@opengeni/runtime 0.11.0 → 0.13.3

package/dist/index.js

@@ -29,6 +29,9 @@ import {
   REPOSITORY_DISCOVERY_LIMIT,
   RecordingError,
   RecordingUnavailableError,
+  RoutingBackendRecoveryRequiredError,
+  RoutingMutationOutcomeUnknownError,
+  RoutingRetainedProcessNotFoundError,
   RoutingSandboxSession,
   RoutingUnsupportedError,
   RunCredentialValidationError,
@@ -48,7 +51,9 @@ import {
   STREAM_TOKEN_DEFAULT_TTL_SECONDS,
   SandboxChannelAService,
   SandboxConfigError,
+  SandboxExecReadinessError,
   SandboxProviderUnavailableError,
+  SandboxReplacementProviderStateError,
   SandboxResumeStateUnavailableError,
   SelfhostedControlError,
   SelfhostedSandboxClient,
@@ -60,6 +65,9 @@ import {
   TerminalServerError,
   TerminalServerUnsupportedError,
   ToolspaceTokenPathError,
+  TurnSandboxCommandCancelledError,
+  WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,
+  WorkspaceArchiveIntegrityError,
   agentErrorToControlError,
   assertDescriptorRegistryInvariants,
   assertProviderRegistryInvariants,
@@ -69,12 +77,15 @@ import {
   buildSelfhostedBackendSession,
   buildStreamUrl,
   buildTerminalServerScript,
+  captureVerifiedWorkspaceArchive,
+  classifyProviderSandboxFailure,
   clearRunCredentials,
   clearRunCredentialsForAttempt,
   collectSandboxEnvironment,
   contentTypeForCodec,
   createSandboxClient,
   createSandboxClientForBackend,
+  createTurnToolCancellationController,
   decideSelfhostedRetry,
   decodeModalSnapshotId,
   defaultSelfhostedRetryClock,
@@ -91,9 +102,13 @@ import {
   execDeadlineHint,
   exposeStreamPort,
   extForCodec,
+  fingerprintSandboxWorkspace,
+  hasPersistableSandboxProviderIdentity,
   inspectRecordingArtifact,
   isExecSessionLostBanner,
+  isProviderSandboxGoneDuringRoutedOperation,
   isProviderSandboxNotFoundError,
+  isProviderSandboxTransientError,
   isSelfhostedProviderNotFoundError,
   localDirLazySkillSource,
   makeActiveBackendResolver,
@@ -115,10 +130,13 @@ import {
   parseNumstatZ,
   parsePorcelainV2,
   parseUnifiedPatch,
+  parseWorkspaceArchiveDescriptor,
   payloadTooLargeMessage,
+  readVerifiedWorkspaceArchive,
   readWorkspaceArchiveFromEnvelopeSessionState,
   recordingStorageKey,
   renderSelfhostedFault,
+  requirePersistableReplacementSandboxEnvelope,
   restoredSandboxSessionStateFromEntry,
   runCredentialPointerFile,
   runCredentialRoot,
@@ -130,6 +148,7 @@ import {
   selfhostedLiveness,
   selfhostedRetryBackoffMs,
   serializeEstablishedSandboxEnvelope,
+  serializeReplacementSandboxEnvelope,
   setSelfhostedApplyDiff,
   startRecording,
   stopRecording,
@@ -146,20 +165,39 @@ import {
   toolspaceTokenFileForSession,
   toolspaceTokenFileFromEnvironment,
   uploadRecordingArtifact,
+  verifyRestoredWorkspace,
+  verifySandboxExecReadiness,
   verifyStreamToken,
   withRunCredentialEnvironment,
   withRunCredentialsClient,
   withRunCredentialsSession,
   withToolspaceTokenClient,
   withToolspaceTokenEnvironment,
-  withToolspaceTokenSession
-} from "./chunk-YUAFQEFY.js";
+  withToolspaceTokenSession,
+  wrapCapabilityToolsForTurnCancellation
+} from "./chunk-JGUQSAG5.js";
 import {
   getSkillLibraryEntry,
   isSkillLibraryEntryId,
   listSkillLibraryEntries,
   loadSkillLibrarySkill
 } from "./chunk-DPULLAJG.js";
+import {
+  MCP_MAX_CONCURRENT_SERVER_OPERATIONS,
+  MCP_MAX_TOOL_DEFINITION_BYTES,
+  MCP_MAX_TOOL_RESULT_BYTES,
+  MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES,
+  McpAggregateToolListBudget,
+  assertMcpPayloadWithinBytes,
+  assertMcpServerSelectionWithinBounds,
+  assertMcpToolListWithinBounds,
+  boundedParallelMap,
+  cancelMcpResponseBody,
+  guardedMcpFetch,
+  mcpOuterConnectTimeoutMs,
+  mcpSerializedSizeBytes,
+  undiciFetch
+} from "./chunk-SSB7VOLE.js";
 import {
   MemorySession,
   connectMcpServers
@@ -225,6 +263,7 @@ import {
 import {
   approvalIdentifier,
   CAPABILITY_DESCRIPTORS as CAPABILITY_DESCRIPTORS2,
+  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
   assertUniqueResourceMountPaths,
   gitCredentialBindingIdForRepository,
   gitCredentialProviderForRepository,
@@ -5094,7 +5133,7 @@ var OpenAITracingExporter = class {
       const payloadItems = groupedItems.map((entry) => entry.toJSON()).filter((item) => !!item).map((item) => isRecord5(item) ? sanitizePayloadItemForTracesIngest(item) : item);
       const payload = { data: payloadItems };
       let attempts = 0;
-      let delay2 = this.#options.baseDelay;
+      let delay = this.#options.baseDelay;
       while (attempts < this.#options.maxRetries) {
         try {
           const response = await fetch(this.#options.endpoint, {
@@ -5128,13 +5167,13 @@ var OpenAITracingExporter = class {
         if (attempts >= this.#options.maxRetries) {
           break;
         }
-        const sleepTime = delay2 + Math.random() * 0.1 * delay2;
+        const sleepTime = delay + Math.random() * 0.1 * delay;
         const shouldContinue = await sleepWithAbort(sleepTime, signal);
         if (!shouldContinue) {
           logger_default.error("Tracing: request aborted");
           break;
         }
-        delay2 = Math.min(delay2 * 2, this.#options.maxDelay);
+        delay = Math.min(delay * 2, this.#options.maxDelay);
       }
       if (attempts >= this.#options.maxRetries) {
         logger_default.error(`Tracing: failed to export traces after ${this.#options.maxRetries} attempts`);
@@ -6372,6 +6411,7 @@ import {
   CODEX_APPS_MCP_SERVER_ID,
   CODEX_MODEL_ID_PREFIX,
   CODEX_ORIGINATOR,
+  CODEX_RESPONSE_SDK_OUTER_TIMEOUT_MS,
   boundModelToolOutputItems as boundModelToolOutputItems2,
   codexAppsSanitizingFetch,
   codexRequestStorage,
@@ -6972,7 +7012,21 @@ function codexToolSearchExecutor(args) {
   const deferred = (args.availableTools ?? []).filter(isCodexAppsFunctionTool);
   if (deferred.length === 0) return [];
   const { query, limit } = parseSearchArgs(args.toolCall?.arguments);
-  return bm25RankTools(deferred, query, limit);
+  const ranked = bm25RankTools(deferred, query, limit);
+  const bounded = [];
+  let disclosedBytes = 0;
+  for (const tool2 of ranked) {
+    const toolBytes = mcpSerializedSizeBytes(tool2);
+    if (toolBytes > MCP_MAX_TOOL_DEFINITION_BYTES) {
+      continue;
+    }
+    if (disclosedBytes + toolBytes > MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES) {
+      break;
+    }
+    disclosedBytes += toolBytes;
+    bounded.push(tool2);
+  }
+  return bounded;
 }
 var NO_NAMESPACES = /* @__PURE__ */ new Set();
 function hasConnectorSources(connectorNamespaces) {
@@ -7570,668 +7624,6 @@ function safeStringify(value) {
   }
 }
 
-// src/sandbox/turn-tool-cancellation.ts
-var TURN_EXEC_YIELD_MS = 250;
-var TURN_WRITE_YIELD_MS = 250;
-var SHELL_HELPER_YIELD_MS = 1e3;
-var SHELL_GRACEFUL_POLLS = 2;
-var SHELL_POLL_MS = 100;
-var SHELL_MARKER_DIR = "/tmp/opengeni-turn-shell";
-var delay = async (milliseconds) => await new Promise((resolve) => setTimeout(resolve, milliseconds));
-var TurnSandboxCommandCancelledError = class extends Error {
-  name = "TurnSandboxCommandCancelledError";
-  constructor(reason) {
-    super(
-      reason instanceof Error ? reason.message : String(reason ?? "Turn sandbox tools were cancelled"),
-      {
-        ...reason instanceof Error ? { cause: reason } : {}
-      }
-    );
-  }
-};
-function cancellationError(reason) {
-  return new TurnSandboxCommandCancelledError(reason);
-}
-function parsedObject(input) {
-  try {
-    const parsed = JSON.parse(input);
-    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-function cappedYield(value, cap) {
-  return typeof value === "number" && Number.isInteger(value) && value >= 0 ? Math.min(value, cap) : cap;
-}
-function execOutput(raw) {
-  const marker = "\nOutput:\n";
-  const index = raw.indexOf(marker);
-  return index >= 0 ? raw.slice(index + marker.length) : "";
-}
-function nativeCommandBanner(result) {
-  if (typeof result === "string") return result;
-  if (!result || typeof result !== "object") {
-    throw new Error("Sandbox command returned an invalid result");
-  }
-  const value = result;
-  const sessionId = typeof value.sessionId === "number" ? value.sessionId : typeof value.session_id === "number" ? value.session_id : null;
-  const exitCode = typeof value.exitCode === "number" ? value.exitCode : typeof value.exit_code === "number" ? value.exit_code : null;
-  const output = [value.output, value.stderr, value.stdout].filter(
-    (candidate) => typeof candidate === "string" && candidate.length > 0
-  ).join("\n");
-  if (sessionId !== null) {
-    return `Process running with session ID ${sessionId}
-
-Output:
-${output}`;
-  }
-  if (exitCode !== null) {
-    return `Process exited with code ${exitCode}
-
-Output:
-${output}`;
-  }
-  throw new Error("Sandbox command did not report a session id or exit code");
-}
-function completedCommandBanner(exitCode, output) {
-  return `Process exited with code ${exitCode}
-
-Output:
-${output}`;
-}
-function appendBoundedOutput(current, chunk, maxOutputTokens) {
-  const maxChars = Math.max(512, maxOutputTokens * 4);
-  const combined = current + chunk;
-  return combined.length <= maxChars ? combined : combined.slice(-maxChars);
-}
-function singleQuote(value) {
-  return `'${value.replaceAll("'", `'"'"'`)}'`;
-}
-function shellMarkerPath(token) {
-  return `${SHELL_MARKER_DIR}/${token}`;
-}
-function cancellableGroupLeaderCommand(command, markerPath) {
-  const marker = singleQuote(markerPath);
-  const markerDir = singleQuote(SHELL_MARKER_DIR);
-  return [
-    `__opengeni_marker=${marker}`,
-    "umask 077",
-    `command mkdir -p ${markerDir} || exit 125`,
-    '__opengeni_pid="$$"',
-    `__opengeni_pgid="$(command ps -o pgid= -p "$__opengeni_pid" 2>/dev/null | command tr -d '[:space:]')"`,
-    'case "$__opengeni_pid:$__opengeni_pgid" in *[!0-9:]*|*:|:*) exit 125 ;; esac',
-    '[ "$__opengeni_pid" -gt 1 ] && [ "$__opengeni_pgid" -gt 1 ] || exit 125',
-    // Never signal a provider/container-wide process group. A cancellable PTY
-    // command must be its group's leader; fail the command closed otherwise.
