@opengeni/runtime 0.11.0 → 0.13.0

package/dist/mcp-network.d.ts

@@ -0,0 +1,78 @@
+import { Settings } from '@opengeni/config';
+import { DnsLookup, isNonPublicAddress } from '@opengeni/network';
+export { undiciFetch } from '@opengeni/network';
+
+declare const MCP_MAX_RESPONSE_BYTES: number;
+declare const MCP_MAX_INBOUND_REQUEST_BYTES: number;
+declare const MCP_MAX_TOOL_DEFINITION_BYTES: number;
+declare const MCP_MAX_TOOL_LIST_BYTES: number;
+declare const MCP_MAX_TOOL_LIST_ENTRIES = 1000;
+declare const MCP_MAX_TOOL_RESULT_BYTES: number;
+declare const MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES: number;
+declare const MCP_MAX_SELECTED_SERVERS = 64;
+declare const MCP_MAX_CONCURRENT_SERVER_OPERATIONS = 8;
+declare const MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES = 4096;
+declare const MCP_MAX_AGGREGATE_TOOL_LIST_BYTES: number;
+declare const MCP_MAX_TOOL_SEARCH_SOURCES = 64;
+declare const MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH = 120;
+declare const MCP_MAX_TOOL_SEARCH_DESCRIPTION_BYTES: number;
+declare class McpPayloadTooLargeError extends Error {
+    readonly label: string;
+    readonly actualBytes: number;
+    readonly maxBytes: number;
+    constructor(label: string, actualBytes: number, maxBytes: number);
+}
+declare function mcpSerializedSizeBytes(value: unknown): number;
+declare function assertMcpPayloadWithinBytes(value: unknown, maxBytes: number, label: string): void;
+declare function assertMcpToolListWithinBounds<T>(tools: readonly T[]): readonly T[];
+declare function assertMcpServerSelectionWithinBounds<T>(servers: readonly T[]): readonly T[];
+type McpToolListContribution = {
+    entries: number;
+    bytes: number;
+};
+/**
+ * Atomic aggregate accounting shared by every exposed tools/list in one run.
+ * A repeated list for the same source REPLACES its prior contribution, so
+ * cache invalidation/relisting cannot ratchet the budget upward. Failed
+ * replacements leave the previous accounting intact.
+ */
+declare class McpAggregateToolListBudget {
+    private readonly label;
+    private readonly maxEntries;
+    private readonly maxBytes;
+    private readonly contributions;
+    private totalEntries;
+    private totalBytes;
+    constructor(label?: string, maxEntries?: number, maxBytes?: number);
+    replace<T>(sourceId: string, tools: readonly T[]): readonly T[];
+    remove(sourceId: string): void;
+    snapshot(): Readonly<McpToolListContribution>;
+}
+/** Stable-order parallel map with a hard in-flight ceiling and fail-stop drain. */
+declare function boundedParallelMap<T, R>(values: readonly T[], concurrency: number, mapper: (value: T, index: number) => Promise<R>): Promise<R[]>;
+/**
+ * Guard normal MCP traffic with the same deployment policy as OAuth traffic.
+ * The pinned transport resolves and policy-checks the destination after the
+ * caller has composed any credential headers, then performs the final network
+ * call through the vetted Agent. It forces manual redirects, so an
+ * Authorization-bearing request never follows a provider-controlled Location
+ * to an unvalidated host.
+ *
+ * This module is deliberately agent-loop-free. API code imports the explicit
+ * `@opengeni/runtime/mcp-network` leaf rather than the runtime root barrel.
+ */
+declare function guardedMcpFetch<TInput extends string | URL | Request>(settings: Pick<Settings, "environment" | "integrationsAllowPrivateNetworkTargets">, fetchImpl: (input: TInput, init?: RequestInit) => Promise<Response>, options?: {
+    maxResponseBytes?: number;
+    dnsLookup?: DnsLookup;
+    requireHttpsOutsideLocalTest?: boolean;
+}): (input: TInput, init?: RequestInit) => Promise<Response>;
+declare function boundMcpResponseBody(response: Response, maxBytes: number): Response;
+declare function cancelMcpResponseBody(response: Response): Promise<void>;
+/** Read and rebuild an inbound MCP request before the SDK parses it. */
+declare function boundedMcpRequest(request: Request, maxBytes?: number): Promise<Request>;
+declare function assertMcpDestinationAllowed(rawUrl: string, settings: Pick<Settings, "environment" | "integrationsAllowPrivateNetworkTargets">, options?: {
+    dnsLookup?: DnsLookup;
+}): Promise<void>;
+declare const isNonPublicMcpAddress: typeof isNonPublicAddress;
+
+export { MCP_MAX_AGGREGATE_TOOL_LIST_BYTES, MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES, MCP_MAX_CONCURRENT_SERVER_OPERATIONS, MCP_MAX_INBOUND_REQUEST_BYTES, MCP_MAX_RESPONSE_BYTES, MCP_MAX_SELECTED_SERVERS, MCP_MAX_TOOL_DEFINITION_BYTES, MCP_MAX_TOOL_LIST_BYTES, MCP_MAX_TOOL_LIST_ENTRIES, MCP_MAX_TOOL_RESULT_BYTES, MCP_MAX_TOOL_SEARCH_DESCRIPTION_BYTES, MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES, MCP_MAX_TOOL_SEARCH_SOURCES, MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH, McpAggregateToolListBudget, McpPayloadTooLargeError, assertMcpDestinationAllowed, assertMcpPayloadWithinBytes, assertMcpServerSelectionWithinBounds, assertMcpToolListWithinBounds, boundMcpResponseBody, boundedMcpRequest, boundedParallelMap, cancelMcpResponseBody, guardedMcpFetch, isNonPublicMcpAddress, mcpSerializedSizeBytes };

