@opengeni/worker-bundle 2.3.1 → 2.3.2-canary.37090756480001

package/dist/activities.d.ts

@@ -85,6 +85,7 @@ export declare function createActivityTestHarness(dependencies?: ActivityDepende
     }>;
     enqueueGoalRetryWake: (input: import("./activities.js").MaybeContinueGoalInput) => Promise<void>;
     maybeContinueGoal: (input: import("./activities.js").MaybeContinueGoalInput) => Promise<import("./activities.js").MaybeContinueGoalResult>;
+    reconcileRecentModelCallFacts: () => Promise<import("./activities/model-call-fact-reconciler.js").ReconcileRecentModelCallFactsResult>;
     runKnowledgeSourceSyncBatch: (input: import("./activities.js").RunKnowledgeSourceSyncBatchInput) => Promise<import("./activities.js").RunKnowledgeSourceSyncBatchResult>;
     maintainRetainedScreenshots: () => Promise<import("./activities/retained-screenshot-reaper.js").MaintainRetainedScreenshotsResult>;
     verifyRigChange: (input: {
@@ -185,8 +186,8 @@ export declare function createActivityTestHarness(dependencies?: ActivityDepende
         admissionFence?: import("@opengeni/db").SessionAdmissionFence;
     } | {
         kind: "admission-blocked";
-        reason?: "sandbox_setup_outcome_unknown";
-        ref?: import("@opengeni/db").SandboxSetupOutcomeUnknown;
+        reason?: "sandbox_setup_outcome_unknown" | "sandbox_setup_recovery_exhausted";
+        ref?: import("@opengeni/db").SandboxSetupOutcomeUnknown | import("@opengeni/db").SandboxSetupRecoveryExhausted;
     } | {
         kind: "sandbox-lifecycle-wait";
         ref: import("@opengeni/db").SandboxLifecycleWait;
@@ -319,8 +320,8 @@ export declare const peekSessionWork: (input: import("./activities/types.js").Pe
     admissionFence?: import("@opengeni/db").SessionAdmissionFence;
 } | {
     kind: "admission-blocked";
-    reason?: "sandbox_setup_outcome_unknown";
-    ref?: import("@opengeni/db").SandboxSetupOutcomeUnknown;
+    reason?: "sandbox_setup_outcome_unknown" | "sandbox_setup_recovery_exhausted";
+    ref?: import("@opengeni/db").SandboxSetupOutcomeUnknown | import("@opengeni/db").SandboxSetupRecoveryExhausted;
 } | {
     kind: "sandbox-lifecycle-wait";
     ref: import("@opengeni/db").SandboxLifecycleWait;
@@ -413,6 +414,7 @@ export declare const recoverVideoGenerationWorkflows: () => Promise<{
 }>;
 export declare const maintainRetainedScreenshots: () => Promise<import("./activities/retained-screenshot-reaper.js").MaintainRetainedScreenshotsResult>;
 export declare const maintainBrowserStateArtifacts: () => Promise<import("./activities/browser-state-artifact-reaper.js").MaintainBrowserStateArtifactsResult>;
+export declare const reconcileRecentModelCallFacts: () => Promise<import("./activities/model-call-fact-reconciler.js").ReconcileRecentModelCallFactsResult>;
 export declare const maintainSiteAuthConnections: () => Promise<import("./activities/site-auth-maintenance.js").MaintainSiteAuthConnectionsResult>;
 export declare const dispatchSessionWorkflowWakes: () => Promise<import("./activities/workflow-wake.js").DispatchSessionWorkflowWakesResult>;
 export declare const verifyRigChange: (input: {

package/dist/{chunk-3K3ULWEE.js → chunk-PA7Z55P4.js}

@@ -1,6 +1,6 @@
 import {
   observabilityEventBusOptions
-} from "./chunk-YG27NEMX.js";
+} from "./chunk-YOI3Z3GF.js";
 
