@opengeni/runtime 0.11.0 → 0.13.3

package/dist/mcp-network.d.ts

@@ -0,0 +1,80 @@
+import { Settings } from '@opengeni/config';
+import { DnsLookup, isNonPublicAddress } from '@opengeni/network';
+export { undiciFetch } from '@opengeni/network';
+
+declare const MCP_MAX_RESPONSE_BYTES: number;
+declare const MCP_MAX_INBOUND_REQUEST_BYTES: number;
+declare const MCP_MAX_TOOL_DEFINITION_BYTES: number;
+declare const MCP_MAX_TOOL_LIST_BYTES: number;
+declare const MCP_MAX_TOOL_LIST_ENTRIES = 1000;
+declare const MCP_MAX_TOOL_RESULT_BYTES: number;
+declare const MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES: number;
+declare const MCP_MAX_SELECTED_SERVERS = 64;
+declare const MCP_MAX_CONCURRENT_SERVER_OPERATIONS = 8;
+declare const MCP_DEFAULT_OUTER_CONNECT_TIMEOUT_MS = 10000;
+declare const MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES = 4096;
+declare const MCP_MAX_AGGREGATE_TOOL_LIST_BYTES: number;
+declare const MCP_MAX_TOOL_SEARCH_SOURCES = 64;
+declare const MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH = 120;
+declare const MCP_MAX_TOOL_SEARCH_DESCRIPTION_BYTES: number;
+declare class McpPayloadTooLargeError extends Error {
+    readonly label: string;
+    readonly actualBytes: number;
+    readonly maxBytes: number;
+    constructor(label: string, actualBytes: number, maxBytes: number);
+}
+declare function mcpSerializedSizeBytes(value: unknown): number;
+declare function assertMcpPayloadWithinBytes(value: unknown, maxBytes: number, label: string): void;
+declare function assertMcpToolListWithinBounds<T>(tools: readonly T[]): readonly T[];
+declare function assertMcpServerSelectionWithinBounds<T>(servers: readonly T[]): readonly T[];
+declare function mcpOuterConnectTimeoutMs(configuredTimeouts: readonly (number | undefined)[]): number;
+type McpToolListContribution = {
+    entries: number;
+    bytes: number;
+};
+/**
+ * Atomic aggregate accounting shared by every exposed tools/list in one run.
+ * A repeated list for the same source REPLACES its prior contribution, so
+ * cache invalidation/relisting cannot ratchet the budget upward. Failed
+ * replacements leave the previous accounting intact.
+ */
+declare class McpAggregateToolListBudget {
+    private readonly label;
+    private readonly maxEntries;
+    private readonly maxBytes;
+    private readonly contributions;
+    private totalEntries;
+    private totalBytes;
+    constructor(label?: string, maxEntries?: number, maxBytes?: number);
+    replace<T>(sourceId: string, tools: readonly T[]): readonly T[];
+    remove(sourceId: string): void;
+    snapshot(): Readonly<McpToolListContribution>;
+}
+/** Stable-order parallel map with a hard in-flight ceiling and fail-stop drain. */
+declare function boundedParallelMap<T, R>(values: readonly T[], concurrency: number, mapper: (value: T, index: number) => Promise<R>): Promise<R[]>;
+/**
+ * Guard normal MCP traffic with the same deployment policy as OAuth traffic.
+ * The pinned transport resolves and policy-checks the destination after the
+ * caller has composed any credential headers, then performs the final network
+ * call through the vetted Agent. It forces manual redirects, so an
+ * Authorization-bearing request never follows a provider-controlled Location
+ * to an unvalidated host.
+ *
+ * This module is deliberately agent-loop-free. API code imports the explicit
+ * `@opengeni/runtime/mcp-network` leaf rather than the runtime root barrel.
