@opengeni/worker-bundle 4.4.1 → 4.5.0

package/dist/index.js

@@ -1477,7 +1477,7 @@ async function createDefaultWorkerActivities(role, dependencies = {}) {
   if (dependencies.objectStorage == null) {
     prepareObjectStorageProvider(dependencies.settings ?? getSettings());
   }
-  return role === "control" ? (await import("./activities-control-BXAGB3AU.js")).createControlActivities(dependencies) : (await import("./activities-turn-G33RWTX2.js")).createTurnActivities(dependencies);
+  return role === "control" ? (await import("./activities-control-BXAGB3AU.js")).createControlActivities(dependencies) : (await import("./activities-turn-B73PNSEA.js")).createTurnActivities(dependencies);
 }
 function resolveOpenGeniWorkflowDefinition(moduleUrl = import.meta.url) {
   const modulePath = fileURLToPath(moduleUrl).replaceAll("\\", "/");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/worker-bundle",
-  "version": "4.4.1",
+  "version": "4.5.0",
   "description": "Opengeni worker entry and reusable embedded lifecycle, shipped with a release-coherent pre-bundled Temporal workflow artifact.",
   "license": "Apache-2.0",
   "repository": {
@@ -56,32 +56,32 @@
     "@1password/sdk": "0.5.0",
     "@keeper-security/secrets-manager-core": "17.6.0",
     "@llamaindex/liteparse": "2.14.2",
-    "@opengeni/agent-proto": "4.4.1",
-    "@opengeni/capabilities": "4.4.1",
-    "@opengeni/codemode": "4.4.1",
-    "@opengeni/codex": "4.4.1",
-    "@opengeni/config": "4.4.1",
-    "@opengeni/contracts": "4.4.1",
-    "@opengeni/core": "4.4.1",
-    "@opengeni/db": "4.4.1",
-    "@opengeni/decisions": "4.4.1",
-    "@opengeni/documents": "4.4.1",
-    "@opengeni/events": "4.4.1",
-    "@opengeni/github": "4.4.1",
-    "@opengeni/interaction": "4.4.1",
-    "@opengeni/jev": "4.4.1",
-    "@opengeni/network": "4.4.1",
-    "@opengeni/observability": "4.4.1",
-    "@opengeni/runtime": "4.4.1",
-    "@opengeni/sdk": "4.4.1",
-    "@opengeni/storage": "4.4.1",
-    "@opengeni/subscriptions": "4.4.1",
-    "@opengeni/tool-gateway": "4.4.1",
-    "@opengeni/vaults": "4.4.1",
-    "@opengeni/vaults-keeper": "4.4.1",
-    "@opengeni/vaults-onepassword": "4.4.1",
-    "@opengeni/vaults-protonpass": "4.4.1",
-    "@opengeni/xai-subscription": "4.4.1",
+    "@opengeni/agent-proto": "4.5.0",
+    "@opengeni/capabilities": "4.5.0",
+    "@opengeni/codemode": "4.5.0",
+    "@opengeni/codex": "4.5.0",
+    "@opengeni/config": "4.5.0",
+    "@opengeni/contracts": "4.5.0",
+    "@opengeni/core": "4.5.0",
+    "@opengeni/db": "4.5.0",
+    "@opengeni/decisions": "4.5.0",
+    "@opengeni/documents": "4.5.0",
+    "@opengeni/events": "4.5.0",
+    "@opengeni/github": "4.5.0",
+    "@opengeni/interaction": "4.5.0",
+    "@opengeni/jev": "4.5.0",
+    "@opengeni/network": "4.5.0",
+    "@opengeni/observability": "4.5.0",
+    "@opengeni/runtime": "4.5.0",
+    "@opengeni/sdk": "4.5.0",
+    "@opengeni/storage": "4.5.0",
+    "@opengeni/subscriptions": "4.5.0",
+    "@opengeni/tool-gateway": "4.5.0",
+    "@opengeni/vaults": "4.5.0",
+    "@opengeni/vaults-keeper": "4.5.0",
+    "@opengeni/vaults-onepassword": "4.5.0",
+    "@opengeni/vaults-protonpass": "4.5.0",
+    "@opengeni/xai-subscription": "4.5.0",
