@opengeni/worker-bundle 3.2.2 → 3.3.0

package/dist/{chunk-436TOEBL.js → chunk-R5BHILMQ.js}

@@ -5,7 +5,7 @@ import {
   SandboxProvisionStageError,
   SandboxWarmingTimeoutError,
   sandboxProvisionFailureStage
-} from "./chunk-NQDVJ6RI.js";
+} from "./chunk-5DF4V5RD.js";
 import {
   observabilityEventBusOptions
 } from "./chunk-5NNS4327.js";
@@ -8598,4 +8598,4 @@ export {
   codexUsageLimitFailurePayload,
   classifyClaudeProviderError
 };
-//# sourceMappingURL=chunk-436TOEBL.js.map
+//# sourceMappingURL=chunk-R5BHILMQ.js.map

package/dist/{chunk-O7HT4LHX.js → chunk-RSI63RZG.js}

@@ -5,7 +5,7 @@ import {
   publishDurableSessionEvents,
   putVersion1TarArchiveOrInline,
   warnDrainSnapshotFailure
-} from "./chunk-NQDVJ6RI.js";
+} from "./chunk-5DF4V5RD.js";
 import {
   CONTROL_WORKER_MAX_CONCURRENT_ACTIVITIES,
   SANDBOX_REAPER_ACTIVITY_HEARTBEAT_INTERVAL_MS,
@@ -3746,4 +3746,4 @@ export {
   terminateProviderBox,
   sandboxLeaseTelemetryKey2 as sandboxLeaseTelemetryKey
 };
-//# sourceMappingURL=chunk-O7HT4LHX.js.map
+//# sourceMappingURL=chunk-RSI63RZG.js.map

package/dist/index.js

@@ -797,7 +797,7 @@ async function internalMaintenanceCadences(input) {
     assertSandboxReaperActivityTimeout(settings);
     const periodMs = settings.sandboxLeaseReaperPeriodMs;
     const lifecycleQueue = sandboxLifecycleTaskQueue(taskQueue);
-    const sandbox = await import("./sandbox-lease-F47EDHHY.js");
+    const sandbox = await import("./sandbox-lease-2IV3DNXR.js");
     if (jobs.has("sandbox-lease-reaper")) {
       const { SANDBOX_CHECKPOINT_GC_CLAIM_TTL_MS } = sandbox;
       cadences.push({
@@ -1437,7 +1437,7 @@ async function createDefaultWorkerActivities(role, dependencies = {}) {
   if (dependencies.objectStorage == null) {
     prepareObjectStorageProvider(dependencies.settings ?? getSettings());
   }
-  return role === "control" ? (await import("./activities-control-LC7WXEIX.js")).createControlActivities(dependencies) : (await import("./activities-turn-PEDPUZI4.js")).createTurnActivities(dependencies);
+  return role === "control" ? (await import("./activities-control-G2W4FEFP.js")).createControlActivities(dependencies) : (await import("./activities-turn-CE2VIWIS.js")).createTurnActivities(dependencies);
 }
 function resolveOpenGeniWorkflowDefinition(moduleUrl = import.meta.url) {
   const modulePath = fileURLToPath(moduleUrl).replaceAll("\\", "/");

package/dist/{sandbox-lease-F47EDHHY.js → sandbox-lease-2IV3DNXR.js}

@@ -36,8 +36,8 @@ import {
   sandboxLeaseTelemetryKey,
   terminateProviderBox,
   verifyDockerDrainCaptureFence
-} from "./chunk-O7HT4LHX.js";
-import "./chunk-NQDVJ6RI.js";
+} from "./chunk-RSI63RZG.js";
+import "./chunk-5DF4V5RD.js";
 import "./chunk-24GP3BX5.js";
 import "./chunk-5NNS4327.js";
 import "./chunk-W2QSM5HR.js";
@@ -81,4 +81,4 @@ export {
   terminateProviderBox,
   verifyDockerDrainCaptureFence
 };
-//# sourceMappingURL=sandbox-lease-F47EDHHY.js.map
+//# sourceMappingURL=sandbox-lease-2IV3DNXR.js.map

