@opengeni/worker-bundle 2.3.1-canary.37062299158001 → 2.3.1

package/dist/activities.d.ts

@@ -185,8 +185,8 @@ export declare function createActivityTestHarness(dependencies?: ActivityDepende
         admissionFence?: import("@opengeni/db").SessionAdmissionFence;
     } | {
         kind: "admission-blocked";
-        reason?: "sandbox_setup_outcome_unknown" | "sandbox_setup_recovery_exhausted";
-        ref?: import("@opengeni/db").SandboxSetupOutcomeUnknown | import("@opengeni/db").SandboxSetupRecoveryExhausted;
+        reason?: "sandbox_setup_outcome_unknown";
+        ref?: import("@opengeni/db").SandboxSetupOutcomeUnknown;
     } | {
         kind: "sandbox-lifecycle-wait";
         ref: import("@opengeni/db").SandboxLifecycleWait;
@@ -319,8 +319,8 @@ export declare const peekSessionWork: (input: import("./activities/types.js").Pe
     admissionFence?: import("@opengeni/db").SessionAdmissionFence;
 } | {
     kind: "admission-blocked";
-    reason?: "sandbox_setup_outcome_unknown" | "sandbox_setup_recovery_exhausted";
-    ref?: import("@opengeni/db").SandboxSetupOutcomeUnknown | import("@opengeni/db").SandboxSetupRecoveryExhausted;
+    reason?: "sandbox_setup_outcome_unknown";
+    ref?: import("@opengeni/db").SandboxSetupOutcomeUnknown;
 } | {
     kind: "sandbox-lifecycle-wait";
     ref: import("@opengeni/db").SandboxLifecycleWait;

package/dist/{chunk-PA7Z55P4.js → chunk-3K3ULWEE.js}

@@ -1,6 +1,6 @@
 import {
   observabilityEventBusOptions
-} from "./chunk-YOI3Z3GF.js";
+} from "./chunk-YG27NEMX.js";
 
 // src/activity-services.ts
 import {
@@ -579,7 +579,6 @@ async function refreshExhaustedXaiQuota(input) {
 }
 
 // src/activities/codex-rotation.ts
-import { subscriptionAccountShardIndex } from "@opengeni/config";
 import { codexPlanExcludesModel, connectionModelAllowed } from "@opengeni/db";
 function codexAccountServesModel(account, modelId, now) {
   return connectionModelAllowed(account.allowedModelIds, modelId) && !codexPlanExcludesModel(account, modelId, now);
@@ -631,13 +630,21 @@ function isCodexCredentialHealthy(acct, now) {
 function isCodexCredentialEligible(acct, now) {
   return acct.allocatorEnabled && isCodexCredentialHealthy(acct, now);
 }
+function fnv1a32(input) {
+  let hash = 2166136261;
+  for (let i = 0; i < input.length; i++) {
+    hash ^= input.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return hash >>> 0;
+}
 function shardCredentialForSession(args) {
   const { sessionId, accounts, now } = args;
   const eligibles = accounts.filter((acct) => isCodexCredentialEligible(acct, now));
   if (eligibles.length === 0) {
     return null;
   }
-  const index = subscriptionAccountShardIndex(sessionId, eligibles.length);
+  const index = fnv1a32(sessionId) % eligibles.length;
   return eligibles[index].id;
 }
 function chooseShardedHome(args) {
@@ -4946,18 +4953,6 @@ function warnDrainSnapshotFailure(observability, message, error, lease) {
   }
 }
 
-// src/session-event-fanout.ts
-async function publishDurableSessionEvents2(bus, workspaceId, events, onError = () => void 0) {
-  if (!bus || !events?.length) return;
-  for (const sessionId of new Set(events.map((event) => event.sessionId))) {
-    await bus.publish(
-      workspaceId,
-      sessionId,
-      events.filter((event) => event.sessionId === sessionId)
-    ).catch(onError);
-  }
-}
-
 // src/sandbox-archive-storage.ts
 import { uploadWorkspaceArchiveSpool } from "@opengeni/storage";
 import { randomUUID as randomUUID2 } from "crypto";
@@ -5091,7 +5086,6 @@ async function deleteUnpublishedWorkspaceArchiveObject(objectStorage, ref, metri
 }
 
 // src/sandbox-routing.ts
-import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 import { sandboxLifecycleTransitionWaitMs as sandboxLifecycleTransitionWaitMs2 } from "@opengeni/config";
 import {
