@opengeni/worker-bundle 3.2.2 → 3.4.0

package/dist/internal-maintenance.d.ts

@@ -14,7 +14,9 @@ export declare const SITE_AUTH_MAINTENANCE_WORKFLOW_ID = "opengeni-site-auth-mai
 export declare const SITE_AUTH_MAINTENANCE_PERIOD_MS: number;
 /** The Schedule earlier releases used to drive the sandbox lease reaper. */
 export declare const SANDBOX_REAPER_SCHEDULE_ID = "opengeni-sandbox-lease-reaper";
-export declare const INTERNAL_MAINTENANCE_JOBS: readonly ["session-workflow-wake-dispatcher", "knowledge-indexing", "site-auth-maintenance", "sandbox-lease-reaper", "sandbox-idle-checkpoint", "browser-deadline-checkpoint"];
+/** Small bounded DB-only pass; no Temporal execution for plan maintenance. */
+export declare const SUBSCRIPTION_PLAN_MAINTENANCE_PERIOD_MS = 60000;
+export declare const INTERNAL_MAINTENANCE_JOBS: readonly ["session-workflow-wake-dispatcher", "knowledge-indexing", "site-auth-maintenance", "sandbox-lease-reaper", "sandbox-idle-checkpoint", "browser-deadline-checkpoint", "subscription-plan-maintenance"];
 export type InternalMaintenanceJob = (typeof INTERNAL_MAINTENANCE_JOBS)[number];
 type WorkflowStarter = Pick<TemporalClient["workflow"], "start" | "signalWithStart">;
 type ScheduleDeleter = {

package/dist/observability-metrics.d.ts

@@ -423,11 +423,25 @@ export declare function recordModelCreditsCharged(observability: Observability |
  * Provider ids come from the resolved provider registry; phase/outcome are closed
  * enums. This function never performs I/O outside the in-memory metrics registry.
  */
+/**
+ * How a model request reached its provider, where the provider has more than
+ * one transport (Codex: a new or reused Responses WebSocket, or HTTP). Empty
+ * for providers with a single transport.
+ */
+export type ModelRequestTransportLabel = "" | "websocket_new" | "websocket_reused" | "http";
+/** The bounded metric label for how a Codex request was carried. */
+export declare function codexRequestTransportLabel(transport: {
+    kind: "websocket";
+    connection: "new" | "reused";
+} | {
+    kind: "http";
+}): ModelRequestTransportLabel;
 export declare function recordModelRequestPhase(observability: Observability, input: {
     provider: string;
     phase: "headers" | "first_byte" | "terminal";
     outcome?: "completed" | "failed" | "timed_out";
     durationSeconds: number;
+    transport?: ModelRequestTransportLabel;
 }): void;
 export type TurnStartupPhase = "services_initialization" | "claim_catalog_read" | "claim_atomic" | "claim_session_read" | "claim_capability_settings" | "learning_policy_freeze" | "attachment_authority_projection" | "claim_and_policy" | "turn_start_settlement" | "credential_selection" | "runtime_preparation" | "session_mcp_settings" | "sandbox_establish" | "file_resolution" | "tool_context_preparation" | "tool_preparation" | "tool_server_construction" | "tool_required_connect" | "tool_optional_connect" | "tool_attempt_catalog_build" | "tool_attempt_catalog_persist" | "tool_workspace_gateway_catalog_build" | "post_tool_preparation" | "agent_construction" | "post_agent_preparation" | "file_materialization" | "history_preparation" | "history_system_update_load" | "history_current_attachment_resolution" | "history_durable_history_load" | "history_sandbox_envelope_load" | "history_canonical_projection" | "history_provider_projection" | "history_attachment_ref_projection" | "history_screenshot_materialization" | "history_model_attachment_projection" | "history_runtime_input_assembly" | "history_artifact_candidate_scan" | "history_generated_image_materialization" | "history_position_load" | "owned_sandbox_setup" | "runtime_stream_initialization" | "model_request_preparation" | "model_sdk_serialization" | "model_prepare_sandbox_agent_preparation" | "model_prepare_sandbox_agent_manifest_inventory" | "model_prepare_sandbox_session_manifest_inventory" | "model_prepare_sandbox_manifest_apply" | "model_prepare_sandbox_entry_materialization" | "model_prepare_sandbox_running_check" | "model_prepare_sandbox_start" | "model_prepare_sandbox_client_create" | "model_prepare_sandbox_client_resume" | "model_prepare_sandbox_client_delete" | "model_prepare_sandbox_client_state_serialize" | "model_prepare_sandbox_client_reuse_check" | "model_prepare_sandbox_workspace_mutation_admission" | "model_prepare_sandbox_workspace_mutation_provider" | "model_prepare_sandbox_workspace_mutation_settlement" | "model_prepare_sandbox_first_routed_resolution_other" | "model_prepare_sandbox_first_routed_mutation_admission" | "model_prepare_sandbox_first_routed_provider_operation" | "model_prepare_sandbox_first_routed_mutation_settlement" | "model_prepare_sandbox_first_routed_other" | "model_prepare_sandbox_snapshot_wait" | "model_prepare_runner_before_first_sandbox_operation" | "model_prepare_sdk_after_first_sandbox_operation" | "model_prepare_runner_before_mcp_tools" | "model_prepare_mcp_tools_snapshot" | "model_prepare_mcp_tools_before_input_filter" | "model_prepare_mcp_tools_before_repository_skill_discovery" | "model_prepare_repository_skill_discovery" | "model_prepare_repository_skill_discovery_before_input_filter" | "model_prepare_input_filter_base" | "model_prepare_input_filter_genesis" | "model_prepare_input_filter_host" | "model_prepare_input_filter_tool_output" | "model_prepare_input_filter_modality" | "model_prepare_input_filter_context" | "model_prepare_responses_input_conversion" | "model_prepare_responses_request_build" | "model_credential_resolution" | "model_wire_normalization" | "model_request_audit" | "stream_bootstrap";
 export type TurnStartupOutcome = "completed" | "failed";

