@opengeni/runtime 0.11.0 → 0.13.0

package/dist/index.js

@@ -153,13 +153,28 @@ import {
   withToolspaceTokenClient,
   withToolspaceTokenEnvironment,
   withToolspaceTokenSession
-} from "./chunk-YUAFQEFY.js";
+} from "./chunk-65UDUFUO.js";
 import {
   getSkillLibraryEntry,
   isSkillLibraryEntryId,
   listSkillLibraryEntries,
   loadSkillLibrarySkill
 } from "./chunk-DPULLAJG.js";
+import {
+  MCP_MAX_CONCURRENT_SERVER_OPERATIONS,
+  MCP_MAX_TOOL_DEFINITION_BYTES,
+  MCP_MAX_TOOL_RESULT_BYTES,
+  MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES,
+  McpAggregateToolListBudget,
+  assertMcpPayloadWithinBytes,
+  assertMcpServerSelectionWithinBounds,
+  assertMcpToolListWithinBounds,
+  boundedParallelMap,
+  cancelMcpResponseBody,
+  guardedMcpFetch,
+  mcpSerializedSizeBytes,
+  undiciFetch
+} from "./chunk-HAN5D27J.js";
 import {
   MemorySession,
   connectMcpServers
@@ -225,6 +240,7 @@ import {
 import {
   approvalIdentifier,
   CAPABILITY_DESCRIPTORS as CAPABILITY_DESCRIPTORS2,
+  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
   assertUniqueResourceMountPaths,
   gitCredentialBindingIdForRepository,
   gitCredentialProviderForRepository,
@@ -6372,6 +6388,7 @@ import {
   CODEX_APPS_MCP_SERVER_ID,
   CODEX_MODEL_ID_PREFIX,
   CODEX_ORIGINATOR,
+  CODEX_RESPONSE_SDK_OUTER_TIMEOUT_MS,
   boundModelToolOutputItems as boundModelToolOutputItems2,
   codexAppsSanitizingFetch,
   codexRequestStorage,
@@ -6972,7 +6989,21 @@ function codexToolSearchExecutor(args) {
   const deferred = (args.availableTools ?? []).filter(isCodexAppsFunctionTool);
   if (deferred.length === 0) return [];
   const { query, limit } = parseSearchArgs(args.toolCall?.arguments);
-  return bm25RankTools(deferred, query, limit);
+  const ranked = bm25RankTools(deferred, query, limit);
+  const bounded = [];
+  let disclosedBytes = 0;
+  for (const tool2 of ranked) {
+    const toolBytes = mcpSerializedSizeBytes(tool2);
+    if (toolBytes > MCP_MAX_TOOL_DEFINITION_BYTES) {
+      continue;
+    }
+    if (disclosedBytes + toolBytes > MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES) {
+      break;
+    }
+    disclosedBytes += toolBytes;
+    bounded.push(tool2);
+  }
+  return bounded;
 }
 var NO_NAMESPACES = /* @__PURE__ */ new Set();
 function hasConnectorSources(connectorNamespaces) {
@@ -8963,7 +8994,9 @@ var ComputerUseCapability = class extends Capability {
       // any computer-use-only recording. One SandboxComputer instance caches
       // this for the rest of the turn.
       prepare: async (preparedSession) => {
-        await ensureDisplayStack(preparedSession);
+        await ensureDisplayStack(preparedSession, {
+          telemetryContext: { callerKind: "computer" }
+        });
         await this.args.onReady?.(preparedSession);
       }
     });
@@ -9008,43 +9041,351 @@ var ComputerUseCapability = class extends Capability {
 };
 
 // src/usage-telemetry.ts
-function modelCallUsageTelemetry(usage) {
+var MAX_MODEL_USAGE_TOKEN_COUNT = 1e9;
+function modelUsageTokenCountOrNull(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= MAX_MODEL_USAGE_TOKEN_COUNT ? value : null;
+}
+function normalizeModelCallUsage(usage) {
+  const rejectedFields = /* @__PURE__ */ new Set();
+  if (!usage) {
+    return {
+      telemetry: {
+        inputTokens: null,
+        outputTokens: null,
+        cachedTokens: null,
+        cacheWriteTokens: null,
+        reasoningTokens: null
+      },
+      totalTokens: null,
+      rejectedFields: []
+    };
+  }
+  const requestEntries = requestUsageEntries(usage.requestUsageEntries, rejectedFields);
+  const topLevelInputTokens = reportedTokenCount(usage.inputTokens, "inputTokens", rejectedFields);
+  const topLevelOutputTokens = reportedTokenCount(
+    usage.outputTokens,
+    "outputTokens",
+    rejectedFields
+  );
+  const topLevelTotalTokens = reportedTokenCount(usage.totalTokens, "totalTokens", rejectedFields);
+  const requestInputTokens = completeRequestTokenAggregate(
+    requestEntries,
+    ["inputTokens", "input_tokens"],
+    "inputTokens.requestUsageEntries",
+    rejectedFields
+  );
+  const requestOutputTokens = completeRequestTokenAggregate(
+    requestEntries,
+    ["outputTokens", "output_tokens"],
+    "outputTokens.requestUsageEntries",
+    rejectedFields
+  );
+  let requestTotalTokens = completeRequestTokenAggregate(
+    requestEntries,
+    ["totalTokens", "total_tokens"],
+    "totalTokens.requestUsageEntries",
+    rejectedFields
+  );
+  if (rejectInconsistentRequestTotals(requestEntries, rejectedFields)) {
+    requestTotalTokens = { ...requestTotalTokens, status: "invalid", value: null };
+  }
+  const inputTokens = canonicalTokenDimension({
+    topLevel: topLevelInputTokens,
+    topLevelReported: isReported(usage.inputTokens),
+    topLevelPath: "inputTokens",
+    requestAggregate: requestInputTokens,
+    rejectedFields
+  });
+  const outputTokens = canonicalTokenDimension({
+    topLevel: topLevelOutputTokens,
+    topLevelReported: isReported(usage.outputTokens),
+    topLevelPath: "outputTokens",
+    requestAggregate: requestOutputTokens,
+    rejectedFields
+  });
+  const totalTokens = canonicalTotalTokens({
+    inputTokens,
+    outputTokens,
+    topLevel: topLevelTotalTokens,
+    topLevelReported: isReported(usage.totalTokens),
+    requestAggregate: requestTotalTokens,
+    rejectedFields
+  });
+  const inputDetailSource = preferredDetailSource(
+    usage.inputTokensDetails,
+    "inputTokensDetails",
+    requestEntries,
+    ["inputTokensDetails", "input_tokens_details"]
+  );
+  const outputDetailSource = preferredDetailSource(