   createProviderCommandRetainer,
@@ -6482,11 +6476,6 @@ async function resumeBoxForTurnOnce(services, ids, kind, holderId) {
         expectedBackend: ids.backend
       });
       if (marked.status === "marked") {
-        await publishDurableSessionEvents2(
-          services.bus,
-          ids.workspaceId,
-          marked.backgroundCommandEvents
-        );
         await services.onSandboxLost?.({
           sandboxGroupId: ids.sandboxGroupId,
           instanceId: live.instanceId,
@@ -6658,11 +6647,6 @@ async function resolveCurrentHomeBackend(services, ids, established) {
       diagnostic: "provider_not_found_during_home_route_rebind"
     });
     if (marked.status === "marked") {
-      await publishDurableSessionEvents2(
-        services.bus,
-        ids.workspaceId,
-        marked.backgroundCommandEvents
-      );
       await services.onHomeSandboxLost?.({
         sandboxGroupId: ids.sandboxGroupId,
         instanceId: lease.instanceId,
@@ -6908,33 +6892,6 @@ function settleRetainedProcessForTurn(services, ids) {
     }
   };
 }
-function isRetainedProcessSettledForTurn(services, ids) {
-  const fence = ids.workspaceMutationFence;
-  if (!fence) return void 0;
-  return async ({
-    backend,
-    process: process2
-  }) => {
-    const durable = await getRetainedProcess(services.db, {
-      workspaceId: ids.workspaceId,
-      sessionId: ids.sessionId,
-      processId: process2.id
-    });
-    if (!durable || durable.state === "active" || durable.providerSessionId !== process2.providerSessionId || durable.providerBackend !== (sandboxBackendForSdkBackendId(backend.kind) ?? backend.kind) || durable.providerInstanceId !== backend.providerInstanceId || durable.leaseEpoch !== backend.leaseEpoch || durable.routeKind !== (backend.sandboxId === null ? "home" : "active") || durable.routeTargetId !== backend.sandboxId || durable.routeEpoch !== backend.activeEpoch)
-      return false;
-    if (process2.providerCommand) {
-      const command = await retainedProviderCommandPersistence(services.db, {
-        accountId: fence.accountId,
-        workspaceId: ids.workspaceId,
-        sessionId: ids.sessionId,
-        processId: process2.id
-      }).load();
-      if (!command || command.kind !== process2.providerCommand.kind || command.execId !== process2.providerCommand.execId || command.taskId !== process2.providerCommand.taskId || command.sandboxId !== process2.providerCommand.sandboxId || Boolean(command.pty) !== Boolean(process2.providerCommand.pty) || command.kind === "modal-router-v1" && process2.providerCommand.kind === "modal-router-v1" && !isDeepStrictEqual3(command.supervision, process2.providerCommand.supervision))
-        return false;
-    }
-    return true;
-  };
-}
 function adoptRetainedProcessAsBackgroundCommandForTurn(services, ids) {
   const fence = ids.workspaceMutationFence;
   if (!fence) return void 0;
@@ -6977,7 +6934,6 @@ function wrapTurnBoxWithRouting(services, ids, established) {
   const beforeProcessMutation = beforeRetainedProcessMutation(services, ids);
   const afterProcessMutation = afterRetainedProcessMutation(services, ids);
   const settleProcess = settleRetainedProcessForTurn(services, ids);
-  const isProcessSettled = isRetainedProcessSettledForTurn(services, ids);
   const adoptProcessAsBackgroundCommand = adoptRetainedProcessAsBackgroundCommandForTurn(
     services,
     ids
@@ -7150,7 +7106,6 @@ function wrapTurnBoxWithRouting(services, ids, established) {
     ...beforeProcessMutation ? { beforeProcessMutation } : {},
     ...afterProcessMutation ? { afterProcessMutation } : {},
     ...settleProcess ? { settleProcess } : {},
-    ...isProcessSettled ? { isProcessSettled } : {},
     ...ids.workspaceMutationFence ? { observeProcessTerminal: observeRetainedProcessTerminalForTurn(services, ids) } : {},