package/dist/{sandbox-lease-F47EDHHY.js → sandbox-lease-XBZWILZ3.js}

@@ -36,10 +36,10 @@ import {
   sandboxLeaseTelemetryKey,
   terminateProviderBox,
   verifyDockerDrainCaptureFence
-} from "./chunk-O7HT4LHX.js";
-import "./chunk-NQDVJ6RI.js";
+} from "./chunk-PG66GHGH.js";
+import "./chunk-PFCSGZGA.js";
 import "./chunk-24GP3BX5.js";
-import "./chunk-5NNS4327.js";
+import "./chunk-BX3KRGDM.js";
 import "./chunk-W2QSM5HR.js";
 import "./chunk-PZ5AY32C.js";
 export {
@@ -81,4 +81,4 @@ export {
   terminateProviderBox,
   verifyDockerDrainCaptureFence
 };
-//# sourceMappingURL=sandbox-lease-F47EDHHY.js.map
+//# sourceMappingURL=sandbox-lease-XBZWILZ3.js.map

package/dist/sandbox-routing.d.ts

@@ -183,6 +183,7 @@ export type SelfhostedTurnSessionArgs = {
     operationCpuQuotaSupported: boolean;
     /** Feature advertisement only; refreshed by exact live admission for each operation. */
     transactionalFsWriteSupported?: boolean;
+    browserControlHttpSupported?: boolean;
     /** The active pointer's epoch — the control-op fence echoed to the agent. */
     epoch: number;
     /** The run's declared sandbox environment (the SAME object fed to buildAgent +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/worker-bundle",
-  "version": "3.2.2",
+  "version": "3.4.0",
   "description": "Opengeni worker entry and reusable embedded lifecycle, shipped with a release-coherent pre-bundled Temporal workflow artifact.",
   "license": "Apache-2.0",
   "repository": {
@@ -56,31 +56,31 @@
     "@1password/sdk": "0.5.0",
     "@keeper-security/secrets-manager-core": "17.6.0",
     "@llamaindex/liteparse": "2.14.2",
-    "@opengeni/agent-proto": "3.2.2",
-    "@opengeni/capabilities": "3.2.2",
-    "@opengeni/codemode": "3.2.2",
-    "@opengeni/codex": "3.2.2",
-    "@opengeni/config": "3.2.2",
-    "@opengeni/contracts": "3.2.2",
-    "@opengeni/core": "3.2.2",
-    "@opengeni/db": "3.2.2",
-    "@opengeni/documents": "3.2.2",
-    "@opengeni/events": "3.2.2",
-    "@opengeni/github": "3.2.2",
-    "@opengeni/interaction": "3.2.2",
-    "@opengeni/jev": "3.2.2",
-    "@opengeni/network": "3.2.2",
-    "@opengeni/observability": "3.2.2",
-    "@opengeni/runtime": "3.2.2",
-    "@opengeni/sdk": "3.2.2",
-    "@opengeni/storage": "3.2.2",
-    "@opengeni/subscriptions": "3.2.2",
-    "@opengeni/tool-gateway": "3.2.2",
-    "@opengeni/vaults": "3.2.2",
-    "@opengeni/vaults-keeper": "3.2.2",
-    "@opengeni/vaults-onepassword": "3.2.2",
-    "@opengeni/vaults-protonpass": "3.2.2",
-    "@opengeni/xai-subscription": "3.2.2",
+    "@opengeni/agent-proto": "3.4.0",
+    "@opengeni/capabilities": "3.4.0",
+    "@opengeni/codemode": "3.4.0",
+    "@opengeni/codex": "3.4.0",
+    "@opengeni/config": "3.4.0",
+    "@opengeni/contracts": "3.4.0",
+    "@opengeni/core": "3.4.0",
+    "@opengeni/db": "3.4.0",