+    usage.outputTokensDetails,
+    "outputTokensDetails",
+    requestEntries,
+    ["outputTokensDetails", "output_tokens_details"]
+  );
   return {
-    inputTokens: finiteNumberOrNull(usage?.inputTokens),
-    outputTokens: finiteNumberOrNull(usage?.outputTokens),
-    cachedTokens: usage ? firstPositiveDetailNumber(usage.inputTokensDetails, [
-      "cached_tokens",
-      "cachedInputTokens",
-      "cached_input_tokens"
-    ]) : null,
-    reasoningTokens: usage ? firstPositiveDetailNumber(usage.outputTokensDetails, [
-      "reasoning_tokens",
-      "reasoningTokens",
-      "reasoning_output_tokens"
-    ]) : null
+    telemetry: {
+      inputTokens,
+      outputTokens,
+      cachedTokens: aggregateDetailTokenCount(
+        inputDetailSource,
+        ["cached_tokens", "cachedInputTokens", "cached_input_tokens"],
+        "cachedTokens",
+        rejectedFields
+      ),
+      cacheWriteTokens: aggregateDetailTokenCount(
+        inputDetailSource,
+        ["cache_write_tokens", "cacheWriteTokens"],
+        "cacheWriteTokens",
+        rejectedFields
+      ),
+      reasoningTokens: aggregateDetailTokenCount(
+        outputDetailSource,
+        ["reasoning_tokens", "reasoningTokens", "reasoning_output_tokens"],
+        "reasoningTokens",
+        rejectedFields
+      )
+    },
+    totalTokens,
+    rejectedFields: [...rejectedFields].slice(0, 32)
   };
 }
-function firstPositiveDetailNumber(details, keys) {
-  if (!details) {
+function modelCallUsageTelemetry(usage) {
+  return normalizeModelCallUsage(usage).telemetry;
+}
+function requestUsageEntries(value, rejectedFields) {
+  if (value === void 0) {
+    return [];
+  }
+  if (!Array.isArray(value)) {
+    rejectField(rejectedFields, "requestUsageEntries");
+    return [];
+  }
+  const entries = [];
+  for (const [index, entry] of value.entries()) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      rejectField(rejectedFields, `requestUsageEntries[${index}]`);
+      entries.push({});
+      continue;
+    }
+    entries.push(entry);
+  }
+  return entries;
+}
+function completeRequestTokenAggregate(requestEntries, requestKeys, aggregatePath, rejectedFields) {
+  if (requestEntries.length === 0) {
+    return { status: "absent", value: null };
+  }
+  const values = [];
+  let incomplete = false;
+  let invalid = false;
+  for (const [index, entry] of requestEntries.entries()) {
+    const selected = firstPresentEntry(entry, requestKeys);
+    if (!selected || selected.value === null) {
+      incomplete = true;
+      continue;
+    }
+    const parsed = reportedTokenCount(
+      selected.value,
+      `requestUsageEntries[${index}].${selected.key}`,
+      rejectedFields
+    );
+    if (parsed === null) invalid = true;
+    values.push(parsed);
+  }
+  if (invalid) {
+    return { status: "invalid", value: null };
+  }
+  if (incomplete) {
+    return { status: "incomplete", value: null };
+  }
+  const value = boundedTokenSum(values, aggregatePath, rejectedFields);
+  return value === null ? { status: "invalid", value: null } : { status: "complete", value };
+}
+function canonicalTokenDimension(input) {
+  if (input.requestAggregate.status === "complete") {
+    if (input.topLevelReported && input.topLevel !== null && input.topLevel !== input.requestAggregate.value) {
+      rejectField(input.rejectedFields, input.topLevelPath);
+    }
+    return input.requestAggregate.value;
+  }
+  if (input.requestAggregate.status === "invalid") {
+    if (input.topLevelReported) {
+      rejectField(input.rejectedFields, input.topLevelPath);
+    }
     return null;
   }
-  const entries = Array.isArray(details) ? details : [details];
-  let sawZero = false;
-  for (const entry of entries) {
-    for (const key of keys) {
-      const value = finiteNumberOrNull(entry[key]);
-      if (value !== null && value > 0) {
-        return value;
+  return input.topLevel;
+}
+function canonicalTotalTokens(input) {
+  if (input.inputTokens !== null && input.outputTokens !== null) {
+    const derived = boundedTokenSum(
+      [input.inputTokens, input.outputTokens],
+      "totalTokens.aggregate",
+      input.rejectedFields
+    );
+    if (derived === null) {
+      if (input.topLevelReported) rejectField(input.rejectedFields, "totalTokens");
+      if (input.requestAggregate.status === "complete") {
+        rejectField(input.rejectedFields, "totalTokens.requestUsageEntries");
       }
-      if (value === 0) {
-        sawZero = true;
+      return null;
+    }
+    if (input.topLevelReported && input.topLevel !== null && input.topLevel !== derived) {
+      rejectField(input.rejectedFields, "totalTokens");
+    }
+    if (input.requestAggregate.status === "complete" && input.requestAggregate.value !== derived) {
+      rejectField(input.rejectedFields, "totalTokens.requestUsageEntries");
+    }
+    return derived;
+  }
+  if (input.requestAggregate.status === "complete") {
+    const requestTotal = input.requestAggregate.value;
+    if (requestTotal === null || !totalCoversKnownComponents(requestTotal, input.inputTokens, input.outputTokens)) {
+      rejectField(input.rejectedFields, "totalTokens.requestUsageEntries");
+      if (input.topLevelReported) rejectField(input.rejectedFields, "totalTokens");
+      return null;
+    }
+    if (input.topLevelReported && input.topLevel !== null && input.topLevel !== requestTotal) {
+      rejectField(input.rejectedFields, "totalTokens");
+    }
+    return requestTotal;
+  }
+  if (input.requestAggregate.status === "invalid") {