 // src/activity-services.ts
 import {
@@ -579,6 +579,7 @@ async function refreshExhaustedXaiQuota(input) {
 }
 
 // src/activities/codex-rotation.ts
+import { subscriptionAccountShardIndex } from "@opengeni/config";
 import { codexPlanExcludesModel, connectionModelAllowed } from "@opengeni/db";
 function codexAccountServesModel(account, modelId, now) {
   return connectionModelAllowed(account.allowedModelIds, modelId) && !codexPlanExcludesModel(account, modelId, now);
@@ -630,21 +631,13 @@ function isCodexCredentialHealthy(acct, now) {
 function isCodexCredentialEligible(acct, now) {
   return acct.allocatorEnabled && isCodexCredentialHealthy(acct, now);
 }
-function fnv1a32(input) {
-  let hash = 2166136261;
-  for (let i = 0; i < input.length; i++) {
-    hash ^= input.charCodeAt(i);
-    hash = Math.imul(hash, 16777619);
-  }
-  return hash >>> 0;
-}
 function shardCredentialForSession(args) {
   const { sessionId, accounts, now } = args;
   const eligibles = accounts.filter((acct) => isCodexCredentialEligible(acct, now));
   if (eligibles.length === 0) {
     return null;
   }
-  const index = fnv1a32(sessionId) % eligibles.length;
+  const index = subscriptionAccountShardIndex(sessionId, eligibles.length);
   return eligibles[index].id;
 }
 function chooseShardedHome(args) {
@@ -4953,6 +4946,18 @@ function warnDrainSnapshotFailure(observability, message, error, lease) {
   }
 }
 
+// src/session-event-fanout.ts
+async function publishDurableSessionEvents2(bus, workspaceId, events, onError = () => void 0) {
+  if (!bus || !events?.length) return;
+  for (const sessionId of new Set(events.map((event) => event.sessionId))) {
+    await bus.publish(
+      workspaceId,
+      sessionId,
+      events.filter((event) => event.sessionId === sessionId)
+    ).catch(onError);
+  }
+}
+
 // src/sandbox-archive-storage.ts
 import { uploadWorkspaceArchiveSpool } from "@opengeni/storage";
 import { randomUUID as randomUUID2 } from "crypto";
@@ -5086,6 +5091,7 @@ async function deleteUnpublishedWorkspaceArchiveObject(objectStorage, ref, metri
 }
 
 // src/sandbox-routing.ts
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 import { sandboxLifecycleTransitionWaitMs as sandboxLifecycleTransitionWaitMs2 } from "@opengeni/config";
 import {
   createProviderCommandRetainer,
@@ -6476,6 +6482,11 @@ async function resumeBoxForTurnOnce(services, ids, kind, holderId) {
         expectedBackend: ids.backend
       });
       if (marked.status === "marked") {
+        await publishDurableSessionEvents2(
+          services.bus,
+          ids.workspaceId,
+          marked.backgroundCommandEvents
+        );
         await services.onSandboxLost?.({
           sandboxGroupId: ids.sandboxGroupId,
           instanceId: live.instanceId,
@@ -6647,6 +6658,11 @@ async function resolveCurrentHomeBackend(services, ids, established) {
       diagnostic: "provider_not_found_during_home_route_rebind"
     });
     if (marked.status === "marked") {
+      await publishDurableSessionEvents2(
+        services.bus,
+        ids.workspaceId,
+        marked.backgroundCommandEvents
+      );
       await services.onHomeSandboxLost?.({
         sandboxGroupId: ids.sandboxGroupId,
         instanceId: lease.instanceId,
@@ -6892,6 +6908,33 @@ function settleRetainedProcessForTurn(services, ids) {
