@opengeni/worker-bundle 4.3.3-canary.39786771332001 → 4.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/worker-bundle",
-  "version": "4.3.3-canary.39786771332001",
+  "version": "4.4.1",
   "description": "Opengeni worker entry and reusable embedded lifecycle, shipped with a release-coherent pre-bundled Temporal workflow artifact.",
   "license": "Apache-2.0",
   "repository": {
@@ -56,32 +56,32 @@
     "@1password/sdk": "0.5.0",
     "@keeper-security/secrets-manager-core": "17.6.0",
     "@llamaindex/liteparse": "2.14.2",
-    "@opengeni/agent-proto": "4.3.3-canary.39786771332001",
-    "@opengeni/capabilities": "4.3.3-canary.39786771332001",
-    "@opengeni/codemode": "4.3.3-canary.39786771332001",
-    "@opengeni/codex": "4.3.3-canary.39786771332001",
-    "@opengeni/config": "4.3.3-canary.39786771332001",
-    "@opengeni/contracts": "4.3.3-canary.39786771332001",
-    "@opengeni/core": "4.3.3-canary.39786771332001",
-    "@opengeni/db": "4.3.3-canary.39786771332001",
-    "@opengeni/decisions": "4.3.3-canary.39786771332001",
-    "@opengeni/documents": "4.3.3-canary.39786771332001",
-    "@opengeni/events": "4.3.3-canary.39786771332001",
-    "@opengeni/github": "4.3.3-canary.39786771332001",
-    "@opengeni/interaction": "4.3.3-canary.39786771332001",
-    "@opengeni/jev": "4.3.3-canary.39786771332001",
-    "@opengeni/network": "4.3.3-canary.39786771332001",
-    "@opengeni/observability": "4.3.3-canary.39786771332001",
-    "@opengeni/runtime": "4.3.3-canary.39786771332001",
-    "@opengeni/sdk": "4.3.3-canary.39786771332001",
-    "@opengeni/storage": "4.3.3-canary.39786771332001",
-    "@opengeni/subscriptions": "4.3.3-canary.39786771332001",
-    "@opengeni/tool-gateway": "4.3.3-canary.39786771332001",
-    "@opengeni/vaults": "4.3.3-canary.39786771332001",
-    "@opengeni/vaults-keeper": "4.3.3-canary.39786771332001",
-    "@opengeni/vaults-onepassword": "4.3.3-canary.39786771332001",
-    "@opengeni/vaults-protonpass": "4.3.3-canary.39786771332001",
-    "@opengeni/xai-subscription": "4.3.3-canary.39786771332001",
+    "@opengeni/agent-proto": "4.4.1",
+    "@opengeni/capabilities": "4.4.1",
+    "@opengeni/codemode": "4.4.1",
+    "@opengeni/codex": "4.4.1",
+    "@opengeni/config": "4.4.1",
+    "@opengeni/contracts": "4.4.1",
+    "@opengeni/core": "4.4.1",
+    "@opengeni/db": "4.4.1",
+    "@opengeni/decisions": "4.4.1",
+    "@opengeni/documents": "4.4.1",
+    "@opengeni/events": "4.4.1",
+    "@opengeni/github": "4.4.1",
+    "@opengeni/interaction": "4.4.1",
+    "@opengeni/jev": "4.4.1",
+    "@opengeni/network": "4.4.1",
+    "@opengeni/observability": "4.4.1",
+    "@opengeni/runtime": "4.4.1",
+    "@opengeni/sdk": "4.4.1",
+    "@opengeni/storage": "4.4.1",
+    "@opengeni/subscriptions": "4.4.1",
+    "@opengeni/tool-gateway": "4.4.1",
+    "@opengeni/vaults": "4.4.1",
+    "@opengeni/vaults-keeper": "4.4.1",
+    "@opengeni/vaults-onepassword": "4.4.1",
+    "@opengeni/vaults-protonpass": "4.4.1",
+    "@opengeni/xai-subscription": "4.4.1",
     "@temporalio/activity": "^1.17.0",
     "@temporalio/client": "^1.17.0",
     "@temporalio/worker": "^1.17.0",