+    if (input.topLevelReported) rejectField(input.rejectedFields, "totalTokens");
+    return null;
+  }
+  if (input.topLevel !== null && !totalCoversKnownComponents(input.topLevel, input.inputTokens, input.outputTokens)) {
+    rejectField(input.rejectedFields, "totalTokens");
+    return null;
+  }
+  return input.topLevel;
+}
+function totalCoversKnownComponents(total, inputTokens, outputTokens) {
+  return (inputTokens === null || total >= inputTokens) && (outputTokens === null || total >= outputTokens);
+}
+function rejectInconsistentRequestTotals(requestEntries, rejectedFields) {
+  let inconsistent = false;
+  for (const [index, entry] of requestEntries.entries()) {
+    const record = entry;
+    const selectedInput = firstPresentEntry(record, ["inputTokens", "input_tokens"]);
+    const selectedOutput = firstPresentEntry(record, ["outputTokens", "output_tokens"]);
+    const selectedTotal = firstPresentEntry(record, ["totalTokens", "total_tokens"]);
+    if (!selectedInput || !selectedOutput || !selectedTotal) continue;
+    const inputTokens = modelUsageTokenCountOrNull(selectedInput.value);
+    const outputTokens = modelUsageTokenCountOrNull(selectedOutput.value);
+    const totalTokens = modelUsageTokenCountOrNull(selectedTotal.value);
+    if (inputTokens === null || outputTokens === null || totalTokens === null) continue;
+    const derived = inputTokens <= MAX_MODEL_USAGE_TOKEN_COUNT - outputTokens ? inputTokens + outputTokens : null;
+    if (derived === null || totalTokens !== derived) {
+      rejectField(rejectedFields, `requestUsageEntries[${index}].${selectedTotal.key}`);
+      inconsistent = true;
+    }
+  }
+  return inconsistent;
+}
+function isReported(value) {
+  return value !== void 0 && value !== null;
+}
+function preferredDetailSource(aggregateDetails, aggregatePath, requestEntries, requestKeys) {
+  const requestDetails = [];
+  let sawRequestDetails = false;
+  for (const [index, entry] of requestEntries.entries()) {
+    const selected = firstPresentEntry(entry, requestKeys);
+    if (!selected) {
+      requestDetails.push({
+        details: void 0,
+        path: `requestUsageEntries[${index}].${requestKeys[0]}`,
+        missing: true
+      });
+      continue;
+    }
+    sawRequestDetails = true;
+    requestDetails.push({
+      details: selected.value,
+      path: `requestUsageEntries[${index}].${selected.key}`
+    });
+  }
+  return sawRequestDetails ? requestDetails : aggregateDetails === void 0 ? [] : [{ details: aggregateDetails, path: aggregatePath }];
+}
+function aggregateDetailTokenCount(sources, keys, field, rejectedFields) {
+  const values = [];
+  let sawReportedValue = false;
+  let sawMissingValue = false;
+  for (const source of sources) {
+    if (source.missing) {
+      sawMissingValue = true;
+      continue;
+    }
+    const details = detailRecords(source.details, source.path, rejectedFields);
+    if (!details.complete) {
+      sawMissingValue = true;
+    }
+    for (const detail of details.records) {
+      const selected = firstPresentEntry(detail.record, keys);
+      if (!selected) {
+        sawMissingValue = true;
+        continue;
       }
+      sawReportedValue = true;
+      values.push(
+        reportedTokenCount(selected.value, `${detail.path}.${selected.key}`, rejectedFields)
+      );
+    }
+  }
+  return sawReportedValue && !sawMissingValue ? boundedTokenSum(values, `${field}.aggregate`, rejectedFields) : null;
+}
+function detailRecords(details, path, rejectedFields) {
+  const entries = Array.isArray(details) ? details : [details];
+  const records = [];
+  let complete = true;
+  for (const [index, entry] of entries.entries()) {
+    const entryPath = Array.isArray(details) ? `${path}[${index}]` : path;
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      rejectField(rejectedFields, entryPath);
+      complete = false;
+      continue;
+    }
+    records.push({ record: entry, path: entryPath });
+  }
+  return { records, complete };
+}
+function firstPresentEntry(record, keys) {
+  for (const key of keys) {
+    if (Object.prototype.hasOwnProperty.call(record, key) && record[key] !== void 0) {
+      return { key, value: record[key] };
+    }
+  }
+  return null;
+}
+function reportedTokenCount(value, field, rejectedFields) {
+  if (value === void 0 || value === null) {
+    return null;
+  }
+  const normalized = modelUsageTokenCountOrNull(value);
+  if (normalized === null) {
+    rejectField(rejectedFields, field);
+  }
+  return normalized;
+}
+function boundedTokenSum(values, field, rejectedFields) {
+  if (values.length === 0 || values.some((value) => value === null)) {
+    return null;
+  }
+  let total = 0;
+  for (const value of values) {
+    if (value > MAX_MODEL_USAGE_TOKEN_COUNT - total) {
+      rejectField(rejectedFields, field);
+      return null;
     }
+    total += value;
   }
-  return sawZero ? 0 : null;
+  return total;
 }
-function finiteNumberOrNull(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : null;
+function rejectField(rejectedFields, field) {
+  if (rejectedFields.size < 32) {
+    rejectedFields.add(field);
+  }
 }
 
 // src/index.ts
@@ -9154,6 +9495,10 @@ function buildProviderClient(provider, settings) {
       // SDK retries on network/5xx/partial streams can replay provider work
       // or external tool side effects without a durable checkpoint.
       maxRetries: 0,
+      // The Codex transport owns finer headers/idle/whole deadlines and
+      // emits typed durable evidence. Keep the SDK's opaque envelope beyond
+      // that whole-response budget so `Request timed out.` cannot win first.