+ */
+declare function guardedMcpFetch<TInput extends string | URL | Request>(settings: Pick<Settings, "environment" | "integrationsAllowPrivateNetworkTargets">, fetchImpl: (input: TInput, init?: RequestInit) => Promise<Response>, options?: {
+    maxResponseBytes?: number;
+    dnsLookup?: DnsLookup;
+    requireHttpsOutsideLocalTest?: boolean;
+}): (input: TInput, init?: RequestInit) => Promise<Response>;
+declare function boundMcpResponseBody(response: Response, maxBytes: number): Response;
+declare function cancelMcpResponseBody(response: Response): Promise<void>;
+/** Read and rebuild an inbound MCP request before the SDK parses it. */
+declare function boundedMcpRequest(request: Request, maxBytes?: number): Promise<Request>;
+declare function assertMcpDestinationAllowed(rawUrl: string, settings: Pick<Settings, "environment" | "integrationsAllowPrivateNetworkTargets">, options?: {
+    dnsLookup?: DnsLookup;
+}): Promise<void>;
+declare const isNonPublicMcpAddress: typeof isNonPublicAddress;
+
+export { MCP_DEFAULT_OUTER_CONNECT_TIMEOUT_MS, MCP_MAX_AGGREGATE_TOOL_LIST_BYTES, MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES, MCP_MAX_CONCURRENT_SERVER_OPERATIONS, MCP_MAX_INBOUND_REQUEST_BYTES, MCP_MAX_RESPONSE_BYTES, MCP_MAX_SELECTED_SERVERS, MCP_MAX_TOOL_DEFINITION_BYTES, MCP_MAX_TOOL_LIST_BYTES, MCP_MAX_TOOL_LIST_ENTRIES, MCP_MAX_TOOL_RESULT_BYTES, MCP_MAX_TOOL_SEARCH_DESCRIPTION_BYTES, MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES, MCP_MAX_TOOL_SEARCH_SOURCES, MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH, McpAggregateToolListBudget, McpPayloadTooLargeError, assertMcpDestinationAllowed, assertMcpPayloadWithinBytes, assertMcpServerSelectionWithinBounds, assertMcpToolListWithinBounds, boundMcpResponseBody, boundedMcpRequest, boundedParallelMap, cancelMcpResponseBody, guardedMcpFetch, isNonPublicMcpAddress, mcpOuterConnectTimeoutMs, mcpSerializedSizeBytes };

package/dist/mcp-network.js

@@ -0,0 +1,66 @@
+import {
+  MCP_DEFAULT_OUTER_CONNECT_TIMEOUT_MS,
+  MCP_MAX_AGGREGATE_TOOL_LIST_BYTES,
+  MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES,
+  MCP_MAX_CONCURRENT_SERVER_OPERATIONS,
+  MCP_MAX_INBOUND_REQUEST_BYTES,
+  MCP_MAX_RESPONSE_BYTES,
+  MCP_MAX_SELECTED_SERVERS,
+  MCP_MAX_TOOL_DEFINITION_BYTES,
+  MCP_MAX_TOOL_LIST_BYTES,
+  MCP_MAX_TOOL_LIST_ENTRIES,
+  MCP_MAX_TOOL_RESULT_BYTES,
+  MCP_MAX_TOOL_SEARCH_DESCRIPTION_BYTES,
+  MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES,
+  MCP_MAX_TOOL_SEARCH_SOURCES,
+  MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH,
+  McpAggregateToolListBudget,
+  McpPayloadTooLargeError,
+  assertMcpDestinationAllowed,
+  assertMcpPayloadWithinBytes,
+  assertMcpServerSelectionWithinBounds,
+  assertMcpToolListWithinBounds,
+  boundMcpResponseBody,
+  boundedMcpRequest,
+  boundedParallelMap,
+  cancelMcpResponseBody,
+  guardedMcpFetch,
+  isNonPublicMcpAddress,
+  mcpOuterConnectTimeoutMs,
+  mcpSerializedSizeBytes,
+  undiciFetch
+} from "./chunk-SSB7VOLE.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MCP_DEFAULT_OUTER_CONNECT_TIMEOUT_MS,
+  MCP_MAX_AGGREGATE_TOOL_LIST_BYTES,
+  MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES,
+  MCP_MAX_CONCURRENT_SERVER_OPERATIONS,
+  MCP_MAX_INBOUND_REQUEST_BYTES,
+  MCP_MAX_RESPONSE_BYTES,
+  MCP_MAX_SELECTED_SERVERS,
+  MCP_MAX_TOOL_DEFINITION_BYTES,
+  MCP_MAX_TOOL_LIST_BYTES,
+  MCP_MAX_TOOL_LIST_ENTRIES,
+  MCP_MAX_TOOL_RESULT_BYTES,
+  MCP_MAX_TOOL_SEARCH_DESCRIPTION_BYTES,
+  MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES,
+  MCP_MAX_TOOL_SEARCH_SOURCES,
+  MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH,
+  McpAggregateToolListBudget,
+  McpPayloadTooLargeError,
+  assertMcpDestinationAllowed,
+  assertMcpPayloadWithinBytes,
+  assertMcpServerSelectionWithinBounds,
+  assertMcpToolListWithinBounds,
+  boundMcpResponseBody,
+  boundedMcpRequest,
