@opengeni/worker-bundle 2.3.1 → 2.3.2-canary.37090756480001

package/dist/activities/agent-turn/claude-usage-observer.d.ts

@@ -1,6 +1,17 @@
 import { type parseModelProvidersJson, type ClaudeUsageObservation } from "@opengeni/config";
 type Scope = "workspace" | "organization";
+type ClaudeRequestCredential = {
+    token: string;
+    connectionId: string;
+    credentialVersion: number;
+};
+export declare class ClaudeSubscriptionConnectionUnavailable extends Error {
+    readonly status = 409;
+    readonly code = "claude_subscription_connection_changed";
+    constructor();
+}
 export type CapturedClaudeUsage = {
+    scope: Scope;
     token: string;
     expectedConnectionId: string;
     expectedCredentialVersion: number;
@@ -11,16 +22,29 @@ export type CapturedClaudeUsage = {
     };
 };
 /** Capture the exact credential before requests; replacement fences late responses. */
-export declare function createClaudeUsageObserver(providers: ReturnType<typeof parseModelProvidersJson>, latest: Map<Scope, CapturedClaudeUsage>, readCredential: (scope: Scope) => Promise<{
+export declare function createClaudeUsageObserver(providers: ReturnType<typeof parseModelProvidersJson>, latest: Map<string, CapturedClaudeUsage>, readCredential: (scope: Scope) => Promise<{
     token: string;
     connectionId: string;
     credentialVersion: number;
-} | null>): Promise<((providerId: string, response: Response) => void) & {
+} | null>): Promise<((providerId: string, response: Response, upstreamModelId?: string, requestToken?: string | null) => void) & {
+    prepareRequestWithObserver: (providerId: string, headers: Headers, resolve: (binding: {
+        scope: Scope;
+        expectedConnectionId: string;
+        expectedCredentialVersion: number;
+    }) => Promise<ClaudeRequestCredential | null>) => Promise<{
+        headers: Headers;
+        observe: (providerId: string, response: Response, upstreamModelId?: string, requestToken?: string | null) => void;
+    }>;
+    prepareRequest(providerId: string, headers: Headers, resolve: (binding: {
+        scope: Scope;
+        expectedConnectionId: string;
+        expectedCredentialVersion: number;
+    }) => Promise<ClaudeRequestCredential | null>): Promise<Headers>;
     binding(providerId: string): {
-        readonly scope: Scope;
-        readonly token: string;
-        readonly expectedConnectionId: string;
-        readonly expectedCredentialVersion: number;
+        scope: Scope;
+        token: string;
+        expectedConnectionId: string;
+        expectedCredentialVersion: number;
     } | undefined;
     renew(providerId: string, credential: {
         token: string;

package/dist/activities/agent-turn/credential-leases.d.ts

@@ -1,6 +1,6 @@
 import type { SharedActivityServices } from "../types.js";
-export type LeaseRenewReason = "timer" | "runtime_event" | "model_usage";
-export type LeaseLossReason = "deadline" | "not_found";
+import { SubscriptionTurnLease, type LeaseRenewReason, type LeaseLossReason } from "./subscription-lease.js";
+export type { LeaseRenewReason, LeaseLossReason } from "./subscription-lease.js";
 export declare class CodexCredentialLeaseLostError extends Error {
     readonly reason: LeaseLossReason;
     readonly code = "codex_credential_lease_lost";
@@ -19,40 +19,13 @@ export type TurnCredentialLeaseDeps = {
  * cross-replica fairness primitive; the heartbeat here only extends its short
  * TTL. A killed worker stops heartbeating and the holder self-expires.
  */
-export declare class CodexTurnLease {
-    private readonly deps;
-    held: boolean;
-    lost: boolean;
-    lossReason: LeaseLossReason | null;
-    holderId: string | null;
-    generation: number | null;
-    confirmedUntilMs: number | null;
-    private heartbeatInFlight;
-    private heartbeatTimer;
+export declare class CodexTurnLease extends SubscriptionTurnLease {
     constructor(deps: TurnCredentialLeaseDeps);
-    markLost: (reason: LeaseLossReason) => void;
-    /** Fail closed at the last worker-confirmed lease deadline before dispatch. */
-    assertUsable: () => void;
-    renew: (reason: LeaseRenewReason) => Promise<void>;
-    startHeartbeat: () => void;
-    stopHeartbeat: () => void;
 }
-/** The xAI/SuperGrok credential holder for one running turn; same shape. */
-export declare class XaiTurnLease {
-    private readonly deps;
-    held: boolean;
-    lost: boolean;
+/** SuperGrok uses the same deadline and holder fences as Codex. */
+export declare class XaiTurnLease extends SubscriptionTurnLease {
     subjectId: string | null;
-    holderId: string | null;
-    generation: number | null;
-    confirmedUntilMs: number | null;
-    private heartbeatInFlight;
-    private heartbeatTimer;
     constructor(deps: TurnCredentialLeaseDeps);
-    markLost: (reason: LeaseLossReason) => void;
-    renew: () => Promise<void>;
-    startHeartbeat: () => void;
-    stopHeartbeat: () => void;
 }
 /** Both serving-credential leases for one turn attempt plus their composite views. */
 export type TurnCredentialLeases = {