+      timeout: CODEX_RESPONSE_SDK_OUTER_TIMEOUT_MS,
       fetch: codexSubscriptionFetch(instrumentedModelFetch(provider.id, globalThis.fetch))
     })
   ) : (
@@ -9184,7 +9529,7 @@ function resolveTurnModel(settings, modelId) {
   return {
     provider: resolved.provider,
     client,
-    model: buildModelInstance(resolved.provider, client, resolved.model.id),
+    model: buildModelInstance(resolved.provider, client, resolved.model.upstreamModelId),
     configured: resolved.model
   };
 }
@@ -9834,7 +10179,7 @@ function maybeInstallCodexToolSearch(agent, settings, options) {
   }
 }
 function mcpToolRequiresApproval(policy, unprefixedName) {
-  return policy === true || Array.isArray(policy) && policy.includes(unprefixedName);
+  return policy === true || policy !== false && policy.has(unprefixedName);
 }
 function installMcpApprovalPolicy(agent, policies) {
   const listMcpTools = agent.getMcpTools.bind(agent);
@@ -9866,7 +10211,7 @@ function applyMcpApprovalPolicy(agent, settings) {
     (server) => server.requireApproval === true || Array.isArray(server.requireApproval) && server.requireApproval.length > 0
   ).map((server) => ({
     prefix: prefixedMcpToolName(server.id, ""),
-    requireApproval: server.requireApproval
+    requireApproval: server.requireApproval === true ? true : new Set(server.requireApproval)
   })).sort((a, b) => b.prefix.length - a.prefix.length);
   if (policies.length === 0) {
     return;
@@ -9966,22 +10311,76 @@ function buildAgentCapabilities(settings, packSkills, options = {}) {
 function sandboxRunAs(_settings) {
   return void 0;
 }
+async function connectMcpServersInBatches(servers, options) {
+  assertMcpServerSelectionWithinBounds(servers);
+  const batches = [];
+  try {
+    for (let offset = 0; offset < servers.length; offset += MCP_MAX_CONCURRENT_SERVER_OPERATIONS) {
+      batches.push(
+        await connectMcpServers(
+          servers.slice(offset, offset + MCP_MAX_CONCURRENT_SERVER_OPERATIONS),
+          {
+            connectInParallel: true,
+            strict: options.strict
+          }
+        )
+      );
+    }
+  } catch (error) {
+    await closeMcpServerBatches(batches).catch(() => void 0);
+    throw error;
+  }
+  const errors = /* @__PURE__ */ new Map();
+  for (const batch of batches) {
+    for (const [server, error] of batch.errors) errors.set(server, error);
+  }
+  return {
+    active: batches.flatMap((batch) => batch.active),
+    failed: batches.flatMap((batch) => batch.failed),
+    errors,
+    close: async () => {
+      await closeMcpServerBatches(batches);
+    }
+  };
+}
+async function closeMcpServerBatches(batches) {
+  let firstError;
+  for (const batch of [...batches].reverse()) {
+    try {
+      await batch.close();
+    } catch (error) {
+      firstError ??= error;
+    }
+  }
+  if (firstError !== void 0) throw firstError;
+}
 async function prepareAgentTools(settings, tools, options = {}) {
   const codexConnectorNamespaces = /* @__PURE__ */ new Set();
+  assertMcpServerSelectionWithinBounds(tools);
   if (tools.length === 0) {
     return { mcpServers: [], close: async () => {
     }, codexConnectorNamespaces };
   }
   const registry = new Map(settings.mcpServers.map((server) => [server.id, server]));
-  const servers = await Promise.all(
-    tools.map(async (tool2) => {
+  const aggregateToolBudget = new McpAggregateToolListBudget();
+  const mcpFetchImpl = options.mcpFetchImpl ?? undiciFetch;
+  const servers = await boundedParallelMap(
+    tools,
+    MCP_MAX_CONCURRENT_SERVER_OPERATIONS,
+    async (tool2, index) => {
       const config = registry.get(tool2.id);
       if (!config) {
         throw new Error(`Unknown MCP server id: ${tool2.id}`);
       }
       const url = firstPartyMcpServerUrlForRun(settings, config, options.workspaceId) ?? config.url;
-      const baseFetch = isCodexAppsMcpServer(config) ? codexAppsSanitizingFetch(globalThis.fetch, codexConnectorNamespaces) : globalThis.fetch;
-      const fetchImpl = config.connectionRef ? connectionBrokerFetch(baseFetch, config, options) : isFirstPartyMcpServer(settings, config) ? firstPartyAuthFetch(baseFetch, settings, options) : baseFetch;
+      const firstParty = isFirstPartyMcpServer(settings, config);
+      const baseFetch = isCodexAppsMcpServer(config) ? codexAppsSanitizingFetch(mcpFetchImpl, codexConnectorNamespaces) : mcpFetchImpl;
+      const guardedFetch = guardedMcpFetch(
+        firstParty ? { ...settings, integrationsAllowPrivateNetworkTargets: true } : settings,
+        baseFetch,
+        firstParty ? { requireHttpsOutsideLocalTest: false } : {}
+      );
+      const fetchImpl = config.connectionRef ? connectionBrokerFetch(guardedFetch, config, options) : firstParty ? firstPartyAuthFetch(guardedFetch, settings, options) : guardedFetch;
       const optional = tool2.optional === true;
       const bestEffort = isCodexAppsMcpServer(config) || optional || !!config.connectionRef;
       const server = new PrefixedMcpServer(
@@ -9993,7 +10392,7 @@ async function prepareAgentTools(settings, tools, options = {}) {
           // MCP SDK's strict Tool schema rejects (fails the turn during tools/list);
           // sanitize the response on the wire before validation. The namespace Set
           // also captures each tool's original connector namespace (P4 Part B.1).
-          ...fetchImpl !== globalThis.fetch ? { fetch: fetchImpl } : {},
+          fetch: fetchImpl,
           ...await mcpServerRequestInit(settings, config),
           ...config.timeoutMs ? {
             timeout: config.timeoutMs,
@@ -10002,30 +10401,35 @@ async function prepareAgentTools(settings, tools, options = {}) {
         }),
         config.id,
         config.allowedTools,
-        bestEffort
+        bestEffort,
+        aggregateToolBudget,
+        `${config.id}:${index}`
       );
       return {
         server,
         bestEffort,
         optional
       };
-    })
+    }
   );
   const requiredServers = servers.filter((entry) => !entry.bestEffort).map((entry) => entry.server);
   const bestEffortServers = servers.filter((entry) => entry.bestEffort).map((entry) => entry.server);
   const optionalServerNames = new Set(
     servers.filter((entry) => entry.optional).map((entry) => entry.server.name)
   );
-  const connectedRequired = await connectMcpServers(requiredServers, {
-    connectInParallel: true,
-    strict: true
-  });