-    '[ "$__opengeni_pid" = "$__opengeni_pgid" ] || exit 125',
-    `command printf '%s %s\\n' "$__opengeni_pid" "$__opengeni_pgid" > "$__opengeni_marker" || exit 125`,
-    `trap 'command rm -f "$__opengeni_marker"' EXIT`,
-    "(",
-    command,
-    ")",
-    "__opengeni_status=$?",
-    'exit "$__opengeni_status"'
-  ].join("\n");
-}
-function cancellableShellCommand(command, markerPath) {
-  const groupLeaderCommand = cancellableGroupLeaderCommand(command, markerPath);
-  return [
-    '__opengeni_outer_pid="$$"',
-    `__opengeni_outer_pgid="$(command ps -o pgid= -p "$__opengeni_outer_pid" 2>/dev/null | command tr -d '[:space:]')"`,
-    'case "$__opengeni_outer_pid:$__opengeni_outer_pgid" in *[!0-9:]*|*:|:*) exit 125 ;; esac',
-    'if [ "$__opengeni_outer_pid" != "$__opengeni_outer_pgid" ]; then',
-    '  __opengeni_setsid="$(command -v setsid 2>/dev/null)"',
-    '  [ -n "$__opengeni_setsid" ] || exit 125',
-    `  exec "$__opengeni_setsid" /bin/sh -c ${singleQuote(groupLeaderCommand)}`,
-    "fi",
-    groupLeaderCommand
-  ].join("\n");
-}
-function shellHelperInput(command) {
-  return JSON.stringify({
-    cmd: command,
-    login: false,
-    tty: false,
-    yield_time_ms: SHELL_HELPER_YIELD_MS,
-    max_output_tokens: 128
-  });
-}
-function safeProcessIdentity(raw) {
-  if (parseExecBannerExitCode(raw) !== 0) return null;
-  const match = execOutput(raw).trim().match(/^(\d+)\s+(\d+)$/);
-  if (!match) return null;
-  const pid = Number.parseInt(match[1], 10);
-  const processGroupId = Number.parseInt(match[2], 10);
-  return Number.isSafeInteger(pid) && Number.isSafeInteger(processGroupId) && pid > 1 && processGroupId > 1 ? { pid, processGroupId } : null;
-}
-function identityGuardScript(state, body, missingIdentityExitCode) {
-  const identity = state.identity;
-  if (!identity || !state.token) return `exit ${missingIdentityExitCode}`;
-  const token = singleQuote(state.token);
-  return [
-    `__opengeni_pid=${identity.pid}`,
-    `__opengeni_pgid=${identity.processGroupId}`,
-    `__opengeni_token=${token}`,
-    // The randomized token lands late in the wrapped command line. Procps
-    // otherwise truncates `args` to the terminal width, which can make a live
-    // group look stale and open the quiescence fence without signalling it.
-    '__opengeni_args="$(command ps -ww -o args= -p "$__opengeni_pid" 2>/dev/null)"',
-    'case "$__opengeni_args" in *"$__opengeni_token"*) ;; *) exit 0 ;; esac',
-    `__opengeni_live_pgid="$(command ps -o pgid= -p "$__opengeni_pid" 2>/dev/null | command tr -d '[:space:]')"`,
-    '[ "$__opengeni_live_pgid" = "$__opengeni_pgid" ] || exit 0',
-    body
-  ].join("\n");
-}
-function wrapComputer(computer, track) {
-  const wrapped = Object.create(Object.getPrototypeOf(computer));
-  Object.assign(wrapped, computer);
-  for (const method of [
-    "initRun",
-    "screenshot",
-    "click",
-    "doubleClick",
-    "scroll",
-    "type",
-    "wait",
-    "move",
-    "keypress",
-    "drag"
-  ]) {
-    const original = computer[method];
-    if (typeof original !== "function") continue;
-    wrapped[method] = (...args) => track(async () => await original.apply(computer, args));
-  }
-  return wrapped;
-}
-var TurnToolCancellationControllerImpl = class {
-  cancelled = false;
-  reason;
-  inFlight = /* @__PURE__ */ new Set();
-  shellSessions = /* @__PURE__ */ new Map();
-  remoteExecs = /* @__PURE__ */ new Set();
-  rawExecInvoke = null;
-  rawWriteInvoke = null;
-  drainPromise = null;
-  signal;
-  onAbort = () => this.cancel(this.signal?.reason);
-  constructor(signal) {
-    this.signal = signal;
-    if (signal?.aborted) {
-      this.cancel(signal.reason);
-    } else {
-      signal?.addEventListener("abort", this.onAbort, { once: true });
-    }
-  }
-  cancel(reason) {
-    if (!this.cancelled) {
-      this.cancelled = true;
-      this.reason = reason;
-      this.signal?.removeEventListener("abort", this.onAbort);
-    }
-    void this.ensureDrain().catch(() => void 0);
-  }
-  async waitForQuiescence() {
-    this.cancel(this.reason);
-    await this.ensureDrain();
-  }
-  runSandboxCommand(session, args) {
-    return this.track(async () => {
-      if (!session.exec && !session.execCommand) {
-        throw new Error("Sandbox session does not support command execution");
-      }
-      const lifecycleRunContext = {};
-      const invokeExec = async (_runContext, input) => {
-        const parsed = parsedObject(input);
-        if (!parsed || typeof parsed.cmd !== "string") {
-          throw new Error("Sandbox lifecycle command input was invalid");
-        }
-        const commandArgs = {
-          cmd: parsed.cmd,
-          ...typeof parsed.workdir === "string" ? { workdir: parsed.workdir } : {},
-          ...typeof parsed.shell === "string" ? { shell: parsed.shell } : {},
-          ...typeof parsed.login === "boolean" ? { login: parsed.login } : {},
-          ...typeof parsed.tty === "boolean" ? { tty: parsed.tty } : {},
-          ...typeof parsed.yield_time_ms === "number" ? { yieldTimeMs: parsed.yield_time_ms } : {},
-          ...typeof parsed.max_output_tokens === "number" ? { maxOutputTokens: parsed.max_output_tokens } : {},
-          ...typeof parsed.run_as === "string" ? { runAs: parsed.run_as } : {}
-        };
-        const result = session.supportsPty?.() !== false && session.execCommand ? await session.execCommand(commandArgs) : session.exec ? await session.exec(commandArgs) : await session.execCommand(commandArgs);
-        return nativeCommandBanner(result);
-      };
-      const invokeWrite = session.writeStdin ? async (_runContext, input) => {
-        const parsed = parsedObject(input);
-        if (!parsed || typeof parsed.session_id !== "number") {
-          throw new Error("Sandbox lifecycle stdin input was invalid");
-        }
-        return await session.writeStdin({
-          sessionId: parsed.session_id,
-          ...typeof parsed.chars === "string" ? { chars: parsed.chars } : {},
-          ...typeof parsed.yield_time_ms === "number" ? { yieldTimeMs: parsed.yield_time_ms } : {},
-          ...typeof parsed.max_output_tokens === "number" ? { maxOutputTokens: parsed.max_output_tokens } : {}
-        });
-      } : null;
-      const correlationId = `turn_lifecycle_${crypto.randomUUID()}`;
-      const useRemoteOpCancellation = Boolean(session.cancelExecCommand) && session.supportsPty?.() === false;
-      const remoteExec = session.cancelExecCommand && useRemoteOpCancellation ? this.registerRemoteExec(
-        { cancelExecCommand: session.cancelExecCommand.bind(session) },
-        `${sanitizeOpIdToken(correlationId)}:0`
-      ) : null;
-      const markerPath = shellMarkerPath(crypto.randomUUID());
-      const commandInput = JSON.stringify({
-        cmd: useRemoteOpCancellation ? args.cmd : cancellableShellCommand(args.cmd, markerPath),
-        ...args.workdir ? { workdir: args.workdir } : {},
-        ...args.shell ? { shell: args.shell } : {},
-        ...args.login !== void 0 ? { login: args.login } : {},
-        ...args.runAs ? { run_as: args.runAs } : {},
-        tty: useRemoteOpCancellation ? args.tty : true,
-        yield_time_ms: useRemoteOpCancellation ? args.yieldTimeMs : cappedYield(args.yieldTimeMs, TURN_EXEC_YIELD_MS),
-        ...args.maxOutputTokens !== void 0 ? { max_output_tokens: args.maxOutputTokens } : {}
-      });
-      let initial;
-      try {
-        initial = await runWithToolCallCorrelation(
-          correlationId,
-          async () => await invokeExec(lifecycleRunContext, commandInput, void 0)
-        );
-      } finally {
-        remoteExec?.settle();
-      }
-      if (typeof initial !== "string" || useRemoteOpCancellation) return initial;
-      const sessionId = parseExecBannerSessionId(initial);
-      if (sessionId === null) return initial;
-      if (!invokeWrite) {
-        throw new Error("Sandbox lifecycle command yielded without stdin support");
-      }
-      const token = markerPath.slice(markerPath.lastIndexOf("/") + 1);
-      const state = {
-        sessionId,
-        markerPath,
-        token,
-        runContext: lifecycleRunContext,
-        execInvoke: invokeExec,
-        writeInvoke: invokeWrite,
-        identity: null,
-        identityValidated: false,
-        cancellation: null
-      };
-      this.shellSessions.set(sessionId, state);
-      const maxOutputTokens = args.maxOutputTokens ?? 2e4;
-      const initialOutput = execOutput(initial);
-      let output = initialOutput ? appendBoundedOutput("", initialOutput, maxOutputTokens) : "";
-      while (true) {
-        if (this.cancelled) throw cancellationError(this.reason);
-        const next = await invokeWrite(
-          lifecycleRunContext,
-          JSON.stringify({
-            session_id: sessionId,
-            chars: "",
-            yield_time_ms: TURN_WRITE_YIELD_MS,
-            max_output_tokens: maxOutputTokens
-          }),
-          void 0
-        );
-        if (typeof next !== "string") {
-          throw new Error("Sandbox lifecycle stdin returned an invalid result");
-        }
-        const nextOutput = execOutput(next);
-        if (nextOutput) output = appendBoundedOutput(output, nextOutput, maxOutputTokens);
-        const exitCode = parseExecBannerExitCode(next);
-        if (exitCode !== null) {
-          this.shellSessions.delete(sessionId);
-          return completedCommandBanner(exitCode, output);
-        }
-        await delay(SHELL_POLL_MS);
-      }
-    });
-  }
-  wrapTools(tools, session) {
-    for (const tool2 of tools) {
-      if (tool2.type !== "function") continue;
-      if (tool2.name === "exec_command") this.rawExecInvoke = tool2.invoke;
-      if (tool2.name === "write_stdin") this.rawWriteInvoke = tool2.invoke;
-    }
-    return tools.map((tool2) => {
-      if (tool2.type === "function") return this.wrapFunctionTool(tool2, session);
-      if (tool2.type === "apply_patch") return this.wrapApplyPatchTool(tool2);
-      if (tool2.type === "computer") return this.wrapComputerTool(tool2);
-      return tool2;
-    });
-  }
-  wrapFunctionTool(tool2, cancellationSession) {
-    if (tool2.name === "exec_command") {
-      return {
-        ...tool2,
-        invoke: (runContext, input, details) => this.track(async () => {
-          const parsed = parsedObject(input);
-          if (!parsed || typeof parsed.cmd !== "string") {
-            return await this.correlatedInvoke(tool2.invoke, runContext, input, details);
-          }
-          const token = crypto.randomUUID();
-          const markerPath = shellMarkerPath(token);
-          const correlationId = details?.toolCall?.callId ?? `turn_exec_${token}`;
-          const cancelExecCommand = cancellationSession?.cancelExecCommand;
-          const useRemoteOpCancellation = Boolean(cancelExecCommand) && cancellationSession?.supportsPty?.() === false;
-          const remoteExec = cancelExecCommand && useRemoteOpCancellation ? this.registerRemoteExec(
-            { cancelExecCommand: cancelExecCommand.bind(cancellationSession) },
-            `${sanitizeOpIdToken(correlationId)}:0`
-          ) : null;
-          const cancellableInput = useRemoteOpCancellation ? input : JSON.stringify({
-            ...parsed,
-            cmd: cancellableShellCommand(parsed.cmd, markerPath),
-            // The SDK's only provider-neutral live-process interrupt is a PTY.