package/dist/activities/agent-turn/errors.d.ts

@@ -90,6 +90,7 @@ export declare function postClaimDatabaseRecoveryFailure(input: {
     triggerEventId: string;
     executionGeneration: number;
     sandboxSetupOutcomeUnknown?: true;
+    sandboxSetupRecoveryExhausted?: true;
     providerRecovery?: {
         failureCode: string;
         providerRecoveryCount: number;
@@ -266,6 +267,8 @@ export declare function classifyXaiCredentialFailure(error: unknown): XaiCredent
 export declare function agentRunFailurePayload(error: unknown, options?: {
     isCodexTurn?: boolean;
 }): ReturnType<typeof baseAgentRunFailurePayload>;
+/** Keep Anthropic provider text on terminal failures, never recovery events. */
+export declare function agentRunRecoveryFailurePayload(error: unknown, failure: ReturnType<typeof agentRunFailurePayload>): ReturnType<typeof agentRunFailurePayload>;
 declare function baseAgentRunFailurePayload(error: unknown, options?: {
     isCodexTurn?: boolean;
 }): {

package/dist/activities/agent-turn/finalization-monitor.d.ts

@@ -8,7 +8,7 @@ export declare function startTurnFinalizationMonitor(input: {
     observability: Observability;
     details: TurnHeartbeatDetails;
     heartbeat: (details: TurnHeartbeatDetails) => void;
-    terminateWorker: () => void;
+    requestWorkerDrain: () => void;
     timeoutMs?: number;
     slowAfterMs?: number;
 }): {

package/dist/activities/agent-turn/finalization.d.ts

@@ -16,6 +16,8 @@ export type TurnFinalizationDeps = {
     wakeSessionWorkflow: ActivityServices["wakeSessionWorkflow"];
     signalSessionAttemptQuiesced: ActivityServices["signalSessionAttemptQuiesced"];
     signalCodexCapacityWorkflow: ActivityServices["signalCodexCapacityWorkflow"];
+    requestWorkerDrain: ActivityServices["requestWorkerDrain"];
+    turnFinalizationTimeoutMs: ActivityServices["turnFinalizationTimeoutMs"];
     cancellationSignal: AbortSignal | undefined;
     sandboxResumeController: AbortController;
     activityContext: ReturnType<typeof currentActivityContext>;

package/dist/activities/agent-turn/quiescence.d.ts

@@ -49,10 +49,9 @@ export declare const QUIESCENCE_PROOF_SIGNAL_INITIAL_RETRY_MS = 250;
 export declare const QUIESCENCE_PROOF_SIGNAL_MAX_RETRY_MS = 5000;
 export declare const TURN_QUIESCENCE_WATCHDOG_MS: number;
 export declare const TURN_FINALIZER_STEP_TIMEOUT_MS = 30000;
-/** A fenced activity must never heartbeat forever while its physical writer
- * drain is stuck. The last-resort worker exit stops every in-process writer;
- * Kubernetes replaces the pod and the workflow's heartbeat-lease reconciler
- * then commits the exact quiescence receipt. */
+/** A fenced activity must never heartbeat forever while physical cleanup is
+ * stuck. The callback requests host-owned containment, which drains peer turns
+ * before applying its final exit policy. A timeout is never quiescence proof. */
 export declare function armTurnQuiescenceWatchdog(input: {
     enabled: boolean;
     timeoutMs?: number;

package/dist/activities/agent-turn/subscription-lease.d.ts

@@ -0,0 +1,38 @@
+export type LeaseRenewReason = "timer" | "runtime_event" | "model_usage";
+export type LeaseLossReason = "deadline" | "not_found";
+type LeaseIdentity = {
+    turnId: string;
+    holderId: string;
+    generation: number;
+};
+export type SubscriptionLeaseDeps = {
+    ttlMs: number;
+    getTurnId: () => string | undefined;
+    heartbeat: (identity: LeaseIdentity) => Promise<Date | null>;
+    onLost: (reason: LeaseLossReason) => void;
+    onRenewed?: (reason: LeaseRenewReason) => void;
+    onError: (error: unknown, reason: LeaseRenewReason) => void;
+    lostError: (reason: LeaseLossReason) => Error;
+    now?: () => number;
+};
+/** Cross-provider lease lifecycle. Only on-time DB confirmation extends ownership. */
+export declare class SubscriptionTurnLease {
+    private readonly leaseDeps;
+    held: boolean;
+    lost: boolean;
+    lossReason: LeaseLossReason | null;
+    holderId: string | null;
+    generation: number | null;
+    confirmedUntilMs: number | null;
+    private heartbeatInFlight;
+    private heartbeatTimer;
+    private readonly now;
+    constructor(leaseDeps: SubscriptionLeaseDeps);
+    private expired;
+    markLost: (reason: LeaseLossReason) => void;
+    assertUsable: () => void;
+    renew: (reason?: LeaseRenewReason) => Promise<void>;
+    startHeartbeat: () => void;
+    stopHeartbeat: () => void;
+}
+export {};