-  const connectedBestEffort = bestEffortServers.length ? await connectMcpServers(bestEffortServers, {
-    connectInParallel: true,
-    strict: false
-  }) : null;
+  const connectedRequired = await connectMcpServersInBatches(requiredServers, { strict: true });
+  let connectedBestEffort = null;
+  try {
+    connectedBestEffort = bestEffortServers.length ? await connectMcpServersInBatches(bestEffortServers, { strict: false }) : null;
+  } catch (error) {
+    await connectedRequired.close().catch(() => void 0);
+    throw error;
+  }
   if (connectedBestEffort) {
     for (const failed of connectedBestEffort.failed) {
+      if (failed instanceof PrefixedMcpServer) {
+        failed.releaseAggregateBudget();
+      }
       if (!optionalServerNames.has(failed.name)) {
         continue;
       }
@@ -10039,10 +10443,20 @@ async function prepareAgentTools(settings, tools, options = {}) {
   return {
     mcpServers: [...connectedRequired.active, ...connectedBestEffort?.active ?? []],
     close: async () => {
-      await connectedRequired.close();
+      let firstError;
       if (connectedBestEffort) {
-        await connectedBestEffort.close();
+        try {
+          await connectedBestEffort.close();
+        } catch (error) {
+          firstError ??= error;
+        }
       }
+      try {
+        await connectedRequired.close();
+      } catch (error) {
+        firstError ??= error;
+      }
+      if (firstError !== void 0) throw firstError;
     },
     codexConnectorNamespaces
   };
@@ -10054,10 +10468,12 @@ function connectionBrokerFetch(baseFetch, config, options) {
   }
   return async (input, init) => {
     const request = await mcpRequestInfo(input, init);
+    const destinationUrl = mcpRequestDestinationUrl(input);
     const first = await resolveConnectionForRequest(
       options,
       config.id,
       connectionRef,
+      destinationUrl,
       request.toolName,
       false
     );
@@ -10069,10 +10485,12 @@ function connectionBrokerFetch(baseFetch, config, options) {
       withConnectionHeaders(input, init, first.headers)
     );
     if (response.status === 401) {
+      await cancelMcpResponseBody(response);
       const refreshed = await resolveConnectionForRequest(
         options,
         config.id,
         connectionRef,
+        destinationUrl,
         request.toolName,
         true
       );
@@ -10085,9 +10503,14 @@ function connectionBrokerFetch(baseFetch, config, options) {
       );
       if (retry.status === 403) {
         const auth = insufficientScopeAuth(retry.headers, connectionRef, refreshed.connectionId);
-        return auth ? await authNeededFetchResponse(options, config.id, request, auth, connectionRef) : retry;
+        if (auth) {
+          await cancelMcpResponseBody(retry);
+          return await authNeededFetchResponse(options, config.id, request, auth, connectionRef);
+        }
+        return retry;
       }
       if (retry.status === 401) {
+        await cancelMcpResponseBody(retry);
         return await authNeededFetchResponse(
           options,
           config.id,
@@ -10109,12 +10532,16 @@ function connectionBrokerFetch(baseFetch, config, options) {
     }
     if (response.status === 403) {
       const auth = insufficientScopeAuth(response.headers, connectionRef, first.connectionId);
-      return auth ? await authNeededFetchResponse(options, config.id, request, auth, connectionRef) : response;
+      if (auth) {
+        await cancelMcpResponseBody(response);
+        return await authNeededFetchResponse(options, config.id, request, auth, connectionRef);
+      }
+      return response;
     }
     return response;
   };
 }
-async function resolveConnectionForRequest(options, serverId, connectionRef, toolName, forceRefresh) {
+async function resolveConnectionForRequest(options, serverId, connectionRef, destinationUrl, toolName, forceRefresh) {
   if (!options.workspaceId || !options.resolveCredential) {
     return {
       status: "auth_needed",
@@ -10131,6 +10558,7 @@ async function resolveConnectionForRequest(options, serverId, connectionRef, too
     workspaceId: options.workspaceId,
     serverId,
     connectionRef,
+    destinationUrl,
     forceRefresh,
     ...toolName ? { toolName } : {},
     ...options.subjectId ? { subjectId: options.subjectId } : {}
@@ -10194,6 +10622,9 @@ async function publishAuthNeeded(options, payload) {
   } catch {
   }
 }
+function mcpRequestDestinationUrl(input) {
+  return new URL(input instanceof Request ? input.url : input.toString()).toString();
+}
 async function mcpRequestInfo(input, init) {
   const body = typeof init?.body === "string" ? init.body : input instanceof Request && (init?.method ?? input.method).toUpperCase() === "POST" ? await input.clone().text().catch(() => "") : "";
   if (!body) {
@@ -10326,7 +10757,7 @@ async function signFirstPartyDelegatedBearer(settings, options) {
     workspaceId: options.workspaceId,
     subjectId: options.subjectId ?? "worker:first-party-mcp",
     ...options.subjectLabel ? { subjectLabel: options.subjectLabel } : {},
-    permissions: options.firstPartyPermissions ?? firstPartyMcpPermissions,
+    permissions: options.firstPartyPermissions ?? [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS],
     ...options.sessionId ? { sessionId: options.sessionId } : {},
     ...options.turnId ? { turnId: options.turnId } : {},
     ...options.attemptId ? { attemptId: options.attemptId } : {},
@@ -10375,21 +10806,6 @@ async function codexAppsMcpRequestInit(settings) {
   }
   return { requestInit: { headers } };
 }
-var firstPartyMcpPermissions = [
-  "workspace:read",
-  "files:read",
-  "documents:search",
-  "scheduled_tasks:manage",
-  "scheduled_tasks:run",
-  "goals:manage",
-  "sessions:read",
-  "sessions:create",
-  "sessions:control",
-  "variable-sets:use",
-  "variable-sets:manage",
-  "rigs:use",
-  "github:use"
-];
 function isCodexAppsMcpServer(config) {
   return config.id === CODEX_APPS_MCP_SERVER_ID;
 }
@@ -10457,8 +10873,10 @@ function prefixedMcpToolName(registryId, toolName) {
   return sharedPrefixedMcpToolName(registryId, toolName);
 }
 var PrefixedMcpServer = class {
-  constructor(inner, registryId, allowedTools, bestEffort = false) {
+  constructor(inner, registryId, allowedTools, bestEffort = false, aggregateToolBudget, aggregateSourceId = registryId) {
     this.inner = inner;
+    this.aggregateToolBudget = aggregateToolBudget;
+    this.aggregateSourceId = aggregateSourceId;