-            // The process marker provides TERM/KILL escalation when Ctrl-C is
-            // ignored; the short yield exposes the provider session promptly.
-            tty: true,
-            yield_time_ms: cappedYield(parsed.yield_time_ms, TURN_EXEC_YIELD_MS)
-          });
-          let output;
-          try {
-            output = await runWithToolCallCorrelation(
-              correlationId,
-              async () => await tool2.invoke(runContext, cancellableInput, details)
-            );
-          } finally {
-            remoteExec?.settle();
-          }
-          if (typeof output !== "string") return output;
-          const sessionId = useRemoteOpCancellation ? null : parseExecBannerSessionId(output);
-          if (sessionId !== null) {
-            this.shellSessions.set(sessionId, {
-              sessionId,
-              markerPath,
-              token,
-              runContext,
-              execInvoke: tool2.invoke,
-              writeInvoke: this.rawWriteInvoke,
-              identity: null,
-              identityValidated: false,
-              cancellation: null
-            });
-          }
-          return output;
-        })
-      };
-    }
-    if (tool2.name === "write_stdin") {
-      return {
-        ...tool2,
-        invoke: (runContext, input, details) => this.track(async () => {
-          const parsed = parsedObject(input);
-          const sessionId = parsed && typeof parsed.session_id === "number" && Number.isSafeInteger(parsed.session_id) ? parsed.session_id : null;
-          const cappedInput = parsed ? JSON.stringify({
-            ...parsed,
-            yield_time_ms: cappedYield(parsed.yield_time_ms, TURN_WRITE_YIELD_MS)
-          }) : input;
-          const output = await tool2.invoke(runContext, cappedInput, details);
-          if (sessionId !== null && typeof output === "string") {
-            if (isExecSessionLostBanner(output, sessionId)) {
-              this.shellSessions.delete(sessionId);
-            } else if (parseExecBannerSessionId(output) === sessionId) {
-              if (!this.shellSessions.has(sessionId)) {
-                this.shellSessions.set(sessionId, {
-                  sessionId,
-                  markerPath: null,
-                  token: null,
-                  runContext,
-                  execInvoke: this.rawExecInvoke ?? tool2.invoke,
-                  writeInvoke: tool2.invoke,
-                  identity: null,
-                  identityValidated: false,
-                  cancellation: null
-                });
-              }
-            } else if (parseExecBannerExitCode(output) !== null) {
-              this.shellSessions.delete(sessionId);
-            }
-          }
-          return output;
-        })
-      };
-    }
-    return {
-      ...tool2,
-      invoke: (runContext, input, details) => this.track(async () => await tool2.invoke(runContext, input, details))
-    };
-  }
-  wrapApplyPatchTool(tool2) {
-    const editor = tool2.editor;
-    const wrappedEditor = {
-      createFile: (operation, context) => this.track(async () => await editor.createFile(operation, context)),
-      updateFile: (operation, context) => this.track(async () => await editor.updateFile(operation, context)),
-      deleteFile: (operation, context) => this.track(async () => await editor.deleteFile(operation, context))
-    };
-    return { ...tool2, editor: wrappedEditor };
-  }
-  wrapComputerTool(tool2) {
-    const computer = tool2.computer;
-    if (typeof computer === "function") {
-      return {
-        ...tool2,
-        computer: async (...args) => wrapComputer(
-          await this.track(async () => await computer(...args)),
-          (operation) => this.track(operation)
-        )
-      };
-    }
-    if ("create" in computer && typeof computer.create === "function") {
-      return {
-        ...tool2,
-        computer: {
-          ...computer,
-          create: async (...args) => wrapComputer(
-            await this.track(async () => await computer.create(...args)),
-            (operation) => this.track(operation)
-          )
-        }
-      };
-    }
-    return {
-      ...tool2,
-      computer: wrapComputer(computer, (operation) => this.track(operation))
-    };
-  }
-  async correlatedInvoke(invoke, runContext, input, details) {
-    const callId = details?.toolCall?.callId;
-    return callId ? await runWithToolCallCorrelation(
-      callId,
-      async () => await invoke(runContext, input, details)
-    ) : await invoke(runContext, input, details);
-  }
-  track(operation) {
-    if (this.cancelled) return Promise.reject(cancellationError(this.reason));
-    const promise = Promise.resolve().then(async () => {
-      if (this.cancelled) throw cancellationError(this.reason);
-      return await operation();
-    });
-    this.inFlight.add(promise);
-    void promise.finally(() => {
-      this.inFlight.delete(promise);
-    }).catch(() => void 0);
-    return promise;
-  }
-  ensureDrain() {
-    this.drainPromise ??= this.drain();
-    return this.drainPromise;
-  }
-  async drain() {
-    while (true) {
-      const remoteCancellations = [...this.remoteExecs].map(async (exec) => await exec.cancel());
-      const inFlight = [...this.inFlight];
-      if (inFlight.length > 0 || remoteCancellations.length > 0) {
-        await Promise.allSettled([...inFlight, ...remoteCancellations]);
-      }
-      const sessions = [...this.shellSessions.values()];
-      if (sessions.length > 0) {
-        await Promise.all(sessions.map(async (session) => await this.cancelShellSession(session)));
-      }
-      if (this.inFlight.size === 0 && this.shellSessions.size === 0 && this.remoteExecs.size === 0)
-        return;
-    }
-  }
-  registerRemoteExec(session, opId) {
-    let resolveSettled;
-    const settledPromise = new Promise((resolve) => {
-      resolveSettled = resolve;
-    });
-    let cancellation = null;
-    const entry = {
-      settled: false,
-      settledPromise,
-      settle: () => {
-        if (entry.settled) return;
-        entry.settled = true;
-        resolveSettled();
-        this.remoteExecs.delete(entry);
-      },
-      cancel: () => {
-        cancellation ??= (async () => {
-          while (!entry.settled) {
-            const attempt = session.cancelExecCommand(opId).catch(() => false);
-            await Promise.race([attempt, entry.settledPromise]);
-            await Promise.race([entry.settledPromise, delay(SHELL_POLL_MS)]);
-          }
-        })();
-        return cancellation;
-      }
-    };
-    this.remoteExecs.add(entry);
-    return entry;
-  }
-  cancelShellSession(state) {
-    state.cancellation ??= this.cancelShellSessionOnce(state).finally(() => {
-      state.cancellation = null;
-    });
-    return state.cancellation;
-  }
-  async cancelShellSessionOnce(state) {
-    if (!state.markerPath) {
-      while (true) {
-        if (state.writeInvoke && await this.rawWrite(state, "", SHELL_POLL_MS)) {
-          this.shellSessions.delete(state.sessionId);
-          return;
-        }
-        await delay(SHELL_POLL_MS);
-      }
-    }
-    while (!state.identity) {
-      state.identity = await this.readIdentity(state);
-      if (state.identity) break;
-      if (state.writeInvoke) {
-        const completed = await this.rawWrite(state, "", SHELL_POLL_MS);
-        if (completed) {
-          this.shellSessions.delete(state.sessionId);
-          return;
-        }
-      }
-      await delay(SHELL_POLL_MS);
-    }
-    if (!await this.identityAlive(state)) {
-      this.shellSessions.delete(state.sessionId);
-      return;
-    }
-    if (state.writeInvoke) {
-      await this.rawWrite(state, "", SHELL_POLL_MS);
-      if (!await this.identityAlive(state)) {
-        this.shellSessions.delete(state.sessionId);
-        return;
-      }
-    }
-    await this.signalIdentity(state, "TERM");
-    for (let attempt = 0; attempt < SHELL_GRACEFUL_POLLS; attempt++) {
-      if (state.writeInvoke) await this.rawWrite(state, "", SHELL_POLL_MS);
-      if (!await this.identityAlive(state)) {
-        this.shellSessions.delete(state.sessionId);
-        return;
-      }
-    }
-    await this.signalIdentity(state, "KILL");
-    while (await this.identityAlive(state)) {
-      if (state.writeInvoke) await this.rawWrite(state, "", SHELL_POLL_MS);
-      await this.signalIdentity(state, "KILL");
-      await delay(SHELL_POLL_MS);
-    }
-    this.shellSessions.delete(state.sessionId);
-  }
-  async rawWrite(state, chars, yieldTimeMs) {
-    if (!state.writeInvoke) return false;
-    try {
-      const output = await state.writeInvoke(
-        state.runContext,
-        JSON.stringify({
-          session_id: state.sessionId,
-          chars,
-          yield_time_ms: yieldTimeMs,
-          max_output_tokens: 128
-        }),
-        void 0
-      );
-      if (typeof output !== "string") return false;
-      if (isExecSessionLostBanner(output, state.sessionId)) return true;
-      if (parseExecBannerSessionId(output) === state.sessionId) return false;
-      if (parseExecBannerExitCode(output) !== null) return true;
-    } catch {
-    }
-    return false;
-  }
-  async readIdentity(state) {
-    if (!state.markerPath) return null;
-    try {
-      const output = await state.execInvoke(
-        state.runContext,
-        shellHelperInput(`command cat ${singleQuote(state.markerPath)} 2>/dev/null`),
-        void 0
-      );
-      return typeof output === "string" ? safeProcessIdentity(output) : null;
-    } catch {
-      return null;
-    }
-  }
-  async identityAlive(state) {
-    const script = state.identityValidated ? [
-      `__opengeni_pgid=${state.identity?.processGroupId ?? 0}`,
-      'command kill -0 "-$__opengeni_pgid" 2>/dev/null && exit 75',
-      "exit 0"
-    ].join("\n") : identityGuardScript(
-      state,
-      'command kill -0 "-$__opengeni_pgid" 2>/dev/null && exit 75\nexit 0',
-      76
-    );
-    try {
-      const output = await state.execInvoke(state.runContext, shellHelperInput(script), void 0);
-      if (typeof output !== "string") return true;
-      const exitCode = parseExecBannerExitCode(output);
-      if (exitCode === 75) {
-        state.identityValidated = true;
-        return true;
-      }
-      return exitCode !== 0;
-    } catch {
-      return true;
-    }
-  }
-  async signalIdentity(state, signal) {
-    const script = state.identityValidated ? `command kill -${signal} "-${state.identity?.processGroupId ?? 0}" 2>/dev/null || exit 76` : identityGuardScript(
-      state,
-      `command kill -${signal} "-$__opengeni_pgid" 2>/dev/null || exit 76
-exit 0`,
-      76
-    );
-    try {
-      await state.execInvoke(state.runContext, shellHelperInput(script), void 0);
-    } catch {
-    }
-  }
-};
-function createTurnToolCancellationController(signal) {
-  return new TurnToolCancellationControllerImpl(signal);
-}
-function wrapCapabilityToolsForTurnCancellation(capability, controller) {
-  const originalTools = capability.tools;
-  capability.tools = function() {
-    return controller.wrapTools(originalTools.call(this), this._session);
-  };
-}
-
 // src/sandbox-computer.ts
 import {
   KeyAction,
@@ -8963,7 +8355,9 @@ var ComputerUseCapability = class extends Capability {
       // any computer-use-only recording. One SandboxComputer instance caches
       // this for the rest of the turn.
