@opengeni/worker-bundle 3.2.2 → 3.3.1-canary.38922642121001

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/worker-bundle",
-  "version": "3.2.2",
+  "version": "3.3.1-canary.38922642121001",
   "description": "Opengeni worker entry and reusable embedded lifecycle, shipped with a release-coherent pre-bundled Temporal workflow artifact.",
   "license": "Apache-2.0",
   "repository": {
@@ -56,31 +56,31 @@
     "@1password/sdk": "0.5.0",
     "@keeper-security/secrets-manager-core": "17.6.0",
     "@llamaindex/liteparse": "2.14.2",
-    "@opengeni/agent-proto": "3.2.2",
-    "@opengeni/capabilities": "3.2.2",
-    "@opengeni/codemode": "3.2.2",
-    "@opengeni/codex": "3.2.2",
-    "@opengeni/config": "3.2.2",
-    "@opengeni/contracts": "3.2.2",
-    "@opengeni/core": "3.2.2",
-    "@opengeni/db": "3.2.2",
-    "@opengeni/documents": "3.2.2",
-    "@opengeni/events": "3.2.2",
-    "@opengeni/github": "3.2.2",
-    "@opengeni/interaction": "3.2.2",
-    "@opengeni/jev": "3.2.2",
-    "@opengeni/network": "3.2.2",
-    "@opengeni/observability": "3.2.2",
-    "@opengeni/runtime": "3.2.2",
-    "@opengeni/sdk": "3.2.2",
-    "@opengeni/storage": "3.2.2",
-    "@opengeni/subscriptions": "3.2.2",
-    "@opengeni/tool-gateway": "3.2.2",
-    "@opengeni/vaults": "3.2.2",
-    "@opengeni/vaults-keeper": "3.2.2",
-    "@opengeni/vaults-onepassword": "3.2.2",
-    "@opengeni/vaults-protonpass": "3.2.2",
-    "@opengeni/xai-subscription": "3.2.2",
+    "@opengeni/agent-proto": "3.3.1-canary.38922642121001",
+    "@opengeni/capabilities": "3.3.1-canary.38922642121001",
+    "@opengeni/codemode": "3.3.1-canary.38922642121001",
+    "@opengeni/codex": "3.3.1-canary.38922642121001",
+    "@opengeni/config": "3.3.1-canary.38922642121001",
+    "@opengeni/contracts": "3.3.1-canary.38922642121001",
+    "@opengeni/core": "3.3.1-canary.38922642121001",
+    "@opengeni/db": "3.3.1-canary.38922642121001",
+    "@opengeni/documents": "3.3.1-canary.38922642121001",
+    "@opengeni/events": "3.3.1-canary.38922642121001",
+    "@opengeni/github": "3.3.1-canary.38922642121001",
+    "@opengeni/interaction": "3.3.1-canary.38922642121001",
+    "@opengeni/jev": "3.3.1-canary.38922642121001",
+    "@opengeni/network": "3.3.1-canary.38922642121001",
+    "@opengeni/observability": "3.3.1-canary.38922642121001",
+    "@opengeni/runtime": "3.3.1-canary.38922642121001",
+    "@opengeni/sdk": "3.3.1-canary.38922642121001",
+    "@opengeni/storage": "3.3.1-canary.38922642121001",
+    "@opengeni/subscriptions": "3.3.1-canary.38922642121001",
+    "@opengeni/tool-gateway": "3.3.1-canary.38922642121001",
+    "@opengeni/vaults": "3.3.1-canary.38922642121001",
+    "@opengeni/vaults-keeper": "3.3.1-canary.38922642121001",
+    "@opengeni/vaults-onepassword": "3.3.1-canary.38922642121001",
+    "@opengeni/vaults-protonpass": "3.3.1-canary.38922642121001",
+    "@opengeni/xai-subscription": "3.3.1-canary.38922642121001",
     "@temporalio/activity": "^1.17.0",
     "@temporalio/client": "^1.17.0",
     "@temporalio/worker": "^1.17.0",

package/src/activities/agent-turn/sandbox-establish.ts

@@ -542,6 +542,8 @@ export async function establishTurnSandbox(deps: EstablishTurnSandboxDeps): Prom
               liveMachineEnrollment?.agentCapabilities.operationCpuQuota === true,
             transactionalFsWriteSupported:
               liveMachineEnrollment?.agentCapabilities.transactionalFsWrite === true,
+            browserControlHttpSupported:
+              liveMachineEnrollment?.agentCapabilities.browserControlHttp === true,
             // Carried for shared machines too: the audience can narrow to Only me
             // mid-turn, and each operation then rechecks this authority.
             ...(fileAuthoritySubjectId

