@opengeni/runtime 0.13.0 → 0.13.3

package/dist/mcp-network.d.ts

@@ -11,6 +11,7 @@ declare const MCP_MAX_TOOL_RESULT_BYTES: number;
 declare const MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES: number;
 declare const MCP_MAX_SELECTED_SERVERS = 64;
 declare const MCP_MAX_CONCURRENT_SERVER_OPERATIONS = 8;
+declare const MCP_DEFAULT_OUTER_CONNECT_TIMEOUT_MS = 10000;
 declare const MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES = 4096;
 declare const MCP_MAX_AGGREGATE_TOOL_LIST_BYTES: number;
 declare const MCP_MAX_TOOL_SEARCH_SOURCES = 64;
@@ -26,6 +27,7 @@ declare function mcpSerializedSizeBytes(value: unknown): number;
 declare function assertMcpPayloadWithinBytes(value: unknown, maxBytes: number, label: string): void;
 declare function assertMcpToolListWithinBounds<T>(tools: readonly T[]): readonly T[];
 declare function assertMcpServerSelectionWithinBounds<T>(servers: readonly T[]): readonly T[];
+declare function mcpOuterConnectTimeoutMs(configuredTimeouts: readonly (number | undefined)[]): number;
 type McpToolListContribution = {
     entries: number;
     bytes: number;
@@ -75,4 +77,4 @@ declare function assertMcpDestinationAllowed(rawUrl: string, settings: Pick<Sett
 }): Promise<void>;
 declare const isNonPublicMcpAddress: typeof isNonPublicAddress;
 
-export { MCP_MAX_AGGREGATE_TOOL_LIST_BYTES, MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES, MCP_MAX_CONCURRENT_SERVER_OPERATIONS, MCP_MAX_INBOUND_REQUEST_BYTES, MCP_MAX_RESPONSE_BYTES, MCP_MAX_SELECTED_SERVERS, MCP_MAX_TOOL_DEFINITION_BYTES, MCP_MAX_TOOL_LIST_BYTES, MCP_MAX_TOOL_LIST_ENTRIES, MCP_MAX_TOOL_RESULT_BYTES, MCP_MAX_TOOL_SEARCH_DESCRIPTION_BYTES, MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES, MCP_MAX_TOOL_SEARCH_SOURCES, MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH, McpAggregateToolListBudget, McpPayloadTooLargeError, assertMcpDestinationAllowed, assertMcpPayloadWithinBytes, assertMcpServerSelectionWithinBounds, assertMcpToolListWithinBounds, boundMcpResponseBody, boundedMcpRequest, boundedParallelMap, cancelMcpResponseBody, guardedMcpFetch, isNonPublicMcpAddress, mcpSerializedSizeBytes };
+export { MCP_DEFAULT_OUTER_CONNECT_TIMEOUT_MS, MCP_MAX_AGGREGATE_TOOL_LIST_BYTES, MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES, MCP_MAX_CONCURRENT_SERVER_OPERATIONS, MCP_MAX_INBOUND_REQUEST_BYTES, MCP_MAX_RESPONSE_BYTES, MCP_MAX_SELECTED_SERVERS, MCP_MAX_TOOL_DEFINITION_BYTES, MCP_MAX_TOOL_LIST_BYTES, MCP_MAX_TOOL_LIST_ENTRIES, MCP_MAX_TOOL_RESULT_BYTES, MCP_MAX_TOOL_SEARCH_DESCRIPTION_BYTES, MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES, MCP_MAX_TOOL_SEARCH_SOURCES, MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH, McpAggregateToolListBudget, McpPayloadTooLargeError, assertMcpDestinationAllowed, assertMcpPayloadWithinBytes, assertMcpServerSelectionWithinBounds, assertMcpToolListWithinBounds, boundMcpResponseBody, boundedMcpRequest, boundedParallelMap, cancelMcpResponseBody, guardedMcpFetch, isNonPublicMcpAddress, mcpOuterConnectTimeoutMs, mcpSerializedSizeBytes };

package/dist/mcp-network.js

@@ -1,4 +1,5 @@
 import {
+  MCP_DEFAULT_OUTER_CONNECT_TIMEOUT_MS,
   MCP_MAX_AGGREGATE_TOOL_LIST_BYTES,
   MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES,
   MCP_MAX_CONCURRENT_SERVER_OPERATIONS,
@@ -25,11 +26,13 @@ import {
   cancelMcpResponseBody,
   guardedMcpFetch,
   isNonPublicMcpAddress,
+  mcpOuterConnectTimeoutMs,
   mcpSerializedSizeBytes,
   undiciFetch
-} from "./chunk-HAN5D27J.js";
+} from "./chunk-SSB7VOLE.js";
 import "./chunk-PZ5AY32C.js";
 export {
+  MCP_DEFAULT_OUTER_CONNECT_TIMEOUT_MS,
   MCP_MAX_AGGREGATE_TOOL_LIST_BYTES,
   MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES,
   MCP_MAX_CONCURRENT_SERVER_OPERATIONS,
@@ -56,6 +59,7 @@ export {
   cancelMcpResponseBody,
   guardedMcpFetch,
   isNonPublicMcpAddress,
+  mcpOuterConnectTimeoutMs,
   mcpSerializedSizeBytes,
   undiciFetch
 };

