@opengeni/worker-bundle 4.4.1 → 4.5.0

package/dist/{activities-turn-G33RWTX2.js → activities-turn-B73PNSEA.js}

@@ -1471,6 +1471,290 @@ function uuidFromDigest(digest2, startByte) {
   return `${hex3.slice(0, 8)}-${hex3.slice(8, 12)}-${hex3.slice(12, 16)}-${hex3.slice(16, 20)}-${hex3.slice(20)}`;
 }
 
+// src/activities/agent-turn/owned-sandbox-setup.ts
+import {
+  runOwnedSandboxSetup,
+  withRunCredentialsSession
+} from "@opengeni/runtime";
+
+// src/activities/agent-turn/sandbox-shared-preparation.ts
+import { randomUUID } from "crypto";
+import {
+  claimSandboxSharedPreparation,
+  readSandboxSharedPreparation,
+  SandboxLeaseSupersededError,
+  settleSandboxSharedPreparation
+} from "@opengeni/db";
+function observeSharedPreparation(options, measurement) {
+  try {
+    options.observe?.(measurement);
+  } catch {
+  }
+}
+function waitForPreparationTransition(ms, signal) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const timer = setTimeout(finish, ms);
+    function finish() {
+      if (settled) return;
+      settled = true;
+      signal?.removeEventListener("abort", cancel);
+      resolve();
+    }
+    function cancel() {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", cancel);
+      reject(signal?.reason ?? new Error("Sandbox shared preparation wait cancelled"));
+    }
+    signal?.addEventListener("abort", cancel, { once: true });
+    if (signal?.aborted) cancel();
+  });
+}
+async function settleCompletedWithRetry(options, input, claimId) {
+  let delayMs = 50;
+  for (let attempt = 0; attempt < 4; attempt += 1) {
+    try {
+      if (await settleSandboxSharedPreparation(options.db, {
+        accountId: options.accountId,
+        workspaceId: options.workspaceId,
+        sandboxGroupId: options.sandboxGroupId,
+        expectedLeaseEpoch: options.sandbox.leaseEpoch,
+        expectedInstanceId: options.sandbox.established.instanceId,
+        specHash: input.specHash,
+        holderId: options.holderId,
+        claimId,
+        outcome: "completed"
+      })) {
+        return true;
+      }
+    } catch {
+    }
+    await waitForPreparationTransition(delayMs, options.signal);
+    delayMs *= 2;
+  }
+  return false;
+}
+function createSharedRigSetupCoordinator(options) {
+  return async (input) => {
+    const startedAt = performance.now();
+    const claimId = randomUUID();
+    const identity = {
+      accountId: options.accountId,
+      workspaceId: options.workspaceId,
+      sandboxGroupId: options.sandboxGroupId,
+      expectedLeaseEpoch: options.sandbox.leaseEpoch,
+      expectedInstanceId: options.sandbox.established.instanceId,
+      specHash: input.specHash,
+      holderId: options.holderId
+    };
+    const claimTimeoutMs = Math.min(36e5, Math.max(3e4, input.timeoutMs + 3e4));
+    let delayMs = 100;
+    let observedRevision = -1;
+    let path = "owner";
+    try {
+      for (; ; ) {
+        if (options.signal?.aborted) {
+          throw options.signal.reason ?? new Error("Sandbox shared preparation cancelled");
+        }
+        const claim = await claimSandboxSharedPreparation(options.db, {
+          ...identity,
+          claimId,
+          ownerAttemptId: options.attemptId,
+          timeoutMs: claimTimeoutMs
+        });
+        if (claim.role === "fenced") {
+          throw new SandboxLeaseSupersededError(options.sandboxGroupId, options.sandbox.leaseEpoch);
+        }
+        if (claim.role === "reused") {
+          if (path !== "joined") path = "reused";
+          observeSharedPreparation(options, {
+            path,
+            outcome: "completed",
+            durationSeconds: (performance.now() - startedAt) / 1e3
+          });
+          return "reused";
+        }
+        if (claim.role === "owner") {
+          try {
+            await input.execute();
+          } catch (error51) {
+            await settleSandboxSharedPreparation(options.db, {
+              ...identity,
+              claimId,
+              outcome: "failed"
+            }).catch(() => void 0);
+            throw error51;
+          }
+          if (await settleCompletedWithRetry(options, input, claimId)) {
+            observeSharedPreparation(options, {
+              path,
+              outcome: "completed",
+              durationSeconds: (performance.now() - startedAt) / 1e3
+            });
+            return "executed";
+          }
+          throw new Error(
+            "Sandbox shared preparation completed but its durable settlement remains unavailable"
+          );
+        }
+        path = "joined";
+        observedRevision = claim.preparation.revision;
+        const jitterMs = Math.floor(Math.random() * Math.max(1, Math.floor(delayMs / 4)));
+        await waitForPreparationTransition(delayMs + jitterMs, options.signal);
+        const observed = await readSandboxSharedPreparation(options.db, identity);
+        if (observed.status === "fenced") {
+          throw new SandboxLeaseSupersededError(options.sandboxGroupId, options.sandbox.leaseEpoch);
+        }
+        if (observed.preparation.status === "completed") {
+          observeSharedPreparation(options, {
+            path,
+            outcome: "completed",
+            durationSeconds: (performance.now() - startedAt) / 1e3
+          });
+          return "reused";
+        }
+        if (observed.preparation.status === "failed") {