+    "@opengeni/documents": "3.4.0",
+    "@opengeni/events": "3.4.0",
+    "@opengeni/github": "3.4.0",
+    "@opengeni/interaction": "3.4.0",
+    "@opengeni/jev": "3.4.0",
+    "@opengeni/network": "3.4.0",
+    "@opengeni/observability": "3.4.0",
+    "@opengeni/runtime": "3.4.0",
+    "@opengeni/sdk": "3.4.0",
+    "@opengeni/storage": "3.4.0",
+    "@opengeni/subscriptions": "3.4.0",
+    "@opengeni/tool-gateway": "3.4.0",
+    "@opengeni/vaults": "3.4.0",
+    "@opengeni/vaults-keeper": "3.4.0",
+    "@opengeni/vaults-onepassword": "3.4.0",
+    "@opengeni/vaults-protonpass": "3.4.0",
+    "@opengeni/xai-subscription": "3.4.0",
     "@temporalio/activity": "^1.17.0",
     "@temporalio/client": "^1.17.0",
     "@temporalio/worker": "^1.17.0",

package/src/activities/agent-turn/run.ts

@@ -61,9 +61,11 @@ import type {
   RunAgentTurnResult,
 } from "../types";
 import {
+  codexRequestTransportLabel,
   makeMachineOpObserver,
   modelRequestLifecycleMetricsFor,
   recordModelRequestPhase,
+  type ModelRequestTransportLabel,
   recordCompanyBrainContributions,
   recordTurnStartupPhase,
   measureTurnStartupPhase,
@@ -805,6 +807,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
                     resolvedToken = token;
                     return token;
                   };
+                  const codexRequestTransports = new Map<string, ModelRequestTransportLabel>();
                   const creditGuard = createCodexCreditGuard({
                     ...(coreUsageReader ? { fetchUsage: coreUsageReader } : {}),
                     canSpendCredits: async () => {
@@ -924,8 +927,20 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
                               ? "terminal"
                               : null;
                       if (!phase) return;
+                      // The transport is known once headers arrive; later
+                      // phases of the same request carry the same label.
+                      const transportKey = `${event.requestId}:${event.transportAttempt}`;
+                      if (event.transport) {
+                        codexRequestTransports.set(
+                          transportKey,
+                          codexRequestTransportLabel(event.transport),
+                        );
+                      }
+                      const transport = codexRequestTransports.get(transportKey);
+                      if (phase === "terminal") codexRequestTransports.delete(transportKey);
                       recordModelRequestPhase(observability, {
                         provider: "codex-subscription",
+                        ...(transport ? { transport } : {}),
                         phase,
                         ...(event.phase === "completed"
                           ? { outcome: "completed" as const }