package/dist/mcp-network.js

@@ -0,0 +1,62 @@
+import {
+  MCP_MAX_AGGREGATE_TOOL_LIST_BYTES,
+  MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES,
+  MCP_MAX_CONCURRENT_SERVER_OPERATIONS,
+  MCP_MAX_INBOUND_REQUEST_BYTES,
+  MCP_MAX_RESPONSE_BYTES,
+  MCP_MAX_SELECTED_SERVERS,
+  MCP_MAX_TOOL_DEFINITION_BYTES,
+  MCP_MAX_TOOL_LIST_BYTES,
+  MCP_MAX_TOOL_LIST_ENTRIES,
+  MCP_MAX_TOOL_RESULT_BYTES,
+  MCP_MAX_TOOL_SEARCH_DESCRIPTION_BYTES,
+  MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES,
+  MCP_MAX_TOOL_SEARCH_SOURCES,
+  MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH,
+  McpAggregateToolListBudget,
+  McpPayloadTooLargeError,
+  assertMcpDestinationAllowed,
+  assertMcpPayloadWithinBytes,
+  assertMcpServerSelectionWithinBounds,
+  assertMcpToolListWithinBounds,
+  boundMcpResponseBody,
+  boundedMcpRequest,
+  boundedParallelMap,
+  cancelMcpResponseBody,
+  guardedMcpFetch,
+  isNonPublicMcpAddress,
+  mcpSerializedSizeBytes,
+  undiciFetch
+} from "./chunk-HAN5D27J.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MCP_MAX_AGGREGATE_TOOL_LIST_BYTES,
+  MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES,
+  MCP_MAX_CONCURRENT_SERVER_OPERATIONS,
+  MCP_MAX_INBOUND_REQUEST_BYTES,
+  MCP_MAX_RESPONSE_BYTES,
+  MCP_MAX_SELECTED_SERVERS,
+  MCP_MAX_TOOL_DEFINITION_BYTES,
+  MCP_MAX_TOOL_LIST_BYTES,
+  MCP_MAX_TOOL_LIST_ENTRIES,
+  MCP_MAX_TOOL_RESULT_BYTES,
+  MCP_MAX_TOOL_SEARCH_DESCRIPTION_BYTES,
+  MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES,
+  MCP_MAX_TOOL_SEARCH_SOURCES,
+  MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH,
+  McpAggregateToolListBudget,
+  McpPayloadTooLargeError,
+  assertMcpDestinationAllowed,
+  assertMcpPayloadWithinBytes,
+  assertMcpServerSelectionWithinBounds,
+  assertMcpToolListWithinBounds,
+  boundMcpResponseBody,
+  boundedMcpRequest,
+  boundedParallelMap,
+  cancelMcpResponseBody,
+  guardedMcpFetch,
+  isNonPublicMcpAddress,
+  mcpSerializedSizeBytes,
+  undiciFetch
+};
+//# sourceMappingURL=mcp-network.js.map

package/dist/mcp-network.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/sandbox/index.d.ts