+          delayMs = 100;
+          continue;
+        }
+        delayMs = observed.preparation.revision === observedRevision ? Math.min(2e3, delayMs * 2) : 100;
+      }
+    } catch (error51) {
+      observeSharedPreparation(options, {
+        path,
+        outcome: "failed",
+        durationSeconds: (performance.now() - startedAt) / 1e3
+      });
+      throw error51;
+    }
+  };
+}
+
+// src/activities/agent-turn/turn-sandbox-access.ts
+function ownedTurnSandboxForAgent(sandboxState) {
+  return sandboxState.lazyOwnedSandbox ?? sandboxState.resolvedSandbox?.established;
+}
+async function resolveTurnSandboxAccess(sandboxState, sdkOwnedSandboxSession, unavailableMessage) {
+  let sandbox = sandboxState.resolvedSandbox;
+  if (!sandbox && sandboxState.turnSandboxProvisioner) {
+    sandbox = await sandboxState.turnSandboxProvisioner.get();
+  }
+  const session = ownedTurnSandboxForAgent(sandboxState)?.session ?? sandbox?.established.session ?? sdkOwnedSandboxSession;
+  if (!session) throw new Error(unavailableMessage);
+  return {
+    sandbox,
+    session,
+    leaseEpoch: sandbox?.leaseEpoch ?? 0
+  };
+}
+
+// src/activities/agent-turn/owned-sandbox-setup.ts
+function hasEagerOwnedSandboxSetup(sandboxState) {
+  return Boolean(
+    sandboxState.resolvedSandbox && !sandboxState.lazyOwnedSandbox && ownedTurnSandboxForAgent(sandboxState)
+  );
+}
+async function runEagerOwnedSandboxSetup(deps, options) {
+  const { input, sandboxState, eventing, leases, observability } = deps;
+  const eagerResolvedSandbox = sandboxState.resolvedSandbox;
+  const ownedEstablished = ownedTurnSandboxForAgent(sandboxState);
+  if (!eagerResolvedSandbox || sandboxState.lazyOwnedSandbox || !ownedEstablished) return;
+  const ownedSandboxSetupStartedAt = performance.now();
+  let ownedSandboxSetupOutcome = "completed";
+  try {
+    const eagerSetupSession = sandboxState.setupBoxSession ?? ownedEstablished.session;
+    await deps.attachRunCredentialRenewal(
+      eagerSetupSession,
+      deps.initialRunCredentialMaterial,
+      eagerResolvedSandbox
+    );
+    const eagerCredentialSetupSession = deps.initialRunCredentialMaterial ? withRunCredentialsSession(eagerSetupSession, input.sessionId) : eagerSetupSession;
+    await deps.runWorkspaceMutationForSandbox(
+      eagerResolvedSandbox,
+      "eagerOwnedSandboxSetup",
+      async () => await runOwnedSandboxSetup(
+        deps.agent,
+        ownedEstablished.session,
+        eagerCredentialSetupSession,
+        {
+          settings: deps.runSettings,
+          environment: deps.sandboxEnvironment,
+          ...options.preparedInput ? { preparedInput: options.preparedInput } : {},
+          ...options.fileDownloadsMaterialized ? { fileDownloadsMaterialized: true } : {},
+          onRuntimeEvent: async (event) => {
+            await leases.renewServing("runtime_event");
+            if (leases.servingLost()) {
+              throw new Error("Provider credential lease expired during sandbox setup");
+            }
+            await eventing.publish([{ type: event.type, payload: event.payload }], true);
+          },
+          ...eventing.toolCancellationFenceRef.current ? {
+            commandRunner: eventing.toolCancellationFenceRef.current.runSandboxCommand.bind(
+              eventing.toolCancellationFenceRef.current
+            )
+          } : {},
+          ...sandboxState.sandboxGroupId && sandboxState.sandboxHolderId ? {
+            coordinateSharedRigSetup: createSharedRigSetupCoordinator({
+              db: deps.db,
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              sandboxGroupId: sandboxState.sandboxGroupId,
+              attemptId: input.attemptId,
+              holderId: sandboxState.sandboxHolderId,
+              sandbox: eagerResolvedSandbox,
+              ...deps.runtimeCancellationSignal ? { signal: deps.runtimeCancellationSignal } : {},
+              observe: (measurement) => recordSandboxSharedPreparation(observability, measurement)
+            })
+          } : {}
+        }
+      )
+    );
+    await deps.attachGitCredentialRenewal(
+      eagerSetupSession,
+      deps.initialGitCredentials
+    );
+  } catch (error51) {
+    ownedSandboxSetupOutcome = "failed";
+    throw error51;
+  } finally {
+    recordTurnStartupPhase(observability, {
+      phase: "owned_sandbox_setup",
+      provider: deps.turnExecutionPolicy.providerId,
+      backend: deps.activeSandboxBackend ?? deps.groupBoxBackend,
+      outcome: ownedSandboxSetupOutcome,
+      durationSeconds: (performance.now() - ownedSandboxSetupStartedAt) / 1e3,
+      count: deps.fileResourceDownloads.length
+    });
+  }
+}
+function createEagerOwnedSandboxSetup(deps, start, runSetup = runEagerOwnedSandboxSetup) {
+  const startedFor = start ? sandboxIdentity(deps.sandboxState) : null;
+  let started = start ? runSetup(deps, {
+    fileDownloadsMaterialized: start.fileDownloadsMaterialized
+  }) : null;
+  const settled = started ? started.then(noop, noop) : Promise.resolve();
+  return {
+    beforeModelStream: async (options) => {
+      if (started) {
+        const prestarted = started;
+        started = null;
+        await prestarted;
+        if (sandboxIdentity(deps.sandboxState) === startedFor) return;
+      }
+      await runSetup(deps, options);
+    },