     }
   };
 }
+function isRetainedProcessSettledForTurn(services, ids) {
+  const fence = ids.workspaceMutationFence;
+  if (!fence) return void 0;
+  return async ({
+    backend,
+    process: process2
+  }) => {
+    const durable = await getRetainedProcess(services.db, {
+      workspaceId: ids.workspaceId,
+      sessionId: ids.sessionId,
+      processId: process2.id
+    });
+    if (!durable || durable.state === "active" || durable.providerSessionId !== process2.providerSessionId || durable.providerBackend !== (sandboxBackendForSdkBackendId(backend.kind) ?? backend.kind) || durable.providerInstanceId !== backend.providerInstanceId || durable.leaseEpoch !== backend.leaseEpoch || durable.routeKind !== (backend.sandboxId === null ? "home" : "active") || durable.routeTargetId !== backend.sandboxId || durable.routeEpoch !== backend.activeEpoch)
+      return false;
+    if (process2.providerCommand) {
+      const command = await retainedProviderCommandPersistence(services.db, {
+        accountId: fence.accountId,
+        workspaceId: ids.workspaceId,
+        sessionId: ids.sessionId,
+        processId: process2.id
+      }).load();
+      if (!command || command.kind !== process2.providerCommand.kind || command.execId !== process2.providerCommand.execId || command.taskId !== process2.providerCommand.taskId || command.sandboxId !== process2.providerCommand.sandboxId || Boolean(command.pty) !== Boolean(process2.providerCommand.pty) || command.kind === "modal-router-v1" && process2.providerCommand.kind === "modal-router-v1" && !isDeepStrictEqual3(command.supervision, process2.providerCommand.supervision))
+        return false;
+    }
+    return true;
+  };
+}
 function adoptRetainedProcessAsBackgroundCommandForTurn(services, ids) {
   const fence = ids.workspaceMutationFence;
   if (!fence) return void 0;
@@ -6934,6 +6977,7 @@ function wrapTurnBoxWithRouting(services, ids, established) {
   const beforeProcessMutation = beforeRetainedProcessMutation(services, ids);
   const afterProcessMutation = afterRetainedProcessMutation(services, ids);
   const settleProcess = settleRetainedProcessForTurn(services, ids);
+  const isProcessSettled = isRetainedProcessSettledForTurn(services, ids);
   const adoptProcessAsBackgroundCommand = adoptRetainedProcessAsBackgroundCommandForTurn(
     services,
     ids
@@ -7106,6 +7150,7 @@ function wrapTurnBoxWithRouting(services, ids, established) {
     ...beforeProcessMutation ? { beforeProcessMutation } : {},
     ...afterProcessMutation ? { afterProcessMutation } : {},
     ...settleProcess ? { settleProcess } : {},
+    ...isProcessSettled ? { isProcessSettled } : {},
     ...ids.workspaceMutationFence ? { observeProcessTerminal: observeRetainedProcessTerminalForTurn(services, ids) } : {},
     ...ids.workspaceMutationFence ? { captureProcessOutput: captureRetainedProcessOutputForTurn(services, ids) } : {},
     ...adoptProcessAsBackgroundCommand ? { adoptProcessAsBackgroundCommand } : {},
@@ -7128,6 +7173,11 @@ function wrapTurnBoxWithRouting(services, ids, established) {
           diagnostic: "provider_not_found_during_routed_operation"
         });
         if (marked.status === "marked") {
+          await publishDurableSessionEvents2(
+            services.bus,
+            ids.workspaceId,
