@opengeni/runtime 0.13.13 → 0.14.1

package/dist/index.d.ts

@@ -3,7 +3,7 @@ import { Tool, Computer, AgentInputItem, Model, MCPServer, ModelProvider, Agent,
 export { MaxTurnsExceededError, OpenAIChatCompletionsModel, OpenAIResponsesModel } from '@openai/agents';
 import { Settings, ResolvedModelProvider, ConfiguredModel, ModelProviderApi } from '@opengeni/config';
 export { collectSandboxEnvironment, parseExposedPorts } from '@opengeni/config';
-import { HumanInputResponse, ReasoningEffort, GitCredentialProvider, GitCredentialTransport, SessionEventType, ResourceRef, ToolRef, Permission, McpServerConnectionRef, ToolAuthNeededPayload, RequestHumanInputToolInput } from '@opengeni/contracts';
+import { HumanInputResponse, ReasoningEffort, GitCredentialProvider, GitCredentialTransport, SessionEventType, ResourceRef, ToolRef, Permission, FirstPartyMcpToolName, McpServerConnectionRef, ToolAuthNeededPayload, RequestHumanInputToolInput } from '@opengeni/contracts';
 export { CAPABILITY_DESCRIPTORS, CapabilityDescriptor, DESKTOP_STREAM_PORT, StreamTokenPayload, StreamTokenPayload as StreamTokenPayloadType, TERMINAL_STREAM_PORT } from '@opengeni/contracts';
 import { SandboxSessionLike, Capability, SandboxSessionState, Manifest, Capabilities, LocalDirLazySkillSource, SandboxClient } from '@openai/agents/sandbox';
 import OpenAI from 'openai';
@@ -40,8 +40,6 @@ declare const USER_MESSAGE_TRUNCATION_MARKER = "\n[... middle truncated for cont
 declare function isUserMessage(item: unknown): boolean;
 /** True for our synthetic compaction summary item. */
 declare function isCompactionSummary(item: unknown): boolean;
-/** Platform-authored system context exists for one inference and is never persisted. */
-declare function isEphemeralInternalContext(item: unknown): boolean;
 /** Serialized-item estimate for pre-call accounting and retained user budgets. */
 declare function estimateItemTokens(item: CompactionItem): number;
 declare function estimateTokens(items: readonly CompactionItem[]): number;
@@ -371,6 +369,11 @@ declare class ComputerUseCapability extends Capability {
     private hostedComputerTool;
 }
 
+type WorkspaceSkillSearchPath = Readonly<{
+    path: string;
+    source: string;
+}>;
+
 /**
  * Read-path sanitizer for replayed conversation history (issue: orphaned
  * tool outputs brick a session).
@@ -838,7 +841,7 @@ type ToolspaceTokenWriterSession = SandboxSessionLike;
 type EffectiveSkillSelection = Readonly<{
     id: string;
     name: string;
-    source: "bundled" | "library" | "pack";
+    source: "bundled" | "library" | "pack" | "session";
     version: string | null;
     contentSha256: string | null;
     reason: string;
@@ -892,6 +895,7 @@ type BuildAgentOptions = {
     sessionInstructions?: string;
     turnInstructions?: string;
     packSkills?: PackSkill[];
+    sessionSkills?: PackSkill[];
     skillLibrarySkills?: PackSkill[];
     skillLibrarySelections?: EffectiveSkillSelection[];
     /**
@@ -913,7 +917,7 @@ type PackSkillFile = {
 };
 type PackSkill = {
     name: string;
-    description?: string | null;
+    description?: string | null | undefined;
     files: PackSkillFile[];
 };
 /**
@@ -1066,6 +1070,8 @@ declare function buildOpenGeniAgent(settings: Settings, resources: ResourceRef[]
 declare function withStructuredViewImageFunctionResults(tools: Tool<unknown>[]): Tool<unknown>[];
 declare function buildAgentCapabilities(settings: Settings, packSkills: PackSkill[], options?: {
     skillLibrarySkills?: PackSkill[];
+    sessionSkills?: PackSkill[];
+    workspaceSkillPaths?: readonly WorkspaceSkillSearchPath[];
     structuredToolTransport?: boolean;
     computerToolMode?: ComputerToolMode;
     onComputerUseReady?: (session: SandboxSessionLike) => Promise<void>;
