@opengeni/worker-bundle 3.1.3-canary.38890816741001 → 3.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/worker-bundle",
-  "version": "3.1.3-canary.38890816741001",
+  "version": "3.3.0",
   "description": "Opengeni worker entry and reusable embedded lifecycle, shipped with a release-coherent pre-bundled Temporal workflow artifact.",
   "license": "Apache-2.0",
   "repository": {
@@ -54,30 +54,33 @@
   },
   "dependencies": {
     "@1password/sdk": "0.5.0",
+    "@keeper-security/secrets-manager-core": "17.6.0",
     "@llamaindex/liteparse": "2.14.2",
-    "@opengeni/agent-proto": "3.1.3-canary.38890816741001",
-    "@opengeni/capabilities": "3.1.3-canary.38890816741001",
-    "@opengeni/codemode": "3.1.3-canary.38890816741001",
-    "@opengeni/codex": "3.1.3-canary.38890816741001",
-    "@opengeni/config": "3.1.3-canary.38890816741001",
-    "@opengeni/contracts": "3.1.3-canary.38890816741001",
-    "@opengeni/core": "3.1.3-canary.38890816741001",
-    "@opengeni/db": "3.1.3-canary.38890816741001",
-    "@opengeni/documents": "3.1.3-canary.38890816741001",
-    "@opengeni/events": "3.1.3-canary.38890816741001",
-    "@opengeni/github": "3.1.3-canary.38890816741001",
-    "@opengeni/interaction": "3.1.3-canary.38890816741001",
-    "@opengeni/jev": "3.1.3-canary.38890816741001",
-    "@opengeni/network": "3.1.3-canary.38890816741001",
-    "@opengeni/observability": "3.1.3-canary.38890816741001",
-    "@opengeni/runtime": "3.1.3-canary.38890816741001",
-    "@opengeni/sdk": "3.1.3-canary.38890816741001",
-    "@opengeni/storage": "3.1.3-canary.38890816741001",
-    "@opengeni/subscriptions": "3.1.3-canary.38890816741001",
-    "@opengeni/tool-gateway": "3.1.3-canary.38890816741001",
-    "@opengeni/vaults": "3.1.3-canary.38890816741001",
-    "@opengeni/vaults-onepassword": "3.1.3-canary.38890816741001",
-    "@opengeni/xai-subscription": "3.1.3-canary.38890816741001",
+    "@opengeni/agent-proto": "3.3.0",
+    "@opengeni/capabilities": "3.3.0",
+    "@opengeni/codemode": "3.3.0",
+    "@opengeni/codex": "3.3.0",
+    "@opengeni/config": "3.3.0",
+    "@opengeni/contracts": "3.3.0",
+    "@opengeni/core": "3.3.0",
+    "@opengeni/db": "3.3.0",
+    "@opengeni/documents": "3.3.0",
+    "@opengeni/events": "3.3.0",
+    "@opengeni/github": "3.3.0",
+    "@opengeni/interaction": "3.3.0",
+    "@opengeni/jev": "3.3.0",
+    "@opengeni/network": "3.3.0",
+    "@opengeni/observability": "3.3.0",
+    "@opengeni/runtime": "3.3.0",
+    "@opengeni/sdk": "3.3.0",
+    "@opengeni/storage": "3.3.0",
+    "@opengeni/subscriptions": "3.3.0",
+    "@opengeni/tool-gateway": "3.3.0",
+    "@opengeni/vaults": "3.3.0",
+    "@opengeni/vaults-keeper": "3.3.0",
+    "@opengeni/vaults-onepassword": "3.3.0",
+    "@opengeni/vaults-protonpass": "3.3.0",
+    "@opengeni/xai-subscription": "3.3.0",
     "@temporalio/activity": "^1.17.0",
     "@temporalio/client": "^1.17.0",
     "@temporalio/worker": "^1.17.0",

package/src/activities/agent-turn/run.ts

@@ -1611,6 +1611,12 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             subjectId: turn.initiatingHumanSubjectId ?? credentialSubjectId ?? null,
             hostVaultProvider: connectionCredentials?.vaultProvider,
             onePasswordVaultProvider: resolvedServices.onePasswordVaultProvider,
+            externalVaultProviders: resolvedServices.externalVaultProviders ?? null,
+            executionContext: {
+              sessionId: input.sessionId,
+              turnId: turn.id,
+              attemptId: input.attemptId,
+            },
           });
           const toolRuntime = await prepareTurnToolRuntime({
             vaultAccess,