+            marked.backgroundCommandEvents
+          );
           await services.onHomeSandboxLost?.({
             sandboxGroupId: home.sandboxGroupId,
             instanceId: expectedInstanceId,
@@ -7154,6 +7204,7 @@ function wrapLazyTurnBoxWithRouting(services, ids, args) {
   const beforeProcessMutation = beforeRetainedProcessMutation(services, ids);
   const afterProcessMutation = afterRetainedProcessMutation(services, ids);
   const settleProcess = settleRetainedProcessForTurn(services, ids);
+  const isProcessSettled = isRetainedProcessSettledForTurn(services, ids);
   const adoptProcessAsBackgroundCommand = adoptRetainedProcessAsBackgroundCommandForTurn(
     services,
     ids
@@ -7310,6 +7361,7 @@ function wrapLazyTurnBoxWithRouting(services, ids, args) {
     ...beforeProcessMutation ? { beforeProcessMutation } : {},
     ...afterProcessMutation ? { afterProcessMutation } : {},
     ...settleProcess ? { settleProcess } : {},
+    ...isProcessSettled ? { isProcessSettled } : {},
     ...ids.workspaceMutationFence ? { observeProcessTerminal: observeRetainedProcessTerminalForTurn(services, ids) } : {},
     ...ids.workspaceMutationFence ? { captureProcessOutput: captureRetainedProcessOutputForTurn(services, ids) } : {},
     ...adoptProcessAsBackgroundCommand ? { adoptProcessAsBackgroundCommand } : {},
@@ -7333,6 +7385,11 @@ function wrapLazyTurnBoxWithRouting(services, ids, args) {
           diagnostic: "provider_not_found_during_routed_operation"
         });
         if (marked.status === "marked") {
+          await publishDurableSessionEvents2(
+            services.bus,
+            ids.workspaceId,
+            marked.backgroundCommandEvents
+          );
           await services.onHomeSandboxLost?.({
             sandboxGroupId: home.sandboxGroupId,
             instanceId: backend.providerInstanceId,
@@ -7901,7 +7958,7 @@ import {
   stableJson
 } from "@opengeni/contracts";
 import { createHash as createHash3 } from "crypto";
-import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
 var INCIDENT_TELEMETRY_AUTHORITY_FENCE_LINEAGE_KEY = "incidentTelemetryAuthorityFence";
 function incidentTelemetryPreflightDeclaration(agentConfig, incidentTriggered) {
   const rawConfig = agentConfig;
@@ -7934,7 +7991,7 @@ function evaluateIncidentTelemetryPreflight(input) {
     return blocked("incident_preflight_metadata_missing");
   }
   if (preflight.requiredResources.some(
-    (required) => !input.responder.resources.some((selected) => isDeepStrictEqual3(selected, required))
+    (required) => !input.responder.resources.some((selected) => isDeepStrictEqual4(selected, required))
   )) {
     return blocked("incident_responder_under_capable");
   }
@@ -8326,6 +8383,127 @@ async function checkpointHistoryBeforeProviderDispatch(historySink, route) {
   }
 }
 
+// src/activities/agent-turn/claude-usage-observer.ts
+import { createHash as createHash4 } from "crypto";
+import {
+  emptyClaudeUsage,
+  mergeClaudeUsage,
+  parseClaudeUsageHeaders
+} from "@opengeni/config";
+var ClaudeSubscriptionConnectionUnavailable = class extends Error {
+  status = 409;
+  code = "claude_subscription_connection_changed";
+  constructor() {
+    super(
+      "Claude connection changed or was disconnected. Start a new turn with the current connection."