+    settled: () => settled
+  };
+}
+function sandboxIdentity(sandboxState) {
+  const resolved = sandboxState.resolvedSandbox;
+  return resolved ? `${resolved.leaseEpoch}:${resolved.established.instanceId}` : null;
+}
+function noop() {
+}
+
 // src/activities/agent-turn/credential-leases.ts
 import {
   CODEX_CREDENTIAL_LEASE_TTL_MS,
@@ -6972,7 +7256,7 @@ import {
   recordUsageEvent,
   getActiveSessionHistoryItemsPaged,
   readLease,
-  SandboxLeaseSupersededError,
+  SandboxLeaseSupersededError as SandboxLeaseSupersededError2,
   isSessionEventPersistenceError as isSessionEventPersistenceError2,
   SANDBOX_SETUP_RECOVERY_LIMIT,
   SubscriptionCoreCodexAccessLostError,
@@ -7988,7 +8272,7 @@ async function settleTurnFailureInAttempt(deps) {
     return claimedResult({ status: "recovering", deferredUntilWake: true });
   }
   const lifecycleTransition = sandboxLifecycleTransitionDiagnostic(error51);
-  const leaseControlError = error51 instanceof SandboxLeaseSupersededError ? error51 : lifecycleTransition;
+  const leaseControlError = error51 instanceof SandboxLeaseSupersededError2 ? error51 : lifecycleTransition;
   if (leaseControlError && recoveryTurnId) {
     try {
       const fencedLease = await readLease(
@@ -9079,8 +9363,6 @@ import {
   findAnthropicRequestSizeError,
   ANTHROPIC_REQUEST_MAX_BYTES as ANTHROPIC_REQUEST_MAX_BYTES2,
   compactionProviderRejection,
-  withRunCredentialsSession,
-  runOwnedSandboxSetup,
   modelResponseHasVisibleText,
   ModelStepHandover,
   isPreemptedModelResponse,
@@ -9605,7 +9887,7 @@ function programmaticContinuationNote(operations) {
 }
 
 // src/activities/codemode-dispatcher.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import {
   bindMcpTelemetry,
   measureMcpPhase,
@@ -9712,7 +9994,7 @@ var CodemodeAttemptDispatcher = class _CodemodeAttemptDispatcher {
             ...this.scope,
             catalogDigest: request.catalogDigest,
             operationId: request.operationId,
-            claimId: randomUUID(),
+            claimId: randomUUID2(),
             claimLeaseMs: this.claimLeaseMs
           });
           if (claim.status === "claimed") {
@@ -9818,7 +10100,7 @@ var CodemodeAttemptDispatcher = class _CodemodeAttemptDispatcher {
       const claim = await claimCodemodeOperation(this.db, {
         ...this.scope,
         operationId: adopted.operationId,
-        claimId: randomUUID(),
+        claimId: randomUUID2(),
         catalogDigest: this.environment.catalog.digest,
         claimLeaseMs: this.claimLeaseMs
       });
@@ -10171,24 +10453,6 @@ function safeErrorMessage(error51) {
   return "Codemode call failed before tool execution";
 }
 
-// src/activities/agent-turn/turn-sandbox-access.ts
-function ownedTurnSandboxForAgent(sandboxState) {
-  return sandboxState.lazyOwnedSandbox ?? sandboxState.resolvedSandbox?.established;
-}
-async function resolveTurnSandboxAccess(sandboxState, sdkOwnedSandboxSession, unavailableMessage) {
-  let sandbox = sandboxState.resolvedSandbox;
-  if (!sandbox && sandboxState.turnSandboxProvisioner) {
-    sandbox = await sandboxState.turnSandboxProvisioner.get();
-  }
-  const session = ownedTurnSandboxForAgent(sandboxState)?.session ?? sandbox?.established.session ?? sdkOwnedSandboxSession;
-  if (!session) throw new Error(unavailableMessage);
-  return {
-    sandbox,
-    session,
-    leaseEpoch: sandbox?.leaseEpoch ?? 0
-  };
-}
-
 // src/activities/open-suffix-resume.ts
 import {
   OPEN_SUFFIX_RUN_STATE_BLOB,
@@ -11010,161 +11274,6 @@ async function inputWaitReplyRefusal(input) {
   return await input.hasVisibleReply() ? null : INPUT_WAIT_REPLY_REFUSAL;
 }
 
-// src/activities/agent-turn/sandbox-shared-preparation.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import {
-  claimSandboxSharedPreparation,
-  readSandboxSharedPreparation,
-  SandboxLeaseSupersededError as SandboxLeaseSupersededError2,
-  settleSandboxSharedPreparation
-} from "@opengeni/db";
-function observeSharedPreparation(options, measurement) {
-  try {
-    options.observe?.(measurement);
-  } catch {
-  }
-}
-function waitForPreparationTransition(ms, signal) {
-  return new Promise((resolve, reject) => {
-    let settled = false;
-    const timer = setTimeout(finish, ms);
-    function finish() {
-      if (settled) return;
-      settled = true;
-      signal?.removeEventListener("abort", cancel);
-      resolve();
-    }
-    function cancel() {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      signal?.removeEventListener("abort", cancel);
-      reject(signal?.reason ?? new Error("Sandbox shared preparation wait cancelled"));
-    }
-    signal?.addEventListener("abort", cancel, { once: true });
-    if (signal?.aborted) cancel();
-  });
-}
-async function settleCompletedWithRetry(options, input, claimId) {
-  let delayMs = 50;
-  for (let attempt = 0; attempt < 4; attempt += 1) {
-    try {
-      if (await settleSandboxSharedPreparation(options.db, {
-        accountId: options.accountId,
-        workspaceId: options.workspaceId,
-        sandboxGroupId: options.sandboxGroupId,
-        expectedLeaseEpoch: options.sandbox.leaseEpoch,
-        expectedInstanceId: options.sandbox.established.instanceId,
-        specHash: input.specHash,
-        holderId: options.holderId,
-        claimId,
-        outcome: "completed"
-      })) {
-        return true;