@@ -1,6 +1,6 @@
 export { collectSandboxEnvironment, parseExposedPorts } from '@opengeni/config';
 export { CAPABILITY_DESCRIPTORS, CapabilityDescriptor, DESKTOP_STREAM_PORT, StreamTokenPayload, StreamTokenPayload as StreamTokenPayloadType, TERMINAL_STREAM_PORT } from '@opengeni/contracts';
 import '@openai/agents/sandbox';
-export { A as ActiveBackendResolverDeps, b as ActiveBackendUnresolvableError, c as ActivePointer, B as BackendUnresolvableCode, C as ChannelAConflictError, d as ChannelAEmitter, e as ChannelAExecArgs, f as ChannelAExecResult, g as ChannelANotFoundError, h as ChannelASession, i as ChannelAUnavailableError, j as ChannelAUnsupportedError, k as ChannelAValidationError, l as ControlRpc, D as DEFAULT_DESKTOP_GEOMETRY, m as DISPLAY_STACK_TIMEOUT_MS, n as DesktopGeometry, o as DisplayStackError, p as DisplayStackUnsupportedError, E as EnsureDisplayStackOptions, q as EnsureDisplayStackResult, r as EnsureTerminalServerOptions, s as EnsureTerminalServerResult, t as EstablishedSandboxSession, u as ExposeStreamPortInput, v as ExposeStreamPortResult, w as ExposedPortEndpoint, F as FAULT_FIELD_WHAT_HAPPENED, x as FAULT_FIELD_WHAT_PRESERVED, y as FAULT_FIELD_WHAT_TO_TRY, z as FAULT_FIELD_WHICH_LAYER, L as LiveModalSandboxLeaseAttribution, M as MaterializeRunCredentialsOptions, G as MintStreamTokenInput, H as MockAgentResponder, I as MockAgentResponderOptions, J as MockExecHandler, K as ModalModuleLoader, N as ModalOrphanSweepResult, O as ModalSandboxAttribution, P as NEVER_SENT_DETAIL_KEY, Q as NatsControlRpc, S as NatsOpStreamConnection, T as NatsOpStreamTransport, U as NatsRequestConnection, V as NegotiationContext, W as NormalizedRunCredentialMaterial, X as NumstatEntry, Y as OP_STREAM_ACK_INTERVAL_MS, Z as OP_STREAM_DEFAULT_WINDOW_BYTES, _ as OP_STREAM_RECONNECT_HOLD_MS, $ as OP_STREAM_SILENCE_TIMEOUT_MS, a0 as OpStreamExecOutcome, a1 as OpStreamJournal, a2 as OpStreamSubscription, a3 as OpStreamTransport, a4 as OpStreamUnavailableError, a5 as PROVIDER_REGISTRY, a6 as ProviderConstructionContext, a7 as ProviderRegistration, a8 as REPOSITORY_DISCOVERY_LIMIT, a9 as RecordingArtifactMetadata, aa as RecordingCodec, ab as RecordingContentType, ac as RecordingError, ad as RecordingProcess, ae as RecordingUnavailableError, af as RepositoryDiscoveryDegradedReason, ag as RepositoryDiscoveryResult, ah as ResolvedActiveBackend, ai as RoutableBackendSession, aj as RoutableSandbox, ak as RoutingSandboxSession, al as RoutingSandboxSessionDeps, am as RoutingTransitionEvent, an as RoutingUnsupportedError, ao as RunCredentialCommandRunner, ap as RunCredentialCommandSession, aq as RunCredentialExpectedScope, R as RunCredentialSessionReady, ar as RunCredentialValidationError, as as SELFHOSTED_DEFAULT_TIMEOUT_MS, at as SELFHOSTED_DRAINING_MAX_RETRIES, au as SELFHOSTED_EXEC_DRAINING_MAX_RETRIES, av as SELFHOSTED_IDEMPOTENT_READONLY_OPS, aw as SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES, ax as SELFHOSTED_NEVER_SENT_MAX_RETRIES, ay as SELFHOSTED_RECONNECT_WINDOW_MS, az as SELFHOSTED_RELAY_STREAM_PATH, aA as SELFHOSTED_RETRY_BACKOFF_BASE_MS, aB as SELFHOSTED_RETRY_BACKOFF_CAP_MS, aC as SELFHOSTED_RETRY_BACKOFF_FACTOR, aD as SELFHOSTED_TIMEOUT_MAX_RETRIES, aE as STREAM_PORT, aF as STREAM_TOKEN_DEFAULT_TTL_SECONDS, aG as SandboxChannelAService, aH as SandboxChannelAServiceOptions, aI as SandboxConfigError, aJ as SandboxCreatedCallback, aK as SandboxProviderUnavailableError, aL as SandboxResumeStateUnavailableError, aM as SelfhostedApplyDiff, aN as SelfhostedControlError, aO as