+    );
+  }
+};
+async function createClaudeUsageObserver(providers, latest, readCredential) {
+  const managedProviderIds = new Set(
+    providers.filter(
+      (provider) => provider.kind === "claude-subscription-workspace" || provider.kind === "claude-subscription-organization"
+    ).map((provider) => provider.id)
+  );
+  const bindings = await Promise.all(
+    providers.filter(
+      (provider) => provider.kind === "claude-subscription-workspace" || provider.kind === "claude-subscription-organization"
+    ).map(async (provider) => {
+      const scope = provider.kind === "claude-subscription-workspace" ? "workspace" : "organization";
+      const binding = provider.anthropic?.credentialBinding;
+      if (binding && provider.apiKey)
+        return [
+          provider.id,
+          {
+            scope,
+            token: provider.apiKey,
+            expectedConnectionId: binding.connectionId,
+            expectedCredentialVersion: binding.credentialVersion
+          }
+        ];
+      const credential = await readCredential(scope).catch(() => null);
+      if (!credential || credential.token !== provider.apiKey) return null;
+      return [
+        provider.id,
+        {
+          scope,
+          token: credential.token,
+          expectedConnectionId: credential.connectionId,
+          expectedCredentialVersion: credential.credentialVersion
+        }
+      ];
+    })
+  );
+  const captured = new Map(bindings.filter((binding) => binding !== null));
+  const observeBinding = (binding, response, upstreamModelId, requestToken) => {
+    if (requestToken === null) return;
+    if (!binding) return;
+    const { scope, ...capturedIdentity } = binding;
+    const identity = { ...capturedIdentity, token: requestToken ?? capturedIdentity.token };
+    const tokenKey = createHash4("sha256").update(identity.token).digest("hex");
+    const captureKey = `${scope}:${identity.expectedConnectionId}:${identity.expectedCredentialVersion}:${tokenKey}`;
+    const previous = latest.get(captureKey);
+    let observation = parseClaudeUsageHeaders(response.headers, /* @__PURE__ */ new Date(), upstreamModelId);
+    if (observation && previous?.observation) {
+      const merged = mergeClaudeUsage(
+        mergeClaudeUsage(emptyClaudeUsage(binding.expectedCredentialVersion), previous.observation),
+        observation
+      );
+      observation = {
+        windows: merged.windows,
+        observedAt: merged.observedAt,
+        source: merged.source,
+        requestStatus: merged.requestStatus ?? null,
+        requestRestrictions: merged.requestRestrictions ?? []
+      };
+    }
+    if (observation || response.status === 401)
+      latest.set(captureKey, {
+        scope,
+        ...identity,
+        ...previous?.observation && !observation ? { observation: previous.observation } : {},
+        ...observation ? { observation } : {},
+        ...response.status === 401 ? { refresh: { status: "reconnect", checkedAt: (/* @__PURE__ */ new Date()).toISOString() } } : {}
+      });
+  };
+  const observe = (providerId, response, upstreamModelId, requestToken) => observeBinding(captured.get(providerId), response, upstreamModelId, requestToken);
+  const prepareRequestWithObserver = async (providerId, headers, resolve) => {
+    if (!managedProviderIds.has(providerId)) return { headers, observe };
+    const binding = captured.get(providerId);
+    if (!binding) throw new ClaudeSubscriptionConnectionUnavailable();
+    const credential = await resolve({
+      scope: binding.scope,
+      expectedConnectionId: binding.expectedConnectionId,
+      expectedCredentialVersion: binding.expectedCredentialVersion
+    });
+    if (!credential || credential.connectionId !== binding.expectedConnectionId || credential.credentialVersion !== binding.expectedCredentialVersion)
+      throw new ClaudeSubscriptionConnectionUnavailable();
+    const dispatched = Object.freeze({ ...binding, token: credential.token });