@@ -1087,7 +1093,9 @@ type PrepareToolsOptions = {
     executionGeneration?: number;
     subjectId?: string;
     subjectLabel?: string;
+    credentialSubjectId?: string;
     firstPartyPermissions?: Permission[];
+    firstPartyTools?: FirstPartyMcpToolName[];
     resolveCredential?: (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
     onAuthNeeded?: (payload: ToolAuthNeededPayload) => Promise<void> | void;
     /** Injectable final MCP transport for tests and embedded hosts. */
@@ -1303,6 +1311,9 @@ declare function modelResponseUsageFromResponse(response: unknown): ModelRespons
 declare function serializeApprovals(interruptions: unknown[]): unknown[];
 declare function serializeHumanInputRequests(interruptions: unknown[]): SerializedHumanInputInterruption[];
 declare function buildManifest(settings: Settings, resources: ResourceRef[], environment?: Record<string, string>, fileResourceDownloads?: SandboxFileDownload[]): Manifest;
+declare function repositoryWorkspaceSkillPathsOption(resources: readonly ResourceRef[]): {
+    workspaceSkillPaths?: readonly WorkspaceSkillSearchPath[];
+};
 type SandboxLifecycleHookPhase = "beforeAgentStart";
 type SandboxLifecycleCommandRunner = (session: TurnSandboxCommandSession, args: TurnSandboxCommandArgs) => Promise<unknown>;
 type SandboxLifecycleHookContext = {
@@ -1446,4 +1457,4 @@ declare function azureOpenAIDefaultQuery(settings: Pick<Settings, "azureOpenaiAp
  */
 declare function lazySkillSourceWithPackSkills(packSkills: PackSkill[], skillLibrarySkills?: PackSkill[]): LocalDirLazySkillSource;
 
-export { type AgentSegmentInput, type BuildAgentOptions, COMPACTION_PROMPT, COMPACTION_SUMMARY_MARKER, COMPACT_USER_MESSAGE_MAX_TOKENS, CodexSubscriptionUnavailableError, type CompactionDecision, type CompactionItem, CompactionNeededError, CompactionProviderResponseError, ComputerActionError, ComputerReadOnlyError, type ComputerToolMode, ComputerUnavailableError, type ComputerUseArgs, ComputerUseCapability, type ConnectedMcpServerBatches, type ContextRobustnessFilterOptions, DEFAULT_COMPACTION_THRESHOLD_RATIO, type EffectiveSkillSelection, EmptyCompactionSummaryError, GENESIS_TITLE_DIRECTIVE, type GitCredentialBindingSeed, type GitCredentialTokenWriterSession, type GitTokenSeeds, HUMAN_INPUT_TOOL_NAME, type HistoryItem, MAX_COMPACTION_THRESHOLD_RATIO, MAX_MODEL_USAGE_TOKEN_COUNT, MIN_COMPACTION_THRESHOLD_RATIO, type ModelCallUsageInput, type ModelCallUsageNormalization, type ModelCallUsageTelemetry, type ModelResponseUsage, MultiProviderModelProvider, type NormalizedRuntimeEvent, type OpenGeniRuntime, type PackSkill, type PackSkillFile, type PersistentSessionSettings, type PrepareInputOptions, type PrepareToolsOptions, type PreparedAgentInput, type PreparedAgentTools, type PreparedCompactionPromptInput, type ProductionRuntimeOverrides, type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult, type RigInstructionsContext, type RigSetupDescriptor, type RunAgentStreamOptions, RunCredentialSessionReady, RuntimeMetricsHooks, SUMMARY_BUFFER_TOKENS, SUMMARY_PREFIX, SandboxComputer, type SandboxComputerOptions, type SandboxFileDownload, type SandboxFileDownloadFailure, type SandboxFileDownloadMaterializationResult, type SandboxLifecycleCommandRunner, type SandboxLifecycleHook, type SandboxLifecycleHookContext, type SandboxLifecycleHookPhase, type SerializedHumanInputInterruption, TOOLSPACE_PROGRAMMATIC_DIRECTIVE, type ToolspaceTokenWriterSession, type TurnSandboxCommandArgs, TurnSandboxCommandCancelledError, type TurnSandboxCommandSession, type TurnToolCancellationController, type TurnToolCancellationFence, USER_MESSAGE_TRUNCATION_MARKER, type