package/dist/sandbox/index.d.ts

@@ -1,6 +1,6 @@
 export { collectSandboxEnvironment, parseExposedPorts } from '@opengeni/config';
 export { CAPABILITY_DESCRIPTORS, CapabilityDescriptor, DESKTOP_STREAM_PORT, StreamTokenPayload, StreamTokenPayload as StreamTokenPayloadType, TERMINAL_STREAM_PORT } from '@opengeni/contracts';
 import '@openai/agents/sandbox';
-export { A as ActiveBackendResolverDeps, b as ActiveBackendUnresolvableError, c as ActivePointer, B as BackendUnresolvableCode, C as ChannelAConflictError, d as ChannelAEmitter, e as ChannelAExecArgs, f as ChannelAExecResult, g as ChannelANotFoundError, h as ChannelASession, i as ChannelAUnavailableError, j as ChannelAUnsupportedError, k as ChannelAValidationError, l as ControlRpc, D as DEFAULT_DESKTOP_GEOMETRY, m as DISPLAY_STACK_TIMEOUT_MS, n as DesktopGeometry, o as DisplayStackCallerKind, p as DisplayStackClassification, q as DisplayStackError, r as DisplayStackTelemetryContext, s as DisplayStackTelemetryEvent, t as DisplayStackTelemetryStatus, u as DisplayStackUnsupportedError, E as EnsureDisplayStackOptions, v as EnsureDisplayStackResult, w as EnsureTerminalServerOptions, x as EnsureTerminalServerResult, y as EstablishedSandboxSession, z as ExposeStreamPortInput, F as ExposeStreamPortResult, G as ExposedPortEndpoint, H as FAULT_FIELD_WHAT_HAPPENED, I as FAULT_FIELD_WHAT_PRESERVED, J as FAULT_FIELD_WHAT_TO_TRY, K as FAULT_FIELD_WHICH_LAYER, L as LiveModalSandboxLeaseAttribution, M as MaterializeRunCredentialsOptions, N as MintStreamTokenInput, O as MockAgentResponder, P as MockAgentResponderOptions, Q as MockExecHandler, S as ModalModuleLoader, T as ModalOrphanSweepResult, U as ModalOrphanSweepTermination, V as ModalSandboxAttribution, W as NEVER_SENT_DETAIL_KEY, X as NatsControlRpc, Y as NatsOpStreamConnection, Z as NatsOpStreamTransport, _ as NatsRequestConnection, $ as NegotiationContext, a0 as NormalizedRunCredentialMaterial, a1 as NumstatEntry, a2 as OP_STREAM_ACK_INTERVAL_MS, a3 as OP_STREAM_DEFAULT_WINDOW_BYTES, a4 as OP_STREAM_RECONNECT_HOLD_MS, a5 as OP_STREAM_SILENCE_TIMEOUT_MS, a6 as OpStreamExecOutcome, a7 as OpStreamJournal, a8 as OpStreamSubscription, a9 as OpStreamTransport, aa as OpStreamUnavailableError, ab as PROVIDER_REGISTRY, ac as ProviderConstructionContext, ad as ProviderRegistration, ae as REPOSITORY_DISCOVERY_LIMIT, af as RecordingArtifactMetadata, ag as RecordingCodec, ah as RecordingContentType, ai as RecordingError, aj as RecordingProcess, ak as RecordingUnavailableError, al as RepositoryDiscoveryDegradedReason, am as RepositoryDiscoveryResult, an as ResolvedActiveBackend, ao as RevalidateModalOrphanTermination, ap as RoutableBackendSession, aq as RoutableSandbox, ar as RoutingSandboxSession, as as RoutingSandboxSessionDeps, at as RoutingTransitionEvent, au as RoutingUnsupportedError, av as RunCredentialCommandRunner, aw as RunCredentialCommandSession, ax as RunCredentialExpectedScope, R as RunCredentialSessionReady, ay as RunCredentialValidationError, az as SELFHOSTED_DEFAULT_TIMEOUT_MS, aA as SELFHOSTED_DRAINING_MAX_RETRIES, aB as SELFHOSTED_EXEC_DRAINING_MAX_RETRIES, aC as SELFHOSTED_IDEMPOTENT_READONLY_OPS, aD as SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES, aE as SELFHOSTED_NEVER_SENT_MAX_RETRIES, aF as SELFHOSTED_RECONNECT_WINDOW_MS, aG as SELFHOSTED_RELAY_STREAM_PATH, aH as SELFHOSTED_RETRY_BACKOFF_BASE_MS, aI as SELFHOSTED_RETRY_BACKOFF_CAP_MS, aJ as SELFHOSTED_RETRY_BACKOFF_FACTOR, aK as SELFHOSTED_TIMEOUT_MAX_RETRIES, aL as STREAM_PORT, aM as STREAM_TOKEN_DEFAULT_TTL_SECONDS, aN as SandboxChannelAService, aO as SandboxChannelAServiceOptions, aP as SandboxConfigError, aQ as SandboxCreatedCallback, aR as SandboxProviderUnavailableError, aS as SandboxResumeStateUnavailableError, aT as SelfhostedApplyDiff, aU as SelfhostedControlError, aV as SelfhostedEditor, aW as SelfhostedEnrollment, aX as SelfhostedExecArgs, aY as SelfhostedExecResult, aZ as SelfhostedImageOutput, a_ as SelfhostedLivenessState, a$ as SelfhostedNegotiationInput, b0 as SelfhostedOpObservation, b1 as SelfhostedOpObserver, b2 as SelfhostedOpStreamDeps, b3 as SelfhostedRelayConfig, b4 as SelfhostedRetryClock, b5 as SelfhostedRetryDecision, b6 as SelfhostedSandboxClient, b7 as SelfhostedSession, b8 as SelfhostedSessionBuild, b9 as SelfhostedSessionDeps, ba as SelfhostedSessionState, bb as SelfhostedUnavailableReason, bc as StartRecordingInput, bd as StreamPortUnavailableError, be as SwapTargetEstablishability, bf as TERMINAL_SERVER_TIMEOUT_MS, bg as TerminalServerError, bh as TerminalServerUnsupportedError, bi as ToolspaceTokenPathError, bj as agentErrorToControlError, bk as assertDescriptorRegistryInvariants, bl as assertProviderRegistryInvariants, bm as assertSafeRelPath, bn as backendSupportsOs, bo as buildDisplayStackScript, bp as buildSelfhostedBackendSession, bq as buildStreamUrl, br as buildTerminalServerScript, bs as clearRunCredentials, bt as clearRunCredentialsForAttempt, bu as contentTypeForCodec, bv as createSandboxClient, bw as createSandboxClientForBackend, bx as decideSelfhostedRetry, by as decodeModalSnapshotId, bz as defaultSelfhostedRetryClock, bA as deletePriorPersistedSnapshot, bB as deleteRecordingArtifacts, bC as