     ...ids.workspaceMutationFence ? { captureProcessOutput: captureRetainedProcessOutputForTurn(services, ids) } : {},
     ...adoptProcessAsBackgroundCommand ? { adoptProcessAsBackgroundCommand } : {},
@@ -7173,11 +7128,6 @@ function wrapTurnBoxWithRouting(services, ids, established) {
           diagnostic: "provider_not_found_during_routed_operation"
         });
         if (marked.status === "marked") {
-          await publishDurableSessionEvents2(
-            services.bus,
-            ids.workspaceId,
-            marked.backgroundCommandEvents
-          );
           await services.onHomeSandboxLost?.({
             sandboxGroupId: home.sandboxGroupId,
             instanceId: expectedInstanceId,
@@ -7204,7 +7154,6 @@ function wrapLazyTurnBoxWithRouting(services, ids, args) {
   const beforeProcessMutation = beforeRetainedProcessMutation(services, ids);
   const afterProcessMutation = afterRetainedProcessMutation(services, ids);
   const settleProcess = settleRetainedProcessForTurn(services, ids);
-  const isProcessSettled = isRetainedProcessSettledForTurn(services, ids);
   const adoptProcessAsBackgroundCommand = adoptRetainedProcessAsBackgroundCommandForTurn(
     services,
     ids
@@ -7361,7 +7310,6 @@ function wrapLazyTurnBoxWithRouting(services, ids, args) {
     ...beforeProcessMutation ? { beforeProcessMutation } : {},
     ...afterProcessMutation ? { afterProcessMutation } : {},
     ...settleProcess ? { settleProcess } : {},
-    ...isProcessSettled ? { isProcessSettled } : {},
     ...ids.workspaceMutationFence ? { observeProcessTerminal: observeRetainedProcessTerminalForTurn(services, ids) } : {},
     ...ids.workspaceMutationFence ? { captureProcessOutput: captureRetainedProcessOutputForTurn(services, ids) } : {},
     ...adoptProcessAsBackgroundCommand ? { adoptProcessAsBackgroundCommand } : {},
@@ -7385,11 +7333,6 @@ function wrapLazyTurnBoxWithRouting(services, ids, args) {
           diagnostic: "provider_not_found_during_routed_operation"
         });
         if (marked.status === "marked") {
-          await publishDurableSessionEvents2(
-            services.bus,
-            ids.workspaceId,
-            marked.backgroundCommandEvents
-          );
           await services.onHomeSandboxLost?.({
             sandboxGroupId: home.sandboxGroupId,
             instanceId: backend.providerInstanceId,
@@ -7958,7 +7901,7 @@ import {
   stableJson
 } from "@opengeni/contracts";
 import { createHash as createHash3 } from "crypto";
-import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 var INCIDENT_TELEMETRY_AUTHORITY_FENCE_LINEAGE_KEY = "incidentTelemetryAuthorityFence";
 function incidentTelemetryPreflightDeclaration(agentConfig, incidentTriggered) {
   const rawConfig = agentConfig;
@@ -7991,7 +7934,7 @@ function evaluateIncidentTelemetryPreflight(input) {
     return blocked("incident_preflight_metadata_missing");
   }
   if (preflight.requiredResources.some(
-    (required) => !input.responder.resources.some((selected) => isDeepStrictEqual4(selected, required))
+    (required) => !input.responder.resources.some((selected) => isDeepStrictEqual3(selected, required))
   )) {
     return blocked("incident_responder_under_capable");
   }
@@ -8383,127 +8326,6 @@ async function checkpointHistoryBeforeProviderDispatch(historySink, route) {
   }
 }
 
-// src/activities/agent-turn/claude-usage-observer.ts
-import { createHash as createHash4 } from "crypto";
-import {
-  emptyClaudeUsage,
-  mergeClaudeUsage,
-  parseClaudeUsageHeaders
-} from "@opengeni/config";
-var ClaudeSubscriptionConnectionUnavailable = class extends Error {
-  status = 409;
-  code = "claude_subscription_connection_changed";
-  constructor() {
-    super(
-      "Claude connection changed or was disconnected. Start a new turn with the current connection."