package/src/activities/agent-turn/sandbox-establish.ts

@@ -542,6 +542,8 @@ export async function establishTurnSandbox(deps: EstablishTurnSandboxDeps): Prom
               liveMachineEnrollment?.agentCapabilities.operationCpuQuota === true,
             transactionalFsWriteSupported:
               liveMachineEnrollment?.agentCapabilities.transactionalFsWrite === true,
+            browserControlHttpSupported:
+              liveMachineEnrollment?.agentCapabilities.browserControlHttp === true,
             // Carried for shared machines too: the audience can narrow to Only me
             // mid-turn, and each operation then rechecks this authority.
             ...(fileAuthoritySubjectId

package/src/activities/agent-turn/secret-resolver.ts

@@ -15,6 +15,7 @@ import {
   createSecretResolver,
   createWorkspaceVaultProviderRegistry,
   type OnePasswordVaultProviderFactory,
+  type ExternalVaultProviderFactories,
 } from "@opengeni/core";
 import { listVaultsForSubject, type Database } from "@opengeni/db";
 import {
@@ -22,6 +23,7 @@ import {
   type ProviderCallBudget,
   type VaultProvider,
   type VaultProviderRegistry,
+  type VaultProviderAuthority,
 } from "@opengeni/vaults";
 
 /**
@@ -49,6 +51,8 @@ export function createAttemptVaultAccess(input: {
   subjectId: string | null;
   hostVaultProvider: VaultProvider | null | undefined;
   onePasswordVaultProvider: OnePasswordVaultProviderFactory | null | undefined;
+  externalVaultProviders?: ExternalVaultProviderFactories | null;
+  executionContext?: Pick<VaultProviderAuthority, "sessionId" | "turnId" | "attemptId" | "siteId">;
 }): AttemptVaultAccess {
   return {
     providers: createWorkspaceVaultProviderRegistry({
@@ -58,6 +62,8 @@ export function createAttemptVaultAccess(input: {
       subjectId: input.subjectId,
       hostVaultProvider: input.hostVaultProvider ?? null,
       onePasswordVaultProvider: input.onePasswordVaultProvider ?? null,
+      externalVaultProviders: input.externalVaultProviders ?? null,
+      ...(input.executionContext ? { executionContext: input.executionContext } : {}),
     }),
     attemptBudget: createProviderCallBudget(VAULT_LIMITS.providerReadsPerAttempt),
   };

package/src/activities/sandbox-lease.ts

@@ -4105,6 +4105,9 @@ async function terminateDrainableBox(
         minIntervalMs: 0,
         pointInTimeCapture: providerWorkspaceCaptureIsPointInTime(backend, lease.resumeState),
         deadlineMandatoryCaptureLeadMs: sandboxDeadlineMandatoryCaptureLeadMs(settings),
+        // An unknown-outcome setup request of a closed attempt never settles
+        // on a live box; after the idle grace it no longer pins the drain.
+        abandonedSetupCaptureAfterMs: Math.max(settings.sandboxIdleGraceMs, 60_000),
         providerReplaySafe: capturePolicy?.takeover === "same_request",
         takeoverSafe: capturePolicy !== null && capturePolicy.takeover !== "exclusive",
       });

package/src/activities/types.ts

@@ -18,7 +18,10 @@ import type { Observability } from "@opengeni/observability";
 import type { OpenGeniRuntime } from "@opengeni/runtime";
 import type { ObjectStorage } from "@opengeni/storage";
 import type { VaultConnectionCredentialsPort } from "@opengeni/vaults";
-import type { OnePasswordVaultProviderFactory } from "@opengeni/core";
+import type {
+  ExternalVaultProviderFactories,
+  OnePasswordVaultProviderFactory,
+} from "@opengeni/core";
 
 // Signal (start-if-needed) a session's Temporal workflow so a queued turn it
 // cannot otherwise observe gets claimed. Used to wake a PARENT session's
@@ -141,6 +144,7 @@ export type SharedActivityServices = {
    * `@opengeni/vaults-onepassword`); null leaves 1Password vaults unavailable.
    */
   onePasswordVaultProvider?: OnePasswordVaultProviderFactory | null;
+  externalVaultProviders?: ExternalVaultProviderFactories | null;
   /** Standalone, default-off personal GitHub smart-HTTP broker consumer. */
   personalGitHubCredentials?: ConnectionCredentialsPort["gitCredentials"] | null;
 };

package/src/activity-services.ts

@@ -12,13 +12,14 @@ import {
 } from "@opengeni/db";
 import { createNatsEventBus } from "@opengeni/events";
 import { createObservability } from "@opengeni/observability";
-import { resolveCatalogSettings } from "@opengeni/core";
+import { createRemoteExternalVaultFactories, resolveCatalogSettings } from "@opengeni/core";
 import { createObjectStorage } from "@opengeni/storage";
 import type { ActivityDependencies, SharedActivityServices } from "./activities/types";
 import { observabilityEventBusOptions } from "./observability-metrics";
 import { buildPersonalGitHubGitCredentials } from "./personal-github-git-credentials";
 import { createStandaloneConnectionCredentialsPort } from "./pr-review-credentials";
 import { loadOnePasswordVaultProvider } from "./onepassword-vault-provider";
+import { createNativeExternalVaultFactories } from "./external-vault-providers";
 