+    captured.set(providerId, dispatched);
+    headers.set("authorization", `Bearer ${credential.token}`);
+    headers.delete("x-api-key");
+    return {
+      headers,
+      observe: (_providerId, response, upstreamModelId, requestToken) => observeBinding(dispatched, response, upstreamModelId, requestToken)
+    };
+  };
+  return Object.assign(observe, {
+    prepareRequestWithObserver,
+    async prepareRequest(...args) {
+      return (await prepareRequestWithObserver(...args)).headers;
+    },
+    binding(providerId) {
+      const binding = captured.get(providerId);
+      return binding ? { ...binding } : void 0;
+    },
+    renew(providerId, credential) {
+      const binding = captured.get(providerId);
+      if (binding && binding.expectedConnectionId === credential.connectionId && binding.expectedCredentialVersion === credential.credentialVersion)
+        captured.set(providerId, { ...binding, token: credential.token });
+    }
+  });
+}
+
 // src/activities/agent-turn/sandbox-provision.ts
 import {
   SandboxLeaseRecoveryBlockedError as SandboxLeaseRecoveryBlockedError2,
@@ -8954,6 +9132,7 @@ import {
 } from "@opengeni/db";
 import {
   ActiveBackendUnresolvableError as ActiveBackendUnresolvableError2,
+  AnthropicProviderRejection,
   CompactionProviderResponseError,
   EmptyCompactionSummaryError,
   compactionProviderRejection,
@@ -8962,6 +9141,7 @@ import {
   isMcpTransportConnectivityError,
   isModalTaskExecStartPreDispatchUnavailableError,
   isModalCommandStartOutcomeUnknownError,
+  isProviderCommandObservationUnavailableError,
   isRoutingMutationOutcomeUnknownError,
   RoutingWorkspaceRootChangedError,
   ResponsesStreamingTerminalError,
@@ -8971,7 +9151,8 @@ import {
   classifyProviderQuotaError,
   providerQuotaExhaustedMessage,
   SelfhostedWorkspaceRootChangedError,
-  UNKNOWN_MODEL_FINISH_REASON_CODE
+  UNKNOWN_MODEL_FINISH_REASON_CODE,
+  AnthropicRequestError
 } from "@opengeni/runtime";
 import {
   mcpTransportRequestFailureDiagnostic
@@ -8985,7 +9166,7 @@ import {
   FileResourceRef,
   resourceMountPath
 } from "@opengeni/contracts";
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import {
   getActiveSessionHistoryItemsPaged,
   getFilesForSubject,
@@ -9103,7 +9284,7 @@ async function modelAttachmentContentForFiles(files, readFileBytes, options = {}
           });
           continue;
         }
-        if (createHash4("sha256").update(bytes).digest("hex") !== checksum) {
+        if (createHash5("sha256").update(bytes).digest("hex") !== checksum) {
           console.error("model attachment checksum did not match finalized metadata", {
             fileId: file.id
           });
@@ -9772,7 +9953,9 @@ function retryableDatabaseFailureCode(error) {
 function postClaimDatabaseRecoveryFailure(input) {
   const code = retryableDatabaseFailureCode(input.error);
   if (!code || input.executionGeneration < 1) return null;
-  if (input.sandboxSetupOutcomeUnknown && input.providerRecovery) return null;
+  if (input.sandboxSetupOutcomeUnknown && input.sandboxSetupRecoveryExhausted || (input.sandboxSetupOutcomeUnknown || input.sandboxSetupRecoveryExhausted) && input.providerRecovery) {
+    return null;
+  }
   if (input.providerRecovery && (!Number.isSafeInteger(input.providerRecovery.providerRecoveryCount) || input.providerRecovery.providerRecoveryCount <= 0 || input.providerRecovery.providerRecoveryCount > MAX_AUTOMATIC_PROVIDER_RECOVERIES || !/^[a-z][a-z0-9_]{0,63}$/.test(input.providerRecovery.failureCode))) {
     return null;
   }
@@ -9782,6 +9965,7 @@ function postClaimDatabaseRecoveryFailure(input) {
     executionGeneration: input.executionGeneration,
     code,
     ...input.sandboxSetupOutcomeUnknown ? { sandboxSetupOutcomeUnknown: true } : {},
+    ...input.sandboxSetupRecoveryExhausted ? { sandboxSetupRecoveryExhausted: true } : {},
     ...input.providerRecovery ? {
       providerFailureCode: input.providerRecovery.failureCode,
