@opengeni/worker-bundle 2.2.1 → 2.3.0-canary.36938443461001

package/dist/{activities-turn-T7Y3BWYO.js → activities-turn-A7LDKRLD.js}

@@ -83,6 +83,7 @@ import {
   signalPendingCodexCapacityWakeTargets,
   startActivityHeartbeat,
   throwIfTurnOperationCancelled,
+  turnCredentialRestriction,
   turnFinalizerCancellationSignal,
   turnInput,
   turnOperationCancellationFailure,
@@ -94,7 +95,7 @@ import {
   withFirstPartyTools,
   wrapLazyTurnBoxWithRouting,
   wrapTurnBoxWithRouting
-} from "./chunk-OWNLATJL.js";
+} from "./chunk-HXPW4HPN.js";
 import {
   StreamTimingMetrics,
   makeMachineOpObserver,
@@ -126,7 +127,7 @@ import {
   runtimeMetricsHooksForObservability,
   sandboxAutomaticRecoveryOutcome,
   turnLifecycleMetricsFor
-} from "./chunk-IJZU752L.js";
+} from "./chunk-YG27NEMX.js";
 import {
   __export
 } from "./chunk-PZ5AY32C.js";
@@ -4460,13 +4461,16 @@ async function runCapture(input, ctx, startedAt, signal, stage, ownership) {
       "error.message": gcError instanceof Error ? gcError.message : String(gcError)
     });
   }
-  const durationMs = Date.now() - startedAt;
+  recordWorkspaceCaptureCompleted(observability, Date.now() - startedAt);
+}
+function recordWorkspaceCaptureCompleted(observability, durationMs) {
   observability.incrementCounter({
     name: "opengeni_workspace_capture_total",
     labels: { result: "ok" }
   });
   observability.observeHistogram({
-    name: "opengeni_workspace_capture_duration_seconds",
+    name: "opengeni_workspace_capture_revision_duration_seconds",
+    help: "Turn-end logical workspace revision capture duration for committed revisions.",
     value: durationMs / 1e3
   });
 }
@@ -10458,7 +10462,9 @@ async function claimTurnAttempt(deps) {
     claimedPolicy.kind === "valid" ? claimedPolicy.policy.productModelId : turn.model
   );
   const codexAppsCredentialId = capabilitySettings.codexConnectedAppsEnabled ? await resolveCodexAppsCredentialIdForRun(db, input.workspaceId) : null;
-  const policyForAbsent = claimedPolicy.kind === "valid" ? claimedPolicy.policy : resolveTurnExecutionPolicyV12(capabilitySettings, legacyTurnExecutionPolicyInput(turn));
+  const candidatePolicy = claimedPolicy.kind === "valid" ? claimedPolicy.policy : resolveTurnExecutionPolicyV12(capabilitySettings, legacyTurnExecutionPolicyInput(turn));
+  const credentialRestriction = claimedPolicy.kind === "absent" ? turn.initiatorContext?.credentialRestriction === "developer_setup" ? "developer_setup" : turnCredentialRestriction(candidatePolicy, session.metadata) : void 0;
+  const policyForAbsent = credentialRestriction ? { ...candidatePolicy, credentialRestriction } : candidatePolicy;
   const installedPolicy = await installOrReadTurnExecutionPolicyForAttempt(db, {
     accountId: input.accountId,
     workspaceId: input.workspaceId,
@@ -15413,6 +15419,7 @@ async function prepareRunCredentials(deps) {
     sandboxState,
     turn,
     session,
+    turnExecutionPolicy,
     fileAuthoritySubjectId,
     runSettings,
     workspaceVariableSet,
@@ -15571,11 +15578,13 @@ async function prepareRunCredentials(deps) {
     attemptId: input.attemptId,
     turn
   }) : void 0;
+  const credentialRestriction = turnCredentialRestriction(turnExecutionPolicy, session.metadata);
   const codemodeAuthority = {
     sessionId: input.sessionId,
     turnId: turn.id,
     attemptId: input.attemptId,
-    executionGeneration: turn.executionGeneration
+    executionGeneration: turn.executionGeneration,
+    ...credentialRestriction ? { credentialRestriction } : {}
   };
   const sandboxArtifactRuntime = sandboxArtifactRuntimeAdmission(
     settings,
@@ -34227,6 +34236,7 @@ async function prepareTurnToolRuntime(deps) {
   });
   const runSettings = accountRoutes.settings;
   const turnTools = accountRoutes.tools;
+  const credentialRestriction = turnCredentialRestriction(turnExecutionPolicy, session.metadata);
   const toolContextPreparationStartedAt = performance.now();
   throwIfWorkerShuttingDown();
   throwIfTurnCancelled();
@@ -34750,6 +34760,7 @@ async function prepareTurnToolRuntime(deps) {
     ] : [],
     ...createFirstPartyInteractionAttemptToolDefinitions({
       settings: runSettings,
+      ...credentialRestriction ? { credentialRestriction } : {},
       scope: {
         accountId: input.accountId,
         workspaceId: input.workspaceId,
@@ -34836,6 +34847,7 @@ async function prepareTurnToolRuntime(deps) {
   try {
     eventing.preparedTools = await waitForTurnOperation(
       runtime.prepareTools(githubRestMcp.settings, githubRestMcp.tools, {
+        ...credentialRestriction ? { credentialRestriction } : {},
         mcpAccountLabels: accountRoutes.accountLabels,
         accountId: input.accountId,
         workspaceId: input.workspaceId,
@@ -37987,6 +37999,7 @@ These are publication receipts for the human's earlier answer. Do not call the r
             sandboxRuntime,
             turn,
             session,
+            turnExecutionPolicy,
             fileAuthoritySubjectId,
             runSettings,
             workspaceVariableSet,
@@ -39739,4 +39752,4 @@ export {
   createTurnActivities,
   createTurnActivitiesFromServices
 };
-//# sourceMappingURL=activities-turn-T7Y3BWYO.js.map
+//# sourceMappingURL=activities-turn-A7LDKRLD.js.map