     "@temporalio/activity": "^1.17.0",
     "@temporalio/client": "^1.17.0",
     "@temporalio/worker": "^1.17.0",

package/src/activities/agent-turn/owned-sandbox-setup.ts

@@ -0,0 +1,207 @@
+import {
+  runOwnedSandboxSetup,
+  withRunCredentialsSession,
+  type GitCredentialTokenWriterSession,
+  type PreparedAgentInput,
+  type RunCredentialCommandSession,
+} from "@opengeni/runtime";
+import {
+  recordSandboxSharedPreparation,
+  recordTurnStartupPhase,
+} from "../../observability-metrics";
+import { createSharedRigSetupCoordinator } from "./sandbox-shared-preparation";
+import type { TurnStreamAttemptDeps } from "./stream-attempt";
+import { ownedTurnSandboxForAgent } from "./turn-sandbox-access";
+
+export type EagerOwnedSandboxSetupDeps = Pick<
+  TurnStreamAttemptDeps,
+  | "input"
+  | "db"
+  | "observability"
+  | "runtimeCancellationSignal"
+  | "sandboxState"
+  | "eventing"
+  | "leases"
+  | "runWorkspaceMutationForSandbox"
+  | "attachGitCredentialRenewal"
+  | "attachRunCredentialRenewal"
+  | "activeSandboxBackend"
+  | "groupBoxBackend"
+  | "turnExecutionPolicy"
+  | "agent"
+  | "runSettings"
+  | "initialRunCredentialMaterial"
+  | "initialGitCredentials"
+  | "sandboxEnvironment"
+  | "fileResourceDownloads"
+>;
+
+export type EagerOwnedSandboxSetupOptions = {
+  /** The worker delivers this turn's file resources itself. */
+  fileDownloadsMaterialized: boolean;
+  /** Receives the runtime's file-failure note when the runtime delivers files. */
+  preparedInput?: PreparedAgentInput;
+};
+
+/**
+ * Whether this turn's platform setup runs eagerly against an owned box the
+ * worker already holds. Lazy boxes run the same setup in their first-operation
+ * provisioner, and connected machines receive no platform setup.
+ */
+export function hasEagerOwnedSandboxSetup(
+  sandboxState: EagerOwnedSandboxSetupDeps["sandboxState"],
+): boolean {
+  return Boolean(
+    sandboxState.resolvedSandbox &&
+    !sandboxState.lazyOwnedSandbox &&
+    ownedTurnSandboxForAgent(sandboxState),
+  );
+}
+
+/**
+ * Run the turn's platform setup (rig setup, credential hooks, repository
+ * clones) against the eager owned box. The setup settles its workspace
+ * admission before returning, so no admission stays open into the model stream.
+ */
+export async function runEagerOwnedSandboxSetup(
+  deps: EagerOwnedSandboxSetupDeps,
+  options: EagerOwnedSandboxSetupOptions,
+): Promise<void> {
+  const { input, sandboxState, eventing, leases, observability } = deps;
+  const eagerResolvedSandbox = sandboxState.resolvedSandbox;
+  const ownedEstablished = ownedTurnSandboxForAgent(sandboxState);
+  if (!eagerResolvedSandbox || sandboxState.lazyOwnedSandbox || !ownedEstablished) return;
+  const ownedSandboxSetupStartedAt = performance.now();
+  let ownedSandboxSetupOutcome: "completed" | "failed" = "completed";
+  try {
+    const eagerSetupSession = sandboxState.setupBoxSession ?? ownedEstablished.session;
+    // The worker owns platform setup for owned boxes, so the runtime skips its
+    // credential session callback. Materialize host-managed run credentials
+    // before any setup command (including provider login hooks), then decorate
+    // setup commands so they source the active generation.