-      }
-    } catch {
-    }
-    await waitForPreparationTransition(delayMs, options.signal);
-    delayMs *= 2;
-  }
-  return false;
-}
-function createSharedRigSetupCoordinator(options) {
-  return async (input) => {
-    const startedAt = performance.now();
-    const claimId = randomUUID2();
-    const identity = {
-      accountId: options.accountId,
-      workspaceId: options.workspaceId,
-      sandboxGroupId: options.sandboxGroupId,
-      expectedLeaseEpoch: options.sandbox.leaseEpoch,
-      expectedInstanceId: options.sandbox.established.instanceId,
-      specHash: input.specHash,
-      holderId: options.holderId
-    };
-    const claimTimeoutMs = Math.min(36e5, Math.max(3e4, input.timeoutMs + 3e4));
-    let delayMs = 100;
-    let observedRevision = -1;
-    let path = "owner";
-    try {
-      for (; ; ) {
-        if (options.signal?.aborted) {
-          throw options.signal.reason ?? new Error("Sandbox shared preparation cancelled");
-        }
-        const claim = await claimSandboxSharedPreparation(options.db, {
-          ...identity,
-          claimId,
-          ownerAttemptId: options.attemptId,
-          timeoutMs: claimTimeoutMs
-        });
-        if (claim.role === "fenced") {
-          throw new SandboxLeaseSupersededError2(options.sandboxGroupId, options.sandbox.leaseEpoch);
-        }
-        if (claim.role === "reused") {
-          if (path !== "joined") path = "reused";
-          observeSharedPreparation(options, {
-            path,
-            outcome: "completed",
-            durationSeconds: (performance.now() - startedAt) / 1e3
-          });
-          return "reused";
-        }
-        if (claim.role === "owner") {
-          try {
-            await input.execute();
-          } catch (error51) {
-            await settleSandboxSharedPreparation(options.db, {
-              ...identity,
-              claimId,
-              outcome: "failed"
-            }).catch(() => void 0);
-            throw error51;
-          }
-          if (await settleCompletedWithRetry(options, input, claimId)) {
-            observeSharedPreparation(options, {
-              path,
-              outcome: "completed",
-              durationSeconds: (performance.now() - startedAt) / 1e3
-            });
-            return "executed";
-          }
-          throw new Error(
-            "Sandbox shared preparation completed but its durable settlement remains unavailable"
-          );
-        }
-        path = "joined";
-        observedRevision = claim.preparation.revision;
-        const jitterMs = Math.floor(Math.random() * Math.max(1, Math.floor(delayMs / 4)));
-        await waitForPreparationTransition(delayMs + jitterMs, options.signal);
-        const observed = await readSandboxSharedPreparation(options.db, identity);
-        if (observed.status === "fenced") {
-          throw new SandboxLeaseSupersededError2(options.sandboxGroupId, options.sandbox.leaseEpoch);
-        }
-        if (observed.preparation.status === "completed") {
-          observeSharedPreparation(options, {
-            path,
-            outcome: "completed",
-            durationSeconds: (performance.now() - startedAt) / 1e3
-          });
-          return "reused";
-        }
-        if (observed.preparation.status === "failed") {
-          delayMs = 100;
-          continue;
-        }
-        delayMs = observed.preparation.revision === observedRevision ? Math.min(2e3, delayMs * 2) : 100;
-      }
-    } catch (error51) {
-      observeSharedPreparation(options, {
-        path,
-        outcome: "failed",
-        durationSeconds: (performance.now() - startedAt) / 1e3
-      });
-      throw error51;
-    }
-  };
-}
-
 // src/activities/agent-turn/final-reply.ts
 function finalReplyNudge(turnId) {
   return {
@@ -26895,11 +27004,9 @@ async function runTurnStreamAttempt(deps) {
     claimedResult,
     flushRuntimeBatcher,
     finalizeTurnOpStreamOps,
-    runWorkspaceMutationForSandbox,
     throwIfWorkerShuttingDown,
     throwIfTurnCancelled,
     setLastInputTokensFenced,
-    attachGitCredentialRenewal,
     attachCodemodeTokenRenewal,
     attachRunCredentialRenewal,
     withProviderRequestContext,
@@ -26939,11 +27046,9 @@ async function runTurnStreamAttempt(deps) {
     modelHistoryProjector,
     compactionModeOptions,
     initialRunCredentialMaterial,
-    initialGitCredentials,
     sandboxEnvironment,
     sandboxCodemodeToken,
     sandboxCodemodeTokenExpiresAt,
-    fileResourceDownloads,
     runCredentialResolver,
     videoGenerationAcceptancesByCallId
   } = deps;
@@ -27315,77 +27420,12 @@ async function runTurnStreamAttempt(deps) {
       });
     };
     const ownedEstablished = ownedTurnSandboxForAgent(sandboxState);
+    const eagerOwnedSandboxSetup = deps.eagerOwnedSandboxSetup ?? createEagerOwnedSandboxSetup(deps);
     const runStreamOnce = async () => {
-      const eagerResolvedSandbox = sandboxState.resolvedSandbox;
-      if (eagerResolvedSandbox && !sandboxState.lazyOwnedSandbox && ownedEstablished) {
-        const ownedSandboxSetupStartedAt = performance.now();
-        let ownedSandboxSetupOutcome = "completed";
-        try {
-          const eagerSetupSession = sandboxState.setupBoxSession ?? ownedEstablished.session;
-          await attachRunCredentialRenewal(