SelfhostedEditor, aP as SelfhostedEnrollment, aQ as SelfhostedExecArgs, aR as SelfhostedExecResult, aS as SelfhostedImageOutput, aT as SelfhostedLivenessState, aU as SelfhostedNegotiationInput, aV as SelfhostedOpObservation, aW as SelfhostedOpObserver, aX as SelfhostedOpStreamDeps, aY as SelfhostedRelayConfig, aZ as SelfhostedRetryClock, a_ as SelfhostedRetryDecision, a$ as SelfhostedSandboxClient, b0 as SelfhostedSession, b1 as SelfhostedSessionBuild, b2 as SelfhostedSessionDeps, b3 as SelfhostedSessionState, b4 as SelfhostedUnavailableReason, b5 as StartRecordingInput, b6 as StreamPortUnavailableError, b7 as SwapTargetEstablishability, b8 as TERMINAL_SERVER_TIMEOUT_MS, b9 as TerminalServerError, ba as TerminalServerUnsupportedError, bb as ToolspaceTokenPathError, bc as agentErrorToControlError, bd as assertDescriptorRegistryInvariants, be as assertProviderRegistryInvariants, bf as assertSafeRelPath, bg as backendSupportsOs, bh as buildDisplayStackScript, bi as buildSelfhostedBackendSession, bj as buildStreamUrl, bk as buildTerminalServerScript, bl as clearRunCredentials, bm as clearRunCredentialsForAttempt, bn as contentTypeForCodec, bo as createSandboxClient, bp as createSandboxClientForBackend, bq as decideSelfhostedRetry, br as decodeModalSnapshotId, bs as defaultSelfhostedRetryClock, bt as deletePriorPersistedSnapshot, bu as deleteRecordingArtifacts, bv as deserializeSandboxSessionStateEnvelope, bw as desktopCapableBackend, bx as drainingExhaustedError, by as drainingMessage, bz as ensureDisplayStack, bA as ensureModalRegistryImage, bB as ensureTerminalServer, bC as establishSandboxSessionFromEnvelope, bD as execDeadlineHint, bE as exposeStreamPort, bF as extForCodec, bG as inspectRecordingArtifact, bH as isExecSessionLostBanner, bI as isProviderSandboxNotFoundError, bJ as isSelfhostedProviderNotFoundError, bK as makeActiveBackendResolver, bL as materializeRunCredentials, bM as mintStreamToken, bN as modalSandboxAttributionEnvironment, bO as modalSandboxAttributionTags, bP as negotiateCapabilities, bQ as negotiateSelfhostedCapabilities, bR as nextDurableOpId, bS as normalizeRunCredentialsResolution, bT as offlineAgentError, bU as offlineControlResponse, bV as opAckSubject, bW as opFrameSubject, bX as parseExecBannerExitCode, bY as parseExecBannerSessionId, bZ as parseNumstatZ, b_ as parsePorcelainV2, b$ as parseUnifiedPatch, c0 as payloadTooLargeMessage, c1 as readWorkspaceArchiveFromEnvelopeSessionState, c2 as recordingStorageKey, c3 as renderSelfhostedFault, c4 as restoredSandboxSessionStateFromEntry, c5 as runCredentialPointerFile, c6 as runCredentialRoot, c7 as runWithToolCallCorrelation, c8 as sandboxStateEntryFromRunState, c9 as sanitizeOpIdToken, ca as selectBackend, cb as selfhostedFaultClass, cc as selfhostedLiveness, cd as selfhostedRetryBackoffMs, ce as serializeEstablishedSandboxEnvelope, cf as setSelfhostedApplyDiff, cg as startRecording, ch as stopRecording, ci as stripExecBanner, cj as subjectFor, ck as swapTargetEstablishability, cl as sweepModalOrphanSandboxes, cm as tagModalSandbox, cn as tearDownDisplayStack, co as tearDownTerminalServer, cp as terminateModalSandboxById, cq as timeoutAgentError, cr as timeoutControlResponse, cs as toolspaceTokenFileForSession, ct as toolspaceTokenFileFromEnvironment, cu as uploadRecordingArtifact, cv as verifyStreamToken, cw as withRunCredentialEnvironment, cx as withRunCredentialsClient, cy as withRunCredentialsSession, cz as withToolspaceTokenClient, cA as withToolspaceTokenEnvironment, cB as withToolspaceTokenSession } from '../index-D6yi-JcU.js';