package/src/activities/agent-turn/sandbox-establish.ts

@@ -542,6 +542,8 @@ export async function establishTurnSandbox(deps: EstablishTurnSandboxDeps): Prom
               liveMachineEnrollment?.agentCapabilities.operationCpuQuota === true,
             transactionalFsWriteSupported:
               liveMachineEnrollment?.agentCapabilities.transactionalFsWrite === true,
+            browserControlHttpSupported:
+              liveMachineEnrollment?.agentCapabilities.browserControlHttp === true,
             // Carried for shared machines too: the audience can narrow to Only me
             // mid-turn, and each operation then rechecks this authority.
             ...(fileAuthoritySubjectId

package/src/activity-services.ts

@@ -45,6 +45,9 @@ export function createSharedActivityServices(
         : createDb(settings.databaseUrl, {
             ...(searchPath ? { searchPath } : {}),
             rlsStrategy: settings.rlsStrategy,
+            ...(settings.databasePreparedStatements === undefined
+              ? {}
+              : { preparedStatements: settings.databasePreparedStatements }),
           });
       const controlPlaneAuth = resolveNatsControlPlaneAuth(settings);
       const db = dependencies.db ?? dbClient!.db;

package/src/editable-artifact-materializer-service.ts

@@ -162,6 +162,9 @@ export async function createProductionEditableArtifactMaterializerService(
   const dbClient = createDb(options.databaseUrl, {
     ...(searchPath ? { searchPath } : {}),
     ...(options.settings.rlsStrategy ? { rlsStrategy: options.settings.rlsStrategy } : {}),
+    ...(options.settings.databasePreparedStatements === undefined
+      ? {}
+      : { preparedStatements: options.settings.databasePreparedStatements }),
     max: Math.max(2, concurrency + 1),
   });
   let created = false;

package/src/editable-artifact-outbox-dispatcher.ts

@@ -43,6 +43,8 @@ export type EditableArtifactOutboxWorkerOptions = Readonly<{
   dispatcherDatabaseUrl: string;
   databaseSearchPath?: string;
   databasePoolSize?: number;
+  /** Unset → decided from the URL; see `CreateDbOptions.preparedStatements`. */
+  databasePreparedStatements?: boolean;
   natsUrl: string;
   natsAuth: EditableArtifactHintNatsAuth;
   owner?: string;
@@ -121,6 +123,9 @@ export async function createEditableArtifactOutboxWorker(
   const database = createDb(dispatcherDatabaseUrl, {
     max: databasePoolSize,
     ...(options.databaseSearchPath ? { searchPath: options.databaseSearchPath } : {}),
+    ...(options.databasePreparedStatements === undefined
+      ? {}
+      : { preparedStatements: options.databasePreparedStatements }),
   });
   let broker: ConfirmedNatsEditableArtifactHintBroker;
   try {

package/src/editable-artifact-outbox-service.ts

@@ -94,6 +94,9 @@ export async function createProductionEditableArtifactOutboxService(
     ...(options.databasePoolSize === undefined
       ? {}
       : { databasePoolSize: options.databasePoolSize }),
+    ...(options.settings.databasePreparedStatements === undefined
+      ? {}
+      : { databasePreparedStatements: options.settings.databasePreparedStatements }),
     natsUrl: options.natsUrl,
     natsAuth: options.natsAuth,
     owner: options.owner,