+  boundedParallelMap,
+  cancelMcpResponseBody,
+  guardedMcpFetch,
+  isNonPublicMcpAddress,
+  mcpOuterConnectTimeoutMs,
+  mcpSerializedSizeBytes,
+  undiciFetch
+};
+//# sourceMappingURL=mcp-network.js.map

package/dist/mcp-network.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/sandbox/index.d.ts

@@ -1,6 +1,6 @@
 export { collectSandboxEnvironment, parseExposedPorts } from '@opengeni/config';
 export { CAPABILITY_DESCRIPTORS, CapabilityDescriptor, DESKTOP_STREAM_PORT, StreamTokenPayload, StreamTokenPayload as StreamTokenPayloadType, TERMINAL_STREAM_PORT } from '@opengeni/contracts';
 import '@openai/agents/sandbox';
-export { A as ActiveBackendResolverDeps, b as ActiveBackendUnresolvableError, c as ActivePointer, B as BackendUnresolvableCode, C as ChannelAConflictError, d as ChannelAEmitter, e as ChannelAExecArgs, f as ChannelAExecResult, g as ChannelANotFoundError, h as ChannelASession, i as ChannelAUnavailableError, j as ChannelAUnsupportedError, k as ChannelAValidationError, l as ControlRpc, D as DEFAULT_DESKTOP_GEOMETRY, m as DISPLAY_STACK_TIMEOUT_MS, n as DesktopGeometry, o as DisplayStackError, p as DisplayStackUnsupportedError, E as EnsureDisplayStackOptions, q as EnsureDisplayStackResult, r as EnsureTerminalServerOptions, s as EnsureTerminalServerResult, t as EstablishedSandboxSession, u as ExposeStreamPortInput, v as ExposeStreamPortResult, w as ExposedPortEndpoint, F as FAULT_FIELD_WHAT_HAPPENED, x as FAULT_FIELD_WHAT_PRESERVED, y as FAULT_FIELD_WHAT_TO_TRY, z as FAULT_FIELD_WHICH_LAYER, L as LiveModalSandboxLeaseAttribution, M as MaterializeRunCredentialsOptions, G as MintStreamTokenInput, H as MockAgentResponder, I as MockAgentResponderOptions, J as MockExecHandler, K as ModalModuleLoader, N as ModalOrphanSweepResult, O as ModalSandboxAttribution, P as NEVER_SENT_DETAIL_KEY, Q as NatsControlRpc, S as NatsOpStreamConnection, T as NatsOpStreamTransport, U as NatsRequestConnection, V as NegotiationContext, W as NormalizedRunCredentialMaterial, X as NumstatEntry, Y as OP_STREAM_ACK_INTERVAL_MS, Z as OP_STREAM_DEFAULT_WINDOW_BYTES, _ as OP_STREAM_RECONNECT_HOLD_MS, $ as OP_STREAM_SILENCE_TIMEOUT_MS, a0 as OpStreamExecOutcome, a1 as OpStreamJournal, a2 as OpStreamSubscription, a3 as OpStreamTransport, a4 as OpStreamUnavailableError, a5 as PROVIDER_REGISTRY, a6 as ProviderConstructionContext, a7 as ProviderRegistration, a8 as REPOSITORY_DISCOVERY_LIMIT, a9 as RecordingArtifactMetadata, aa as RecordingCodec, ab as RecordingContentType, ac as RecordingError, ad as RecordingProcess, ae as RecordingUnavailableError, af as RepositoryDiscoveryDegradedReason, ag as RepositoryDiscoveryResult, ah as ResolvedActiveBackend, ai as RoutableBackendSession, aj as RoutableSandbox, ak as RoutingSandboxSession, al as RoutingSandboxSessionDeps, am as RoutingTransitionEvent, an as RoutingUnsupportedError, ao as RunCredentialCommandRunner, ap as RunCredentialCommandSession, aq as RunCredentialExpectedScope, R as RunCredentialSessionReady, ar as RunCredentialValidationError, as as SELFHOSTED_DEFAULT_TIMEOUT_MS, at as SELFHOSTED_DRAINING_MAX_RETRIES, au as SELFHOSTED_EXEC_DRAINING_MAX_RETRIES, av as SELFHOSTED_IDEMPOTENT_READONLY_OPS, aw as SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES, ax as SELFHOSTED_NEVER_SENT_MAX_RETRIES, ay as SELFHOSTED_RECONNECT_WINDOW_MS, az as SELFHOSTED_RELAY_STREAM_PATH, aA as SELFHOSTED_RETRY_BACKOFF_BASE_MS, aB as SELFHOSTED_RETRY_BACKOFF_CAP_MS, aC as SELFHOSTED_RETRY_BACKOFF_FACTOR, aD as SELFHOSTED_TIMEOUT_MAX_RETRIES, aE as STREAM_PORT, aF as STREAM_TOKEN_DEFAULT_TTL_SECONDS, aG as SandboxChannelAService, aH as SandboxChannelAServiceOptions, aI as SandboxConfigError, aJ as SandboxCreatedCallback, aK as SandboxProviderUnavailableError, aL as SandboxResumeStateUnavailableError, aM as SelfhostedApplyDiff, aN as SelfhostedControlError, aO as SelfhostedEditor, aP as SelfhostedEnrollment, aQ as SelfhostedExecArgs, aR as SelfhostedExecResult, aS as SelfhostedImageOutput, aT as SelfhostedLivenessState, aU as SelfhostedNegotiationInput, aV as SelfhostedOpObservation, aW as SelfhostedOpObserver, aX as SelfhostedOpStreamDeps, aY as SelfhostedRelayConfig, aZ as SelfhostedRetryClock, a_ as SelfhostedRetryDecision, a$ as SelfhostedSandboxClient, b0 as SelfhostedSession, b1 as SelfhostedSessionBuild, b2 as SelfhostedSessionDeps, b3 as SelfhostedSessionState, b4 as SelfhostedUnavailableReason, b5 as StartRecordingInput, b6 as StreamPortUnavailableError, b7 as SwapTargetEstablishability, b8 as TERMINAL_SERVER_TIMEOUT_MS, b9 as TerminalServerError, ba as TerminalServerUnsupportedError, bb as ToolspaceTokenPathError, bc as agentErrorToControlError, bd as assertDescriptorRegistryInvariants, be as assertProviderRegistryInvariants, bf as assertSafeRelPath, bg as backendSupportsOs, bh as buildDisplayStackScript, bi as buildSelfhostedBackendSession, bj as buildStreamUrl, bk as buildTerminalServerScript, bl as clearRunCredentials, bm as clearRunCredentialsForAttempt, bn as contentTypeForCodec, bo as createSandboxClient, bp as createSandboxClientForBackend, bq as decideSelfhostedRetry, br as decodeModalSnapshotId, bs as defaultSelfhostedRetryClock, bt as deletePriorPersistedSnapshot, bu as deleteRecordingArtifacts, bv as deserializeSandboxSessionStateEnvelope, bw as desktopCapableBackend, bx as drainingExhaustedError, by as drainingMessage, bz as ensureDisplayStack, bA as ensureModalRegistryImage, bB as ensureTerminalServer, bC as establishSandboxSessionFromEnvelope, bD as execDeadlineHint, bE as exposeStreamPort, bF as extForCodec, bG as inspectRecordingArtifact, bH as isExecSessionLostBanner, bI as isProviderSandboxNotFoundError, bJ as isSelfhostedProviderNotFoundError, bK as makeActiveBackendResolver, bL as materializeRunCredentials, bM as mintStreamToken, bN as modalSandboxAttributionEnvironment, bO as modalSandboxAttributionTags, bP as negotiateCapabilities, bQ as negotiateSelfhostedCapabilities, bR as nextDurableOpId, bS as normalizeRunCredentialsResolution, bT as offlineAgentError, bU as offlineControlResponse, bV as opAckSubject, bW as opFrameSubject, bX as parseExecBannerExitCode, bY as parseExecBannerSessionId, bZ as parseNumstatZ, b_ as parsePorcelainV2, b$ as parseUnifiedPatch, c0 as payloadTooLargeMessage, c1 as readWorkspaceArchiveFromEnvelopeSessionState, c2 as recordingStorageKey, c3 as renderSelfhostedFault, c4 as restoredSandboxSessionStateFromEntry, c5 as runCredentialPointerFile, c6 as runCredentialRoot, c7 as runWithToolCallCorrelation, c8 as sandboxStateEntryFromRunState, c9 as sanitizeOpIdToken, ca as selectBackend, cb as selfhostedFaultClass, cc as selfhostedLiveness, cd as selfhostedRetryBackoffMs, ce as serializeEstablishedSandboxEnvelope, cf as setSelfhostedApplyDiff, cg as startRecording, ch as stopRecording, ci as stripExecBanner, cj as subjectFor, ck as swapTargetEstablishability, cl as sweepModalOrphanSandboxes, cm as tagModalSandbox, cn as tearDownDisplayStack, co as tearDownTerminalServer, cp as terminateModalSandboxById, cq as timeoutAgentError, cr as timeoutControlResponse, cs as toolspaceTokenFileForSession, ct as toolspaceTokenFileFromEnvironment, cu as uploadRecordingArtifact, cv as verifyStreamToken, cw as withRunCredentialEnvironment, cx as withRunCredentialsClient, cy as withRunCredentialsSession, cz as withToolspaceTokenClient, cA as withToolspaceTokenEnvironment, cB as withToolspaceTokenSession } from '../index-D6yi-JcU.js';