-    );
-  }
-};
-async function createClaudeUsageObserver(providers, latest, readCredential) {
-  const managedProviderIds = new Set(
-    providers.filter(
-      (provider) => provider.kind === "claude-subscription-workspace" || provider.kind === "claude-subscription-organization"
-    ).map((provider) => provider.id)
-  );
-  const bindings = await Promise.all(
-    providers.filter(
-      (provider) => provider.kind === "claude-subscription-workspace" || provider.kind === "claude-subscription-organization"
-    ).map(async (provider) => {
-      const scope = provider.kind === "claude-subscription-workspace" ? "workspace" : "organization";
-      const binding = provider.anthropic?.credentialBinding;
-      if (binding && provider.apiKey)
-        return [
-          provider.id,
-          {
-            scope,
-            token: provider.apiKey,
-            expectedConnectionId: binding.connectionId,
-            expectedCredentialVersion: binding.credentialVersion
-          }
-        ];
-      const credential = await readCredential(scope).catch(() => null);
-      if (!credential || credential.token !== provider.apiKey) return null;
-      return [
-        provider.id,
-        {
-          scope,
-          token: credential.token,
-          expectedConnectionId: credential.connectionId,
-          expectedCredentialVersion: credential.credentialVersion
-        }
-      ];
-    })
-  );
-  const captured = new Map(bindings.filter((binding) => binding !== null));
-  const observeBinding = (binding, response, upstreamModelId, requestToken) => {
-    if (requestToken === null) return;
-    if (!binding) return;
-    const { scope, ...capturedIdentity } = binding;
-    const identity = { ...capturedIdentity, token: requestToken ?? capturedIdentity.token };
-    const tokenKey = createHash4("sha256").update(identity.token).digest("hex");
-    const captureKey = `${scope}:${identity.expectedConnectionId}:${identity.expectedCredentialVersion}:${tokenKey}`;
-    const previous = latest.get(captureKey);
-    let observation = parseClaudeUsageHeaders(response.headers, /* @__PURE__ */ new Date(), upstreamModelId);
-    if (observation && previous?.observation) {
-      const merged = mergeClaudeUsage(
-        mergeClaudeUsage(emptyClaudeUsage(binding.expectedCredentialVersion), previous.observation),
-        observation
-      );
-      observation = {
-        windows: merged.windows,
-        observedAt: merged.observedAt,
-        source: merged.source,
-        requestStatus: merged.requestStatus ?? null,
-        requestRestrictions: merged.requestRestrictions ?? []
-      };
-    }
-    if (observation || response.status === 401)
-      latest.set(captureKey, {
-        scope,
-        ...identity,
-        ...previous?.observation && !observation ? { observation: previous.observation } : {},
-        ...observation ? { observation } : {},
-        ...response.status === 401 ? { refresh: { status: "reconnect", checkedAt: (/* @__PURE__ */ new Date()).toISOString() } } : {}
-      });
-  };
-  const observe = (providerId, response, upstreamModelId, requestToken) => observeBinding(captured.get(providerId), response, upstreamModelId, requestToken);
-  const prepareRequestWithObserver = async (providerId, headers, resolve) => {
-    if (!managedProviderIds.has(providerId)) return { headers, observe };
-    const binding = captured.get(providerId);
-    if (!binding) throw new ClaudeSubscriptionConnectionUnavailable();
-    const credential = await resolve({
-      scope: binding.scope,
-      expectedConnectionId: binding.expectedConnectionId,
-      expectedCredentialVersion: binding.expectedCredentialVersion
-    });
-    if (!credential || credential.connectionId !== binding.expectedConnectionId || credential.credentialVersion !== binding.expectedCredentialVersion)
-      throw new ClaudeSubscriptionConnectionUnavailable();
-    const dispatched = Object.freeze({ ...binding, token: credential.token });
