       },
-      policy: {
-        model: continuationModel,
-        reasoningEffort: continuationReasoningEffort,
-        latencyMode: continuationLatencyMode,
-        ...(turnExecutionPolicy ? { turnExecutionPolicy } : {}),
-        tools: withFirstPartyTools(settings, session.tools),
-        sandboxBackend: session.sandboxBackend,
-      },
+      policy: continuationPolicy,
       // Long-wait guidance is only given when `wait_for_input` is actually in this
       // session's effective first-party selection (the same source the worker
       // signs into the delegated token and the API uses to register tools), so

package/src/activities/sandbox-lease.ts

@@ -41,6 +41,8 @@ import {
   deferRetainedProcessReconciliation,
   forceDrainOverLimitViewerOnlyBoxes,
   listCreditBalancesByAccount,
+  countActiveUsers,
+  readCreditGrantTotals,
   readVerifiedSignupTrialSwitch,
   listLegacyModalCheckpointSlots,
   listLiveModalSandboxLeaseAttributions,
@@ -150,7 +152,9 @@ import { assertSandboxDrainInputTiming, sandboxDrainTiming } from "../sandbox-re
 import type { ControlActivityServices as ActivityServices } from "./types";
 import { reconcilePendingParentSystemUpdates } from "./parent-wake";
 import {
+  recordActiveUserGauges,
   recordCreditBalanceGauges,
+  recordCreditGrantGauges,
   recordCreditMicros,
   recordExpiredDrainingSandboxLeaseGauges,
   recordOpenSandboxKubernetesInventoryGauges,
@@ -2525,6 +2529,24 @@ async function refreshQueueLeaseAndCreditGauges(
         });
       }
     })(),
+    (async () => {
+      try {
+        recordActiveUserGauges(observability, await countActiveUsers(db));
+      } catch (error) {
+        observability.warn("sandbox reaper: active-user gauge refresh failed", {
+          error: error instanceof Error ? error.message : String(error),
+        });
+      }
+    })(),
+    (async () => {
+      try {
+        recordCreditGrantGauges(observability, await readCreditGrantTotals(db));
+      } catch (error) {
+        observability.warn("sandbox reaper: credit-grant gauge refresh failed", {
+          error: error instanceof Error ? error.message : String(error),
+        });
+      }
+    })(),
     (async () => {
       recordVerifiedSignupTrialDeploymentFlagGauge(
         observability,