package/dist/activities/agent-turn/turn-context.d.ts

@@ -146,7 +146,7 @@ export type ProviderTurnState = {
     xaiCredentialQuarantined: boolean;
     priorSessionCodexCredentialId: string | null;
     latestCodexUsage: CodexUsageHeaderSnapshot | null;
-    latestClaudeUsage: Map<"workspace" | "organization", import("./claude-usage-observer.js").CapturedClaudeUsage>;
+    latestClaudeUsage: Map<string, import("./claude-usage-observer.js").CapturedClaudeUsage>;
     lastCodexRequestOpaqueArtifacts: readonly string[];
 };
 export type TurnContext = {

package/dist/activities/model-call-fact-reconciler.d.ts

@@ -0,0 +1,34 @@
+import { listWorkspaceIdsAfter, reconcileModelCallFacts } from "@opengeni/db";
+import type { ControlActivityServices } from "./types.js";
+/** Recent charged calls are rechecked on every run; older gaps use the backfill script. */
+export declare const MODEL_CALL_FACT_RECONCILE_LOOKBACK_MS: number;
+/** Skip the newest calls so a live fact write is not raced by its own repair. */
+export declare const MODEL_CALL_FACT_RECONCILE_SETTLE_MS: number;
+export declare const MODEL_CALL_FACT_RECONCILE_WORKSPACE_LIMIT = 500;
+export declare const MODEL_CALL_FACT_RECONCILE_RUN_BUDGET_MS: number;
+export type ReconcileRecentModelCallFactsResult = {
+    workspaces: number;
+    missing: number;
+    repaired: number;
+    unrepaired: number;
+    /** Workspaces with more missing facts than one bounded pass examines. */
+    truncatedWorkspaces: number;
+    failedWorkspaces: number;
+    budgetExhausted: boolean;
+};
+export type ModelCallFactReconcilerOptions = {
+    now?: () => number;
+    runBudgetMs?: number;
+    startAfterWorkspaceId?: () => string;
+    reconcile?: typeof reconcileModelCallFacts;
+    listWorkspaces?: typeof listWorkspaceIdsAfter;
+};
+/**
+ * Rebuild missing Insights call facts for recently charged model calls. Each
+ * workspace pass is bounded and idempotent, one failure never stops the rest,
+ * and each run starts at a random workspace so a run that exhausts its budget
+ * does not starve the same tail of workspaces every time.
+ */
+export declare function createModelCallFactReconcilerActivities(services: () => Promise<ControlActivityServices>, options?: ModelCallFactReconcilerOptions): {
+    reconcileRecentModelCallFacts: () => Promise<ReconcileRecentModelCallFactsResult>;
+};

package/dist/activities/session-state.d.ts

@@ -53,8 +53,8 @@ export declare function createSessionStateActivities(services: () => Promise<Con
         admissionFence?: import("@opengeni/db").SessionAdmissionFence;
     } | {
         kind: "admission-blocked";
-        reason?: "sandbox_setup_outcome_unknown";
-        ref?: import("@opengeni/db").SandboxSetupOutcomeUnknown;
+        reason?: "sandbox_setup_outcome_unknown" | "sandbox_setup_recovery_exhausted";
+        ref?: import("@opengeni/db").SandboxSetupOutcomeUnknown | import("@opengeni/db").SandboxSetupRecoveryExhausted;
     } | {
         kind: "sandbox-lifecycle-wait";
         ref: import("@opengeni/db").SandboxLifecycleWait;

package/dist/activities/types.d.ts

@@ -87,6 +87,11 @@ export type SharedActivityServices = {
 export type ControlActivityServices = SharedActivityServices;
 /** Turn workers own the model loop and never construct document parsers. */
 export type TurnActivityServices = SharedActivityServices & {
+    /** Host-owned containment: stop polling and checkpoint peer turns before exit.
+     * Bare activity embedders must provide their own worker lifecycle edge. */
+    requestWorkerDrain: () => void;
+    /** Deterministic test clock for the cleanup-only monitor. */
+    turnFinalizationTimeoutMs?: number | undefined;
     runtime: OpenGeniRuntime;
     /** Provider-free test/profiling seam; production injects the real runtime summarizer. */
     summarizeContextForCompaction: typeof import("@opengeni/runtime").summarizeForCompaction;
@@ -237,6 +242,8 @@ export type PostClaimDatabaseRecoveryDetail = {
     providerFailureCode?: string;
     /** Persist the no-replay setup marker, not a new provider/setup attempt. */
     sandboxSetupOutcomeUnknown?: true;
+    /** Preserve the exhausted budget for a command proven not dispatched. */
+    sandboxSetupRecoveryExhausted?: true;
 };
 export declare const POST_CLAIM_DATABASE_RECOVERY_FAILURE_TYPE = "OpenGeniPostClaimDatabaseRecovery";
 export declare const POST_CLAIM_DATABASE_RECOVERY_FAILURE_MESSAGE = "Agent turn database recovery required after attempt claim.";