+export { A as ActiveBackendResolverDeps, b as ActiveBackendUnresolvableError, c as ActivePointer, B as BackendUnresolvableCode, C as ChannelAConflictError, d as ChannelAEmitter, e as ChannelAExecArgs, f as ChannelAExecResult, g as ChannelANotFoundError, h as ChannelASession, i as ChannelAUnavailableError, j as ChannelAUnsupportedError, k as ChannelAValidationError, l as ControlRpc, D as DEFAULT_DESKTOP_GEOMETRY, m as DISPLAY_STACK_TIMEOUT_MS, n as DefaultBackendLossResult, o as DesktopGeometry, p as DisplayStackCallerKind, q as DisplayStackClassification, r as DisplayStackError, s as DisplayStackTelemetryContext, t as DisplayStackTelemetryEvent, u as DisplayStackTelemetryStatus, v as DisplayStackUnsupportedError, E as EnsureDisplayStackOptions, w as EnsureDisplayStackResult, x as EnsureTerminalServerOptions, y as EnsureTerminalServerResult, z as EstablishedSandboxSession, F as ExposeStreamPortInput, G as ExposeStreamPortResult, H as ExposedPortEndpoint, I as FAULT_FIELD_WHAT_HAPPENED, J as FAULT_FIELD_WHAT_PRESERVED, K as FAULT_FIELD_WHAT_TO_TRY, L as FAULT_FIELD_WHICH_LAYER, M as LiveModalSandboxLeaseAttribution, N as MaterializeRunCredentialsOptions, O as MintStreamTokenInput, P as MockAgentResponder, Q as MockAgentResponderOptions, S as MockExecHandler, T as ModalModuleLoader, U as ModalOrphanSweepResult, V as ModalOrphanSweepTermination, W as ModalSandboxAttribution, X as NEVER_SENT_DETAIL_KEY, Y as NatsControlRpc, Z as NatsOpStreamConnection, _ as NatsOpStreamTransport, $ as NatsRequestConnection, a0 as NegotiationContext, a1 as NormalizedRunCredentialMaterial, a2 as NumstatEntry, a3 as OP_STREAM_ACK_INTERVAL_MS, a4 as OP_STREAM_DEFAULT_WINDOW_BYTES, a5 as OP_STREAM_RECONNECT_HOLD_MS, a6 as OP_STREAM_SILENCE_TIMEOUT_MS, a7 as OpStreamExecOutcome, a8 as OpStreamJournal, a9 as OpStreamSubscription, aa as OpStreamTransport, ab as OpStreamUnavailableError, ac as PROVIDER_REGISTRY, ad as ProviderConstructionContext, ae as ProviderRegistration, af as ProviderSandboxFailure, ag as ProviderSandboxFailureKind, ah as REPOSITORY_DISCOVERY_LIMIT, ai as RecordingArtifactMetadata, aj as RecordingCodec, ak as RecordingContentType, al as RecordingError, am as RecordingProcess, an as RecordingUnavailableError, ao as RepositoryDiscoveryDegradedReason, ap as RepositoryDiscoveryResult, aq as ResolvedActiveBackend, ar as RevalidateModalOrphanTermination, as as RoutableBackendSession, at as RoutableSandbox, au as RoutingBackendRecoveryRequiredError, av as RoutingMutationOutcomeUnknownError, aw as RoutingRetainedProcess, ax as RoutingRetainedProcessAdoption, ay as RoutingRetainedProcessNotFoundError, az as RoutingRetainedProcessTerminalProof, aA as RoutingSandboxSession, aB as RoutingSandboxSessionDeps, aC as RoutingTransitionEvent, aD as RoutingUnsupportedError, aE as RunCredentialCommandRunner, aF as RunCredentialCommandSession, aG as RunCredentialExpectedScope, R as RunCredentialSessionReady, aH as RunCredentialValidationError, aI as SELFHOSTED_DEFAULT_TIMEOUT_MS, aJ as SELFHOSTED_DRAINING_MAX_RETRIES, aK as SELFHOSTED_EXEC_DRAINING_MAX_RETRIES, aL as SELFHOSTED_IDEMPOTENT_READONLY_OPS, aM as SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES, aN as SELFHOSTED_NEVER_SENT_MAX_RETRIES, aO as SELFHOSTED_RECONNECT_WINDOW_MS, aP as SELFHOSTED_RELAY_STREAM_PATH, aQ as SELFHOSTED_RETRY_BACKOFF_BASE_MS, aR as SELFHOSTED_RETRY_BACKOFF_CAP_MS, aS as SELFHOSTED_RETRY_BACKOFF_FACTOR, aT as SELFHOSTED_TIMEOUT_MAX_RETRIES, aU as STREAM_PORT, aV as STREAM_TOKEN_DEFAULT_TTL_SECONDS, aW as SandboxChannelAService, aX as SandboxChannelAServiceOptions, aY as SandboxConfigError, aZ as SandboxCreatedCallback, a_ as SandboxExecReadinessError, a$ as SandboxProviderUnavailableError, b0 as SandboxReplacementProviderStateError, b1 as SandboxResumeStateUnavailableError, b2 as SelfhostedApplyDiff, b3 as SelfhostedControlError, b4 as SelfhostedEditor, b5 as SelfhostedEnrollment, b6 as SelfhostedExecArgs, b7 as SelfhostedExecResult, b8 as SelfhostedImageOutput, b9 as SelfhostedLivenessState, ba as SelfhostedNegotiationInput, bb as SelfhostedOpObservation, bc as SelfhostedOpObserver, bd as SelfhostedOpStreamDeps, be as SelfhostedRelayConfig, bf as SelfhostedRetryClock, bg as SelfhostedRetryDecision, bh