+export { A as ActiveBackendResolverDeps, b as ActiveBackendUnresolvableError, c as ActivePointer, B as BackendUnresolvableCode, C as ChannelAConflictError, d as ChannelAEmitter, e as ChannelAExecArgs, f as ChannelAExecResult, g as ChannelANotFoundError, h as ChannelASession, i as ChannelAUnavailableError, j as ChannelAUnsupportedError, k as ChannelAValidationError, l as ControlRpc, D as DEFAULT_DESKTOP_GEOMETRY, m as DISPLAY_STACK_TIMEOUT_MS, n as DesktopGeometry, o as DisplayStackCallerKind, p as DisplayStackClassification, q as DisplayStackError, r as DisplayStackTelemetryContext, s as DisplayStackTelemetryEvent, t as DisplayStackTelemetryStatus, u as DisplayStackUnsupportedError, E as EnsureDisplayStackOptions, v as EnsureDisplayStackResult, w as EnsureTerminalServerOptions, x as EnsureTerminalServerResult, y as EstablishedSandboxSession, z as ExposeStreamPortInput, F as ExposeStreamPortResult, G as ExposedPortEndpoint, H as FAULT_FIELD_WHAT_HAPPENED, I as FAULT_FIELD_WHAT_PRESERVED, J as FAULT_FIELD_WHAT_TO_TRY, K as FAULT_FIELD_WHICH_LAYER, L as LiveModalSandboxLeaseAttribution, M as MaterializeRunCredentialsOptions, N as MintStreamTokenInput, O as MockAgentResponder, P as MockAgentResponderOptions, Q as MockExecHandler, S as ModalModuleLoader, T as ModalOrphanSweepResult, U as ModalOrphanSweepTermination, V as ModalSandboxAttribution, W as NEVER_SENT_DETAIL_KEY, X as NatsControlRpc, Y as NatsOpStreamConnection, Z as NatsOpStreamTransport, _ as NatsRequestConnection, $ as NegotiationContext, a0 as NormalizedRunCredentialMaterial, a1 as NumstatEntry, a2 as OP_STREAM_ACK_INTERVAL_MS, a3 as OP_STREAM_DEFAULT_WINDOW_BYTES, a4 as OP_STREAM_RECONNECT_HOLD_MS, a5 as OP_STREAM_SILENCE_TIMEOUT_MS, a6 as OpStreamExecOutcome, a7 as OpStreamJournal, a8 as OpStreamSubscription, a9 as OpStreamTransport, aa as OpStreamUnavailableError, ab as PROVIDER_REGISTRY, ac as ProviderConstructionContext, ad as ProviderRegistration, ae as REPOSITORY_DISCOVERY_LIMIT, af as RecordingArtifactMetadata, ag as RecordingCodec, ah as RecordingContentType, ai as RecordingError, aj as RecordingProcess, ak as RecordingUnavailableError, al as RepositoryDiscoveryDegradedReason, am as RepositoryDiscoveryResult, an as ResolvedActiveBackend, ao as RevalidateModalOrphanTermination, ap as RoutableBackendSession, aq as RoutableSandbox, ar as RoutingSandboxSession, as as RoutingSandboxSessionDeps, at as RoutingTransitionEvent, au as RoutingUnsupportedError, av as RunCredentialCommandRunner, aw as RunCredentialCommandSession, ax as RunCredentialExpectedScope, R as RunCredentialSessionReady, ay as RunCredentialValidationError, az as SELFHOSTED_DEFAULT_TIMEOUT_MS, aA as SELFHOSTED_DRAINING_MAX_RETRIES, aB as SELFHOSTED_EXEC_DRAINING_MAX_RETRIES, aC as SELFHOSTED_IDEMPOTENT_READONLY_OPS, aD as SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES, aE as SELFHOSTED_NEVER_SENT_MAX_RETRIES, aF as SELFHOSTED_RECONNECT_WINDOW_MS, aG as SELFHOSTED_RELAY_STREAM_PATH, aH as SELFHOSTED_RETRY_BACKOFF_BASE_MS, aI as SELFHOSTED_RETRY_BACKOFF_CAP_MS, aJ as SELFHOSTED_RETRY_BACKOFF_FACTOR, aK as SELFHOSTED_TIMEOUT_MAX_RETRIES, aL as STREAM_PORT, aM as STREAM_TOKEN_DEFAULT_TTL_SECONDS, aN as SandboxChannelAService, aO as SandboxChannelAServiceOptions, aP as SandboxConfigError, aQ as SandboxCreatedCallback, aR as SandboxProviderUnavailableError, aS as SandboxResumeStateUnavailableError, aT as SelfhostedApplyDiff, aU as SelfhostedControlError, aV as SelfhostedEditor, aW as SelfhostedEnrollment, aX as SelfhostedExecArgs, aY as