deserializeSandboxSessionStateEnvelope, bD as desktopCapableBackend, bE as drainingExhaustedError, bF as drainingMessage, bG as ensureDisplayStack, bH as ensureModalRegistryImage, bI as ensureTerminalServer, bJ as establishSandboxSessionFromEnvelope, bK as execDeadlineHint, bL as exposeStreamPort, bM as extForCodec, bN as inspectRecordingArtifact, bO as isExecSessionLostBanner, bP as isProviderSandboxNotFoundError, bQ as isSelfhostedProviderNotFoundError, bR as makeActiveBackendResolver, bS as materializeRunCredentials, bT as mintStreamToken, bU as modalSandboxAttributionEnvironment, bV as modalSandboxAttributionTags, bW as negotiateCapabilities, bX as negotiateSelfhostedCapabilities, bY as nextDurableOpId, bZ as normalizeRunCredentialsResolution, b_ as offlineAgentError, b$ as offlineControlResponse, c0 as opAckSubject, c1 as opFrameSubject, c2 as parseExecBannerExitCode, c3 as parseExecBannerSessionId, c4 as parseNumstatZ, c5 as parsePorcelainV2, c6 as parseUnifiedPatch, c7 as payloadTooLargeMessage, c8 as readWorkspaceArchiveFromEnvelopeSessionState, c9 as recordingStorageKey, ca as renderSelfhostedFault, cb as restoredSandboxSessionStateFromEntry, cc as runCredentialPointerFile, cd as runCredentialRoot, ce as runWithToolCallCorrelation, cf as sandboxStateEntryFromRunState, cg as sanitizeOpIdToken, ch as selectBackend, ci as selfhostedFaultClass, cj as selfhostedLiveness, ck as selfhostedRetryBackoffMs, cl as serializeEstablishedSandboxEnvelope, cm as setSelfhostedApplyDiff, cn as startRecording, co as stopRecording, cp as stripExecBanner, cq as subjectFor, cr as swapTargetEstablishability, cs as sweepModalOrphanSandboxes, ct as tagModalSandbox, cu as tearDownDisplayStack, cv as tearDownTerminalServer, cw as terminateModalSandboxById, cx as timeoutAgentError, cy as timeoutControlResponse, cz as toolspaceTokenFileForSession, cA as toolspaceTokenFileFromEnvironment, cB as uploadRecordingArtifact, cC as verifyStreamToken, cD as withRunCredentialEnvironment, cE as withRunCredentialsClient, cF as withRunCredentialsSession, cG as withToolspaceTokenClient, cH as withToolspaceTokenEnvironment, cI as withToolspaceTokenSession } from '../index-DGUrY_yR.js';
+export { A as ActiveBackendResolverDeps, b as ActiveBackendUnresolvableError, c as ActivePointer, B as BackendUnresolvableCode, C as ChannelAConflictError, d as ChannelAEmitter, e as ChannelAExecArgs, f as ChannelAExecResult, g as ChannelANotFoundError, h as ChannelASession, i as ChannelAUnavailableError, j as ChannelAUnsupportedError, k as ChannelAValidationError, l as ControlRpc, D as DEFAULT_DESKTOP_GEOMETRY, m as DISPLAY_STACK_TIMEOUT_MS, n as DefaultBackendLossResult, o as DesktopGeometry, p as DisplayStackCallerKind, q as DisplayStackClassification, r as DisplayStackError, s as DisplayStackTelemetryContext, t as DisplayStackTelemetryEvent, u as DisplayStackTelemetryStatus, v as DisplayStackUnsupportedError, E as EnsureDisplayStackOptions, w as EnsureDisplayStackResult, x as EnsureTerminalServerOptions, y as EnsureTerminalServerResult, z as EstablishedSandboxSession, F as ExposeStreamPortInput, G as ExposeStreamPortResult, H as ExposedPortEndpoint, I as FAULT_FIELD_WHAT_HAPPENED, J as FAULT_FIELD_WHAT_PRESERVED, K as FAULT_FIELD_WHAT_TO_TRY, L as FAULT_FIELD_WHICH_LAYER, M as LiveModalSandboxLeaseAttribution, N as MaterializeRunCredentialsOptions, O as MintStreamTokenInput, P as MockAgentResponder, Q as MockAgentResponderOptions, S as MockExecHandler, T as ModalModuleLoader, U as ModalOrphanSweepResult, V as ModalOrphanSweepTermination, W as ModalSandboxAttribution, X as NEVER_SENT_DETAIL_KEY, Y as NatsControlRpc, Z as NatsOpStreamConnection, _ as NatsOpStreamTransport, $ as NatsRequestConnection, a0 as NegotiationContext, a1 as NormalizedRunCredentialMaterial, a2 as NumstatEntry, a3 as OP_STREAM_ACK_INTERVAL_MS, a4 as OP_STREAM_DEFAULT_WINDOW_BYTES, a5 as OP_STREAM_RECONNECT_HOLD_MS, a6 as OP_STREAM_SILENCE_TIMEOUT_MS, a7 as OpStreamExecOutcome, a8 as OpStreamJournal, a9 as OpStreamSubscription, aa as OpStreamTransport, ab as OpStreamUnavailableError, ac as PROVIDER_REGISTRY, ad as ProviderConstructionContext, ae as ProviderRegistration, af as ProviderSandboxFailure, ag as ProviderSandboxFailureKind, ah as REPOSITORY_DISCOVERY_LIMIT, ai as RecordingArtifactMetadata, aj as RecordingCodec, ak as RecordingContentType, al as RecordingError, am as RecordingProcess, an as RecordingUnavailableError, ao as RepositoryDiscoveryDegradedReason, ap as RepositoryDiscoveryResult, aq as ResolvedActiveBackend, ar as RevalidateModalOrphanTermination, as as RoutableBackendSession, at as RoutableSandbox, au as RoutingBackendRecoveryRequiredError, av as RoutingMutationOutcomeUnknownError, aw as RoutingRetainedProcess, ax as RoutingRetainedProcessAdoption, ay as RoutingRetainedProcessNotFoundError, az as RoutingRetainedProcessTerminalProof, aA as RoutingSandboxSession, aB as RoutingSandboxSessionDeps, aC as RoutingTransitionEvent, aD as RoutingUnsupportedError, aE as RunCredentialCommandRunner, aF as RunCredentialCommandSession, aG as RunCredentialExpectedScope, R as RunCredentialSessionReady, aH as RunCredentialValidationError, aI as SELFHOSTED_DEFAULT_TIMEOUT_MS, aJ as