as SelfhostedSandboxClient, bi as SelfhostedSession, bj as SelfhostedSessionBuild, bk as SelfhostedSessionDeps, bl as SelfhostedSessionState, bm as SelfhostedUnavailableReason, bn as StartRecordingInput, bo as StreamPortUnavailableError, bp as SwapTargetEstablishability, bq as TERMINAL_SERVER_TIMEOUT_MS, br as TerminalServerError, bs as TerminalServerUnsupportedError, bt as ToolspaceTokenPathError, bu as VerifiedWorkspaceArchive, bv as WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION, bw as WorkspaceArchiveDescriptor, bx as WorkspaceArchiveIntegrityCode, by as WorkspaceArchiveIntegrityError, bz as WorkspaceTreeFingerprint, bA as agentErrorToControlError, bB as assertDescriptorRegistryInvariants, bC as assertProviderRegistryInvariants, bD as assertSafeRelPath, bE as backendSupportsOs, bF as buildDisplayStackScript, bG as buildSelfhostedBackendSession, bH as buildStreamUrl, bI as buildTerminalServerScript, bJ as captureVerifiedWorkspaceArchive, bK as classifyProviderSandboxFailure, bL as clearRunCredentials, bM as clearRunCredentialsForAttempt, bN as contentTypeForCodec, bO as createSandboxClient, bP as createSandboxClientForBackend, bQ as decideSelfhostedRetry, bR as decodeModalSnapshotId, bS as defaultSelfhostedRetryClock, bT as deletePriorPersistedSnapshot, bU as deleteRecordingArtifacts, bV as deserializeSandboxSessionStateEnvelope, bW as desktopCapableBackend, bX as drainingExhaustedError, bY as drainingMessage, bZ as ensureDisplayStack, b_ as ensureModalRegistryImage, b$ as ensureTerminalServer, c0 as establishSandboxSessionFromEnvelope, c1 as execDeadlineHint, c2 as exposeStreamPort, c3 as extForCodec, c4 as fingerprintSandboxWorkspace, c5 as hasPersistableSandboxProviderIdentity, c6 as inspectRecordingArtifact, c7 as isExecSessionLostBanner, c8 as isProviderSandboxGoneDuringRoutedOperation, c9 as isProviderSandboxNotFoundError, ca as isProviderSandboxTransientError, cb as isSelfhostedProviderNotFoundError, cc as makeActiveBackendResolver, cd as materializeRunCredentials, ce as mintStreamToken, cf as modalSandboxAttributionEnvironment, cg as modalSandboxAttributionTags, ch as negotiateCapabilities, ci as negotiateSelfhostedCapabilities, cj as nextDurableOpId, ck as normalizeRunCredentialsResolution, cl as offlineAgentError, cm as offlineControlResponse, cn as opAckSubject, co as opFrameSubject, cp as parseExecBannerExitCode, cq as parseExecBannerSessionId, cr as parseNumstatZ, cs as parsePorcelainV2, ct as parseUnifiedPatch, cu as parseWorkspaceArchiveDescriptor, cv as payloadTooLargeMessage, cw as readVerifiedWorkspaceArchive, cx as readWorkspaceArchiveFromEnvelopeSessionState, cy as recordingStorageKey, cz as renderSelfhostedFault, cA as requirePersistableReplacementSandboxEnvelope, cB as restoredSandboxSessionStateFromEntry, cC as runCredentialPointerFile, cD as runCredentialRoot, cE as runWithToolCallCorrelation, cF as sandboxStateEntryFromRunState, cG as sanitizeOpIdToken, cH as selectBackend, cI as selfhostedFaultClass, cJ as selfhostedLiveness, cK as selfhostedRetryBackoffMs, cL as serializeEstablishedSandboxEnvelope, cM as serializeReplacementSandboxEnvelope, cN as setSelfhostedApplyDiff, cO as startRecording, cP as stopRecording, cQ as stripExecBanner, cR as subjectFor, cS as swapTargetEstablishability, cT as sweepModalOrphanSandboxes, cU as tagModalSandbox, cV as tearDownDisplayStack, cW as tearDownTerminalServer, cX as terminateModalSandboxById, cY as timeoutAgentError, cZ as timeoutControlResponse, c_ as toolspaceTokenFileForSession, c$ as toolspaceTokenFileFromEnvironment, d0 as uploadRecordingArtifact, d1 as verifyRestoredWorkspace, d2 as verifySandboxExecReadiness, d3 as verifyStreamToken, d4 as withRunCredentialEnvironment, d5 as withRunCredentialsClient, d6 as withRunCredentialsSession, d7 as withToolspaceTokenClient, d8 as withToolspaceTokenEnvironment, d9 as withToolspaceTokenSession } from '../index-DU-KXVlx.js';