-            eagerSetupSession,
-            initialRunCredentialMaterial,
-            eagerResolvedSandbox
-          );
-          const eagerCredentialSetupSession = initialRunCredentialMaterial ? withRunCredentialsSession(eagerSetupSession, input.sessionId) : eagerSetupSession;
-          await runWorkspaceMutationForSandbox(
-            eagerResolvedSandbox,
-            "eagerOwnedSandboxSetup",
-            async () => await runOwnedSandboxSetup(
-              agent,
-              ownedEstablished.session,
-              eagerCredentialSetupSession,
-              {
-                settings: runSettings,
-                environment: sandboxEnvironment,
-                preparedInput: runInput,
-                ...fileDownloadsMaterializedForRun ? { fileDownloadsMaterialized: true } : {},
-                onRuntimeEvent: async (event) => {
-                  await leases.renewServing("runtime_event");
-                  if (leases.servingLost()) {
-                    throw new Error("Provider credential lease expired during sandbox setup");
-                  }
-                  await eventing.publish([{ type: event.type, payload: event.payload }], true);
-                },
-                ...eventing.toolCancellationFenceRef.current ? {
-                  commandRunner: eventing.toolCancellationFenceRef.current.runSandboxCommand.bind(
-                    eventing.toolCancellationFenceRef.current
-                  )
-                } : {},
-                ...sandboxState.sandboxGroupId && sandboxState.sandboxHolderId ? {
-                  coordinateSharedRigSetup: createSharedRigSetupCoordinator({
-                    db,
-                    accountId: input.accountId,
-                    workspaceId: input.workspaceId,
-                    sandboxGroupId: sandboxState.sandboxGroupId,
-                    attemptId: input.attemptId,
-                    holderId: sandboxState.sandboxHolderId,
-                    sandbox: eagerResolvedSandbox,
-                    ...runtimeCancellationSignal ? { signal: runtimeCancellationSignal } : {},
-                    observe: (measurement) => recordSandboxSharedPreparation(observability, measurement)
-                  })
-                } : {}
-              }
-            )
-          );
-          await attachGitCredentialRenewal(
-            eagerSetupSession,
-            initialGitCredentials
-          );
-        } catch (error51) {
-          ownedSandboxSetupOutcome = "failed";
-          throw error51;
-        } finally {
-          recordTurnStartupPhase(observability, {
-            phase: "owned_sandbox_setup",
-            provider: turnExecutionPolicy.providerId,
-            backend: activeSandboxBackend ?? groupBoxBackend,
-            outcome: ownedSandboxSetupOutcome,
-            durationSeconds: (performance.now() - ownedSandboxSetupStartedAt) / 1e3,
-            count: fileResourceDownloads.length
-          });
-        }
-      }
+      await eagerOwnedSandboxSetup.beforeModelStream({
+        preparedInput: runInput,
+        fileDownloadsMaterialized: fileDownloadsMaterializedForRun
+      });
       recordCompanyBrainContributionReceiptOnce();
       if (!eventing.firstModelRequestPreparationRecorded) {
         await eventing.publish([
@@ -42852,194 +42892,226 @@ These are publication receipts for the human's earlier answer. Do not call the r
             outcome: "completed",
             durationSeconds: (performance.now() - postAgentPreparationStartedAt) / 1e3
           });
-          let fileMaterializationFailures = [];
-          let fileDownloadsMaterializedForRun = false;
-          if (sandboxState.resolvedSandbox && sandboxState.setupBoxSession && fileResourceDownloads.length > 0) {
-            const fileMaterializationStartedAt = performance.now();
-            let fileMaterializationOutcome = "completed";
-            let fileMaterializationCache = "miss";
-            try {
-              const boxInstanceId = sandboxState.resolvedSandbox.established.instanceId;
-              const alreadyMaterialized = await getMaterializedSandboxFileResources3(db, {
-                accountId: input.accountId,
-                workspaceId: input.workspaceId,
-                sandboxGroupId: session.sandboxGroupId,
-                expectedEpoch: sandboxState.resolvedSandbox.leaseEpoch,
-                instanceId: boxInstanceId
-              });
-              const downloadsToMaterialize = filterUnmaterializedSandboxFileDownloads(
-                fileResourceDownloads,
-                alreadyMaterialized
-              );
-              if (downloadsToMaterialize.length === 0) {
-                fileMaterializationCache = "hit";
-              }
-              const runAs = sandboxRunAs6(runSettings);
-              if (downloadsToMaterialize.length > 0) {
-                const materialized = await runWorkspaceMutationForSandbox(
-                  sandboxState.resolvedSandbox,
-                  "fileMaterialization",
-                  async () => await materializeSandboxFileDownloads3(
-                    sandboxState.setupBoxSession,
-                    downloadsToMaterialize,
-                    {
-                      onRuntimeEvent: async (event) => {
-                        await eventing.publish(
-                          [{ type: event.type, payload: event.payload }],