 /**
  * Build the dependency graph common to both worker roles exactly once.
@@ -92,6 +93,13 @@ export function createSharedActivityServices(
           dependencies.onePasswordVaultProvider === undefined
             ? loadOnePasswordVaultProvider
             : dependencies.onePasswordVaultProvider,
+        externalVaultProviders:
+          dependencies.externalVaultProviders === undefined
+            ? {
+                ...createRemoteExternalVaultFactories(settings),
+                ...createNativeExternalVaultFactories(settings),
+              }
+            : dependencies.externalVaultProviders,
       };
     })();
     return await servicesPromise;

package/src/external-vault-providers.ts

@@ -0,0 +1,136 @@
+import type { Settings } from "@opengeni/config";
+import type {
+  ExternalVaultProviderFactories,
+  ExternalVaultProviderFactory,
+  StoredVaultProviderCredentials,
+} from "@opengeni/core";
+import { pinnedFetch, type PinnedFetchOptions } from "@opengeni/network";
+import { VaultProviderError } from "@opengeni/vaults";
+import type { KeeperRuntimeOptions } from "@opengeni/vaults-keeper";
+import type { ProtonPassProviderPool } from "@opengeni/vaults-protonpass";
+
+/** Test seams only; production passes nothing. */
+export type NativeExternalVaultOptions = {
+  keeper?: Pick<KeeperRuntimeOptions, "queryFunction" | "fetchFile" | "sdk">;
+  /** Applies when this call creates the pool for its CLI path. */
+  protonpass?: { stateRoot?: string; hostEnv?: Readonly<Record<string, string | undefined>> };
+};
+
+/**
+ * Native external vault adapters that run inside this server: Keeper Secrets
+ * Manager always, Proton Pass only when the operator installed `pass-cli`
+ * (`OPENGENI_PROTON_PASS_CLI_PATH`). Both packages load through `import()`
+ * on first use (packages/vaults-keeper/test/import-guard.test.ts). Keep this
+ * file identical to apps/api/src/integrations/external-vault-providers.ts.
+ */
+export function createNativeExternalVaultFactories(
+  settings: Settings,
+  options: NativeExternalVaultOptions = {},
+): ExternalVaultProviderFactories {
+  const factories: ExternalVaultProviderFactories = {
+    keeper: keeperFactory(settings, options.keeper ?? {}),
+  };
+  const cliPath = settings.protonPassCliPath;
+  if (cliPath) factories.protonpass = protonPassFactory(cliPath, options.protonpass ?? {});
+  return factories;
+}
+
+/** Logs out every pooled Proton Pass CLI session and wipes its state (graceful shutdown). */
+export async function closeNativeExternalVaultProviders(): Promise<void> {
+  const pools = [...protonPools.values()];
+  protonPools.clear();
+  await Promise.all(pools.map(async (pool) => (await pool.catch(() => null))?.close()));
+}
+
+function mismatch(): never {
+  throw new VaultProviderError(
+    "provider_unavailable",
+    "The configured adapter does not match this connection.",
+  );
+}
+
+/**
+ * The fetch every Keeper request and file download uses: DNS-pinned and
+ * policy-checked (no private or special-use targets). The adapter adds
+ * HTTPS-only, no redirects, deadlines, size bounds and the caller's abort.
+ */
+export function nativeKeeperFetch(
+  settings: Settings,
+  pinned: Pick<PinnedFetchOptions, "dnsLookup" | "fetchImpl" | "agentFactory"> = {},
+) {
+  return (input: string | URL, init: RequestInit) =>
+    pinnedFetch(input, init, settings, {
+      ...pinned,
+      label: "Keeper Secrets Manager",
+      requireHttpsOutsideLocalTest: true,
+    });
+}
+
+function keeperFactory(
+  settings: Settings,
+  seams: NonNullable<NativeExternalVaultOptions["keeper"]>,
+): ExternalVaultProviderFactory {
+  const fetch = nativeKeeperFetch(settings);
+  return async (input) => {
+    const credentials = input.credentials;
+    if (credentials.provider !== "keeper") mismatch();
+    const persist = input.persistCredentials;
+    const { openKeeperConnection } = await import("@opengeni/vaults-keeper");
+    const opened = await openKeeperConnection({
+      credentials:
+        "oneTimeToken" in credentials
+          ? {
+              oneTimeToken: credentials.oneTimeToken,
+              ...(credentials.hostname ? { hostname: credentials.hostname } : {}),
+            }
+          : { configuration: credentials.configuration },
+      // Without it openKeeperConnection refuses: a redeemed token or rotated
+      // key must never live only in memory.
+      ...(persist
+        ? {
+            persistConfiguration: (configuration: Record<string, string>) =>
+              persist({ provider: "keeper", configuration }),
+          }
+        : {}),
+      ...(input.operations ? { operations: input.operations } : {}),
+      // Cancels a pending bootstrap; a stored configuration opens without a request.
+      ...(input.signal ? { signal: input.signal } : {}),
+      fetch,
+      ...seams,
+    });
+    const stored: StoredVaultProviderCredentials = {
+      provider: "keeper",
+      configuration: opened.configuration,
+    };
+    return { provider: opened.provider, credentials: stored };
+  };
+}
+
+/** One pool per CLI path per process, so repeated factory creation never leaks sessions. */
+const protonPools = new Map<string, Promise<ProtonPassProviderPool>>();
+
+function protonPassFactory(
+  binaryPath: string,
+  seams: NonNullable<NativeExternalVaultOptions["protonpass"]>,
+): ExternalVaultProviderFactory {
+  return async (input) => {
+    const credentials = input.credentials;
+    if (credentials.provider !== "protonpass") mismatch();
+    let pool = protonPools.get(binaryPath);
+    if (!pool) {
+      pool = import("@opengeni/vaults-protonpass").then(({ createProtonPassProviderPool }) =>
+        createProtonPassProviderPool({ ...seams, binaryPath }),
+      );
+      protonPools.set(binaryPath, pool);
+      pool.catch(() => protonPools.delete(binaryPath));
+    }
+    // Sessions are scoped to the connection, so two connections never share
+    // CLI state even with the same token. Without a connection id (a setup
+    // probe) the provider gets an isolated session of its own.
+    const provider = (await pool).provider(credentials.token, {
+      ...(input.connectionId === undefined ? {} : { connectionId: input.connectionId }),
+      ...(input.operations ? { operations: input.operations } : {}),
+    });
+    return { provider, credentials: { provider: "protonpass", token: credentials.token } };
+  };
+}