SelfhostedExecResult, aZ as SelfhostedImageOutput, a_ as SelfhostedLivenessState, a$ as SelfhostedNegotiationInput, b0 as SelfhostedOpObservation, b1 as SelfhostedOpObserver, b2 as SelfhostedOpStreamDeps, b3 as SelfhostedRelayConfig, b4 as SelfhostedRetryClock, b5 as SelfhostedRetryDecision, b6 as SelfhostedSandboxClient, b7 as SelfhostedSession, b8 as SelfhostedSessionBuild, b9 as SelfhostedSessionDeps, ba as SelfhostedSessionState, bb as SelfhostedUnavailableReason, bc as StartRecordingInput, bd as StreamPortUnavailableError, be as SwapTargetEstablishability, bf as TERMINAL_SERVER_TIMEOUT_MS, bg as TerminalServerError, bh as TerminalServerUnsupportedError, bi as ToolspaceTokenPathError, bj as agentErrorToControlError, bk as assertDescriptorRegistryInvariants, bl as assertProviderRegistryInvariants, bm as assertSafeRelPath, bn as backendSupportsOs, bo as buildDisplayStackScript, bp as buildSelfhostedBackendSession, bq as buildStreamUrl, br as buildTerminalServerScript, bs as clearRunCredentials, bt as clearRunCredentialsForAttempt, bu as contentTypeForCodec, bv as createSandboxClient, bw as createSandboxClientForBackend, bx as decideSelfhostedRetry, by as decodeModalSnapshotId, bz as defaultSelfhostedRetryClock, bA as deletePriorPersistedSnapshot, bB as deleteRecordingArtifacts, bC as deserializeSandboxSessionStateEnvelope, bD as desktopCapableBackend, bE as drainingExhaustedError, bF as drainingMessage, bG as ensureDisplayStack, bH as ensureModalRegistryImage, bI as ensureTerminalServer, bJ as establishSandboxSessionFromEnvelope, bK as execDeadlineHint, bL as exposeStreamPort, bM as extForCodec, bN as inspectRecordingArtifact, bO as isExecSessionLostBanner, bP as isProviderSandboxNotFoundError, bQ as isSelfhostedProviderNotFoundError, bR as makeActiveBackendResolver, bS as materializeRunCredentials, bT as mintStreamToken, bU as modalSandboxAttributionEnvironment, bV as modalSandboxAttributionTags, bW as negotiateCapabilities, bX as negotiateSelfhostedCapabilities, bY as nextDurableOpId, bZ as normalizeRunCredentialsResolution, b_ as offlineAgentError, b$ as offlineControlResponse, c0 as opAckSubject, c1 as opFrameSubject, c2 as parseExecBannerExitCode, c3 as parseExecBannerSessionId, c4 as parseNumstatZ, c5 as parsePorcelainV2, c6 as parseUnifiedPatch, c7 as payloadTooLargeMessage, c8 as readWorkspaceArchiveFromEnvelopeSessionState, c9 as recordingStorageKey, ca as renderSelfhostedFault, cb as restoredSandboxSessionStateFromEntry, cc as runCredentialPointerFile, cd as runCredentialRoot, ce as runWithToolCallCorrelation, cf as sandboxStateEntryFromRunState, cg as sanitizeOpIdToken, ch as selectBackend, ci as selfhostedFaultClass, cj as selfhostedLiveness, ck as selfhostedRetryBackoffMs, cl as serializeEstablishedSandboxEnvelope, cm as setSelfhostedApplyDiff, cn as startRecording, co as stopRecording, cp as stripExecBanner, cq as subjectFor, cr as swapTargetEstablishability, cs as sweepModalOrphanSandboxes, ct as tagModalSandbox, cu as tearDownDisplayStack, cv as tearDownTerminalServer, cw as terminateModalSandboxById, cx as timeoutAgentError, cy as timeoutControlResponse, cz as toolspaceTokenFileForSession, cA as toolspaceTokenFileFromEnvironment, cB as uploadRecordingArtifact, cC as verifyStreamToken, cD as withRunCredentialEnvironment, cE as withRunCredentialsClient, cF as withRunCredentialsSession, cG as withToolspaceTokenClient, cH as withToolspaceTokenEnvironment, cI as withToolspaceTokenSession } from '../index-DGUrY_yR.js';
 import 'modal';
 import '@opengeni/agent-proto';