SELFHOSTED_DRAINING_MAX_RETRIES, aK as SELFHOSTED_EXEC_DRAINING_MAX_RETRIES, aL as SELFHOSTED_IDEMPOTENT_READONLY_OPS, aM as SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES, aN as SELFHOSTED_NEVER_SENT_MAX_RETRIES, aO as SELFHOSTED_RECONNECT_WINDOW_MS, aP as SELFHOSTED_RELAY_STREAM_PATH, aQ as SELFHOSTED_RETRY_BACKOFF_BASE_MS, aR as SELFHOSTED_RETRY_BACKOFF_CAP_MS, aS as SELFHOSTED_RETRY_BACKOFF_FACTOR, aT as SELFHOSTED_TIMEOUT_MAX_RETRIES, aU as STREAM_PORT, aV as STREAM_TOKEN_DEFAULT_TTL_SECONDS, aW as SandboxChannelAService, aX as SandboxChannelAServiceOptions, aY as SandboxConfigError, aZ as SandboxCreatedCallback, a_ as SandboxExecReadinessError, a$ as SandboxProviderUnavailableError, b0 as SandboxReplacementProviderStateError, b1 as SandboxResumeStateUnavailableError, b2 as SelfhostedApplyDiff, b3 as SelfhostedControlError, b4 as SelfhostedEditor, b5 as SelfhostedEnrollment, b6 as SelfhostedExecArgs, b7 as SelfhostedExecResult, b8 as SelfhostedImageOutput, b9 as SelfhostedLivenessState, ba as SelfhostedNegotiationInput, bb as SelfhostedOpObservation, bc as SelfhostedOpObserver, bd as SelfhostedOpStreamDeps, be as SelfhostedRelayConfig, bf as SelfhostedRetryClock, bg as SelfhostedRetryDecision, bh as SelfhostedSandboxClient, bi as SelfhostedSession, bj as SelfhostedSessionBuild, bk as SelfhostedSessionDeps, bl as SelfhostedSessionState, bm as SelfhostedUnavailableReason, bn as StartRecordingInput, bo as StreamPortUnavailableError, bp as SwapTargetEstablishability, bq as TERMINAL_SERVER_TIMEOUT_MS, br as TerminalServerError, bs as TerminalServerUnsupportedError, bt as ToolspaceTokenPathError, bu as VerifiedWorkspaceArchive, bv as WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION, bw as WorkspaceArchiveDescriptor, bx as WorkspaceArchiveIntegrityCode, by as WorkspaceArchiveIntegrityError, bz as WorkspaceTreeFingerprint, bA as agentErrorToControlError, bB as assertDescriptorRegistryInvariants, bC as assertProviderRegistryInvariants, bD as assertSafeRelPath, bE as backendSupportsOs, bF as buildDisplayStackScript, bG as buildSelfhostedBackendSession, bH as buildStreamUrl, bI as buildTerminalServerScript, bJ as captureVerifiedWorkspaceArchive, bK as classifyProviderSandboxFailure, bL as clearRunCredentials, bM as clearRunCredentialsForAttempt, bN as contentTypeForCodec, bO as createSandboxClient, bP as createSandboxClientForBackend, bQ as decideSelfhostedRetry, bR as decodeModalSnapshotId, bS as defaultSelfhostedRetryClock, bT as deletePriorPersistedSnapshot, bU as deleteRecordingArtifacts, bV as deserializeSandboxSessionStateEnvelope, bW as desktopCapableBackend, bX as drainingExhaustedError, bY as drainingMessage, bZ as ensureDisplayStack, b_ as ensureModalRegistryImage, b$ as ensureTerminalServer, c0 as establishSandboxSessionFromEnvelope, c1 as execDeadlineHint, c2 as exposeStreamPort, c3 as extForCodec, c4 as fingerprintSandboxWorkspace, c5 as hasPersistableSandboxProviderIdentity, c6 as inspectRecordingArtifact, c7 as isExecSessionLostBanner, c8 as isProviderSandboxGoneDuringRoutedOperation, c9 as isProviderSandboxNotFoundError, ca as isProviderSandboxTransientError, cb as isSelfhostedProviderNotFoundError, cc as makeActiveBackendResolver, cd as materializeRunCredentials, ce as mintStreamToken, cf as modalSandboxAttributionEnvironment, cg as modalSandboxAttributionTags, ch as negotiateCapabilities, ci as negotiateSelfhostedCapabilities, cj as nextDurableOpId, ck as normalizeRunCredentialsResolution, cl as offlineAgentError, cm as offlineControlResponse, cn as opAckSubject, co as opFrameSubject, cp as parseExecBannerExitCode, cq as parseExecBannerSessionId, cr as parseNumstatZ, cs as parsePorcelainV2, ct as parseUnifiedPatch, cu as parseWorkspaceArchiveDescriptor, cv as payloadTooLargeMessage, cw as readVerifiedWorkspaceArchive, cx as readWorkspaceArchiveFromEnvelopeSessionState, cy as recordingStorageKey, cz as renderSelfhostedFault, cA as requirePersistableReplacementSandboxEnvelope, cB as restoredSandboxSessionStateFromEntry, cC as runCredentialPointerFile, cD as runCredentialRoot, cE as runWithToolCallCorrelation, cF as sandboxStateEntryFromRunState, cG as sanitizeOpIdToken, cH as selectBackend, cI as selfhostedFaultClass, cJ as selfhostedLiveness, cK as selfhostedRetryBackoffMs, cL as serializeEstablishedSandboxEnvelope, cM as serializeReplacementSandboxEnvelope, cN as setSelfhostedApplyDiff, cO as startRecording, cP as stopRecording, cQ as stripExecBanner, cR as subjectFor, cS as swapTargetEstablishability, cT as sweepModalOrphanSandboxes, cU as tagModalSandbox, cV as tearDownDisplayStack, cW as tearDownTerminalServer, cX as terminateModalSandboxById, cY as timeoutAgentError, cZ as timeoutControlResponse, c_ as toolspaceTokenFileForSession, c$ as toolspaceTokenFileFromEnvironment, d0 as uploadRecordingArtifact, d1 as verifyRestoredWorkspace, d2 as verifySandboxExecReadiness, d3 as verifyStreamToken, d4 as withRunCredentialEnvironment, d5 as withRunCredentialsClient, d6 as withRunCredentialsSession, d7 as withToolspaceTokenClient, d8 as withToolspaceTokenEnvironment, d9 as withToolspaceTokenSession } from '../index-DU-KXVlx.js';
 import 'modal';
 import '@opengeni/agent-proto';