-                          true
-                        );
-                      },
-                      ...runAs ? { runAs } : {},
-                      ...eventing.toolCancellationFenceRef.current ? {
-                        commandRunner: eventing.toolCancellationFenceRef.current.runSandboxCommand.bind(
-                          eventing.toolCancellationFenceRef.current
-                        )
-                      } : {}
-                    }
-                  )
-                );
-                fileMaterializationFailures = materialized.failures;
-                fileMaterializationOutcome = sandboxFileMaterializationOutcome(
-                  materialized.failures
-                );
-                const failedFileIds = new Set(
-                  materialized.failures.map((failure2) => failure2.fileId)
+          const workerDeliversFiles = Boolean(
+            sandboxState.resolvedSandbox && sandboxState.setupBoxSession && fileResourceDownloads.length > 0
+          );
+          const eagerOwnedSandboxSetup = createEagerOwnedSandboxSetup(
+            {
+              input,
+              db,
+              observability,
+              runtimeCancellationSignal,
+              sandboxState,
+              eventing: wiredEventing,
+              leases,
+              runWorkspaceMutationForSandbox,
+              attachGitCredentialRenewal,
+              attachRunCredentialRenewal,
+              activeSandboxBackend,
+              groupBoxBackend,
+              turnExecutionPolicy,
+              agent,
+              runSettings,
+              initialRunCredentialMaterial,
+              initialGitCredentials,
+              sandboxEnvironment,
+              fileResourceDownloads
+            },
+            hasEagerOwnedSandboxSetup(sandboxState) && (workerDeliversFiles || fileResourceDownloads.length === 0) ? { fileDownloadsMaterialized: workerDeliversFiles } : void 0
+          );
+          try {
+            let fileMaterializationFailures = [];
+            let fileDownloadsMaterializedForRun = false;
+            if (sandboxState.resolvedSandbox && sandboxState.setupBoxSession && fileResourceDownloads.length > 0) {
+              const fileMaterializationStartedAt = performance.now();
+              let fileMaterializationOutcome = "completed";
+              let fileMaterializationCache = "miss";
+              try {
+                const boxInstanceId = sandboxState.resolvedSandbox.established.instanceId;
+                const alreadyMaterialized = await getMaterializedSandboxFileResources3(db, {
+                  accountId: input.accountId,
+                  workspaceId: input.workspaceId,
+                  sandboxGroupId: session.sandboxGroupId,
+                  expectedEpoch: sandboxState.resolvedSandbox.leaseEpoch,
+                  instanceId: boxInstanceId
+                });
+                const downloadsToMaterialize = filterUnmaterializedSandboxFileDownloads(
+                  fileResourceDownloads,
+                  alreadyMaterialized
                 );
-                const succeededFileIds = downloadsToMaterialize.map((download) => download.fileId).filter((fileId) => !failedFileIds.has(fileId));
-                if (succeededFileIds.length > 0) {
-                  await markSandboxFileResourcesMaterialized3(db, {
-                    accountId: input.accountId,
-                    workspaceId: input.workspaceId,
-                    sandboxGroupId: session.sandboxGroupId,
-                    expectedEpoch: sandboxState.resolvedSandbox.leaseEpoch,
-                    instanceId: boxInstanceId,
-                    fileIds: succeededFileIds
-                  });
+                if (downloadsToMaterialize.length === 0) {
+                  fileMaterializationCache = "hit";
+                }
+                const runAs = sandboxRunAs6(runSettings);
+                if (downloadsToMaterialize.length > 0) {
+                  const materialized = await runWorkspaceMutationForSandbox(
+                    sandboxState.resolvedSandbox,
+                    "fileMaterialization",
+                    async () => await materializeSandboxFileDownloads3(
+                      sandboxState.setupBoxSession,
+                      downloadsToMaterialize,
+                      {
+                        onRuntimeEvent: async (event) => {
+                          await eventing.publish(
+                            [{ type: event.type, payload: event.payload }],
+                            true
+                          );
+                        },
+                        ...runAs ? { runAs } : {},
+                        ...eventing.toolCancellationFenceRef.current ? {
+                          commandRunner: eventing.toolCancellationFenceRef.current.runSandboxCommand.bind(
+                            eventing.toolCancellationFenceRef.current
+                          )
+                        } : {}
+                      }
+                    )
+                  );
+                  fileMaterializationFailures = materialized.failures;
+                  fileMaterializationOutcome = sandboxFileMaterializationOutcome(
+                    materialized.failures
+                  );
+                  const failedFileIds = new Set(
+                    materialized.failures.map((failure2) => failure2.fileId)
+                  );
+                  const succeededFileIds = downloadsToMaterialize.map((download) => download.fileId).filter((fileId) => !failedFileIds.has(fileId));
+                  if (succeededFileIds.length > 0) {
+                    await markSandboxFileResourcesMaterialized3(db, {
+                      accountId: input.accountId,
+                      workspaceId: input.workspaceId,
+                      sandboxGroupId: session.sandboxGroupId,
+                      expectedEpoch: sandboxState.resolvedSandbox.leaseEpoch,
+                      instanceId: boxInstanceId,
+                      fileIds: succeededFileIds
+                    });
+                  }
                 }
+                fileDownloadsMaterializedForRun = true;
+              } catch (error51) {
+                fileMaterializationOutcome = "failed";
+                throw error51;
+              } finally {
+                recordTurnStartupPhase(observability, {
+                  phase: "file_materialization",
+                  provider: turnExecutionPolicy.providerId,
+                  backend: activeSandboxBackend ?? groupBoxBackend,
+                  outcome: fileMaterializationOutcome,
+                  durationSeconds: (performance.now() - fileMaterializationStartedAt) / 1e3,
+                  count: fileResourceDownloads.length,
+                  cache: fileMaterializationCache
+                });
               }
-              fileDownloadsMaterializedForRun = true;
-            } catch (error51) {
-              fileMaterializationOutcome = "failed";
-              throw error51;
-            } finally {
+            } else {
               recordTurnStartupPhase(observability, {
                 phase: "file_materialization",
                 provider: turnExecutionPolicy.providerId,
                 backend: activeSandboxBackend ?? groupBoxBackend,
-                outcome: fileMaterializationOutcome,
-                durationSeconds: (performance.now() - fileMaterializationStartedAt) / 1e3,
-                count: fileResourceDownloads.length,
-                cache: fileMaterializationCache
+                outcome: "completed",
+                durationSeconds: 0,
+                count: 0
               });
             }
-          } else {
-            recordTurnStartupPhase(observability, {
-              phase: "file_materialization",
-              provider: turnExecutionPolicy.providerId,
-              backend: activeSandboxBackend ?? groupBoxBackend,
-              outcome: "completed",
-              durationSeconds: 0,
-              count: 0
-            });
-          }
-          const requiredVideoFileIds = new Set(
-            requiredGeneratedVideoFiles.map((file2) => file2.fileId)
-          );
-          const failedRequiredVideo = fileMaterializationFailures.find(
-            (failure2) => requiredVideoFileIds.has(failure2.fileId)
-          );
-          if (failedRequiredVideo) {
-            observability.warn("Generated video sandbox materialization deferred", {
-              errorClass: "SandboxFileDownloadFailure",
-              errorCode: "generated_video_materialization_deferred",
-              origin: "worker"
+            const requiredVideoFileIds = new Set(
+              requiredGeneratedVideoFiles.map((file2) => file2.fileId)
+            );
+            const failedRequiredVideo = fileMaterializationFailures.find(
+              (failure2) => requiredVideoFileIds.has(failure2.fileId)
+            );
+            if (failedRequiredVideo) {
+              observability.warn("Generated video sandbox materialization deferred", {
+                errorClass: "SandboxFileDownloadFailure",
+                errorCode: "generated_video_materialization_deferred",
+                origin: "worker"
+              });
+            }
+            const unavailableSandboxFilesNote = sandboxFileDownloadFailureNote(
+              fileMaterializationFailures
+            );
+            return await runTurnStreamAttempt({
+              input,
+              settings: capabilitySettings,
+              db,
+              bus,
+              runtime,
+              objectStorage,
+              observability,
+              entitlements,
+              startVideoGenerationWorkflow,
+              startSessionTitleWorkflow,
+              sessionTitleExpectedCurrent: { title: session.title, source: session.titleSource },
+              cancellationSignal,
+              runtimeCancellationSignal,
+              activityContext,
+              dispatchId,
+              control,
+              attempt,
+              billingState,
+              sandboxState,
+              eventing: wiredEventing,
+              providerTurn,
+              leases,
+              historySink,
+              checkpointBeforeProviderDispatch,
+              media,
+              toolResultSpill,
+              claimedResult,
+              flushRuntimeBatcher,
+              finalizeTurnOpStreamOps,
+              runWorkspaceMutationForSandbox,
+              throwIfWorkerShuttingDown,
+              throwIfTurnCancelled,
+              setLastInputTokensFenced,
+              attachGitCredentialRenewal,
+              attachCodemodeTokenRenewal,
+              attachRunCredentialRenewal,