WorkspaceEnvironmentContext, WorkspaceModelPolicyBlockedError, agentsErrorRunState, appendGenesisTitleDirective, appendGitCredentialBindingInstructions, appendPersistentSessionSettings, appendSessionInstructions, appendToolspaceInstructions, appendTurnInstructions, appendWorkspaceMemory, applyMissingManifestEntries, azureCliLoginCommand, azureOpenAIDefaultQuery, boundModelToolOutputsFilterForSettings, buildAgentCapabilities, buildCompactionPromptInput, buildCompactionReplacementHistory, buildManifest, buildModelInstance, buildOpenAIClientFromSettings, buildOpenGeniAgent, buildProviderClient, buildSummaryItem, callModelInputFilterForSettings, clampCompactionThresholdRatio, compactionProviderFailureDiagnostics, compactionReplacementFingerprint, compactionResponseDiagnostics, compactionThresholdTokens, composeAgentInstructions, computerUse, configureOpenAI, configureRuntimeMetricsHooks, connectMcpServersInBatches, contextRobustnessFilterForSettings, coreInstructions, createProductionAgentRuntime, createTurnToolCancellationController, decideCompaction, effectiveSkillSelectionsForAgent, elideSupersededViewImagePairs, elideSupersededViewImagesFilter, ensureReadableStreamFrom, estimateCompleteModelInput, estimateItemTokens, estimateSerializedValueTokens, estimateTokens, extractResponseOutputText, findCompactionNeededError, gitCredentialBindingHash, gitCredentialBindingTokenRefreshCommand, gitProviderTokenRefreshCommand, hasModelGeneratedItem, isCompactionSummary, isEphemeralInternalContext, isUserMessage, latestCompactionReplacementFingerprint, lazySkillSourceWithPackSkills, manifestEnvironmentDrift, materializeSandboxFileDownloads, maxTurnsExceededRunState, mcpToolErrorOutput, modelCallUsageTelemetry, modelResponseUsageFromResponse, modelResponseUsageFromSdkEvent, modelUsageTokenCountOrNull, neutralizeToolSearchItemsInSerializedRunState, normalizeComputerCallsFilter, normalizeModelCallUsage, normalizeSdkEvent, normalizeToolOutputForEvent, oneShotGenesisTitleInputFilter, pinProvidedSessionManifestEnvironment, prefixedMcpToolName, prepareAgentTools, prepareCompactionPromptInput, prepareRunInput, refreshGitCredentialBindingTokenFiles, refreshGitProviderTokenFiles, refreshToolspaceTokenFile, renderCompactionPromptInputForChat, repositoryCloneCommand, repositoryUsesSandboxClone, resolveTurnModel, rigInstructions, rigSetupScriptCommand, runAgentStream, runAzureCliLoginHook, runBeforeAgentStartHooks, runOwnedSandboxSetup, runRepositoryCloneHook, runRigSetupHook, runToolspaceTokenSeedHook, sandboxCommandExitCode, sandboxCommandOutput, sandboxCommandStillRunning, sandboxFileDownloadFailureNote, sandboxFileDownloadsForAgent, sandboxLifecycleHooksForIds, sandboxRunAs, sanitizeHistoryItemsForModel, serializeApprovals, serializeHumanInputRequests, stripProviderItemIdsFilter, stripReasoningEncryptedContent, stripReasoningIdentityFromSerializedRunState, summarizeForCompaction, toolspaceTokenSeedCommand, withManifestRefreshOnResume, withSandboxFileDownloads, withSandboxLifecycleHooks, withStructuredViewImageFunctionResults, workspaceEnvironmentInstructions };
+export { type AgentSegmentInput, type BuildAgentOptions, COMPACTION_PROMPT, COMPACTION_SUMMARY_MARKER, COMPACT_USER_MESSAGE_MAX_TOKENS, CodexSubscriptionUnavailableError, type CompactionDecision, type CompactionItem, CompactionNeededError, CompactionProviderResponseError, ComputerActionError, ComputerReadOnlyError, type ComputerToolMode, ComputerUnavailableError, type ComputerUseArgs, ComputerUseCapability, type ConnectedMcpServerBatches, type ContextRobustnessFilterOptions, DEFAULT_COMPACTION_THRESHOLD_RATIO, type EffectiveSkillSelection, EmptyCompactionSummaryError, GENESIS_TITLE_DIRECTIVE, type GitCredentialBindingSeed, type GitCredentialTokenWriterSession, type