package/src/index.ts

@@ -1078,9 +1078,14 @@ export async function startWorker() {
   const onRetry = (event: Parameters<typeof logStartupDependencyRetry>[1]) =>
     logStartupDependencyRetry(observability, event);
   const searchPath = dbSearchPath(settings);
+  const preparedStatements =
+    settings.databasePreparedStatements === undefined
+      ? {}
+      : { preparedStatements: settings.databasePreparedStatements };
   const dbClient = createDb(settings.databaseUrl, {
     ...(searchPath ? { searchPath } : {}),
     rlsStrategy: settings.rlsStrategy,
+    ...preparedStatements,
   });
   // Readiness must prove PostgreSQL independently of activity demand. Sharing
   // the default application pool makes the probe wait behind live turns when
@@ -1090,6 +1095,7 @@ export async function startWorker() {
   const readinessDbClient = createDb(settings.databaseUrl, {
     ...(searchPath ? { searchPath } : {}),
     rlsStrategy: settings.rlsStrategy,
+    ...preparedStatements,
     max: 1,
   });
   const databasePosture = {

package/src/internal-maintenance.ts

@@ -10,11 +10,13 @@ import {
   automaticSessionTitleFanoutDue,
   browserDeadlineCheckpointDue,
   knowledgeIndexDue,
+  maintainSubscriptionPlans,
   sandboxIdleCheckpointDue,
   sandboxLeaseReaperDue,
   sandboxMaintenanceDue,
   sessionWorkflowWakesDue,
   siteAuthMaintenanceDue,
+  subscriptionPlanMaintenanceDue,
   workspacePauseTimerDue,
   type Database,
 } from "@opengeni/db";
@@ -53,6 +55,8 @@ export const SITE_AUTH_MAINTENANCE_WORKFLOW_ID = "opengeni-site-auth-maintenance
 export const SITE_AUTH_MAINTENANCE_PERIOD_MS = 60 * 1_000;
 /** The Schedule earlier releases used to drive the sandbox lease reaper. */
 export const SANDBOX_REAPER_SCHEDULE_ID = "opengeni-sandbox-lease-reaper";
+/** Small bounded DB-only pass; no Temporal execution for plan maintenance. */
+export const SUBSCRIPTION_PLAN_MAINTENANCE_PERIOD_MS = 60_000;
 
 export const INTERNAL_MAINTENANCE_JOBS = [
   "session-workflow-wake-dispatcher",
@@ -61,6 +65,7 @@ export const INTERNAL_MAINTENANCE_JOBS = [
   "sandbox-lease-reaper",
   "sandbox-idle-checkpoint",
   "browser-deadline-checkpoint",
+  "subscription-plan-maintenance",
 ] as const;
 export type InternalMaintenanceJob = (typeof INTERNAL_MAINTENANCE_JOBS)[number];
 
@@ -139,6 +144,25 @@ export async function internalMaintenanceCadences(input: {
   const jobs = new Set(input.jobs ?? INTERNAL_MAINTENANCE_JOBS);
   const taskQueue = settings.temporalTaskQueue;
   const cadences: MaintenanceCadence[] = [];
+  if (settings.subscriptionPlansEnabled && jobs.has("subscription-plan-maintenance")) {
+    cadences.push({
+      job: "subscription-plan-maintenance",
+      periodMs: SUBSCRIPTION_PLAN_MAINTENANCE_PERIOD_MS,
+      hasWork: async () => await subscriptionPlanMaintenanceDue(db),
+      start: async () => {
+        const result = await maintainSubscriptionPlans(db, {
+          onError: (error, accountId) =>
+            observability.warn("Subscription plan maintenance account failed", {
+              accountId,
+              error: error instanceof Error ? error.message : String(error),
+            }),
+        });
+        if (result.failedAccounts > 0)
+          throw new Error(`${result.failedAccounts} subscription plan maintenance accounts failed`);
+        return "started";
+      },
+    });
+  }
   if (jobs.has("session-workflow-wake-dispatcher")) {
     const { repairMissedSessionWorkflowWakes } = await import("./activities/parent-wake");
     cadences.push({