     this.name = registryId;
     this.prefix = prefixedMcpToolName(registryId, "");
     this.cacheToolsList = inner.cacheToolsList;
@@ -10480,12 +10898,22 @@ var PrefixedMcpServer = class {
     return this.inner.connect();
   }
   close() {
+    this.releaseAggregateBudget();
     return this.inner.close();
   }
+  releaseAggregateBudget() {
+    this.aggregateToolBudget?.remove(this.aggregateSourceId);
+  }
   async listTools() {
-    let tools;
     try {
-      tools = await this.inner.listTools();
+      const tools = assertMcpToolListWithinBounds(await this.inner.listTools());
+      const exposed = tools.filter((tool2) => this.isAllowed(tool2.name)).map((tool2) => ({
+        ...tool2,
+        name: prefixedMcpToolName(this.name, tool2.name)
+      }));
+      const bounded = this.aggregateToolBudget?.replace(this.aggregateSourceId, exposed) ?? assertMcpToolListWithinBounds(exposed);
+      this.listedToolSchemaTokens = estimateSerializedValueTokens(bounded);
+      return bounded;
     } catch (error) {
       if (!this.bestEffort) {
         throw error;
@@ -10499,14 +10927,9 @@ var PrefixedMcpServer = class {
           { serverId: this.name, ...safeMcpErrorFields(error) }
         );
       }
+      this.releaseAggregateBudget();
       return [];
     }
-    const exposed = tools.filter((tool2) => this.isAllowed(tool2.name)).map((tool2) => ({
-      ...tool2,
-      name: prefixedMcpToolName(this.name, tool2.name)
-    }));
-    this.listedToolSchemaTokens = estimateSerializedValueTokens(exposed);
-    return exposed;
   }
   /** Latest exact tools/list projection used to build the model request. */
   modelToolSchemaTokens() {
@@ -10518,7 +10941,9 @@ var PrefixedMcpServer = class {
       throw new Error(`MCP tool ${unprefixed} is not allowed for server ${this.name}`);
     }
     try {
-      return await this.inner.callTool(unprefixed, args, meta);
+      const output = await this.inner.callTool(unprefixed, args, meta);
+      assertMcpPayloadWithinBytes(output, MCP_MAX_TOOL_RESULT_BYTES, "MCP tool result");
+      return output;
     } catch (error) {
       if (isAuthNeededMcpError(error)) {
         return {
@@ -11590,17 +12015,18 @@ function usageFromResponse(response) {
     ),
     ...numberProp(record, "totalTokens", "totalTokens", "total_tokens"),
     ...inputTokenDetailsProp(record),
-    ...outputTokenDetailsProp(record)
+    ...outputTokenDetailsProp(record),
+    ...requestUsageEntriesProp(record)
   };
   return Object.keys(usage).length > 0 ? usage : null;
 }
 function numberProp(raw, outputKey, ...keys) {
   const value = keys.map((key) => raw[key]).find((candidate) => candidate !== void 0);
-  return typeof value === "number" && Number.isFinite(value) ? { [outputKey]: value } : {};
+  return typeof value === "number" ? { [outputKey]: value } : {};
 }
 function inputTokenDetailsProp(raw) {
   const details = raw.inputTokensDetails ?? raw.input_tokens_details ?? raw.promptTokensDetails ?? raw.prompt_tokens_details;
-  if (!details || typeof details !== "object") {
+  if (details === void 0 || details === null) {
     return {};
   }
   return {
@@ -11610,13 +12036,25 @@ function inputTokenDetailsProp(raw) {
 function outputTokenDetailsProp(raw) {
   const details = raw.outputTokensDetails ?? raw.output_tokens_details;
   const normalized = details ?? raw.completionTokensDetails ?? raw.completion_tokens_details;
-  if (!normalized || typeof normalized !== "object") {
+  if (normalized === void 0 || normalized === null) {
     return {};
   }
   return {
     outputTokensDetails: normalized
   };
 }
+function requestUsageEntriesProp(raw) {
+  const entries = raw.requestUsageEntries ?? raw.request_usage_entries;
+  if (entries === void 0 || entries === null) {
+    return {};
+  }
+  return {
+    // The normalizer validates every entry and all supported field aliases.
+    // Preserve the SDK objects rather than rebuilding them and accidentally
+    // dropping provider detail fields such as cache_write_tokens.
+    requestUsageEntries: entries
+  };
+}
 function serializeApprovals(interruptions) {
   return interruptions.filter((item) => interruptionToolName(item) !== HUMAN_INPUT_TOOL_NAME).map((item) => {
     if (typeof item?.toJSON === "function") {
@@ -12085,13 +12523,95 @@ function runtimeGitBindingDescriptors(resources) {
     };
   });
 }
+function gitCredentialBindingKey(provider, credentialBindingId) {
+  return `${provider}\0${credentialBindingId}`;
+}
+function brokeredGitCredentialBindingKeys(bindings) {
+  return new Set(
+    bindings.filter((binding) => binding.transport?.kind === "http_broker").map((binding) => gitCredentialBindingKey(binding.provider, binding.credentialBindingId))
+  );
+}
+function runtimeGitHttpBrokerRouteDescriptors(resources, bindings) {
+  const resourceDescriptors = runtimeGitBindingDescriptors(resources);
+  const byBindingAndUri = /* @__PURE__ */ new Map();
+  for (const descriptor of resourceDescriptors) {
+    byBindingAndUri.set(
+      `${gitCredentialBindingKey(descriptor.provider, descriptor.credentialBindingId)}\0${descriptor.uri}`,
+      descriptor
+    );
+  }
+  const routes = [];
+  const claimedRepositoryUris = /* @__PURE__ */ new Set();
+  const claimedBrokerUris = /* @__PURE__ */ new Set();
+  for (const binding of bindings) {
+    if (!binding.transport) continue;
+    if (typeof binding.transport !== "object" || binding.transport.kind !== "http_broker" || !Array.isArray(binding.transport.repositories)) {
+      throw new Error(
+        `Git credential binding ${binding.credentialBindingId} uses an unsupported transport`
+      );
+    }
+    const bindingKey = gitCredentialBindingKey(binding.provider, binding.credentialBindingId);
+    const expected = resourceDescriptors.filter(
+      (descriptor) => gitCredentialBindingKey(descriptor.provider, descriptor.credentialBindingId) === bindingKey
+    );
+    if (expected.length === 0 || binding.transport.repositories.length !== expected.length) {
+      throw new Error(
+        `Git HTTP broker binding ${binding.credentialBindingId} does not cover its exact repository set`
+      );
+    }
+    for (const route of binding.transport.repositories) {
+      if (!route || typeof route !== "object" || typeof route.repositoryUri !== "string" || typeof route.brokerUri !== "string") {
+        throw new Error(
+          `Git HTTP broker binding ${binding.credentialBindingId} contains an invalid repository route`