GitTokenSeeds, HUMAN_INPUT_TOOL_NAME, type HistoryItem, MAX_COMPACTION_THRESHOLD_RATIO, MAX_MODEL_USAGE_TOKEN_COUNT, MIN_COMPACTION_THRESHOLD_RATIO, type ModelCallUsageInput, type ModelCallUsageNormalization, type ModelCallUsageTelemetry, type ModelResponseUsage, MultiProviderModelProvider, type NormalizedRuntimeEvent, type OpenGeniRuntime, type PackSkill, type PackSkillFile, type PersistentSessionSettings, type PrepareInputOptions, type PrepareToolsOptions, type PreparedAgentInput, type PreparedAgentTools, type PreparedCompactionPromptInput, type ProductionRuntimeOverrides, type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult, type RigInstructionsContext, type RigSetupDescriptor, type RunAgentStreamOptions, RunCredentialSessionReady, RuntimeMetricsHooks, SUMMARY_BUFFER_TOKENS, SUMMARY_PREFIX, SandboxComputer, type SandboxComputerOptions, type SandboxFileDownload, type SandboxFileDownloadFailure, type SandboxFileDownloadMaterializationResult, type SandboxLifecycleCommandRunner, type SandboxLifecycleHook, type SandboxLifecycleHookContext, type SandboxLifecycleHookPhase, type SerializedHumanInputInterruption, TOOLSPACE_PROGRAMMATIC_DIRECTIVE, type ToolspaceTokenWriterSession, type TurnSandboxCommandArgs, TurnSandboxCommandCancelledError, type TurnSandboxCommandSession, type TurnToolCancellationController, type TurnToolCancellationFence, USER_MESSAGE_TRUNCATION_MARKER, type WorkspaceEnvironmentContext, WorkspaceModelPolicyBlockedError, agentsErrorRunState, appendGenesisTitleDirective, appendGitCredentialBindingInstructions, appendPersistentSessionSettings, appendSessionInstructions, appendToolspaceInstructions, appendTurnInstructions, appendWorkspaceMemory, applyMissingManifestEntries, azureCliLoginCommand, azureOpenAIDefaultQuery, boundModelToolOutputsFilterForSettings, buildAgentCapabilities, buildCompactionPromptInput, buildCompactionReplacementHistory, buildManifest, buildModelInstance, buildOpenAIClientFromSettings, buildOpenGeniAgent, buildProviderClient, buildSummaryItem, callModelInputFilterForSettings, clampCompactionThresholdRatio, compactionProviderFailureDiagnostics, compactionReplacementFingerprint, compactionResponseDiagnostics, compactionThresholdTokens, composeAgentInstructions, computerUse, configureOpenAI, configureRuntimeMetricsHooks, connectMcpServersInBatches, contextRobustnessFilterForSettings, coreInstructions, createProductionAgentRuntime, createTurnToolCancellationController, decideCompaction, effectiveSkillSelectionsForAgent, elideSupersededViewImagePairs, elideSupersededViewImagesFilter, ensureReadableStreamFrom, estimateCompleteModelInput, estimateItemTokens, estimateSerializedValueTokens, estimateTokens, extractResponseOutputText, findCompactionNeededError, gitCredentialBindingHash, gitCredentialBindingTokenRefreshCommand, gitProviderTokenRefreshCommand, hasModelGeneratedItem, isCompactionSummary, isUserMessage, latestCompactionReplacementFingerprint, lazySkillSourceWithPackSkills, manifestEnvironmentDrift, materializeSandboxFileDownloads, maxTurnsExceededRunState, mcpToolErrorOutput, modelCallUsageTelemetry, modelResponseUsageFromResponse, modelResponseUsageFromSdkEvent, modelUsageTokenCountOrNull, neutralizeToolSearchItemsInSerializedRunState, normalizeComputerCallsFilter, normalizeModelCallUsage, normalizeSdkEvent, normalizeToolOutputForEvent, oneShotGenesisTitleInputFilter, pinProvidedSessionManifestEnvironment, prefixedMcpToolName, prepareAgentTools, prepareCompactionPromptInput, prepareRunInput, refreshGitCredentialBindingTokenFiles, refreshGitProviderTokenFiles, refreshToolspaceTokenFile, renderCompactionPromptInputForChat, repositoryCloneCommand, repositoryUsesSandboxClone, repositoryWorkspaceSkillPathsOption, resolveTurnModel, rigInstructions, rigSetupScriptCommand, runAgentStream, runAzureCliLoginHook, runBeforeAgentStartHooks, runOwnedSandboxSetup, runRepositoryCloneHook, runRigSetupHook, runToolspaceTokenSeedHook, sandboxCommandExitCode, sandboxCommandOutput, sandboxCommandStillRunning, sandboxFileDownloadFailureNote, sandboxFileDownloadsForAgent, sandboxLifecycleHooksForIds, sandboxRunAs, sanitizeHistoryItemsForModel, serializeApprovals, serializeHumanInputRequests, stripProviderItemIdsFilter, stripReasoningEncryptedContent, stripReasoningIdentityFromSerializedRunState, summarizeForCompaction, toolspaceTokenSeedCommand, withManifestRefreshOnResume, withSandboxFileDownloads, withSandboxLifecycleHooks, withStructuredViewImageFunctionResults, workspaceEnvironmentInstructions };

package/dist/index.js

@@ -150,6 +150,7 @@ import {
   serializeEstablishedSandboxEnvelope,
   serializeReplacementSandboxEnvelope,
   setSelfhostedApplyDiff,
+  shellToolspacePath,
   startRecording,
   stopRecording,
   stripExecBanner,
@@ -175,7 +176,7 @@ import {
   withToolspaceTokenEnvironment,
   withToolspaceTokenSession,
   wrapCapabilityToolsForTurnCancellation
-} from "./chunk-3NUSY22C.js";
+} from "./chunk-HHWIZHQM.js";
 import {
   getSkillLibraryEntry,
   isSkillLibraryEntryId,
@@ -267,6 +268,7 @@ import {
   approvalIdentifier,
   CAPABILITY_DESCRIPTORS as CAPABILITY_DESCRIPTORS2,
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
+  DEFAULT_FIRST_PARTY_MCP_TOOLS,
   assertUniqueResourceMountPaths,
   gitCredentialBindingIdForRepository,
   gitCredentialProviderForRepository,
@@ -6422,7 +6424,7 @@ import {
   codexSubscriptionFetch
 } from "@opengeni/codex";
 import { cpSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync } from "fs";
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { dirname, isAbsolute, join, posix as posixPath, relative } from "path";
 import { fileURLToPath } from "url";
 
@@ -7225,9 +7227,6 @@ function isUserMessage(item) {
 function isCompactionSummary(item) {
   return isUserMessage(item) && item[COMPACTION_SUMMARY_MARKER] === true;
 }
-function isEphemeralInternalContext(item) {
-  return itemType2(item) === "message" && itemRole(item) === "system";
-}
 function estimateTextTokens(text) {
   let asciiCodeUnits = 0;
   let nonAsciiCodeUnits = 0;
@@ -8480,6 +8479,184 @@ var ComputerUseCapability = class extends Capability {
   }
 };
 
+// src/workspace-skills.ts
+import { createHash as createHash2 } from "crypto";
+var SKILL_FILE = "SKILL.md";
+var MAX_DISCOVERED_SKILLS = 256;
+var MAX_SKILL_ENTRIES = 1024;
+var MAX_SKILL_BYTES = 32 * 1024 * 1024;
+var SAFE_SKILL_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var WorkspaceSkillsCapability = class extends Capability {
+  constructor(searchPaths, reservedNames = /* @__PURE__ */ new Set()) {
+    super();
+    this.searchPaths = searchPaths;
+    this.reservedNames = reservedNames;
+  }
+  type = "workspace-skills";
+  discovery;
+  async instructions() {
+    const session = requireWorkspaceSkillSession(this._session);
+    this.discovery ??= discoverWorkspaceSkills(
+      session,
+      this.searchPaths,
+      this.reservedNames,
+      this._runAs
+    );
+    const skills2 = await this.discovery;
+    if (skills2.length === 0) return null;
+    const available = skills2.map((skill) => `- ${skill.name}: ${skill.description} (file: ${skill.path})`).join("\n");
+    return `## Repository skills
+
+Repository skills are instructions already present in the live workspace. They do not need to be loaded or copied.
+
+### Available repository skills
+${available}
+
+### How to use repository skills
+- If the user names a skill, or the task clearly matches a skill description, read its complete SKILL.md before acting.