       prepare: async (preparedSession) => {
-        await ensureDisplayStack(preparedSession);
+        await ensureDisplayStack(preparedSession, {
+          telemetryContext: { callerKind: "computer" }
+        });
         await this.args.onReady?.(preparedSession);
       }
     });
@@ -9008,43 +8402,351 @@ var ComputerUseCapability = class extends Capability {
 };
 
 // src/usage-telemetry.ts
-function modelCallUsageTelemetry(usage) {
+var MAX_MODEL_USAGE_TOKEN_COUNT = 1e9;
+function modelUsageTokenCountOrNull(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= MAX_MODEL_USAGE_TOKEN_COUNT ? value : null;
+}
+function normalizeModelCallUsage(usage) {
+  const rejectedFields = /* @__PURE__ */ new Set();
+  if (!usage) {
+    return {
+      telemetry: {
+        inputTokens: null,
+        outputTokens: null,
+        cachedTokens: null,
+        cacheWriteTokens: null,
+        reasoningTokens: null
+      },
+      totalTokens: null,
+      rejectedFields: []
+    };
+  }
+  const requestEntries = requestUsageEntries(usage.requestUsageEntries, rejectedFields);
+  const topLevelInputTokens = reportedTokenCount(usage.inputTokens, "inputTokens", rejectedFields);
+  const topLevelOutputTokens = reportedTokenCount(
+    usage.outputTokens,
+    "outputTokens",
+    rejectedFields
+  );
+  const topLevelTotalTokens = reportedTokenCount(usage.totalTokens, "totalTokens", rejectedFields);
+  const requestInputTokens = completeRequestTokenAggregate(
+    requestEntries,
+    ["inputTokens", "input_tokens"],
+    "inputTokens.requestUsageEntries",
+    rejectedFields
+  );
+  const requestOutputTokens = completeRequestTokenAggregate(
+    requestEntries,
+    ["outputTokens", "output_tokens"],
+    "outputTokens.requestUsageEntries",
+    rejectedFields
+  );
+  let requestTotalTokens = completeRequestTokenAggregate(
+    requestEntries,
+    ["totalTokens", "total_tokens"],
+    "totalTokens.requestUsageEntries",
+    rejectedFields
+  );
+  if (rejectInconsistentRequestTotals(requestEntries, rejectedFields)) {
+    requestTotalTokens = { ...requestTotalTokens, status: "invalid", value: null };
+  }
+  const inputTokens = canonicalTokenDimension({
+    topLevel: topLevelInputTokens,
+    topLevelReported: isReported(usage.inputTokens),
+    topLevelPath: "inputTokens",
+    requestAggregate: requestInputTokens,
+    rejectedFields
+  });
+  const outputTokens = canonicalTokenDimension({
+    topLevel: topLevelOutputTokens,
+    topLevelReported: isReported(usage.outputTokens),
+    topLevelPath: "outputTokens",
+    requestAggregate: requestOutputTokens,
+    rejectedFields
+  });
+  const totalTokens = canonicalTotalTokens({
+    inputTokens,
+    outputTokens,
+    topLevel: topLevelTotalTokens,
+    topLevelReported: isReported(usage.totalTokens),
+    requestAggregate: requestTotalTokens,
+    rejectedFields
+  });
+  const inputDetailSource = preferredDetailSource(
+    usage.inputTokensDetails,
+    "inputTokensDetails",
+    requestEntries,
+    ["inputTokensDetails", "input_tokens_details"]
+  );
+  const outputDetailSource = preferredDetailSource(
+    usage.outputTokensDetails,
+    "outputTokensDetails",
+    requestEntries,
+    ["outputTokensDetails", "output_tokens_details"]
+  );
   return {
-    inputTokens: finiteNumberOrNull(usage?.inputTokens),
-    outputTokens: finiteNumberOrNull(usage?.outputTokens),
-    cachedTokens: usage ? firstPositiveDetailNumber(usage.inputTokensDetails, [
-      "cached_tokens",
-      "cachedInputTokens",
-      "cached_input_tokens"
-    ]) : null,
-    reasoningTokens: usage ? firstPositiveDetailNumber(usage.outputTokensDetails, [
-      "reasoning_tokens",
-      "reasoningTokens",
-      "reasoning_output_tokens"
-    ]) : null
+    telemetry: {
+      inputTokens,
+      outputTokens,
+      cachedTokens: aggregateDetailTokenCount(
+        inputDetailSource,
+        ["cached_tokens", "cachedInputTokens", "cached_input_tokens"],
+        "cachedTokens",
+        rejectedFields
+      ),
+      cacheWriteTokens: aggregateDetailTokenCount(
+        inputDetailSource,
+        ["cache_write_tokens", "cacheWriteTokens"],
+        "cacheWriteTokens",
+        rejectedFields
+      ),
+      reasoningTokens: aggregateDetailTokenCount(
+        outputDetailSource,
+        ["reasoning_tokens", "reasoningTokens", "reasoning_output_tokens"],
+        "reasoningTokens",
+        rejectedFields
+      )
+    },
+    totalTokens,
+    rejectedFields: [...rejectedFields].slice(0, 32)
   };
 }
-function firstPositiveDetailNumber(details, keys) {
-  if (!details) {
+function modelCallUsageTelemetry(usage) {
+  return normalizeModelCallUsage(usage).telemetry;
+}
+function requestUsageEntries(value, rejectedFields) {
+  if (value === void 0) {
+    return [];
+  }
+  if (!Array.isArray(value)) {
+    rejectField(rejectedFields, "requestUsageEntries");
+    return [];
+  }
+  const entries = [];
+  for (const [index, entry] of value.entries()) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      rejectField(rejectedFields, `requestUsageEntries[${index}]`);
+      entries.push({});
+      continue;
+    }
+    entries.push(entry);
+  }
+  return entries;
+}
+function completeRequestTokenAggregate(requestEntries, requestKeys, aggregatePath, rejectedFields) {
+  if (requestEntries.length === 0) {
+    return { status: "absent", value: null };
+  }
+  const values = [];
+  let incomplete = false;
+  let invalid = false;
+  for (const [index, entry] of requestEntries.entries()) {
+    const selected = firstPresentEntry(entry, requestKeys);
+    if (!selected || selected.value === null) {
+      incomplete = true;
+      continue;
+    }
+    const parsed = reportedTokenCount(
+      selected.value,
+      `requestUsageEntries[${index}].${selected.key}`,
+      rejectedFields
+    );
+    if (parsed === null) invalid = true;
+    values.push(parsed);
+  }
+  if (invalid) {
+    return { status: "invalid", value: null };
+  }
+  if (incomplete) {
+    return { status: "incomplete", value: null };
+  }
+  const value = boundedTokenSum(values, aggregatePath, rejectedFields);
+  return value === null ? { status: "invalid", value: null } : { status: "complete", value };
+}
+function canonicalTokenDimension(input) {
+  if (input.requestAggregate.status === "complete") {
+    if (input.topLevelReported && input.topLevel !== null && input.topLevel !== input.requestAggregate.value) {
+      rejectField(input.rejectedFields, input.topLevelPath);
+    }
+    return input.requestAggregate.value;
+  }
+  if (input.requestAggregate.status === "invalid") {
+    if (input.topLevelReported) {
+      rejectField(input.rejectedFields, input.topLevelPath);
+    }
     return null;
   }
-  const entries = Array.isArray(details) ? details : [details];
-  let sawZero = false;
-  for (const entry of entries) {
-    for (const key of keys) {
-      const value = finiteNumberOrNull(entry[key]);
-      if (value !== null && value > 0) {
-        return value;
+  return input.topLevel;
+}
+function canonicalTotalTokens(input) {
+  if (input.inputTokens !== null && input.outputTokens !== null) {
+    const derived = boundedTokenSum(
+      [input.inputTokens, input.outputTokens],
+      "totalTokens.aggregate",
+      input.rejectedFields
+    );
+    if (derived === null) {
+      if (input.topLevelReported) rejectField(input.rejectedFields, "totalTokens");
+      if (input.requestAggregate.status === "complete") {
+        rejectField(input.rejectedFields, "totalTokens.requestUsageEntries");
       }
-      if (value === 0) {
-        sawZero = true;
+      return null;
+    }
+    if (input.topLevelReported && input.topLevel !== null && input.topLevel !== derived) {
+      rejectField(input.rejectedFields, "totalTokens");
+    }
+    if (input.requestAggregate.status === "complete" && input.requestAggregate.value !== derived) {
+      rejectField(input.rejectedFields, "totalTokens.requestUsageEntries");
+    }
+    return derived;
+  }
+  if (input.requestAggregate.status === "complete") {
+    const requestTotal = input.requestAggregate.value;
+    if (requestTotal === null || !totalCoversKnownComponents(requestTotal, input.inputTokens, input.outputTokens)) {
+      rejectField(input.rejectedFields, "totalTokens.requestUsageEntries");
+      if (input.topLevelReported) rejectField(input.rejectedFields, "totalTokens");
+      return null;
+    }
+    if (input.topLevelReported && input.topLevel !== null && input.topLevel !== requestTotal) {
+      rejectField(input.rejectedFields, "totalTokens");
+    }
+    return requestTotal;
+  }
+  if (input.requestAggregate.status === "invalid") {
+    if (input.topLevelReported) rejectField(input.rejectedFields, "totalTokens");
+    return null;
+  }
+  if (input.topLevel !== null && !totalCoversKnownComponents(input.topLevel, input.inputTokens, input.outputTokens)) {
+    rejectField(input.rejectedFields, "totalTokens");
+    return null;
+  }
+  return input.topLevel;
+}
+function totalCoversKnownComponents(total, inputTokens, outputTokens) {
+  return (inputTokens === null || total >= inputTokens) && (outputTokens === null || total >= outputTokens);
+}
+function rejectInconsistentRequestTotals(requestEntries, rejectedFields) {
+  let inconsistent = false;
+  for (const [index, entry] of requestEntries.entries()) {
+    const record = entry;
+    const selectedInput = firstPresentEntry(record, ["inputTokens", "input_tokens"]);
+    const selectedOutput = firstPresentEntry(record, ["outputTokens", "output_tokens"]);
+    const selectedTotal = firstPresentEntry(record, ["totalTokens", "total_tokens"]);
+    if (!selectedInput || !selectedOutput || !selectedTotal) continue;
+    const inputTokens = modelUsageTokenCountOrNull(selectedInput.value);
+    const outputTokens = modelUsageTokenCountOrNull(selectedOutput.value);