+        );
+      }
+      const descriptor = byBindingAndUri.get(`${bindingKey}\0${route.repositoryUri}`);
+      if (!descriptor || claimedRepositoryUris.has(route.repositoryUri)) {
+        throw new Error(
+          `Git HTTP broker binding ${binding.credentialBindingId} contains an unexpected repository route`
+        );
+      }
+      let brokerUrl;
+      try {
+        brokerUrl = new URL(route.brokerUri);
+      } catch {
+        throw new Error(
+          `Git HTTP broker binding ${binding.credentialBindingId} contains an invalid broker URI`
+        );
+      }
+      if (brokerUrl.protocol !== "https:" || brokerUrl.username || brokerUrl.password || brokerUrl.search || brokerUrl.hash || brokerUrl.href !== route.brokerUri || claimedBrokerUris.has(brokerUrl.href)) {
+        throw new Error(
+          `Git HTTP broker binding ${binding.credentialBindingId} contains an unsafe broker URI`
+        );
+      }
+      claimedRepositoryUris.add(route.repositoryUri);
+      claimedBrokerUris.add(brokerUrl.href);
+      routes.push({
+        provider: binding.provider,
+        credentialBindingId: binding.credentialBindingId,
+        bindingHash: gitCredentialBindingHash(binding.credentialBindingId),
+        repositoryUri: route.repositoryUri,
+        brokerUri: route.brokerUri,
+        protocol: "https",
+        host: brokerUrl.host.toLowerCase(),
+        path: brokerUrl.pathname.replace(/^\/+|\/+$/g, "")
+      });
+    }
+  }
+  return routes;
+}
 function gitUsernameForProvider(provider) {
   if (provider === "github") return "x-access-token";
   if (provider === "gitlab") return "oauth2";
   return "opengeni";
 }
-function gitCredentialHelperBindingCaseLines(resources) {
-  return runtimeGitBindingDescriptors(resources).flatMap((descriptor) => {
+function gitCredentialHelperBindingCaseLines(resources, bindings) {
+  const brokeredBindings = brokeredGitCredentialBindingKeys(bindings);
+  return runtimeGitBindingDescriptors(resources).filter(
+    (descriptor) => !brokeredBindings.has(
+      gitCredentialBindingKey(descriptor.provider, descriptor.credentialBindingId)
+    )
+  ).flatMap((descriptor) => {
     const paths = /* @__PURE__ */ new Set([
       descriptor.path,
       descriptor.path.replace(/\.git$/, ""),
@@ -12102,7 +12622,19 @@ function gitCredentialHelperBindingCaseLines(resources) {
     );
   });
 }
-function gitAskpassHostProviderCaseLines(resources) {
+function gitCredentialHelperBrokerCaseLines(routes) {
+  return routes.flatMap((route) => {
+    const paths = /* @__PURE__ */ new Set([
+      route.path,
+      route.path.replace(/\.git$/, ""),
+      `${route.path.replace(/\.git$/, "")}.git`
+    ]);
+    return [...paths].map(
+      (path) => `  ${shellQuote(`${route.protocol}|${route.host}|${path}`)}) username=opengeni; token_file="$credential_dir/${route.bindingHash}-token" ;;`
+    );
+  });
+}
+function gitAskpassHostProviderCaseLines(resources, brokerRoutes) {
   const hosts = /* @__PURE__ */ new Map();
   for (const descriptor of runtimeGitBindingDescriptors(resources)) {
     const entry = hosts.get(descriptor.host) ?? {
@@ -12112,9 +12644,13 @@ function gitAskpassHostProviderCaseLines(resources) {
     entry.bindings.add(`${descriptor.provider}\0${descriptor.credentialBindingId}`);
     hosts.set(descriptor.host, entry);
   }
-  return [...hosts.entries()].filter(([, entry]) => entry.bindings.size === 1).sort(([a], [b]) => a.localeCompare(b)).map(
-    ([hostname, entry]) => `    ${shellQuote(hostname)}) printf '%s\\n' ${entry.provider}; return 0 ;;`
-  );
+  const brokerHosts = [...new Set(brokerRoutes.map((route) => route.host))].sort((a, b) => a.localeCompare(b)).map((hostname) => `    ${shellQuote(hostname)}) printf '\\n'; return 0 ;;`);
+  return [
+    ...brokerHosts,
+    ...[...hosts.entries()].filter(([, entry]) => entry.bindings.size === 1).sort(([a], [b]) => a.localeCompare(b)).map(
+      ([hostname, entry]) => `    ${shellQuote(hostname)}) printf '%s\\n' ${entry.provider}; return 0 ;;`
+    )
+  ];
 }
 function gitCredentialTokenWriterCommandLines(bindings = []) {
   const bindingWrites = bindings.flatMap((binding) => {
@@ -12123,7 +12659,7 @@ function gitCredentialTokenWriterCommandLines(bindings = []) {
     const count = Math.max(1, binding.providerBindingCount ?? 1);
     const provider = binding.provider;
     const lines = [`write_git_binding_token ${shellQuote(hash)} "\${${seedEnv}:-}"`];
-    if (count === 1) {
+    if (count === 1 && binding.transport?.kind !== "http_broker") {
       lines.push(`write_git_provider_token ${shellQuote(provider)} "\${${seedEnv}:-}"`);
     } else {
       lines.push(`remove_git_provider_token ${shellQuote(provider)}`);
@@ -12184,11 +12720,36 @@ function gitCredentialTokenWriterCommandLines(bindings = []) {
     'umask "$seed_umask"'
   ];
 }
+function gitHttpBrokerConfigCommandLines(routes) {
+  return [
+    'git_http_broker_config="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/http-broker.gitconfig"',
+    'mkdir -p "$(dirname "$git_http_broker_config")"',
+    'broker_umask="$(umask)"',
+    "umask 077",
+    ': > "$git_http_broker_config.tmp.$$"',
+    ...routes.map(
+      (route) => `git config --file "$git_http_broker_config.tmp.$$" --add ${shellQuote(`url.${route.brokerUri}.insteadOf`)} ${shellQuote(route.repositoryUri)}`
+    ),
+    'mv -f "$git_http_broker_config.tmp.$$" "$git_http_broker_config"',
+    'umask "$broker_umask"',
+    'git config --global --unset-all include.path "$git_http_broker_config" >/dev/null 2>&1 || true',
+    'git config --global --add include.path "$git_http_broker_config"'
+  ];
+}
 function gitCredentialHelperCommandLines(resources = [], bindings = []) {
-  const hostProviderCases = gitAskpassHostProviderCaseLines(resources);
-  const bindingCases = gitCredentialHelperBindingCaseLines(resources);
+  const brokerRoutes = runtimeGitHttpBrokerRouteDescriptors(resources, bindings);
+  const hostProviderCases = gitAskpassHostProviderCaseLines(resources, brokerRoutes);
+  const bindingCases = [
+    ...gitCredentialHelperBindingCaseLines(resources, bindings),
+    ...gitCredentialHelperBrokerCaseLines(brokerRoutes)
+  ];
   const descriptors = runtimeGitBindingDescriptors(resources);
-  const wrapperDescriptors = bindings.length > 0 ? descriptors : [];
+  const brokeredBindings = brokeredGitCredentialBindingKeys(bindings);
+  const wrapperDescriptors = bindings.length > 0 ? descriptors.filter(