 import 'modal';
 import '@opengeni/agent-proto';

package/dist/sandbox/index.js

@@ -28,6 +28,9 @@ import {
   REPOSITORY_DISCOVERY_LIMIT,
   RecordingError,
   RecordingUnavailableError,
+  RoutingBackendRecoveryRequiredError,
+  RoutingMutationOutcomeUnknownError,
+  RoutingRetainedProcessNotFoundError,
   RoutingSandboxSession,
   RoutingUnsupportedError,
   RunCredentialValidationError,
@@ -47,7 +50,9 @@ import {
   STREAM_TOKEN_DEFAULT_TTL_SECONDS,
   SandboxChannelAService,
   SandboxConfigError,
+  SandboxExecReadinessError,
   SandboxProviderUnavailableError,
+  SandboxReplacementProviderStateError,
   SandboxResumeStateUnavailableError,
   SelfhostedControlError,
   SelfhostedSandboxClient,
@@ -59,6 +64,8 @@ import {
   TerminalServerError,
   TerminalServerUnsupportedError,
   ToolspaceTokenPathError,
+  WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,
+  WorkspaceArchiveIntegrityError,
   agentErrorToControlError,
   assertDescriptorRegistryInvariants,
   assertProviderRegistryInvariants,
@@ -68,6 +75,8 @@ import {
   buildSelfhostedBackendSession,
   buildStreamUrl,
   buildTerminalServerScript,
+  captureVerifiedWorkspaceArchive,
+  classifyProviderSandboxFailure,
   clearRunCredentials,
   clearRunCredentialsForAttempt,
   collectSandboxEnvironment,
@@ -90,9 +99,13 @@ import {
   execDeadlineHint,
   exposeStreamPort,
   extForCodec,
+  fingerprintSandboxWorkspace,
+  hasPersistableSandboxProviderIdentity,
   inspectRecordingArtifact,
   isExecSessionLostBanner,
+  isProviderSandboxGoneDuringRoutedOperation,
   isProviderSandboxNotFoundError,
+  isProviderSandboxTransientError,
   isSelfhostedProviderNotFoundError,
   makeActiveBackendResolver,
   materializeRunCredentials,
@@ -113,10 +126,13 @@ import {
   parseNumstatZ,
   parsePorcelainV2,
   parseUnifiedPatch,
+  parseWorkspaceArchiveDescriptor,
   payloadTooLargeMessage,
+  readVerifiedWorkspaceArchive,
   readWorkspaceArchiveFromEnvelopeSessionState,
   recordingStorageKey,
   renderSelfhostedFault,
+  requirePersistableReplacementSandboxEnvelope,
   restoredSandboxSessionStateFromEntry,
   runCredentialPointerFile,
   runCredentialRoot,
@@ -128,6 +144,7 @@ import {
   selfhostedLiveness,
   selfhostedRetryBackoffMs,
   serializeEstablishedSandboxEnvelope,
+  serializeReplacementSandboxEnvelope,
   setSelfhostedApplyDiff,
   startRecording,
   stopRecording,
@@ -144,6 +161,8 @@ import {
   toolspaceTokenFileForSession,
   toolspaceTokenFileFromEnvironment,
   uploadRecordingArtifact,
+  verifyRestoredWorkspace,
+  verifySandboxExecReadiness,
   verifyStreamToken,
   withRunCredentialEnvironment,
   withRunCredentialsClient,
@@ -151,7 +170,7 @@ import {
   withToolspaceTokenClient,
   withToolspaceTokenEnvironment,
   withToolspaceTokenSession
-} from "../chunk-YUAFQEFY.js";
+} from "../chunk-JGUQSAG5.js";
 import "../chunk-4YJ5Z52Z.js";
 import "../chunk-K4V4QYCL.js";
 import "../chunk-PZ5AY32C.js";
@@ -185,6 +204,9 @@ export {
   REPOSITORY_DISCOVERY_LIMIT,
   RecordingError,
   RecordingUnavailableError,
+  RoutingBackendRecoveryRequiredError,
+  RoutingMutationOutcomeUnknownError,
+  RoutingRetainedProcessNotFoundError,
   RoutingSandboxSession,
   RoutingUnsupportedError,
   RunCredentialValidationError,
@@ -204,7 +226,9 @@ export {
   STREAM_TOKEN_DEFAULT_TTL_SECONDS,
   SandboxChannelAService,
   SandboxConfigError,
+  SandboxExecReadinessError,
   SandboxProviderUnavailableError,
+  SandboxReplacementProviderStateError,
   SandboxResumeStateUnavailableError,
   SelfhostedControlError,
   SelfhostedSandboxClient,
@@ -216,6 +240,8 @@ export {
   TerminalServerError,
   TerminalServerUnsupportedError,
   ToolspaceTokenPathError,
+  WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,
+  WorkspaceArchiveIntegrityError,
   agentErrorToControlError,
   assertDescriptorRegistryInvariants,
   assertProviderRegistryInvariants,