package/dist/sandbox/index.js

@@ -151,7 +151,7 @@ import {
   withToolspaceTokenClient,
   withToolspaceTokenEnvironment,
   withToolspaceTokenSession
-} from "../chunk-YUAFQEFY.js";
+} from "../chunk-65UDUFUO.js";
 import "../chunk-4YJ5Z52Z.js";
 import "../chunk-K4V4QYCL.js";
 import "../chunk-PZ5AY32C.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/runtime",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -28,6 +28,10 @@
     "./skill-library": {
       "types": "./dist/skill-library.d.ts",
       "import": "./dist/skill-library.js"
+    },
+    "./mcp-network": {
+      "types": "./dist/mcp-network.d.ts",
+      "import": "./dist/mcp-network.js"
     }
   },
   "publishConfig": {
@@ -45,9 +49,10 @@
     "@openai/agents": "0.13.3",
     "@openai/agents-extensions": "0.13.3",
     "@opengeni/agent-proto": "^0.3.0",
-    "@opengeni/codex": "^0.2.5",
-    "@opengeni/config": "^0.6.2",
-    "@opengeni/contracts": "^0.15.0",
+    "@opengeni/codex": "^0.2.7",
+    "@opengeni/config": "^0.6.9",
+    "@opengeni/contracts": "^0.18.0",
+    "@opengeni/network": "^0.1.1",
     "debug": "4.4.3",
     "modal": "0.7.6",
     "openai": "6.47.0",

package/src/codex-tool-search.ts

@@ -26,6 +26,11 @@
 // all unchanged). Invocation is untouched; only the wire tool-set shrinks.
 
 import { toolSearchTool, type Tool } from "@openai/agents";
+import {
+  MCP_MAX_TOOL_DEFINITION_BYTES,
+  MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES,
+  mcpSerializedSizeBytes,
+} from "./mcp-network";
 
 /** The prefix OpenGeni's PrefixedMcpServer stamps on codex_apps connector tools. */
 export const CODEX_APPS_TOOL_PREFIX = "codex_apps__";
@@ -239,7 +244,21 @@ function codexToolSearchExecutor(args: {
   const deferred = (args.availableTools ?? []).filter(isCodexAppsFunctionTool);
   if (deferred.length === 0) return [];
   const { query, limit } = parseSearchArgs(args.toolCall?.arguments);
-  return bm25RankTools(deferred, query, limit);
+  const ranked = bm25RankTools(deferred, query, limit);
+  const bounded: Tool[] = [];
+  let disclosedBytes = 0;
+  for (const tool of ranked) {
+    const toolBytes = mcpSerializedSizeBytes(tool);
+    if (toolBytes > MCP_MAX_TOOL_DEFINITION_BYTES) {
+      continue;
+    }
+    if (disclosedBytes + toolBytes > MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES) {
+      break;
+    }
+    disclosedBytes += toolBytes;
+    bounded.push(tool);
+  }
+  return bounded;
 }
 
 const NO_NAMESPACES: ReadonlySet<string> = new Set();