package/dist/sandbox/index.js

@@ -28,6 +28,9 @@ import {
   REPOSITORY_DISCOVERY_LIMIT,
   RecordingError,
   RecordingUnavailableError,
+  RoutingBackendRecoveryRequiredError,
+  RoutingMutationOutcomeUnknownError,
+  RoutingRetainedProcessNotFoundError,
   RoutingSandboxSession,
   RoutingUnsupportedError,
   RunCredentialValidationError,
@@ -47,7 +50,9 @@ import {
   STREAM_TOKEN_DEFAULT_TTL_SECONDS,
   SandboxChannelAService,
   SandboxConfigError,
+  SandboxExecReadinessError,
   SandboxProviderUnavailableError,
+  SandboxReplacementProviderStateError,
   SandboxResumeStateUnavailableError,
   SelfhostedControlError,
   SelfhostedSandboxClient,
@@ -59,6 +64,8 @@ import {
   TerminalServerError,
   TerminalServerUnsupportedError,
   ToolspaceTokenPathError,
+  WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,
+  WorkspaceArchiveIntegrityError,
   agentErrorToControlError,
   assertDescriptorRegistryInvariants,
   assertProviderRegistryInvariants,
@@ -68,6 +75,8 @@ import {
   buildSelfhostedBackendSession,
   buildStreamUrl,
   buildTerminalServerScript,
+  captureVerifiedWorkspaceArchive,
+  classifyProviderSandboxFailure,
   clearRunCredentials,
   clearRunCredentialsForAttempt,
   collectSandboxEnvironment,
@@ -90,9 +99,13 @@ import {
   execDeadlineHint,
   exposeStreamPort,
   extForCodec,
+  fingerprintSandboxWorkspace,
+  hasPersistableSandboxProviderIdentity,
   inspectRecordingArtifact,
   isExecSessionLostBanner,
+  isProviderSandboxGoneDuringRoutedOperation,
   isProviderSandboxNotFoundError,
+  isProviderSandboxTransientError,
   isSelfhostedProviderNotFoundError,
   makeActiveBackendResolver,
   materializeRunCredentials,
@@ -113,10 +126,13 @@ import {
   parseNumstatZ,
   parsePorcelainV2,
   parseUnifiedPatch,
+  parseWorkspaceArchiveDescriptor,
   payloadTooLargeMessage,
+  readVerifiedWorkspaceArchive,
   readWorkspaceArchiveFromEnvelopeSessionState,
   recordingStorageKey,
   renderSelfhostedFault,
+  requirePersistableReplacementSandboxEnvelope,
   restoredSandboxSessionStateFromEntry,
   runCredentialPointerFile,
   runCredentialRoot,
@@ -128,6 +144,7 @@ import {
   selfhostedLiveness,
   selfhostedRetryBackoffMs,
   serializeEstablishedSandboxEnvelope,
+  serializeReplacementSandboxEnvelope,
   setSelfhostedApplyDiff,
   startRecording,
   stopRecording,
@@ -144,6 +161,8 @@ import {
   toolspaceTokenFileForSession,
   toolspaceTokenFileFromEnvironment,
   uploadRecordingArtifact,
+  verifyRestoredWorkspace,
+  verifySandboxExecReadiness,
   verifyStreamToken,
   withRunCredentialEnvironment,
   withRunCredentialsClient,
@@ -151,7 +170,7 @@ import {
   withToolspaceTokenClient,
   withToolspaceTokenEnvironment,
   withToolspaceTokenSession
-} from "../chunk-65UDUFUO.js";
+} from "../chunk-JGUQSAG5.js";
 import "../chunk-4YJ5Z52Z.js";
 import "../chunk-K4V4QYCL.js";
 import "../chunk-PZ5AY32C.js";
@@ -185,6 +204,9 @@ export {
   REPOSITORY_DISCOVERY_LIMIT,
   RecordingError,
   RecordingUnavailableError,
+  RoutingBackendRecoveryRequiredError,
+  RoutingMutationOutcomeUnknownError,
+  RoutingRetainedProcessNotFoundError,
   RoutingSandboxSession,
   RoutingUnsupportedError,
   RunCredentialValidationError,
@@ -204,7 +226,9 @@ export {
   STREAM_TOKEN_DEFAULT_TTL_SECONDS,
   SandboxChannelAService,
   SandboxConfigError,
+  SandboxExecReadinessError,
   SandboxProviderUnavailableError,
+  SandboxReplacementProviderStateError,
   SandboxResumeStateUnavailableError,
   SelfhostedControlError,
   SelfhostedSandboxClient,
@@ -216,6 +240,8 @@ export {
   TerminalServerError,
   TerminalServerUnsupportedError,
   ToolspaceTokenPathError,
+  WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,
+  WorkspaceArchiveIntegrityError,
   agentErrorToControlError,
   assertDescriptorRegistryInvariants,
   assertProviderRegistryInvariants,
@@ -225,6 +251,8 @@ export {
   buildSelfhostedBackendSession,
   buildStreamUrl,
   buildTerminalServerScript,
+  captureVerifiedWorkspaceArchive,
+  classifyProviderSandboxFailure,
   clearRunCredentials,
   clearRunCredentialsForAttempt,
   collectSandboxEnvironment,
@@ -247,9 +275,13 @@ export {
   execDeadlineHint,
   exposeStreamPort,
   extForCodec,
+  fingerprintSandboxWorkspace,
+  hasPersistableSandboxProviderIdentity,
   inspectRecordingArtifact,
   isExecSessionLostBanner,
+  isProviderSandboxGoneDuringRoutedOperation,
   isProviderSandboxNotFoundError,
+  isProviderSandboxTransientError,
   isSelfhostedProviderNotFoundError,
   makeActiveBackendResolver,
   materializeRunCredentials,
@@ -270,10 +302,13 @@ export {
   parseNumstatZ,
   parsePorcelainV2,
   parseUnifiedPatch,
+  parseWorkspaceArchiveDescriptor,
   payloadTooLargeMessage,
+  readVerifiedWorkspaceArchive,
   readWorkspaceArchiveFromEnvelopeSessionState,
   recordingStorageKey,
   renderSelfhostedFault,
+  requirePersistableReplacementSandboxEnvelope,
   restoredSandboxSessionStateFromEntry,
   runCredentialPointerFile,
   runCredentialRoot,
@@ -285,6 +320,7 @@ export {
   selfhostedLiveness,
   selfhostedRetryBackoffMs,
   serializeEstablishedSandboxEnvelope,
+  serializeReplacementSandboxEnvelope,
   setSelfhostedApplyDiff,
   startRecording,
   stopRecording,
@@ -301,6 +337,8 @@ export {
   toolspaceTokenFileForSession,
   toolspaceTokenFileFromEnvironment,
   uploadRecordingArtifact,
+  verifyRestoredWorkspace,
+  verifySandboxExecReadiness,
   verifyStreamToken,
   withRunCredentialEnvironment,
   withRunCredentialsClient,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/runtime",
-  "version": "0.13.0",
+  "version": "0.13.3",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -50,8 +50,8 @@
     "@openai/agents-extensions": "0.13.3",
     "@opengeni/agent-proto": "^0.3.0",
     "@opengeni/codex": "^0.2.7",
-    "@opengeni/config": "^0.6.9",
-    "@opengeni/contracts": "^0.18.0",
+    "@opengeni/config": "^0.7.0",
+    "@opengeni/contracts": "^0.19.0",
     "@opengeni/network": "^0.1.1",
     "debug": "4.4.3",
     "modal": "0.7.6",