+    const totalTokens = modelUsageTokenCountOrNull(selectedTotal.value);
+    if (inputTokens === null || outputTokens === null || totalTokens === null) continue;
+    const derived = inputTokens <= MAX_MODEL_USAGE_TOKEN_COUNT - outputTokens ? inputTokens + outputTokens : null;
+    if (derived === null || totalTokens !== derived) {
+      rejectField(rejectedFields, `requestUsageEntries[${index}].${selectedTotal.key}`);
+      inconsistent = true;
+    }
+  }
+  return inconsistent;
+}
+function isReported(value) {
+  return value !== void 0 && value !== null;
+}
+function preferredDetailSource(aggregateDetails, aggregatePath, requestEntries, requestKeys) {
+  const requestDetails = [];
+  let sawRequestDetails = false;
+  for (const [index, entry] of requestEntries.entries()) {
+    const selected = firstPresentEntry(entry, requestKeys);
+    if (!selected) {
+      requestDetails.push({
+        details: void 0,
+        path: `requestUsageEntries[${index}].${requestKeys[0]}`,
+        missing: true
+      });
+      continue;
+    }
+    sawRequestDetails = true;
+    requestDetails.push({
+      details: selected.value,
+      path: `requestUsageEntries[${index}].${selected.key}`
+    });
+  }
+  return sawRequestDetails ? requestDetails : aggregateDetails === void 0 ? [] : [{ details: aggregateDetails, path: aggregatePath }];
+}
+function aggregateDetailTokenCount(sources, keys, field, rejectedFields) {
+  const values = [];
+  let sawReportedValue = false;
+  let sawMissingValue = false;
+  for (const source of sources) {
+    if (source.missing) {
+      sawMissingValue = true;
+      continue;
+    }
+    const details = detailRecords(source.details, source.path, rejectedFields);
+    if (!details.complete) {
+      sawMissingValue = true;
+    }
+    for (const detail of details.records) {
+      const selected = firstPresentEntry(detail.record, keys);
+      if (!selected) {
+        sawMissingValue = true;
+        continue;
       }
+      sawReportedValue = true;
+      values.push(
+        reportedTokenCount(selected.value, `${detail.path}.${selected.key}`, rejectedFields)
+      );
+    }
+  }
+  return sawReportedValue && !sawMissingValue ? boundedTokenSum(values, `${field}.aggregate`, rejectedFields) : null;
+}
+function detailRecords(details, path, rejectedFields) {
+  const entries = Array.isArray(details) ? details : [details];
+  const records = [];
+  let complete = true;
+  for (const [index, entry] of entries.entries()) {
+    const entryPath = Array.isArray(details) ? `${path}[${index}]` : path;
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      rejectField(rejectedFields, entryPath);
+      complete = false;
+      continue;
+    }
+    records.push({ record: entry, path: entryPath });
+  }
+  return { records, complete };
+}
+function firstPresentEntry(record, keys) {
+  for (const key of keys) {
+    if (Object.prototype.hasOwnProperty.call(record, key) && record[key] !== void 0) {
+      return { key, value: record[key] };
+    }
+  }
+  return null;
+}
+function reportedTokenCount(value, field, rejectedFields) {
+  if (value === void 0 || value === null) {
+    return null;
+  }
+  const normalized = modelUsageTokenCountOrNull(value);
+  if (normalized === null) {
+    rejectField(rejectedFields, field);
+  }
+  return normalized;
+}
+function boundedTokenSum(values, field, rejectedFields) {
+  if (values.length === 0 || values.some((value) => value === null)) {
+    return null;
+  }
+  let total = 0;
+  for (const value of values) {
+    if (value > MAX_MODEL_USAGE_TOKEN_COUNT - total) {
+      rejectField(rejectedFields, field);
+      return null;
     }
+    total += value;
   }
-  return sawZero ? 0 : null;
+  return total;
 }
-function finiteNumberOrNull(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : null;
+function rejectField(rejectedFields, field) {
+  if (rejectedFields.size < 32) {
+    rejectedFields.add(field);
+  }
 }
 
 // src/index.ts
@@ -9154,6 +8856,10 @@ function buildProviderClient(provider, settings) {
       // SDK retries on network/5xx/partial streams can replay provider work
       // or external tool side effects without a durable checkpoint.
       maxRetries: 0,
+      // The Codex transport owns finer headers/idle/whole deadlines and
+      // emits typed durable evidence. Keep the SDK's opaque envelope beyond
+      // that whole-response budget so `Request timed out.` cannot win first.
+      timeout: CODEX_RESPONSE_SDK_OUTER_TIMEOUT_MS,
       fetch: codexSubscriptionFetch(instrumentedModelFetch(provider.id, globalThis.fetch))
     })
   ) : (
@@ -9184,7 +8890,7 @@ function resolveTurnModel(settings, modelId) {
   return {
     provider: resolved.provider,
     client,
-    model: buildModelInstance(resolved.provider, client, resolved.model.id),
+    model: buildModelInstance(resolved.provider, client, resolved.model.upstreamModelId),
     configured: resolved.model
   };
 }
@@ -9834,7 +9540,7 @@ function maybeInstallCodexToolSearch(agent, settings, options) {
   }
 }
 function mcpToolRequiresApproval(policy, unprefixedName) {
-  return policy === true || Array.isArray(policy) && policy.includes(unprefixedName);
+  return policy === true || policy !== false && policy.has(unprefixedName);
 }
 function installMcpApprovalPolicy(agent, policies) {
   const listMcpTools = agent.getMcpTools.bind(agent);
@@ -9866,7 +9572,7 @@ function applyMcpApprovalPolicy(agent, settings) {
     (server) => server.requireApproval === true || Array.isArray(server.requireApproval) && server.requireApproval.length > 0
   ).map((server) => ({
     prefix: prefixedMcpToolName(server.id, ""),
-    requireApproval: server.requireApproval
+    requireApproval: server.requireApproval === true ? true : new Set(server.requireApproval)
   })).sort((a, b) => b.prefix.length - a.prefix.length);
   if (policies.length === 0) {
     return;
@@ -9966,22 +9672,77 @@ function buildAgentCapabilities(settings, packSkills, options = {}) {
 function sandboxRunAs(_settings) {
   return void 0;
 }
+async function connectMcpServersInBatches(servers, options) {
+  assertMcpServerSelectionWithinBounds(servers);
+  const batches = [];
+  try {
+    for (let offset = 0; offset < servers.length; offset += MCP_MAX_CONCURRENT_SERVER_OPERATIONS) {
+      batches.push(
+        await connectMcpServers(
+          servers.slice(offset, offset + MCP_MAX_CONCURRENT_SERVER_OPERATIONS),
+          {
+            ...options.connectTimeoutMs === void 0 ? {} : { connectTimeoutMs: options.connectTimeoutMs },
+            connectInParallel: true,
+            strict: options.strict
+          }
+        )
+      );
+    }
+  } catch (error) {
+    await closeMcpServerBatches(batches).catch(() => void 0);
+    throw error;
+  }
+  const errors = /* @__PURE__ */ new Map();
+  for (const batch of batches) {
+    for (const [server, error] of batch.errors) errors.set(server, error);
+  }
+  return {
+    active: batches.flatMap((batch) => batch.active),
+    failed: batches.flatMap((batch) => batch.failed),
+    errors,
+    close: async () => {
+      await closeMcpServerBatches(batches);
+    }
+  };
+}
+async function closeMcpServerBatches(batches) {
+  let firstError;
+  for (const batch of [...batches].reverse()) {
+    try {
+      await batch.close();
+    } catch (error) {
+      firstError ??= error;
+    }
+  }
+  if (firstError !== void 0) throw firstError;
+}
 async function prepareAgentTools(settings, tools, options = {}) {
   const codexConnectorNamespaces = /* @__PURE__ */ new Set();
+  assertMcpServerSelectionWithinBounds(tools);
   if (tools.length === 0) {
     return { mcpServers: [], close: async () => {
     }, codexConnectorNamespaces };
   }
   const registry = new Map(settings.mcpServers.map((server) => [server.id, server]));
-  const servers = await Promise.all(
-    tools.map(async (tool2) => {
+  const aggregateToolBudget = new McpAggregateToolListBudget();
+  const mcpFetchImpl = options.mcpFetchImpl ?? undiciFetch;
+  const servers = await boundedParallelMap(
+    tools,
+    MCP_MAX_CONCURRENT_SERVER_OPERATIONS,
+    async (tool2, index) => {
       const config = registry.get(tool2.id);
       if (!config) {
         throw new Error(`Unknown MCP server id: ${tool2.id}`);
       }
       const url = firstPartyMcpServerUrlForRun(settings, config, options.workspaceId) ?? config.url;
-      const baseFetch = isCodexAppsMcpServer(config) ? codexAppsSanitizingFetch(globalThis.fetch, codexConnectorNamespaces) : globalThis.fetch;
-      const fetchImpl = config.connectionRef ? connectionBrokerFetch(baseFetch, config, options) : isFirstPartyMcpServer(settings, config) ? firstPartyAuthFetch(baseFetch, settings, options) : baseFetch;
+      const firstParty = isFirstPartyMcpServer(settings, config);
+      const baseFetch = isCodexAppsMcpServer(config) ? codexAppsSanitizingFetch(mcpFetchImpl, codexConnectorNamespaces) : mcpFetchImpl;
+      const guardedFetch = guardedMcpFetch(
+        firstParty ? { ...settings, integrationsAllowPrivateNetworkTargets: true } : settings,
+        baseFetch,
+        firstParty ? { requireHttpsOutsideLocalTest: false } : {}
+      );
+      const fetchImpl = config.connectionRef ? connectionBrokerFetch(guardedFetch, config, options) : firstParty ? firstPartyAuthFetch(guardedFetch, settings, options) : guardedFetch;
       const optional = tool2.optional === true;
       const bestEffort = isCodexAppsMcpServer(config) || optional || !!config.connectionRef;
       const server = new PrefixedMcpServer(
@@ -9993,7 +9754,7 @@ async function prepareAgentTools(settings, tools, options = {}) {
           // MCP SDK's strict Tool schema rejects (fails the turn during tools/list);
           // sanitize the response on the wire before validation. The namespace Set
           // also captures each tool's original connector namespace (P4 Part B.1).