+    (descriptor) => !brokeredBindings.has(
+      gitCredentialBindingKey(descriptor.provider, descriptor.credentialBindingId)
+    )
+  ) : [];
   const bindingProviders = /* @__PURE__ */ new Map();
   for (const descriptor of runtimeGitBindingDescriptors(resources)) {
     const ids = bindingProviders.get(descriptor.provider) ?? /* @__PURE__ */ new Set();
@@ -12213,6 +12774,23 @@ function gitCredentialHelperCommandLines(resources = [], bindings = []) {
     ] : [];
   });
   const multiWrapperProviders = bindings.length > 0 ? [...bindingProviders.entries()].filter(([, ids]) => ids.size > 1).map(([provider]) => provider) : [];
+  const brokeredOriginCases = brokerRoutes.flatMap((route) => {
+    const base = route.repositoryUri.replace(/\.git$/, "");
+    return [.../* @__PURE__ */ new Set([route.repositoryUri, base, `${base}.git`])].map(
+      (uri) => `    ${shellQuote(`${route.provider}|${uri}`)}) return 0 ;;`
+    );
+  });
+  const brokeredBindingHashCases = bindings.filter((binding) => binding.transport?.kind === "http_broker").map(
+    (binding) => `    ${shellQuote(`${binding.provider}|${gitCredentialBindingHash(binding.credentialBindingId)}`)}) return 0 ;;`
+  );
+  const providerBindingKinds = /* @__PURE__ */ new Map();
+  for (const binding of bindings) {
+    const counts = providerBindingKinds.get(binding.provider) ?? { direct: 0, brokered: 0 };
+    if (binding.transport?.kind === "http_broker") counts.brokered += 1;
+    else counts.direct += 1;
+    providerBindingKinds.set(binding.provider, counts);
+  }
+  const brokerOnlyProviders = [...providerBindingKinds.entries()].filter(([, counts]) => counts.brokered > 0 && counts.direct === 0).map(([provider]) => provider);
   return [
     ...gitCredentialTokenWriterCommandLines(bindings),
     // Provision git/provider-CLI helpers at SETUP (runtime) before any clone
@@ -12304,6 +12882,7 @@ function gitCredentialHelperCommandLines(resources = [], bindings = []) {
     "git config --global --add credential.helper ''",
     'git config --global --add credential.helper "$git_credential_helper"',
     "git config --global credential.useHttpPath true",
+    ...gitHttpBrokerConfigCommandLines(brokerRoutes),
     'wrapper_dir="${OPENGENI_GIT_CLI_WRAPPER_DIR:-$HOME/.opengeni/bin}"',
     'mkdir -p "$wrapper_dir"',
     "for opengeni_git_cli_tool in gh glab az; do",
@@ -12331,12 +12910,24 @@ function gitCredentialHelperCommandLines(resources = [], bindings = []) {
     "    *) return 1 ;;",
     "  esac",
     "}",
+    "binding_hash_is_brokered() {",
+    '  case "$provider|$1" in',
+    ...brokeredBindingHashCases,
+    "    *) return 1 ;;",
+    "  esac",
+    "}",
     "binding_hash_for_origin() {",
     '  case "$provider|$1" in',
     ...originWrapperHashes,
     "    *) return 1 ;;",
     "  esac",
     "}",
+    "origin_is_brokered() {",
+    '  case "$provider|$1" in',
+    ...brokeredOriginCases,
+    "    *) return 1 ;;",
+    "  esac",
+    "}",
     "sole_binding_hash() {",
     '  case "$provider" in',
     ...soleWrapperHashes,
@@ -12344,19 +12935,25 @@ function gitCredentialHelperCommandLines(resources = [], bindings = []) {
     "  esac",
     "}",
     `multi_binding_providers=${shellQuote(multiWrapperProviders.join(" "))}`,
+    `broker_only_providers=${shellQuote(brokerOnlyProviders.join(" "))}`,
     'if [ -n "$provider" ]; then',
     "  binding_hash=",
     '  if [ -n "${OPENGENI_GIT_BINDING:-}" ]; then',
     '    binding_hash="$(hash_binding_id "$OPENGENI_GIT_BINDING")"',
+    `    binding_hash_is_brokered "$binding_hash" && { printf '%s\\n' "$tool provider API authentication is host-brokered for OPENGENI_GIT_BINDING; use the configured provider MCP tools" >&2; exit 2; }`,
     `    binding_hash_allowed "$binding_hash" || { printf '%s\\n' "OPENGENI_GIT_BINDING does not select a $provider credential attached to this session" >&2; exit 2; }`,
     "  elif command -v git >/dev/null 2>&1; then",
     '    origin="$(git config --get remote.origin.url 2>/dev/null || true)"',
+    `    [ -z "$origin" ] || ! origin_is_brokered "$origin" || { printf '%s\\n' "$tool provider API authentication is host-brokered for this repository; use the configured provider MCP tools" >&2; exit 2; }`,
     '    [ -z "$origin" ] || binding_hash="$(binding_hash_for_origin "$origin" 2>/dev/null || true)"',
     "  fi",
     '  [ -n "$binding_hash" ] || binding_hash="$(sole_binding_hash 2>/dev/null || true)"',
     '  if [ -n "$binding_hash" ]; then',
     '    token_file="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/$binding_hash-token"',
     "  else",
+    '    case " $broker_only_providers " in',
+    `      *" $provider "*) printf '%s\\n' "$tool provider API authentication is host-brokered for this session; use the configured provider MCP tools" >&2; exit 2 ;;`,
+    "    esac",
     '    case " $multi_binding_providers " in',
     `      *" $provider "*) printf '%s\\n' "Unable to select one of multiple $provider credentials; run inside an attached repository or set OPENGENI_GIT_BINDING" >&2; exit 2 ;;`,
     "    esac",
@@ -13194,6 +13791,7 @@ export {
   GENESIS_TITLE_DIRECTIVE,
   HUMAN_INPUT_TOOL_NAME,
   MAX_COMPACTION_THRESHOLD_RATIO,
+  MAX_MODEL_USAGE_TOKEN_COUNT,
   MIN_COMPACTION_THRESHOLD_RATIO,
   MaxTurnsExceededError,
   MockAgentResponder,
@@ -13247,6 +13845,7 @@ export {
   TerminalServerError,
   TerminalServerUnsupportedError,
   ToolspaceTokenPathError,
+  TurnSandboxCommandCancelledError,
   USER_MESSAGE_TRUNCATION_MARKER,
   WorkspaceModelPolicyBlockedError,
   agentErrorToControlError,
@@ -13291,12 +13890,14 @@ export {
   computerUse,
   configureOpenAI,
   configureRuntimeMetricsHooks,
+  connectMcpServersInBatches,
   contentTypeForCodec,
   contextRobustnessFilterForSettings,
   coreInstructions,
   createProductionAgentRuntime,
   createSandboxClient,
   createSandboxClientForBackend,
+  createTurnToolCancellationController,
   decideCompaction,
   decideSelfhostedRetry,
   decodeModalSnapshotId,
@@ -13353,11 +13954,13 @@ export {
   modelCallUsageTelemetry,
   modelResponseUsageFromResponse,
   modelResponseUsageFromSdkEvent,
+  modelUsageTokenCountOrNull,
   negotiateCapabilities,
   negotiateSelfhostedCapabilities,
   neutralizeToolSearchItemsInSerializedRunState,
   nextDurableOpId,
   normalizeComputerCallsFilter,
+  normalizeModelCallUsage,
   normalizeRunCredentialsResolution,
   normalizeSdkEvent,
   normalizeToolOutputForEvent,