package/src/index.ts

@@ -49,6 +49,7 @@ import {
   boundedParallelMap,
   cancelMcpResponseBody,
   guardedMcpFetch,
+  mcpOuterConnectTimeoutMs,
   undiciFetch,
 } from "./mcp-network";
 import {
@@ -2342,7 +2343,7 @@ export type ConnectedMcpServerBatches = {
  */
 export async function connectMcpServersInBatches(
   servers: MCPServer[],
-  options: { strict: boolean },
+  options: { strict: boolean; connectTimeoutMs?: number },
 ): Promise<ConnectedMcpServerBatches> {
   assertMcpServerSelectionWithinBounds(servers);
   const batches: ConnectedMcpServerBatch[] = [];
@@ -2352,6 +2353,9 @@ export async function connectMcpServersInBatches(
         await connectMcpServers(
           servers.slice(offset, offset + MCP_MAX_CONCURRENT_SERVER_OPERATIONS),
           {
+            ...(options.connectTimeoutMs === undefined
+              ? {}
+              : { connectTimeoutMs: options.connectTimeoutMs }),
             connectInParallel: true,
             strict: options.strict,
           },
@@ -2478,24 +2482,33 @@ export async function prepareAgentTools(
         server,
         bestEffort,
         optional,
+        timeoutMs: config.timeoutMs,
       };
     },
   );
-  const requiredServers = servers.filter((entry) => !entry.bestEffort).map((entry) => entry.server);
-  const bestEffortServers = servers
-    .filter((entry) => entry.bestEffort)
-    .map((entry) => entry.server);
+  const requiredEntries = servers.filter((entry) => !entry.bestEffort);
+  const bestEffortEntries = servers.filter((entry) => entry.bestEffort);
+  const requiredServers = requiredEntries.map((entry) => entry.server);
+  const bestEffortServers = bestEffortEntries.map((entry) => entry.server);
   // Names of the OPTIONAL servers (not codex_apps) so a drop is surfaced as a
   // warning; codex_apps keeps its historically-quiet drop (a not-logged-in
   // ChatGPT plan is a normal, non-noteworthy state).
   const optionalServerNames = new Set(
     servers.filter((entry) => entry.optional).map((entry) => entry.server.name),
   );
-  const connectedRequired = await connectMcpServersInBatches(requiredServers, { strict: true });
+  const connectedRequired = await connectMcpServersInBatches(requiredServers, {
+    strict: true,
+    connectTimeoutMs: mcpOuterConnectTimeoutMs(requiredEntries.map((entry) => entry.timeoutMs)),
+  });
   let connectedBestEffort: ConnectedMcpServerBatches | null = null;
   try {
     connectedBestEffort = bestEffortServers.length
-      ? await connectMcpServersInBatches(bestEffortServers, { strict: false })
+      ? await connectMcpServersInBatches(bestEffortServers, {
+          strict: false,
+          connectTimeoutMs: mcpOuterConnectTimeoutMs(
+            bestEffortEntries.map((entry) => entry.timeoutMs),
+          ),
+        })
       : null;
   } catch (error) {
     await connectedRequired.close().catch(() => undefined);