-          ...fetchImpl !== globalThis.fetch ? { fetch: fetchImpl } : {},
+          fetch: fetchImpl,
           ...await mcpServerRequestInit(settings, config),
           ...config.timeoutMs ? {
             timeout: config.timeoutMs,
@@ -10002,30 +9763,46 @@ async function prepareAgentTools(settings, tools, options = {}) {
         }),
         config.id,
         config.allowedTools,
-        bestEffort
+        bestEffort,
+        aggregateToolBudget,
+        `${config.id}:${index}`
       );
       return {
         server,
         bestEffort,
-        optional
+        optional,
+        timeoutMs: config.timeoutMs
       };
-    })
+    }
   );
-  const requiredServers = servers.filter((entry) => !entry.bestEffort).map((entry) => entry.server);
-  const bestEffortServers = servers.filter((entry) => entry.bestEffort).map((entry) => entry.server);
+  const requiredEntries = servers.filter((entry) => !entry.bestEffort);
+  const bestEffortEntries = servers.filter((entry) => entry.bestEffort);
+  const requiredServers = requiredEntries.map((entry) => entry.server);
+  const bestEffortServers = bestEffortEntries.map((entry) => entry.server);
   const optionalServerNames = new Set(
     servers.filter((entry) => entry.optional).map((entry) => entry.server.name)
   );
-  const connectedRequired = await connectMcpServers(requiredServers, {
-    connectInParallel: true,
-    strict: true
+  const connectedRequired = await connectMcpServersInBatches(requiredServers, {
+    strict: true,
+    connectTimeoutMs: mcpOuterConnectTimeoutMs(requiredEntries.map((entry) => entry.timeoutMs))
   });
-  const connectedBestEffort = bestEffortServers.length ? await connectMcpServers(bestEffortServers, {
-    connectInParallel: true,
-    strict: false
-  }) : null;
+  let connectedBestEffort = null;
+  try {
+    connectedBestEffort = bestEffortServers.length ? await connectMcpServersInBatches(bestEffortServers, {
+      strict: false,
+      connectTimeoutMs: mcpOuterConnectTimeoutMs(
+        bestEffortEntries.map((entry) => entry.timeoutMs)
+      )
+    }) : null;
+  } catch (error) {
+    await connectedRequired.close().catch(() => void 0);
+    throw error;
+  }
   if (connectedBestEffort) {
     for (const failed of connectedBestEffort.failed) {
+      if (failed instanceof PrefixedMcpServer) {
+        failed.releaseAggregateBudget();
+      }
       if (!optionalServerNames.has(failed.name)) {
         continue;
       }
@@ -10039,10 +9816,20 @@ async function prepareAgentTools(settings, tools, options = {}) {
   return {
     mcpServers: [...connectedRequired.active, ...connectedBestEffort?.active ?? []],
     close: async () => {
-      await connectedRequired.close();
+      let firstError;
       if (connectedBestEffort) {
-        await connectedBestEffort.close();
+        try {
+          await connectedBestEffort.close();
+        } catch (error) {
+          firstError ??= error;
+        }
+      }
+      try {
+        await connectedRequired.close();
+      } catch (error) {
+        firstError ??= error;
       }
+      if (firstError !== void 0) throw firstError;
     },
     codexConnectorNamespaces
   };
@@ -10054,10 +9841,12 @@ function connectionBrokerFetch(baseFetch, config, options) {
   }
   return async (input, init) => {
     const request = await mcpRequestInfo(input, init);
+    const destinationUrl = mcpRequestDestinationUrl(input);
     const first = await resolveConnectionForRequest(
       options,
       config.id,
       connectionRef,
+      destinationUrl,
       request.toolName,
       false
     );
@@ -10069,10 +9858,12 @@ function connectionBrokerFetch(baseFetch, config, options) {
       withConnectionHeaders(input, init, first.headers)
     );
     if (response.status === 401) {
+      await cancelMcpResponseBody(response);
       const refreshed = await resolveConnectionForRequest(
         options,
         config.id,
         connectionRef,
+        destinationUrl,
         request.toolName,
         true
       );
@@ -10085,9 +9876,14 @@ function connectionBrokerFetch(baseFetch, config, options) {
       );
       if (retry.status === 403) {
         const auth = insufficientScopeAuth(retry.headers, connectionRef, refreshed.connectionId);
-        return auth ? await authNeededFetchResponse(options, config.id, request, auth, connectionRef) : retry;
+        if (auth) {
+          await cancelMcpResponseBody(retry);
+          return await authNeededFetchResponse(options, config.id, request, auth, connectionRef);
+        }
+        return retry;
       }
       if (retry.status === 401) {
+        await cancelMcpResponseBody(retry);
         return await authNeededFetchResponse(
           options,
           config.id,
@@ -10109,12 +9905,16 @@ function connectionBrokerFetch(baseFetch, config, options) {
     }
     if (response.status === 403) {
       const auth = insufficientScopeAuth(response.headers, connectionRef, first.connectionId);
-      return auth ? await authNeededFetchResponse(options, config.id, request, auth, connectionRef) : response;
+      if (auth) {
+        await cancelMcpResponseBody(response);
+        return await authNeededFetchResponse(options, config.id, request, auth, connectionRef);
+      }
+      return response;
     }
     return response;
   };
 }
-async function resolveConnectionForRequest(options, serverId, connectionRef, toolName, forceRefresh) {
+async function resolveConnectionForRequest(options, serverId, connectionRef, destinationUrl, toolName, forceRefresh) {
   if (!options.workspaceId || !options.resolveCredential) {
     return {
       status: "auth_needed",
@@ -10131,6 +9931,7 @@ async function resolveConnectionForRequest(options, serverId, connectionRef, too
     workspaceId: options.workspaceId,
     serverId,
     connectionRef,
+    destinationUrl,
     forceRefresh,
     ...toolName ? { toolName } : {},
     ...options.subjectId ? { subjectId: options.subjectId } : {}
@@ -10194,6 +9995,9 @@ async function publishAuthNeeded(options, payload) {
   } catch {
   }
 }
+function mcpRequestDestinationUrl(input) {
+  return new URL(input instanceof Request ? input.url : input.toString()).toString();
+}
 async function mcpRequestInfo(input, init) {
   const body = typeof init?.body === "string" ? init.body : input instanceof Request && (init?.method ?? input.method).toUpperCase() === "POST" ? await input.clone().text().catch(() => "") : "";
   if (!body) {
@@ -10326,7 +10130,7 @@ async function signFirstPartyDelegatedBearer(settings, options) {
     workspaceId: options.workspaceId,
     subjectId: options.subjectId ?? "worker:first-party-mcp",
     ...options.subjectLabel ? { subjectLabel: options.subjectLabel } : {},
-    permissions: options.firstPartyPermissions ?? firstPartyMcpPermissions,
+    permissions: options.firstPartyPermissions ?? [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS],
     ...options.sessionId ? { sessionId: options.sessionId } : {},
     ...options.turnId ? { turnId: options.turnId } : {},
     ...options.attemptId ? { attemptId: options.attemptId } : {},
@@ -10375,21 +10179,6 @@ async function codexAppsMcpRequestInit(settings) {
   }
   return { requestInit: { headers } };
 }
-var firstPartyMcpPermissions = [
-  "workspace:read",
-  "files:read",
-  "documents:search",
-  "scheduled_tasks:manage",
-  "scheduled_tasks:run",
-  "goals:manage",
-  "sessions:read",
-  "sessions:create",
-  "sessions:control",
-  "variable-sets:use",
-  "variable-sets:manage",
-  "rigs:use",
-  "github:use"
-];
 function isCodexAppsMcpServer(config) {
   return config.id === CODEX_APPS_MCP_SERVER_ID;
 }
@@ -10457,8 +10246,10 @@ function prefixedMcpToolName(registryId, toolName) {
   return sharedPrefixedMcpToolName(registryId, toolName);
 }
 var PrefixedMcpServer = class {
-  constructor(inner, registryId, allowedTools, bestEffort = false) {
+  constructor(inner, registryId, allowedTools, bestEffort = false, aggregateToolBudget, aggregateSourceId = registryId) {
     this.inner = inner;
+    this.aggregateToolBudget = aggregateToolBudget;
+    this.aggregateSourceId = aggregateSourceId;
     this.name = registryId;
     this.prefix = prefixedMcpToolName(registryId, "");
     this.cacheToolsList = inner.cacheToolsList;
@@ -10480,12 +10271,22 @@ var PrefixedMcpServer = class {
     return this.inner.connect();
   }
   close() {
+    this.releaseAggregateBudget();
     return this.inner.close();
   }
+  releaseAggregateBudget() {
+    this.aggregateToolBudget?.remove(this.aggregateSourceId);
+  }
   async listTools() {
-    let tools;
     try {
-      tools = await this.inner.listTools();
+      const tools = assertMcpToolListWithinBounds(await this.inner.listTools());
+      const exposed = tools.filter((tool2) => this.isAllowed(tool2.name)).map((tool2) => ({
+        ...tool2,
+        name: prefixedMcpToolName(this.name, tool2.name)
+      }));
+      const bounded = this.aggregateToolBudget?.replace(this.aggregateSourceId, exposed) ?? assertMcpToolListWithinBounds(exposed);
+      this.listedToolSchemaTokens = estimateSerializedValueTokens(bounded);
+      return bounded;
     } catch (error) {
       if (!this.bestEffort) {
         throw error;
@@ -10499,14 +10300,9 @@ var PrefixedMcpServer = class {
           { serverId: this.name, ...safeMcpErrorFields(error) }
         );
       }
+      this.releaseAggregateBudget();
       return [];
     }
-    const exposed = tools.filter((tool2) => this.isAllowed(tool2.name)).map((tool2) => ({
-      ...tool2,
-      name: prefixedMcpToolName(this.name, tool2.name)
-    }));
-    this.listedToolSchemaTokens = estimateSerializedValueTokens(exposed);
-    return exposed;
   }
   /** Latest exact tools/list projection used to build the model request. */
   modelToolSchemaTokens() {
@@ -10518,7 +10314,9 @@ var PrefixedMcpServer = class {
       throw new Error(`MCP tool ${unprefixed} is not allowed for server ${this.name}`);
     }
     try {
-      return await this.inner.callTool(unprefixed, args, meta);
+      const output = await this.inner.callTool(unprefixed, args, meta);
+      assertMcpPayloadWithinBytes(output, MCP_MAX_TOOL_RESULT_BYTES, "MCP tool result");
+      return output;
     } catch (error) {
       if (isAuthNeededMcpError(error)) {
         return {
@@ -11590,17 +11388,18 @@ function usageFromResponse(response) {
     ),
     ...numberProp(record, "totalTokens", "totalTokens", "total_tokens"),
     ...inputTokenDetailsProp(record),
-    ...outputTokenDetailsProp(record)
+    ...outputTokenDetailsProp(record),
+    ...requestUsageEntriesProp(record)
   };
   return Object.keys(usage).length > 0 ? usage : null;
 }
 function numberProp(raw, outputKey, ...keys) {
   const value = keys.map((key) => raw[key]).find((candidate) => candidate !== void 0);
-  return typeof value === "number" && Number.isFinite(value) ? { [outputKey]: value } : {};
+  return typeof value === "number" ? { [outputKey]: value } : {};
 }
 function inputTokenDetailsProp(raw) {
   const details = raw.inputTokensDetails ?? raw.input_tokens_details ?? raw.promptTokensDetails ?? raw.prompt_tokens_details;
-  if (!details || typeof details !== "object") {
+  if (details === void 0 || details === null) {
     return {};
   }
   return {
@@ -11610,13 +11409,25 @@ function inputTokenDetailsProp(raw) {
 function outputTokenDetailsProp(raw) {
   const details = raw.outputTokensDetails ?? raw.output_tokens_details;
   const normalized = details ?? raw.completionTokensDetails ?? raw.completion_tokens_details;
-  if (!normalized || typeof normalized !== "object") {
+  if (normalized === void 0 || normalized === null) {
     return {};
   }
   return {
     outputTokensDetails: normalized
   };
 }
+function requestUsageEntriesProp(raw) {
+  const entries = raw.requestUsageEntries ?? raw.request_usage_entries;
+  if (entries === void 0 || entries === null) {
+    return {};
+  }
+  return {
+    // The normalizer validates every entry and all supported field aliases.