-    captured.set(providerId, dispatched);
-    headers.set("authorization", `Bearer ${credential.token}`);
-    headers.delete("x-api-key");
-    return {
-      headers,
-      observe: (_providerId, response, upstreamModelId, requestToken) => observeBinding(dispatched, response, upstreamModelId, requestToken)
-    };
-  };
-  return Object.assign(observe, {
-    prepareRequestWithObserver,
-    async prepareRequest(...args) {
-      return (await prepareRequestWithObserver(...args)).headers;
-    },
-    binding(providerId) {
-      const binding = captured.get(providerId);
-      return binding ? { ...binding } : void 0;
-    },
-    renew(providerId, credential) {
-      const binding = captured.get(providerId);
-      if (binding && binding.expectedConnectionId === credential.connectionId && binding.expectedCredentialVersion === credential.credentialVersion)
-        captured.set(providerId, { ...binding, token: credential.token });
-    }
-  });
-}
-
 // src/activities/agent-turn/sandbox-provision.ts
 import {
   SandboxLeaseRecoveryBlockedError as SandboxLeaseRecoveryBlockedError2,
@@ -9132,7 +8954,6 @@ import {
 } from "@opengeni/db";
 import {
   ActiveBackendUnresolvableError as ActiveBackendUnresolvableError2,
-  AnthropicProviderRejection,
   CompactionProviderResponseError,
   EmptyCompactionSummaryError,
   compactionProviderRejection,
@@ -9141,7 +8962,6 @@ import {
   isMcpTransportConnectivityError,
   isModalTaskExecStartPreDispatchUnavailableError,
   isModalCommandStartOutcomeUnknownError,
-  isProviderCommandObservationUnavailableError,
   isRoutingMutationOutcomeUnknownError,
   RoutingWorkspaceRootChangedError,
   ResponsesStreamingTerminalError,
@@ -9151,8 +8971,7 @@ import {
   classifyProviderQuotaError,
   providerQuotaExhaustedMessage,
   SelfhostedWorkspaceRootChangedError,
-  UNKNOWN_MODEL_FINISH_REASON_CODE,
-  AnthropicRequestError
+  UNKNOWN_MODEL_FINISH_REASON_CODE
 } from "@opengeni/runtime";
 import {
   mcpTransportRequestFailureDiagnostic
@@ -9166,7 +8985,7 @@ import {
   FileResourceRef,
   resourceMountPath
 } from "@opengeni/contracts";
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import {
   getActiveSessionHistoryItemsPaged,
   getFilesForSubject,
@@ -9284,7 +9103,7 @@ async function modelAttachmentContentForFiles(files, readFileBytes, options = {}
           });
           continue;
         }
-        if (createHash5("sha256").update(bytes).digest("hex") !== checksum) {
+        if (createHash4("sha256").update(bytes).digest("hex") !== checksum) {
           console.error("model attachment checksum did not match finalized metadata", {
             fileId: file.id
           });
@@ -9953,9 +9772,7 @@ function retryableDatabaseFailureCode(error) {
 function postClaimDatabaseRecoveryFailure(input) {
   const code = retryableDatabaseFailureCode(input.error);
   if (!code || input.executionGeneration < 1) return null;
-  if (input.sandboxSetupOutcomeUnknown && input.sandboxSetupRecoveryExhausted || (input.sandboxSetupOutcomeUnknown || input.sandboxSetupRecoveryExhausted) && input.providerRecovery) {
-    return null;
-  }
+  if (input.sandboxSetupOutcomeUnknown && input.providerRecovery) return null;
   if (input.providerRecovery && (!Number.isSafeInteger(input.providerRecovery.providerRecoveryCount) || input.providerRecovery.providerRecoveryCount <= 0 || input.providerRecovery.providerRecoveryCount > MAX_AUTOMATIC_PROVIDER_RECOVERIES || !/^[a-z][a-z0-9_]{0,63}$/.test(input.providerRecovery.failureCode))) {
     return null;
   }
@@ -9965,7 +9782,6 @@ function postClaimDatabaseRecoveryFailure(input) {
     executionGeneration: input.executionGeneration,
     code,
     ...input.sandboxSetupOutcomeUnknown ? { sandboxSetupOutcomeUnknown: true } : {},
-    ...input.sandboxSetupRecoveryExhausted ? { sandboxSetupRecoveryExhausted: true } : {},
     ...input.providerRecovery ? {
       providerFailureCode: input.providerRecovery.failureCode,