+              withProviderRequestContext,
+              withSessionTitleProviderRequestContext,
+              publishCompactionLiveEvents,
+              publishCompactionOutcomeEvents,
+              recordCompanyBrainContributionReceiptOnce,
+              modelCheckpointMemoryCollector,
+              claimedModelUsageSourceKeys,
+              emittedModelUsageSourceKeys,
+              modelUsageDispatchId,
+              workerPreparationStartedAt,
+              fileDownloadsMaterializedForRun,
+              eagerOwnedSandboxSetup,
+              unavailableSandboxFilesNote,
+              runCredentialsNote,
+              mcpAvailabilityNote,
+              knowledgeSourcePreparationNote,
+              fileAuthoritySubjectId,
+              activeSandboxBackend,
+              groupBoxBackend,
+              turnExecutionPolicy,
+              turn,
+              trigger,
+              humanInputResume,
+              attachPendingUpdatesAfterOpenSuffix,
+              agent,
+              resolvedModel,
+              providerApi,
+              runSettings,
+              turnTools,
+              generateSessionTitleInParallel,
+              sessionTitlePrompt: session.initialMessage.trim() ? session.initialMessage : turn.prompt,
+              compactSummarizer,
+              settleDeferredSteerAfterCompaction,
+              compactionModelHistoryProjector,
+              generatedImageHistoryProjector,
+              modelHistoryProjector,
+              compactionModeOptions,
+              initialRunCredentialMaterial,
+              initialGitCredentials,
+              sandboxEnvironment,
+              sandboxCodemodeToken,
+              sandboxCodemodeTokenExpiresAt,
+              fileResourceDownloads,
+              runCredentialResolver,
+              videoGenerationAcceptancesByCallId
             });
+          } finally {
+            await eagerOwnedSandboxSetup.settled();
           }
-          const unavailableSandboxFilesNote = sandboxFileDownloadFailureNote(
-            fileMaterializationFailures
-          );
-          return await runTurnStreamAttempt({
-            input,
-            settings: capabilitySettings,
-            db,
-            bus,
-            runtime,
-            objectStorage,
-            observability,
-            entitlements,
-            startVideoGenerationWorkflow,
-            startSessionTitleWorkflow,
-            sessionTitleExpectedCurrent: { title: session.title, source: session.titleSource },
-            cancellationSignal,
-            runtimeCancellationSignal,
-            activityContext,
-            dispatchId,
-            control,
-            attempt,
-            billingState,
-            sandboxState,
-            eventing: wiredEventing,
-            providerTurn,
-            leases,
-            historySink,
-            checkpointBeforeProviderDispatch,
-            media,
-            toolResultSpill,
-            claimedResult,
-            flushRuntimeBatcher,
-            finalizeTurnOpStreamOps,
-            runWorkspaceMutationForSandbox,
-            throwIfWorkerShuttingDown,
-            throwIfTurnCancelled,
-            setLastInputTokensFenced,
-            attachGitCredentialRenewal,
-            attachCodemodeTokenRenewal,
-            attachRunCredentialRenewal,
-            withProviderRequestContext,
-            withSessionTitleProviderRequestContext,
-            publishCompactionLiveEvents,
-            publishCompactionOutcomeEvents,
-            recordCompanyBrainContributionReceiptOnce,
-            modelCheckpointMemoryCollector,
-            claimedModelUsageSourceKeys,
-            emittedModelUsageSourceKeys,
-            modelUsageDispatchId,
-            workerPreparationStartedAt,
-            fileDownloadsMaterializedForRun,
-            unavailableSandboxFilesNote,
-            runCredentialsNote,
-            mcpAvailabilityNote,
-            knowledgeSourcePreparationNote,
-            fileAuthoritySubjectId,
-            activeSandboxBackend,
-            groupBoxBackend,
-            turnExecutionPolicy,
-            turn,
-            trigger,
-            humanInputResume,
-            attachPendingUpdatesAfterOpenSuffix,
-            agent,
-            resolvedModel,
-            providerApi,
-            runSettings,
-            turnTools,
-            generateSessionTitleInParallel,
-            sessionTitlePrompt: session.initialMessage.trim() ? session.initialMessage : turn.prompt,
-            compactSummarizer,
-            settleDeferredSteerAfterCompaction,
-            compactionModelHistoryProjector,
-            generatedImageHistoryProjector,
-            modelHistoryProjector,
-            compactionModeOptions,
-            initialRunCredentialMaterial,
-            initialGitCredentials,
-            sandboxEnvironment,
-            sandboxCodemodeToken,
-            sandboxCodemodeTokenExpiresAt,
-            fileResourceDownloads,
-            runCredentialResolver,
-            videoGenerationAcceptancesByCallId
-          });
         }
       );
     } catch (error51) {
@@ -44259,4 +44331,4 @@ export {
   createTurnActivities,
   createTurnActivitiesFromServices
 };
-//# sourceMappingURL=activities-turn-G33RWTX2.js.map
+//# sourceMappingURL=activities-turn-B73PNSEA.js.map