package/src/internal-maintenance.ts

@@ -10,11 +10,13 @@ import {
   automaticSessionTitleFanoutDue,
   browserDeadlineCheckpointDue,
   knowledgeIndexDue,
+  maintainSubscriptionPlans,
   sandboxIdleCheckpointDue,
   sandboxLeaseReaperDue,
   sandboxMaintenanceDue,
   sessionWorkflowWakesDue,
   siteAuthMaintenanceDue,
+  subscriptionPlanMaintenanceDue,
   workspacePauseTimerDue,
   type Database,
 } from "@opengeni/db";
@@ -53,6 +55,8 @@ export const SITE_AUTH_MAINTENANCE_WORKFLOW_ID = "opengeni-site-auth-maintenance
 export const SITE_AUTH_MAINTENANCE_PERIOD_MS = 60 * 1_000;
 /** The Schedule earlier releases used to drive the sandbox lease reaper. */
 export const SANDBOX_REAPER_SCHEDULE_ID = "opengeni-sandbox-lease-reaper";
+/** Small bounded DB-only pass; no Temporal execution for plan maintenance. */
+export const SUBSCRIPTION_PLAN_MAINTENANCE_PERIOD_MS = 60_000;
 
 export const INTERNAL_MAINTENANCE_JOBS = [
   "session-workflow-wake-dispatcher",
@@ -61,6 +65,7 @@ export const INTERNAL_MAINTENANCE_JOBS = [
   "sandbox-lease-reaper",
   "sandbox-idle-checkpoint",
   "browser-deadline-checkpoint",
+  "subscription-plan-maintenance",
 ] as const;
 export type InternalMaintenanceJob = (typeof INTERNAL_MAINTENANCE_JOBS)[number];
 
@@ -139,6 +144,25 @@ export async function internalMaintenanceCadences(input: {
   const jobs = new Set(input.jobs ?? INTERNAL_MAINTENANCE_JOBS);
   const taskQueue = settings.temporalTaskQueue;
   const cadences: MaintenanceCadence[] = [];
+  if (settings.subscriptionPlansEnabled && jobs.has("subscription-plan-maintenance")) {
+    cadences.push({
+      job: "subscription-plan-maintenance",
+      periodMs: SUBSCRIPTION_PLAN_MAINTENANCE_PERIOD_MS,
+      hasWork: async () => await subscriptionPlanMaintenanceDue(db),
+      start: async () => {
+        const result = await maintainSubscriptionPlans(db, {
+          onError: (error, accountId) =>
+            observability.warn("Subscription plan maintenance account failed", {
+              accountId,
+              error: error instanceof Error ? error.message : String(error),
+            }),
+        });
+        if (result.failedAccounts > 0)
+          throw new Error(`${result.failedAccounts} subscription plan maintenance accounts failed`);
+        return "started";
+      },
+    });
+  }
   if (jobs.has("session-workflow-wake-dispatcher")) {
     const { repairMissedSessionWorkflowWakes } = await import("./activities/parent-wake");
     cadences.push({

package/src/sandbox-routing.ts

@@ -1542,6 +1542,7 @@ export type SelfhostedTurnSessionArgs = {
   operationCpuQuotaSupported: boolean;
   /** Feature advertisement only; refreshed by exact live admission for each operation. */
   transactionalFsWriteSupported?: boolean;
+  browserControlHttpSupported?: boolean;
   /** The active pointer's epoch — the control-op fence echoed to the agent. */
   epoch: number;
   /** The run's declared sandbox environment (the SAME object fed to buildAgent +
@@ -1618,6 +1619,7 @@ export function connectionBindingFor(
     operationResourcePolicySupported: enrollment.agentCapabilities.operationResourcePolicy === true,
     operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
     transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
+    browserControlHttpSupported: enrollment.agentCapabilities.browserControlHttp === true,
   };
 }
 
@@ -1693,6 +1695,7 @@ export async function establishSelfhostedTurnSession(
     operationResourcePolicySupported: args.operationResourcePolicySupported,
     operationCpuQuotaSupported: args.operationCpuQuotaSupported,
     transactionalFsWriteSupported: args.transactionalFsWriteSupported === true,
+    browserControlHttpSupported: args.browserControlHttpSupported === true,
     resolveOperationAdmission: async () => {
       // The machine's audience can change in place during a turn. Read the
       // current scope on every admitted operation: a machine that is Only me now