       providerRecoveryCount: input.providerRecovery.providerRecoveryCount
@@ -10285,31 +10101,11 @@ function findPostgresDriverError(error) {
 function isRawDatabaseQueryError(error) {
   return error instanceof Error && "query" in error && typeof error.query === "string" && "params" in error && Array.isArray(error.params);
 }
-function anthropicRequestDiagnostic(error) {
-  if (error instanceof AnthropicRequestError) return error;
-  return error instanceof Error && error.cause instanceof AnthropicRequestError ? error.cause : void 0;
-}
 function agentRunFailurePayload(error, options = {}) {
   const failure = baseAgentRunFailurePayload(error, options);
   const diagnostic = materializationVerificationDiagnostic(error);
-  const anthropic = anthropicRequestDiagnostic(error);
-  if (anthropic) {
-    return {
-      ...failure,
-      code: failure.code ?? anthropic.code,
-      retryable: failure.retryable ?? false,
-      ...anthropic.detail ? { detail: anthropic.detail } : {},
-      ...anthropic.request_id ? { requestId: anthropic.request_id } : {}
-    };
-  }
   return diagnostic ? { ...failure, materializationDiagnostic: diagnostic } : failure;
 }
-function agentRunRecoveryFailurePayload(error, failure) {
-  if (!anthropicRequestDiagnostic(error)) return failure;
-  const recovery = { ...failure };
-  delete recovery.detail;
-  return recovery;
-}
 function baseAgentRunFailurePayload(error, options = {}) {
   if (error instanceof SandboxMaterializationVerificationError) {
     return {
@@ -10344,17 +10140,6 @@ function baseAgentRunFailurePayload(error, options = {}) {
       ...Object.keys(database).length > 0 ? { database } : {}
     };
   }
-  if (error instanceof ClaudeSubscriptionConnectionUnavailable) {
-    return { error: error.message, code: error.code, retryable: false };
-  }
-  if (error instanceof AnthropicProviderRejection) {
-    return {
-      error: error.message,
-      code: error.code === "content_policy_violation" ? "provider_safety_refusal" : error.code,
-      retryable: false,
-      ...error.request_id ? { requestId: error.request_id } : {}
-    };
-  }
   const safetyRefusalDiagnostic = providerSafetyRefusalDiagnostic(error);
   if (safetyRefusalDiagnostic !== void 0) {
     return {
@@ -10414,13 +10199,6 @@ function baseAgentRunFailurePayload(error, options = {}) {
       retryable: true
     };
   }
-  if (isProviderCommandObservationUnavailableError(error)) {
-    return {
-      error: "A managed sandbox command cannot be observed. Its exact invocation and writer remain retained; setup is blocked without replay until the incomplete operation can be reconciled.",
-      code: "sandbox_command_observation_unavailable",
-      retryable: false
-    };
-  }
   if (isModalCommandStartOutcomeUnknownError(error)) {
     return {
       error: "A managed sandbox command has an unknown outcome. Its original invocation remains fenced; setup is blocked without replay until the incomplete operation can be reconciled.",
@@ -10705,7 +10483,6 @@ export {
   startActivityHeartbeat,
   nextStreamEvent,
   warnDrainSnapshotFailure,
-  publishDurableSessionEvents2 as publishDurableSessionEvents,
   persistWorkspaceArchiveCandidate,
   putVersion1TarArchiveOrInline,
   sandboxLeaseHolderIdForAttempt,
@@ -10736,7 +10513,6 @@ export {
   resolveIncidentTelemetryResponderMetadata,
   validateIncidentTelemetrySystemUpdateAuthority,
   checkpointHistoryBeforeProviderDispatch,
-  createClaudeUsageObserver,
   projectRejectedProviderArtifacts,
   createModelHistoryAttachmentProjector,
   turnInput,
@@ -10794,10 +10570,9 @@ export {
   classifyContextWindowOverflowError,
   classifyXaiCredentialFailure,
   agentRunFailurePayload,
-  agentRunRecoveryFailurePayload,
   codexCredentialCooldownUntil,
   classifyCodexCredentialFailure,
   codexUsageLimitFailurePayload,
   CODEX_USAGE_LIMIT_MAX_RESUME_MS
 };
-//# sourceMappingURL=chunk-PA7Z55P4.js.map
+//# sourceMappingURL=chunk-3K3ULWEE.js.map