package/src/activities/agent-turn/tool-environment.ts

@@ -1,4 +1,5 @@
 import { createKnowledgeSourceAttemptTools } from "./knowledge-source-tools";
+import { userSetupCardPoster } from "./user-setup-card";
 import {
   resolveInitiatingHuman,
   buildSlackApiRateLimiter,
@@ -933,6 +934,17 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
       ...(interactionInterventionResume
         ? { interventionResume: interactionInterventionResume }
         : {}),
+      postSetupCard: userSetupCardPoster({
+        db,
+        bus,
+        connectedMachinesEnabled: runSettings.sandboxSelfhostedEnabled,
+        webBaseUrl: runSettings.webBaseUrl ?? runSettings.publicBaseUrl,
+        workspaceId: input.workspaceId,
+        sessionId: input.sessionId,
+        turnId: turn.id,
+        executionGeneration: attempt.executionGeneration,
+        attemptId: input.attemptId,
+      }),
     }),
     ...(googleDrivePublicationTool && googleDrivePublicationAllowed
       ? [googleDrivePublicationTool]

package/src/activities/agent-turn/user-setup-card.ts

@@ -0,0 +1,60 @@
+import { sessionChatUrl } from "@opengeni/contracts";
+import { CONNECTED_MACHINE_CAPABILITY_ID, userSetupCardPayload } from "@opengeni/core";
+import { appendTurnCapabilityCardOnce } from "@opengeni/db";
+import { publishDurableSessionEvents } from "@opengeni/events";
+import type { UserSetupCardPoster } from "@opengeni/runtime";
+
+type AppendCardOnce = typeof appendTurnCapabilityCardOnce;
+type PublishEvents = typeof publishDurableSessionEvents;
+
+export type UserSetupCardInput = {
+  db: Parameters<AppendCardOnce>[0];
+  bus: Parameters<PublishEvents>[0];
+  /** Connected Machines are enabled on this deployment; their cards can't help otherwise. */
+  connectedMachinesEnabled: boolean;
+  /** The web app's base URL, for the chat link the agent can hand out. */
+  webBaseUrl: string | null | undefined;
+  workspaceId: string;
+  sessionId: string;
+  turnId: string;
+  executionGeneration: number;
+  attemptId: string;
+  append?: AppendCardOnce;
+  publish?: PublishEvents;
+};
+
+/**
+ * Posts the setup card for a tool refusal the person can fix (see
+ * USER_SETUP_BLOCKERS) in the calling turn, at most once per turn and card: a
+ * later refusal in the same turn reuses the card already shown. The append
+ * runs under the attempt fence, so a replaced turn posts nothing. Resolves
+ * "unavailable" when the card can't help on this deployment, and null when it
+ * was not posted.
+ */
+export function userSetupCardPoster(input: UserSetupCardInput): UserSetupCardPoster {
+  const append = input.append ?? appendTurnCapabilityCardOnce;
+  const publish = input.publish ?? publishDurableSessionEvents;
+  return async (blocker, toolName) => {
+    if (
+      blocker.capabilityId === CONNECTED_MACHINE_CAPABILITY_ID &&
+      !input.connectedMachinesEnabled
+    ) {
+      return "unavailable";
+    }
+    const payload = userSetupCardPayload(blocker, { toolName });
+    if (!payload) return null;
+    const appended = await append(
+      input.db,
+      input.workspaceId,
+      input.sessionId,
+      input.turnId,
+      input.executionGeneration,
+      input.attemptId,
+      blocker.capabilityId,
+      { type: "tool.auth_needed", payload },
+    );
+    await publish(input.bus, input.workspaceId, input.sessionId, appended.events);
+    if (!appended.accepted) return null;
+    return { chatUrl: sessionChatUrl(input.webBaseUrl, input.workspaceId, input.sessionId) };
+  };
+}