+    // Preserve the SDK objects rather than rebuilding them and accidentally
+    // dropping provider detail fields such as cache_write_tokens.
+    requestUsageEntries: entries
+  };
+}
 function serializeApprovals(interruptions) {
   return interruptions.filter((item) => interruptionToolName(item) !== HUMAN_INPUT_TOOL_NAME).map((item) => {
     if (typeof item?.toJSON === "function") {
@@ -12085,13 +11896,95 @@ function runtimeGitBindingDescriptors(resources) {
     };
   });
 }
+function gitCredentialBindingKey(provider, credentialBindingId) {
+  return `${provider}\0${credentialBindingId}`;
+}
+function brokeredGitCredentialBindingKeys(bindings) {
+  return new Set(
+    bindings.filter((binding) => binding.transport?.kind === "http_broker").map((binding) => gitCredentialBindingKey(binding.provider, binding.credentialBindingId))
+  );
+}
+function runtimeGitHttpBrokerRouteDescriptors(resources, bindings) {
+  const resourceDescriptors = runtimeGitBindingDescriptors(resources);
+  const byBindingAndUri = /* @__PURE__ */ new Map();
+  for (const descriptor of resourceDescriptors) {
+    byBindingAndUri.set(
+      `${gitCredentialBindingKey(descriptor.provider, descriptor.credentialBindingId)}\0${descriptor.uri}`,
+      descriptor
+    );
+  }
+  const routes = [];
+  const claimedRepositoryUris = /* @__PURE__ */ new Set();
+  const claimedBrokerUris = /* @__PURE__ */ new Set();
+  for (const binding of bindings) {
+    if (!binding.transport) continue;
+    if (typeof binding.transport !== "object" || binding.transport.kind !== "http_broker" || !Array.isArray(binding.transport.repositories)) {
+      throw new Error(
+        `Git credential binding ${binding.credentialBindingId} uses an unsupported transport`
+      );
+    }
+    const bindingKey = gitCredentialBindingKey(binding.provider, binding.credentialBindingId);
+    const expected = resourceDescriptors.filter(
+      (descriptor) => gitCredentialBindingKey(descriptor.provider, descriptor.credentialBindingId) === bindingKey
+    );
+    if (expected.length === 0 || binding.transport.repositories.length !== expected.length) {
+      throw new Error(
+        `Git HTTP broker binding ${binding.credentialBindingId} does not cover its exact repository set`
+      );
+    }
+    for (const route of binding.transport.repositories) {
+      if (!route || typeof route !== "object" || typeof route.repositoryUri !== "string" || typeof route.brokerUri !== "string") {
+        throw new Error(
+          `Git HTTP broker binding ${binding.credentialBindingId} contains an invalid repository route`
+        );
+      }
+      const descriptor = byBindingAndUri.get(`${bindingKey}\0${route.repositoryUri}`);
+      if (!descriptor || claimedRepositoryUris.has(route.repositoryUri)) {
+        throw new Error(
+          `Git HTTP broker binding ${binding.credentialBindingId} contains an unexpected repository route`
+        );
+      }
+      let brokerUrl;
+      try {
+        brokerUrl = new URL(route.brokerUri);
+      } catch {
+        throw new Error(
+          `Git HTTP broker binding ${binding.credentialBindingId} contains an invalid broker URI`
+        );
+      }
+      if (brokerUrl.protocol !== "https:" || brokerUrl.username || brokerUrl.password || brokerUrl.search || brokerUrl.hash || brokerUrl.href !== route.brokerUri || claimedBrokerUris.has(brokerUrl.href)) {
+        throw new Error(
+          `Git HTTP broker binding ${binding.credentialBindingId} contains an unsafe broker URI`
+        );
+      }
+      claimedRepositoryUris.add(route.repositoryUri);
+      claimedBrokerUris.add(brokerUrl.href);
+      routes.push({
+        provider: binding.provider,
+        credentialBindingId: binding.credentialBindingId,
+        bindingHash: gitCredentialBindingHash(binding.credentialBindingId),
+        repositoryUri: route.repositoryUri,
+        brokerUri: route.brokerUri,
+        protocol: "https",
+        host: brokerUrl.host.toLowerCase(),
+        path: brokerUrl.pathname.replace(/^\/+|\/+$/g, "")
+      });
+    }
+  }
+  return routes;
+}
 function gitUsernameForProvider(provider) {
   if (provider === "github") return "x-access-token";
   if (provider === "gitlab") return "oauth2";
   return "opengeni";
 }
-function gitCredentialHelperBindingCaseLines(resources) {
-  return runtimeGitBindingDescriptors(resources).flatMap((descriptor) => {
+function gitCredentialHelperBindingCaseLines(resources, bindings) {
+  const brokeredBindings = brokeredGitCredentialBindingKeys(bindings);
+  return runtimeGitBindingDescriptors(resources).filter(
+    (descriptor) => !brokeredBindings.has(
+      gitCredentialBindingKey(descriptor.provider, descriptor.credentialBindingId)
+    )
+  ).flatMap((descriptor) => {
     const paths = /* @__PURE__ */ new Set([
       descriptor.path,
       descriptor.path.replace(/\.git$/, ""),
@@ -12102,7 +11995,19 @@ function gitCredentialHelperBindingCaseLines(resources) {
     );
   });
 }
-function gitAskpassHostProviderCaseLines(resources) {
+function gitCredentialHelperBrokerCaseLines(routes) {
+  return routes.flatMap((route) => {
+    const paths = /* @__PURE__ */ new Set([
+      route.path,
+      route.path.replace(/\.git$/, ""),
+      `${route.path.replace(/\.git$/, "")}.git`
+    ]);
+    return [...paths].map(
+      (path) => `  ${shellQuote(`${route.protocol}|${route.host}|${path}`)}) username=opengeni; token_file="$credential_dir/${route.bindingHash}-token" ;;`
+    );
+  });
+}
+function gitAskpassHostProviderCaseLines(resources, brokerRoutes) {
   const hosts = /* @__PURE__ */ new Map();
   for (const descriptor of runtimeGitBindingDescriptors(resources)) {
     const entry = hosts.get(descriptor.host) ?? {
@@ -12112,9 +12017,13 @@ function gitAskpassHostProviderCaseLines(resources) {
     entry.bindings.add(`${descriptor.provider}\0${descriptor.credentialBindingId}`);
     hosts.set(descriptor.host, entry);
   }
-  return [...hosts.entries()].filter(([, entry]) => entry.bindings.size === 1).sort(([a], [b]) => a.localeCompare(b)).map(
-    ([hostname, entry]) => `    ${shellQuote(hostname)}) printf '%s\\n' ${entry.provider}; return 0 ;;`
-  );
+  const brokerHosts = [...new Set(brokerRoutes.map((route) => route.host))].sort((a, b) => a.localeCompare(b)).map((hostname) => `    ${shellQuote(hostname)}) printf '\\n'; return 0 ;;`);
+  return [
+    ...brokerHosts,
+    ...[...hosts.entries()].filter(([, entry]) => entry.bindings.size === 1).sort(([a], [b]) => a.localeCompare(b)).map(
+      ([hostname, entry]) => `    ${shellQuote(hostname)}) printf '%s\\n' ${entry.provider}; return 0 ;;`
+    )
+  ];
 }
 function gitCredentialTokenWriterCommandLines(bindings = []) {
   const bindingWrites = bindings.flatMap((binding) => {
@@ -12123,7 +12032,7 @@ function gitCredentialTokenWriterCommandLines(bindings = []) {
     const count = Math.max(1, binding.providerBindingCount ?? 1);
     const provider = binding.provider;
     const lines = [`write_git_binding_token ${shellQuote(hash)} "\${${seedEnv}:-}"`];
-    if (count === 1) {
+    if (count === 1 && binding.transport?.kind !== "http_broker") {
       lines.push(`write_git_provider_token ${shellQuote(provider)} "\${${seedEnv}:-}"`);
     } else {
       lines.push(`remove_git_provider_token ${shellQuote(provider)}`);
@@ -12184,11 +12093,36 @@ function gitCredentialTokenWriterCommandLines(bindings = []) {
     'umask "$seed_umask"'
   ];
 }
+function gitHttpBrokerConfigCommandLines(routes) {
+  return [
+    'git_http_broker_config="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/http-broker.gitconfig"',
+    'mkdir -p "$(dirname "$git_http_broker_config")"',
+    'broker_umask="$(umask)"',
+    "umask 077",
+    ': > "$git_http_broker_config.tmp.$$"',
+    ...routes.map(
+      (route) => `git config --file "$git_http_broker_config.tmp.$$" --add ${shellQuote(`url.${route.brokerUri}.insteadOf`)} ${shellQuote(route.repositoryUri)}`
+    ),
+    'mv -f "$git_http_broker_config.tmp.$$" "$git_http_broker_config"',
+    'umask "$broker_umask"',
+    'git config --global --unset-all include.path "$git_http_broker_config" >/dev/null 2>&1 || true',
+    'git config --global --add include.path "$git_http_broker_config"'
+  ];
+}
 function gitCredentialHelperCommandLines(resources = [], bindings = []) {
-  const hostProviderCases = gitAskpassHostProviderCaseLines(resources);
-  const bindingCases = gitCredentialHelperBindingCaseLines(resources);
+  const brokerRoutes = runtimeGitHttpBrokerRouteDescriptors(resources, bindings);
+  const hostProviderCases = gitAskpassHostProviderCaseLines(resources, brokerRoutes);
+  const bindingCases = [
+    ...gitCredentialHelperBindingCaseLines(resources, bindings),
+    ...gitCredentialHelperBrokerCaseLines(brokerRoutes)
+  ];
   const descriptors = runtimeGitBindingDescriptors(resources);
-  const wrapperDescriptors = bindings.length > 0 ? descriptors : [];
+  const brokeredBindings = brokeredGitCredentialBindingKeys(bindings);
+  const wrapperDescriptors = bindings.length > 0 ? descriptors.filter(
+    (descriptor) => !brokeredBindings.has(
+      gitCredentialBindingKey(descriptor.provider, descriptor.credentialBindingId)
+    )
+  ) : [];