package/src/observability-metrics.ts

@@ -2194,6 +2194,21 @@ const MODEL_REQUEST_PHASE_BUCKETS = [
  * Provider ids come from the resolved provider registry; phase/outcome are closed
  * enums. This function never performs I/O outside the in-memory metrics registry.
  */
+/**
+ * How a model request reached its provider, where the provider has more than
+ * one transport (Codex: a new or reused Responses WebSocket, or HTTP). Empty
+ * for providers with a single transport.
+ */
+export type ModelRequestTransportLabel = "" | "websocket_new" | "websocket_reused" | "http";
+
+/** The bounded metric label for how a Codex request was carried. */
+export function codexRequestTransportLabel(
+  transport: { kind: "websocket"; connection: "new" | "reused" } | { kind: "http" },
+): ModelRequestTransportLabel {
+  if (transport.kind === "http") return "http";
+  return transport.connection === "reused" ? "websocket_reused" : "websocket_new";
+}
+
 export function recordModelRequestPhase(
   observability: Observability,
   input: {
@@ -2201,19 +2216,21 @@ export function recordModelRequestPhase(
     phase: "headers" | "first_byte" | "terminal";
     outcome?: "completed" | "failed" | "timed_out";
     durationSeconds: number;
+    transport?: ModelRequestTransportLabel;
   },
 ): void {
   const outcome = input.outcome ?? "";
+  const transport = input.transport ?? "";
   observability.incrementCounter({
     name: "opengeni_model_request_phases_total",
-    help: "Provider model-request lifecycle phases by bounded phase and outcome.",
-    labels: { provider: input.provider, phase: input.phase, outcome },
+    help: "Provider model-request lifecycle phases by bounded phase, outcome and transport.",
+    labels: { provider: input.provider, phase: input.phase, outcome, transport },
   });
   observability.observeHistogram({
     name: "opengeni_model_request_phase_duration_seconds",
     help: "Monotonic seconds from provider dispatch to a model-request lifecycle phase.",
     buckets: MODEL_REQUEST_PHASE_BUCKETS,
-    labels: { provider: input.provider, phase: input.phase },
+    labels: { provider: input.provider, phase: input.phase, transport },
     value: Math.max(0, input.durationSeconds),
   });
 }

package/src/sandbox-routing.ts

@@ -1038,6 +1038,7 @@ export function wrapTurnBoxWithRouting(
               connectionInstanceId: command.connectionInstanceId,
               opId: command.opId,
               command: command.command,
+              ...(command.abandoned ? { abandoned: true } : {}),
             });
             return { commandId: adopted.id };
           },
@@ -1337,6 +1338,7 @@ export function wrapLazyTurnBoxWithRouting(
               connectionInstanceId: command.connectionInstanceId,
               opId: command.opId,
               command: command.command,
+              ...(command.abandoned ? { abandoned: true } : {}),
             });
             return { commandId: adopted.id };
           },
@@ -1542,6 +1544,7 @@ export type SelfhostedTurnSessionArgs = {
   operationCpuQuotaSupported: boolean;
   /** Feature advertisement only; refreshed by exact live admission for each operation. */
   transactionalFsWriteSupported?: boolean;
+  browserControlHttpSupported?: boolean;
   /** The active pointer's epoch — the control-op fence echoed to the agent. */
   epoch: number;
   /** The run's declared sandbox environment (the SAME object fed to buildAgent +
@@ -1618,6 +1621,7 @@ export function connectionBindingFor(
     operationResourcePolicySupported: enrollment.agentCapabilities.operationResourcePolicy === true,
     operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
     transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
+    browserControlHttpSupported: enrollment.agentCapabilities.browserControlHttp === true,
   };
 }
 
@@ -1693,6 +1697,7 @@ export async function establishSelfhostedTurnSession(
     operationResourcePolicySupported: args.operationResourcePolicySupported,
     operationCpuQuotaSupported: args.operationCpuQuotaSupported,
     transactionalFsWriteSupported: args.transactionalFsWriteSupported === true,
+    browserControlHttpSupported: args.browserControlHttpSupported === true,
     resolveOperationAdmission: async () => {
       // The machine's audience can change in place during a turn. Read the
       // current scope on every admitted operation: a machine that is Only me now
@@ -1747,6 +1752,7 @@ export async function establishSelfhostedTurnSession(
               connectionInstanceId: command.connectionInstanceId,
               opId: command.opId,
               command: command.command,
+              ...(command.abandoned ? { abandoned: true } : {}),
             });
             return { commandId: adopted.id };
           },