+    await deps.attachRunCredentialRenewal(
+      eagerSetupSession as RunCredentialCommandSession,
+      deps.initialRunCredentialMaterial,
+      eagerResolvedSandbox,
+    );
+    const eagerCredentialSetupSession = deps.initialRunCredentialMaterial
+      ? withRunCredentialsSession(eagerSetupSession as object, input.sessionId)
+      : eagerSetupSession;
+    await deps.runWorkspaceMutationForSandbox(
+      eagerResolvedSandbox,
+      "eagerOwnedSandboxSetup",
+      async () =>
+        await runOwnedSandboxSetup(
+          deps.agent,
+          ownedEstablished.session as never,
+          eagerCredentialSetupSession as never,
+          {
+            settings: deps.runSettings,
+            environment: deps.sandboxEnvironment,
+            ...(options.preparedInput ? { preparedInput: options.preparedInput } : {}),
+            ...(options.fileDownloadsMaterialized ? { fileDownloadsMaterialized: true } : {}),
+            onRuntimeEvent: async (event) => {
+              await leases.renewServing("runtime_event");
+              if (leases.servingLost()) {
+                throw new Error("Provider credential lease expired during sandbox setup");
+              }
+              await eventing.publish([{ type: event.type, payload: event.payload }], true);
+            },
+            ...(eventing.toolCancellationFenceRef.current
+              ? {
+                  commandRunner: eventing.toolCancellationFenceRef.current.runSandboxCommand.bind(
+                    eventing.toolCancellationFenceRef.current,
+                  ),
+                }
+              : {}),
+            ...(sandboxState.sandboxGroupId && sandboxState.sandboxHolderId
+              ? {
+                  coordinateSharedRigSetup: createSharedRigSetupCoordinator({
+                    db: deps.db,
+                    accountId: input.accountId,
+                    workspaceId: input.workspaceId,
+                    sandboxGroupId: sandboxState.sandboxGroupId,
+                    attemptId: input.attemptId,
+                    holderId: sandboxState.sandboxHolderId,
+                    sandbox: eagerResolvedSandbox,
+                    ...(deps.runtimeCancellationSignal
+                      ? { signal: deps.runtimeCancellationSignal }
+                      : {}),
+                    observe: (measurement) =>
+                      recordSandboxSharedPreparation(observability, measurement),
+                  }),
+                }
+              : {}),
+          },
+        ),
+    );
+    await deps.attachGitCredentialRenewal(
+      eagerSetupSession as GitCredentialTokenWriterSession,
+      deps.initialGitCredentials,
+    );
+  } catch (error) {
+    ownedSandboxSetupOutcome = "failed";
+    throw error;
+  } finally {
+    recordTurnStartupPhase(observability, {
+      phase: "owned_sandbox_setup",
+      provider: deps.turnExecutionPolicy.providerId,
+      backend: deps.activeSandboxBackend ?? deps.groupBoxBackend,
+      outcome: ownedSandboxSetupOutcome,
+      durationSeconds: (performance.now() - ownedSandboxSetupStartedAt) / 1_000,
+      count: deps.fileResourceDownloads.length,
+    });
+  }
+}
+
+/**
+ * The eager platform setup for each model stream of one turn attempt.
+ *
+ * The first stream's setup may already be running: it needs nothing from the
+ * model input, so the worker starts it with file delivery and input
+ * preparation instead of after them. Each later stream of the attempt runs the
+ * idempotent setup again, as before.
+ */
+export type EagerOwnedSandboxSetup = {
+  /** Run, or join the already started, setup for the next model stream. */
+  beforeModelStream(options: EagerOwnedSandboxSetupOptions): Promise<void>;
+  /** Resolves once a started setup has finished, whatever its outcome. */
+  settled(): Promise<void>;
+};
+
+export function createEagerOwnedSandboxSetup(
+  deps: EagerOwnedSandboxSetupDeps,
+  start?: { fileDownloadsMaterialized: boolean },
+  runSetup: typeof runEagerOwnedSandboxSetup = runEagerOwnedSandboxSetup,
+): EagerOwnedSandboxSetup {
+  const startedFor = start ? sandboxIdentity(deps.sandboxState) : null;
+  let started: Promise<void> | null = start
+    ? runSetup(deps, {
+        fileDownloadsMaterialized: start.fileDownloadsMaterialized,
+      })
+    : null;
+  // Observing the outcome here keeps an early failure from being unhandled;
+  // the first model stream still awaits the original promise and rethrows it.
+  const settled = started ? started.then(noop, noop) : Promise.resolve();
+  return {
+    beforeModelStream: async (options) => {
+      if (started) {
+        const prestarted = started;
+        started = null;
+        await prestarted;
+        // A box rebound while the setup ran (rotation, recovery) gets its
+        // own setup; the prestarted one only covered the earlier box.
+        if (sandboxIdentity(deps.sandboxState) === startedFor) return;
+      }
+      await runSetup(deps, options);
+    },
+    settled: () => settled,
+  };
+}
+
+function sandboxIdentity(sandboxState: EagerOwnedSandboxSetupDeps["sandboxState"]): string | null {
+  const resolved = sandboxState.resolvedSandbox;
+  return resolved ? `${resolved.leaseEpoch}:${resolved.established.instanceId}` : null;
+}
+
+function noop(): void {}