package/dist/sandbox-routing.d.ts

@@ -183,6 +183,7 @@ export type SelfhostedTurnSessionArgs = {
     operationCpuQuotaSupported: boolean;
     /** Feature advertisement only; refreshed by exact live admission for each operation. */
     transactionalFsWriteSupported?: boolean;
+    browserControlHttpSupported?: boolean;
     /** The active pointer's epoch — the control-op fence echoed to the agent. */
     epoch: number;
     /** The run's declared sandbox environment (the SAME object fed to buildAgent +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/worker-bundle",
-  "version": "3.2.2",
+  "version": "3.3.0",
   "description": "Opengeni worker entry and reusable embedded lifecycle, shipped with a release-coherent pre-bundled Temporal workflow artifact.",
   "license": "Apache-2.0",
   "repository": {
@@ -56,31 +56,31 @@
     "@1password/sdk": "0.5.0",
     "@keeper-security/secrets-manager-core": "17.6.0",
     "@llamaindex/liteparse": "2.14.2",
-    "@opengeni/agent-proto": "3.2.2",
-    "@opengeni/capabilities": "3.2.2",
-    "@opengeni/codemode": "3.2.2",
-    "@opengeni/codex": "3.2.2",
-    "@opengeni/config": "3.2.2",
-    "@opengeni/contracts": "3.2.2",
-    "@opengeni/core": "3.2.2",
-    "@opengeni/db": "3.2.2",
-    "@opengeni/documents": "3.2.2",
-    "@opengeni/events": "3.2.2",
-    "@opengeni/github": "3.2.2",
-    "@opengeni/interaction": "3.2.2",
-    "@opengeni/jev": "3.2.2",
-    "@opengeni/network": "3.2.2",
-    "@opengeni/observability": "3.2.2",
-    "@opengeni/runtime": "3.2.2",
-    "@opengeni/sdk": "3.2.2",
-    "@opengeni/storage": "3.2.2",
-    "@opengeni/subscriptions": "3.2.2",
-    "@opengeni/tool-gateway": "3.2.2",
-    "@opengeni/vaults": "3.2.2",
-    "@opengeni/vaults-keeper": "3.2.2",
-    "@opengeni/vaults-onepassword": "3.2.2",
-    "@opengeni/vaults-protonpass": "3.2.2",
-    "@opengeni/xai-subscription": "3.2.2",
+    "@opengeni/agent-proto": "3.3.0",
+    "@opengeni/capabilities": "3.3.0",
+    "@opengeni/codemode": "3.3.0",
+    "@opengeni/codex": "3.3.0",
+    "@opengeni/config": "3.3.0",
+    "@opengeni/contracts": "3.3.0",
+    "@opengeni/core": "3.3.0",
+    "@opengeni/db": "3.3.0",
+    "@opengeni/documents": "3.3.0",
+    "@opengeni/events": "3.3.0",
+    "@opengeni/github": "3.3.0",
+    "@opengeni/interaction": "3.3.0",
+    "@opengeni/jev": "3.3.0",
+    "@opengeni/network": "3.3.0",
+    "@opengeni/observability": "3.3.0",
+    "@opengeni/runtime": "3.3.0",
+    "@opengeni/sdk": "3.3.0",
+    "@opengeni/storage": "3.3.0",
+    "@opengeni/subscriptions": "3.3.0",
+    "@opengeni/tool-gateway": "3.3.0",
+    "@opengeni/vaults": "3.3.0",
+    "@opengeni/vaults-keeper": "3.3.0",
+    "@opengeni/vaults-onepassword": "3.3.0",
+    "@opengeni/vaults-protonpass": "3.3.0",
+    "@opengeni/xai-subscription": "3.3.0",
     "@temporalio/activity": "^1.17.0",
     "@temporalio/client": "^1.17.0",
     "@temporalio/worker": "^1.17.0",

package/src/activities/agent-turn/sandbox-establish.ts

@@ -542,6 +542,8 @@ export async function establishTurnSandbox(deps: EstablishTurnSandboxDeps): Prom
               liveMachineEnrollment?.agentCapabilities.operationCpuQuota === true,
             transactionalFsWriteSupported:
               liveMachineEnrollment?.agentCapabilities.transactionalFsWrite === true,
+            browserControlHttpSupported:
+              liveMachineEnrollment?.agentCapabilities.browserControlHttp === true,
             // Carried for shared machines too: the audience can narrow to Only me
             // mid-turn, and each operation then rechecks this authority.
             ...(fileAuthoritySubjectId

package/src/sandbox-routing.ts

@@ -1542,6 +1542,7 @@ export type SelfhostedTurnSessionArgs = {
   operationCpuQuotaSupported: boolean;
   /** Feature advertisement only; refreshed by exact live admission for each operation. */
   transactionalFsWriteSupported?: boolean;
+  browserControlHttpSupported?: boolean;
   /** The active pointer's epoch — the control-op fence echoed to the agent. */
   epoch: number;
   /** The run's declared sandbox environment (the SAME object fed to buildAgent +
@@ -1618,6 +1619,7 @@ export function connectionBindingFor(
     operationResourcePolicySupported: enrollment.agentCapabilities.operationResourcePolicy === true,
     operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
     transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
+    browserControlHttpSupported: enrollment.agentCapabilities.browserControlHttp === true,
   };
 }
 
@@ -1693,6 +1695,7 @@ export async function establishSelfhostedTurnSession(
     operationResourcePolicySupported: args.operationResourcePolicySupported,
     operationCpuQuotaSupported: args.operationCpuQuotaSupported,
     transactionalFsWriteSupported: args.transactionalFsWriteSupported === true,
+    browserControlHttpSupported: args.browserControlHttpSupported === true,
     resolveOperationAdmission: async () => {
       // The machine's audience can change in place during a turn. Read the
       // current scope on every admitted operation: a machine that is Only me now