package/src/mcp-network.ts

@@ -18,6 +18,10 @@ export const MCP_MAX_TOOL_RESULT_BYTES = 1024 * 1024;
 export const MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES = 256 * 1024;
 export const MCP_MAX_SELECTED_SERVERS = 64;
 export const MCP_MAX_CONCURRENT_SERVER_OPERATIONS = 8;
+// @openai/agents has a separate lifecycle fence around MCPServer.connect().
+// It defaults to 10 seconds and can otherwise preempt a larger per-server
+// transport timeout before that server finishes its own handshake.
+export const MCP_DEFAULT_OUTER_CONNECT_TIMEOUT_MS = 10_000;
 export const MCP_MAX_AGGREGATE_TOOL_LIST_ENTRIES = 4_096;
 export const MCP_MAX_AGGREGATE_TOOL_LIST_BYTES = 16 * 1024 * 1024;
 export const MCP_MAX_TOOL_SEARCH_SOURCES = 64;
@@ -87,6 +91,15 @@ export function assertMcpServerSelectionWithinBounds<T>(servers: readonly T[]):
   return servers;
 }
 
+export function mcpOuterConnectTimeoutMs(
+  configuredTimeouts: readonly (number | undefined)[],
+): number {
+  return Math.max(
+    MCP_DEFAULT_OUTER_CONNECT_TIMEOUT_MS,
+    ...configuredTimeouts.flatMap((timeoutMs) => (timeoutMs === undefined ? [] : [timeoutMs])),
+  );
+}
+
 type McpToolListContribution = {
   entries: number;
   bytes: number;

package/src/sandbox/channel-a.ts

@@ -58,9 +58,21 @@ import type {
   TerminalExecRequest,
   TerminalExecResponse,
 } from "@opengeni/contracts";
-import { parseExecBannerExitCode, parseExecBannerSessionId } from "./exec-banner";
-
-export { parseExecBannerExitCode, parseExecBannerSessionId } from "./exec-banner";
+import {
+  isExecSessionLostBanner,
+  parseExecBannerExitCode,
+  parseExecBannerSessionId,
+} from "./exec-banner";
+import {
+  createTurnToolCancellationController,
+  TurnSandboxCommandCancelledError,
+} from "./turn-tool-cancellation";
+
+export {
+  isExecSessionLostBanner,
+  parseExecBannerExitCode,
+  parseExecBannerSessionId,
+} from "./exec-banner";
 
 // ── The minimal session surface Channel A consumes (a structural subset of the
 // SDK's SandboxSession, all optional — capability-probed before use). ─────────
@@ -101,6 +113,21 @@ export type ChannelASession = {
     yieldTimeMs?: number;
     maxOutputTokens?: number;
   }): Promise<string>;
+  writeStdinForProcessMutation?(args: {
+    sessionId: number;
+    chars?: string;
+    yieldTimeMs?: number;
+    maxOutputTokens?: number;
+  }): Promise<string>;
+  writeStdinForProcessControl?(args: {
+    sessionId: number;
+    chars?: string;
+    yieldTimeMs?: number;
+    maxOutputTokens?: number;
+  }): Promise<string>;
+  cancelExecCommand?(opId: string): Promise<boolean>;
+  hasRetainedProcess?(providerSessionId: number): boolean;
+  execCommandForProcessControl?(providerSessionId: number, args: ChannelAExecArgs): Promise<string>;
   createEditor?(runAs?: string): ChannelAEditor;
   supportsPty?(): boolean;
 };
@@ -1133,17 +1160,49 @@ export class SandboxChannelAService {
 