   const bindingProviders = /* @__PURE__ */ new Map();
   for (const descriptor of runtimeGitBindingDescriptors(resources)) {
     const ids = bindingProviders.get(descriptor.provider) ?? /* @__PURE__ */ new Set();
@@ -12213,6 +12147,23 @@ function gitCredentialHelperCommandLines(resources = [], bindings = []) {
     ] : [];
   });
   const multiWrapperProviders = bindings.length > 0 ? [...bindingProviders.entries()].filter(([, ids]) => ids.size > 1).map(([provider]) => provider) : [];
+  const brokeredOriginCases = brokerRoutes.flatMap((route) => {
+    const base = route.repositoryUri.replace(/\.git$/, "");
+    return [.../* @__PURE__ */ new Set([route.repositoryUri, base, `${base}.git`])].map(
+      (uri) => `    ${shellQuote(`${route.provider}|${uri}`)}) return 0 ;;`
+    );
+  });
+  const brokeredBindingHashCases = bindings.filter((binding) => binding.transport?.kind === "http_broker").map(
+    (binding) => `    ${shellQuote(`${binding.provider}|${gitCredentialBindingHash(binding.credentialBindingId)}`)}) return 0 ;;`
+  );
+  const providerBindingKinds = /* @__PURE__ */ new Map();
+  for (const binding of bindings) {
+    const counts = providerBindingKinds.get(binding.provider) ?? { direct: 0, brokered: 0 };
+    if (binding.transport?.kind === "http_broker") counts.brokered += 1;
+    else counts.direct += 1;
+    providerBindingKinds.set(binding.provider, counts);
+  }
+  const brokerOnlyProviders = [...providerBindingKinds.entries()].filter(([, counts]) => counts.brokered > 0 && counts.direct === 0).map(([provider]) => provider);
   return [
     ...gitCredentialTokenWriterCommandLines(bindings),
     // Provision git/provider-CLI helpers at SETUP (runtime) before any clone
@@ -12304,6 +12255,7 @@ function gitCredentialHelperCommandLines(resources = [], bindings = []) {
     "git config --global --add credential.helper ''",
     'git config --global --add credential.helper "$git_credential_helper"',
     "git config --global credential.useHttpPath true",
+    ...gitHttpBrokerConfigCommandLines(brokerRoutes),
     'wrapper_dir="${OPENGENI_GIT_CLI_WRAPPER_DIR:-$HOME/.opengeni/bin}"',
     'mkdir -p "$wrapper_dir"',
     "for opengeni_git_cli_tool in gh glab az; do",
@@ -12331,12 +12283,24 @@ function gitCredentialHelperCommandLines(resources = [], bindings = []) {
     "    *) return 1 ;;",
     "  esac",
     "}",
+    "binding_hash_is_brokered() {",
+    '  case "$provider|$1" in',
+    ...brokeredBindingHashCases,
+    "    *) return 1 ;;",
+    "  esac",
+    "}",
     "binding_hash_for_origin() {",
     '  case "$provider|$1" in',
     ...originWrapperHashes,
     "    *) return 1 ;;",
     "  esac",
     "}",
+    "origin_is_brokered() {",
+    '  case "$provider|$1" in',
+    ...brokeredOriginCases,
+    "    *) return 1 ;;",
+    "  esac",
+    "}",
     "sole_binding_hash() {",
     '  case "$provider" in',
     ...soleWrapperHashes,
@@ -12344,19 +12308,25 @@ function gitCredentialHelperCommandLines(resources = [], bindings = []) {
     "  esac",
     "}",
     `multi_binding_providers=${shellQuote(multiWrapperProviders.join(" "))}`,
+    `broker_only_providers=${shellQuote(brokerOnlyProviders.join(" "))}`,
     'if [ -n "$provider" ]; then',
     "  binding_hash=",
     '  if [ -n "${OPENGENI_GIT_BINDING:-}" ]; then',
     '    binding_hash="$(hash_binding_id "$OPENGENI_GIT_BINDING")"',
+    `    binding_hash_is_brokered "$binding_hash" && { printf '%s\\n' "$tool provider API authentication is host-brokered for OPENGENI_GIT_BINDING; use the configured provider MCP tools" >&2; exit 2; }`,
     `    binding_hash_allowed "$binding_hash" || { printf '%s\\n' "OPENGENI_GIT_BINDING does not select a $provider credential attached to this session" >&2; exit 2; }`,
     "  elif command -v git >/dev/null 2>&1; then",
     '    origin="$(git config --get remote.origin.url 2>/dev/null || true)"',
+    `    [ -z "$origin" ] || ! origin_is_brokered "$origin" || { printf '%s\\n' "$tool provider API authentication is host-brokered for this repository; use the configured provider MCP tools" >&2; exit 2; }`,
     '    [ -z "$origin" ] || binding_hash="$(binding_hash_for_origin "$origin" 2>/dev/null || true)"',
     "  fi",
     '  [ -n "$binding_hash" ] || binding_hash="$(sole_binding_hash 2>/dev/null || true)"',
     '  if [ -n "$binding_hash" ]; then',
     '    token_file="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/$binding_hash-token"',
     "  else",
+    '    case " $broker_only_providers " in',
+    `      *" $provider "*) printf '%s\\n' "$tool provider API authentication is host-brokered for this session; use the configured provider MCP tools" >&2; exit 2 ;;`,
+    "    esac",
     '    case " $multi_binding_providers " in',
     `      *" $provider "*) printf '%s\\n' "Unable to select one of multiple $provider credentials; run inside an attached repository or set OPENGENI_GIT_BINDING" >&2; exit 2 ;;`,
     "    esac",
@@ -13194,6 +13164,7 @@ export {
   GENESIS_TITLE_DIRECTIVE,
   HUMAN_INPUT_TOOL_NAME,
   MAX_COMPACTION_THRESHOLD_RATIO,
+  MAX_MODEL_USAGE_TOKEN_COUNT,
   MIN_COMPACTION_THRESHOLD_RATIO,
   MaxTurnsExceededError,
   MockAgentResponder,
@@ -13212,6 +13183,9 @@ export {
   REPOSITORY_DISCOVERY_LIMIT,
   RecordingError,
   RecordingUnavailableError,
+  RoutingBackendRecoveryRequiredError,
+  RoutingMutationOutcomeUnknownError,
+  RoutingRetainedProcessNotFoundError,
   RoutingSandboxSession,
   RoutingUnsupportedError,
   RunCredentialValidationError,
@@ -13234,7 +13208,9 @@ export {
   SandboxChannelAService,
   SandboxComputer,
   SandboxConfigError,
+  SandboxExecReadinessError,
   SandboxProviderUnavailableError,
+  SandboxReplacementProviderStateError,
   SandboxResumeStateUnavailableError,
   SelfhostedControlError,
   SelfhostedSandboxClient,
@@ -13247,7 +13223,10 @@ export {
   TerminalServerError,
   TerminalServerUnsupportedError,
   ToolspaceTokenPathError,
+  TurnSandboxCommandCancelledError,
   USER_MESSAGE_TRUNCATION_MARKER,
+  WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,
+  WorkspaceArchiveIntegrityError,
   WorkspaceModelPolicyBlockedError,
   agentErrorToControlError,
   agentsErrorRunState,
@@ -13279,7 +13258,9 @@ export {
   buildSummaryItem,
   buildTerminalServerScript,
   callModelInputFilterForSettings,
+  captureVerifiedWorkspaceArchive,
   clampCompactionThresholdRatio,
+  classifyProviderSandboxFailure,
   clearRunCredentials,
   clearRunCredentialsForAttempt,
   collectSandboxEnvironment,
@@ -13291,12 +13272,14 @@ export {
   computerUse,
   configureOpenAI,
   configureRuntimeMetricsHooks,
+  connectMcpServersInBatches,
   contentTypeForCodec,
   contextRobustnessFilterForSettings,
   coreInstructions,
   createProductionAgentRuntime,
   createSandboxClient,
   createSandboxClientForBackend,
+  createTurnToolCancellationController,
   decideCompaction,
   decideSelfhostedRetry,
   decodeModalSnapshotId,
@@ -13324,16 +13307,20 @@ export {
   extForCodec,
   extractResponseOutputText,
   findCompactionNeededError,
+  fingerprintSandboxWorkspace,
   getSkillLibraryEntry,
   gitCredentialBindingHash,
   gitCredentialBindingTokenRefreshCommand,
   gitProviderTokenRefreshCommand,
   hasModelGeneratedItem,
+  hasPersistableSandboxProviderIdentity,
   inspectRecordingArtifact,
   isCompactionSummary,
   isEphemeralInternalContext,
   isExecSessionLostBanner,
+  isProviderSandboxGoneDuringRoutedOperation,
   isProviderSandboxNotFoundError,
+  isProviderSandboxTransientError,
   isSelfhostedProviderNotFoundError,
   isSkillLibraryEntryId,
   isUserMessage,
@@ -13353,11 +13340,13 @@ export {
   modelCallUsageTelemetry,
   modelResponseUsageFromResponse,
   modelResponseUsageFromSdkEvent,
+  modelUsageTokenCountOrNull,
   negotiateCapabilities,
   negotiateSelfhostedCapabilities,
   neutralizeToolSearchItemsInSerializedRunState,
   nextDurableOpId,
   normalizeComputerCallsFilter,
+  normalizeModelCallUsage,
   normalizeRunCredentialsResolution,
   normalizeSdkEvent,
   normalizeToolOutputForEvent,
@@ -13372,12 +13361,14 @@ export {
   parseNumstatZ,
   parsePorcelainV2,
   parseUnifiedPatch,
+  parseWorkspaceArchiveDescriptor,
   payloadTooLargeMessage,
   pinProvidedSessionManifestEnvironment,
   prefixedMcpToolName,
   prepareAgentTools,
   prepareCompactionPromptInput,
   prepareRunInput,
+  readVerifiedWorkspaceArchive,
   readWorkspaceArchiveFromEnvelopeSessionState,
   recordingStorageKey,
   refreshGitCredentialBindingTokenFiles,
@@ -13387,6 +13378,7 @@ export {
   renderSelfhostedFault,
   repositoryCloneCommand,
   repositoryUsesSandboxClone,
+  requirePersistableReplacementSandboxEnvelope,
   resolveTurnModel,
   restoredSandboxSessionStateFromEntry,
   rigInstructions,
@@ -13418,6 +13410,7 @@ export {
   serializeApprovals,
   serializeEstablishedSandboxEnvelope,
   serializeHumanInputRequests,
+  serializeReplacementSandboxEnvelope,
   setSelfhostedApplyDiff,
   startRecording,
   stopRecording,
@@ -13439,6 +13432,8 @@ export {
   toolspaceTokenFileFromEnvironment,
   toolspaceTokenSeedCommand,
   uploadRecordingArtifact,
+  verifyRestoredWorkspace,
+  verifySandboxExecReadiness,
   verifyStreamToken,
   withManifestRefreshOnResume,
   withRunCredentialEnvironment,