@@ -225,6 +251,8 @@ export {
   buildSelfhostedBackendSession,
   buildStreamUrl,
   buildTerminalServerScript,
+  captureVerifiedWorkspaceArchive,
+  classifyProviderSandboxFailure,
   clearRunCredentials,
   clearRunCredentialsForAttempt,
   collectSandboxEnvironment,
@@ -247,9 +275,13 @@ export {
   execDeadlineHint,
   exposeStreamPort,
   extForCodec,
+  fingerprintSandboxWorkspace,
+  hasPersistableSandboxProviderIdentity,
   inspectRecordingArtifact,
   isExecSessionLostBanner,
+  isProviderSandboxGoneDuringRoutedOperation,
   isProviderSandboxNotFoundError,
+  isProviderSandboxTransientError,
   isSelfhostedProviderNotFoundError,
   makeActiveBackendResolver,
   materializeRunCredentials,
@@ -270,10 +302,13 @@ export {
   parseNumstatZ,
   parsePorcelainV2,
   parseUnifiedPatch,
+  parseWorkspaceArchiveDescriptor,
   payloadTooLargeMessage,
+  readVerifiedWorkspaceArchive,
   readWorkspaceArchiveFromEnvelopeSessionState,
   recordingStorageKey,
   renderSelfhostedFault,
+  requirePersistableReplacementSandboxEnvelope,
   restoredSandboxSessionStateFromEntry,
   runCredentialPointerFile,
   runCredentialRoot,
@@ -285,6 +320,7 @@ export {
   selfhostedLiveness,
   selfhostedRetryBackoffMs,
   serializeEstablishedSandboxEnvelope,
+  serializeReplacementSandboxEnvelope,
   setSelfhostedApplyDiff,
   startRecording,
   stopRecording,
@@ -301,6 +337,8 @@ export {
   toolspaceTokenFileForSession,
   toolspaceTokenFileFromEnvironment,
   uploadRecordingArtifact,
+  verifyRestoredWorkspace,
+  verifySandboxExecReadiness,
   verifyStreamToken,
   withRunCredentialEnvironment,
   withRunCredentialsClient,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/runtime",
-  "version": "0.11.0",
+  "version": "0.13.3",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -28,6 +28,10 @@
     "./skill-library": {
       "types": "./dist/skill-library.d.ts",
       "import": "./dist/skill-library.js"
+    },
+    "./mcp-network": {
+      "types": "./dist/mcp-network.d.ts",
+      "import": "./dist/mcp-network.js"
     }
   },
   "publishConfig": {
@@ -45,9 +49,10 @@
     "@openai/agents": "0.13.3",
     "@openai/agents-extensions": "0.13.3",
     "@opengeni/agent-proto": "^0.3.0",
-    "@opengeni/codex": "^0.2.5",
-    "@opengeni/config": "^0.6.2",
-    "@opengeni/contracts": "^0.15.0",
+    "@opengeni/codex": "^0.2.7",
+    "@opengeni/config": "^0.7.0",
+    "@opengeni/contracts": "^0.19.0",
+    "@opengeni/network": "^0.1.1",
     "debug": "4.4.3",
     "modal": "0.7.6",
     "openai": "6.47.0",

package/src/codex-tool-search.ts

@@ -26,6 +26,11 @@
 // all unchanged). Invocation is untouched; only the wire tool-set shrinks.
 
 import { toolSearchTool, type Tool } from "@openai/agents";
+import {
+  MCP_MAX_TOOL_DEFINITION_BYTES,
+  MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES,
+  mcpSerializedSizeBytes,
+} from "./mcp-network";
 
 /** The prefix OpenGeni's PrefixedMcpServer stamps on codex_apps connector tools. */
 export const CODEX_APPS_TOOL_PREFIX = "codex_apps__";
@@ -239,7 +244,21 @@ function codexToolSearchExecutor(args: {
   const deferred = (args.availableTools ?? []).filter(isCodexAppsFunctionTool);
   if (deferred.length === 0) return [];
   const { query, limit } = parseSearchArgs(args.toolCall?.arguments);
-  return bm25RankTools(deferred, query, limit);
+  const ranked = bm25RankTools(deferred, query, limit);
+  const bounded: Tool[] = [];
+  let disclosedBytes = 0;
+  for (const tool of ranked) {
+    const toolBytes = mcpSerializedSizeBytes(tool);
+    if (toolBytes > MCP_MAX_TOOL_DEFINITION_BYTES) {
+      continue;
+    }
+    if (disclosedBytes + toolBytes > MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES) {
+      break;
+    }
+    disclosedBytes += toolBytes;
+    bounded.push(tool);
+  }
+  return bounded;
 }
 
 const NO_NAMESPACES: ReadonlySet<string> = new Set();