       providerRecoveryCount: input.providerRecovery.providerRecoveryCount
@@ -10101,11 +10285,31 @@ function findPostgresDriverError(error) {
 function isRawDatabaseQueryError(error) {
   return error instanceof Error && "query" in error && typeof error.query === "string" && "params" in error && Array.isArray(error.params);
 }
+function anthropicRequestDiagnostic(error) {
+  if (error instanceof AnthropicRequestError) return error;
+  return error instanceof Error && error.cause instanceof AnthropicRequestError ? error.cause : void 0;
+}
 function agentRunFailurePayload(error, options = {}) {
   const failure = baseAgentRunFailurePayload(error, options);
   const diagnostic = materializationVerificationDiagnostic(error);
+  const anthropic = anthropicRequestDiagnostic(error);
+  if (anthropic) {
+    return {
+      ...failure,
+      code: failure.code ?? anthropic.code,
+      retryable: failure.retryable ?? false,
+      ...anthropic.detail ? { detail: anthropic.detail } : {},
+      ...anthropic.request_id ? { requestId: anthropic.request_id } : {}
+    };
+  }
   return diagnostic ? { ...failure, materializationDiagnostic: diagnostic } : failure;
 }
+function agentRunRecoveryFailurePayload(error, failure) {
+  if (!anthropicRequestDiagnostic(error)) return failure;
+  const recovery = { ...failure };
+  delete recovery.detail;
+  return recovery;
+}
 function baseAgentRunFailurePayload(error, options = {}) {
   if (error instanceof SandboxMaterializationVerificationError) {
     return {
@@ -10140,6 +10344,17 @@ function baseAgentRunFailurePayload(error, options = {}) {
       ...Object.keys(database).length > 0 ? { database } : {}
     };
   }
+  if (error instanceof ClaudeSubscriptionConnectionUnavailable) {
+    return { error: error.message, code: error.code, retryable: false };
+  }
+  if (error instanceof AnthropicProviderRejection) {
+    return {
+      error: error.message,
+      code: error.code === "content_policy_violation" ? "provider_safety_refusal" : error.code,
+      retryable: false,
+      ...error.request_id ? { requestId: error.request_id } : {}
+    };
+  }
   const safetyRefusalDiagnostic = providerSafetyRefusalDiagnostic(error);
   if (safetyRefusalDiagnostic !== void 0) {
     return {
@@ -10199,6 +10414,13 @@ function baseAgentRunFailurePayload(error, options = {}) {
       retryable: true
     };
   }
+  if (isProviderCommandObservationUnavailableError(error)) {
+    return {
+      error: "A managed sandbox command cannot be observed. Its exact invocation and writer remain retained; setup is blocked without replay until the incomplete operation can be reconciled.",
+      code: "sandbox_command_observation_unavailable",
+      retryable: false
+    };
+  }
   if (isModalCommandStartOutcomeUnknownError(error)) {
     return {
       error: "A managed sandbox command has an unknown outcome. Its original invocation remains fenced; setup is blocked without replay until the incomplete operation can be reconciled.",
@@ -10483,6 +10705,7 @@ export {
   startActivityHeartbeat,
   nextStreamEvent,
   warnDrainSnapshotFailure,
+  publishDurableSessionEvents2 as publishDurableSessionEvents,
   persistWorkspaceArchiveCandidate,
   putVersion1TarArchiveOrInline,
   sandboxLeaseHolderIdForAttempt,
@@ -10513,6 +10736,7 @@ export {
   resolveIncidentTelemetryResponderMetadata,
   validateIncidentTelemetrySystemUpdateAuthority,
   checkpointHistoryBeforeProviderDispatch,
+  createClaudeUsageObserver,
   projectRejectedProviderArtifacts,
   createModelHistoryAttachmentProjector,
   turnInput,
@@ -10570,9 +10794,10 @@ export {
   classifyContextWindowOverflowError,
   classifyXaiCredentialFailure,
   agentRunFailurePayload,
+  agentRunRecoveryFailurePayload,
   codexCredentialCooldownUntil,
   classifyCodexCredentialFailure,
   codexUsageLimitFailurePayload,
   CODEX_USAGE_LIMIT_MAX_RESUME_MS
 };
-//# sourceMappingURL=chunk-3K3ULWEE.js.map
+//# sourceMappingURL=chunk-PA7Z55P4.js.map