   // ════════════════════════ Terminal exec + PTY (A2) ════════════════════════
 
-  /** Run a bounded command, return buffered stdout/stderr + exit code inline. The
-   *  long-running tail (when the process hasn't exited within timeoutMs) keeps
-   *  running in-box; if emitStream is set the buffered output is also published as
-   *  the agent firehose so other viewers see it. */
+  /** Run a bounded command to physical completion and return buffered output.
+   *  A deadline cancels the exact provider operation, proves its process group
+   *  absent, and settles any retained-process admission before returning 124. */
   async terminalExec(req: TerminalExecRequest): Promise<TerminalExecResponse> {
-    const r = await this.run({
-      cmd: req.command,
-      workdir: this.terminalWorkdir(req.cwd),
-      yieldTimeMs: req.timeoutMs,
-    });
-    const running = r.exitCode === null && typeof r.sessionId === "number";
+    const abort = new AbortController();
+    const controller = createTurnToolCancellationController(abort.signal);
+    const timeoutReason = new Error(`Terminal command exceeded ${req.timeoutMs}ms`);
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      abort.abort(timeoutReason);
+    }, req.timeoutMs);
+    const terminalWorkdir = this.terminalWorkdir(req.cwd);
+    let r: Awaited<ReturnType<typeof controller.runSandboxCommandStructured>>;
+    try {
+      r = await controller.runSandboxCommandStructured(this.session, {
+        cmd: req.command,
+        ...(terminalWorkdir ? { workdir: terminalWorkdir } : {}),
+        ...(this.runAs ? { runAs: this.runAs } : {}),
+        yieldTimeMs: req.timeoutMs,
+      });
+      if (timedOut) {
+        await controller.waitForQuiescence();
+        r = {
+          stdout: "",
+          stderr: timeoutReason.message,
+          exitCode: 124,
+          wallTimeSeconds: req.timeoutMs / 1_000,
+        };
+      }
+    } catch (error) {
+      controller.cancel(error);
+      await controller.waitForQuiescence();
+      if (!timedOut && !(error instanceof TurnSandboxCommandCancelledError)) throw error;
+      r = {
+        stdout: "",
+        stderr: timeoutReason.message,
+        exitCode: 124,
+        wallTimeSeconds: req.timeoutMs / 1_000,
+      };
+    } finally {
+      clearTimeout(timer);
+    }
     if (req.emitStream && (r.stdout || r.stderr)) {
       const events: { type: SessionEventType; payload: unknown }[] = [];
       const commandId = crypto.randomUUID();
@@ -1163,7 +1222,7 @@ export class SandboxChannelAService {
       stdout: r.stdout,
       stderr: r.stderr,
       exitCode: r.exitCode,
-      running,
+      running: false,
       wallTimeSeconds: r.wallTimeSeconds,
     };
   }
@@ -1203,10 +1262,13 @@ export class SandboxChannelAService {
    *  it as terminal.pty.output.delta). Throws ChannelAUnsupportedError when the
    *  backend has no writeStdin. */
   async ptyWrite(_req: PtyWriteRequest, execSessionId: number, data: string): Promise<string> {
-    if (!this.session.writeStdin) {
+    const write =
+      this.session.writeStdinForProcessMutation?.bind(this.session) ??
+      this.session.writeStdin?.bind(this.session);
+    if (!write) {
       throw new ChannelAUnsupportedError("interactive terminal unsupported on this backend");
     }
-    const out = await this.session.writeStdin({
+    const out = await write({
       sessionId: execSessionId,
       chars: data,
       yieldTimeMs: 250,
@@ -1228,25 +1290,27 @@ export class SandboxChannelAService {
   /** Resize an open PTY (SIGWINCH via stty against the exec-session). The SDK has
    *  no resize method; stty in the same tty session updates the geometry. */
   async ptyResize(req: PtyResizeRequest, execSessionId: number): Promise<void> {
-    if (!this.session.writeStdin) return;
+    const write =
+      this.session.writeStdinForProcessControl?.bind(this.session) ??
+      this.session.writeStdin?.bind(this.session);
+    if (!write) return;
     // Send a stty in-band on the same pty session.
-    await this.session.writeStdin({
+    await write({
       sessionId: execSessionId,
       chars: `stty cols ${req.cols} rows ${req.rows}\n`,
       yieldTimeMs: 50,
     });
   }
 
-  /** Close an open PTY: write exit/EOF. The caller marks the row closed + emits
-   *  terminal.pty.exited. */
-  async ptyClose(_req: PtyCloseRequest, execSessionId: number | null): Promise<void> {
-    if (execSessionId !== null && this.session.writeStdin) {
-      try {
-        await this.session.writeStdin({ sessionId: execSessionId, chars: "", yieldTimeMs: 50 }); // EOF
-      } catch {
-        // best-effort; the row is marked closed regardless.
-      }
-    }
+  /** Ask an open PTY to exit and return the exact provider banner. The routing
+   * session settles durable process authority only when that banner proves this
+   * locator exited or was lost; callers must keep metadata open otherwise. */
+  async ptyClose(_req: PtyCloseRequest, execSessionId: number | null): Promise<string> {
+    const write =
+      this.session.writeStdinForProcessControl?.bind(this.session) ??
+      this.session.writeStdin?.bind(this.session);
+    if (execSessionId === null || !write) return "";
+    return await write({ sessionId: execSessionId, chars: "", yieldTimeMs: 250 }); // EOF
   }
 
   // ──────────────────────────── helpers ──────────────────────────────────────
@@ -1435,24 +1499,6 @@ function isDefinitePathNotFoundError(error: unknown): boolean {
   );
 }
 
-// Detect the Modal "the exec-session you're writing to no longer exists" banner.
-// writeStdin reports a vanished session as a non-throwing string of the shape
-// `write_stdin failed: session not found: <N>` (it does NOT raise). This is a
-// hard cancellation-fence fact, so classify only the complete known banner (or
-// its bare provider fact) carrying the exact tracked numeric id. ID-less,
-// malformed, mismatched, or embellished/ambiguous text must remain fail-closed.
-export function isExecSessionLostBanner(out: string, execSessionId: number): boolean {
-  if (!out || !Number.isSafeInteger(execSessionId) || execSessionId < 0) return false;
-  const match = out.match(/^(?:write_stdin failed: )?session not found: (\d+)$/);
-  // JavaScript's `$` also matches immediately before one final line terminator.
-  // Requiring the regex match to consume the entire string keeps even that
-  // otherwise-special case fail-closed.
-  if (!match || match[0] !== out) return false;
-  // String equality is intentional: parseInt would normalize malformed facts
-  // such as `01` and can round an out-of-range integer into another identity.
-  return match[1] === String(execSessionId);
-}
-
 function sniffBinary(bytes: Buffer): boolean {
   const n = Math.min(bytes.byteLength, 8192);
   for (let i = 0; i < n; i++) if (bytes[i] === 0) return true;

package/src/sandbox/exec-banner.ts

@@ -65,3 +65,18 @@ export function parseExecBannerExitCode(raw: string): number | null {
   const banner = parseExecResponseBanner(raw);
   return banner.kind === "exited" ? banner.exitCode : null;
 }
+
+// Detect the Modal "the exec-session you're writing to no longer exists" fact.
+// This is process-lifetime authority, so classify only the complete known
+// banner (or its bare provider form) carrying the exact tracked numeric id.
+export function isExecSessionLostBanner(out: string, execSessionId: number): boolean {
+  if (!out || !Number.isSafeInteger(execSessionId) || execSessionId < 0) return false;
+  const match = out.match(/^(?:write_stdin failed: )?session not found: (\d+)$/);
+  // JavaScript's `$` also matches immediately before one final line terminator.
+  // Requiring the regex match to consume the entire string keeps even that
+  // otherwise-special case fail-closed.
+  if (!match || match[0] !== out) return false;
+  // String equality is intentional: parseInt would normalize malformed facts
+  // such as `01` and can round an out-of-range integer into another identity.
+  return match[1] === String(execSessionId);
+}