package/src/index.ts

@@ -42,6 +42,7 @@ import { fileURLToPath } from "node:url";
 import type { createControlActivities } from "./activities-control";
 import type { createTurnActivities } from "./activities-turn";
 import type { ActivityDependencies } from "./activities/types";
+import { closeNativeExternalVaultProviders } from "./external-vault-providers";
 import type {
   InspectSessionAttemptActivity,
   SignalCodexCapacityWorkflow,
@@ -1129,7 +1130,12 @@ export async function startWorker() {
       },
     });
   } finally {
-    await Promise.allSettled([bus?.close(), readinessDbClient.close(), dbClient.close()]);
+    await Promise.allSettled([
+      closeNativeExternalVaultProviders(),
+      bus?.close(),
+      readinessDbClient.close(),
+      dbClient.close(),
+    ]);
     disposeUnhandledRejectionBoundary();
   }
 }

package/src/sandbox-routing.ts

@@ -1542,6 +1542,7 @@ export type SelfhostedTurnSessionArgs = {
   operationCpuQuotaSupported: boolean;
   /** Feature advertisement only; refreshed by exact live admission for each operation. */
   transactionalFsWriteSupported?: boolean;
+  browserControlHttpSupported?: boolean;
   /** The active pointer's epoch — the control-op fence echoed to the agent. */
   epoch: number;
   /** The run's declared sandbox environment (the SAME object fed to buildAgent +
@@ -1618,6 +1619,7 @@ export function connectionBindingFor(
     operationResourcePolicySupported: enrollment.agentCapabilities.operationResourcePolicy === true,
     operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
     transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
+    browserControlHttpSupported: enrollment.agentCapabilities.browserControlHttp === true,
   };
 }
 
@@ -1693,6 +1695,7 @@ export async function establishSelfhostedTurnSession(
     operationResourcePolicySupported: args.operationResourcePolicySupported,
     operationCpuQuotaSupported: args.operationCpuQuotaSupported,
     transactionalFsWriteSupported: args.transactionalFsWriteSupported === true,
+    browserControlHttpSupported: args.browserControlHttpSupported === true,
     resolveOperationAdmission: async () => {
       // The machine's audience can change in place during a turn. Read the
       // current scope on every admitted operation: a machine that is Only me now