+- Resolve referenced scripts, references, assets, and templates relative to that skill directory.
+- Use only the minimum relevant skills for the turn, and say briefly which ones you are using.
+- Do not assume a skill remains applicable on later turns; evaluate the current request again.`;
+  }
+};
+function workspaceSkills(searchPaths, reservedNames = []) {
+  return new WorkspaceSkillsCapability(
+    searchPaths,
+    new Set([...reservedNames].map((name) => name.toLowerCase()))
+  );
+}
+async function discoverWorkspaceSkills(session, searchPaths, reservedNames = /* @__PURE__ */ new Set(), runAs) {
+  if (!session.listDir || !session.readFile) {
+    throw new Error("Workspace skill discovery requires sandbox listDir() and readFile() support");
+  }
+  const discovered = /* @__PURE__ */ new Map();
+  let candidates = 0;
+  for (const searchPath of searchPaths) {
+    let entries;
+    try {
+      entries = await session.listDir({ path: searchPath.path, ...runAs ? { runAs } : {} });
+    } catch {
+      continue;
+    }
+    for (const entry of [...entries].sort((left, right) => left.name.localeCompare(right.name))) {
+      if (entry.type !== "dir") continue;
+      candidates += 1;
+      if (candidates > MAX_DISCOVERED_SKILLS) {
+        throw new Error(`Repository skill discovery exceeds ${MAX_DISCOVERED_SKILLS} directories`);
+      }
+      const skillMarkdownPath = joinWorkspacePath(entry.path, SKILL_FILE);
+      let markdown;
+      try {
+        const content = await session.readFile({
+          path: skillMarkdownPath,
+          ...runAs ? { runAs } : {}
+        });
+        markdown = typeof content === "string" ? content : new TextDecoder().decode(content);
+      } catch {
+        continue;
+      }
+      const frontmatter = parseSkillFrontmatter(markdown);
+      const name = frontmatter.name?.trim() || entry.name;
+      if (name.length > 64 || !SAFE_SKILL_NAME.test(name)) {
+        throw new Error(`Repository skill has an invalid name: ${name.slice(0, 64)}`);
+      }
+      const description = frontmatter.description?.trim() || "No description provided.";
+      if (description.length > 2048 || /[\r\n]/.test(description)) {
+        throw new Error(`Repository skill "${name}" has an invalid description`);
+      }
+      const key = name.toLowerCase();
+      if (reservedNames.has(key)) {
+        throw new Error(`Workspace skill "${name}" conflicts with a configured OpenGeni skill`);
+      }
+      const candidate = {
+        name,
+        description,
+        path: skillMarkdownPath,
+        fingerprint: await fingerprintWorkspaceDirectory(session, entry.path, runAs),
+        source: searchPath.source
+      };
+      const existing = discovered.get(key);
+      if (!existing) {
+        discovered.set(key, candidate);
+        continue;
+      }
+      if (existing.fingerprint !== candidate.fingerprint) {
+        throw new Error(
+          `Workspace skill "${name}" has conflicting definitions in ${existing.source} and ${candidate.source}`
+        );
+      }
+    }
+  }
+  return [...discovered.values()].sort((left, right) => left.name.localeCompare(right.name));
+}
+async function fingerprintWorkspaceDirectory(session, root, runAs) {
+  const hash = createHash2("sha256");
+  let entryCount = 0;
+  let byteCount = 0;
+  async function visit(path, relativePath) {
+    const entries = await session.listDir({ path, ...runAs ? { runAs } : {} });
+    for (const entry of [...entries].sort((left, right) => left.name.localeCompare(right.name))) {
+      entryCount += 1;
+      if (entryCount > MAX_SKILL_ENTRIES) {
+        throw new Error(`Workspace skill exceeds ${MAX_SKILL_ENTRIES} filesystem entries`);
+      }
+      const childRelativePath = relativePath ? `${relativePath}/${entry.name}` : entry.name;
+      hash.update(entry.type);
+      hash.update("\0");
+      hash.update(childRelativePath);
+      hash.update("\0");
+      if (entry.type === "dir") {
+        await visit(entry.path, childRelativePath);
+        continue;
+      }
+      if (entry.type !== "file") continue;
+      const content = await session.readFile({
+        path: entry.path,
+        ...runAs ? { runAs } : {}
+      });
+      const bytes = typeof content === "string" ? new TextEncoder().encode(content) : content;
+      byteCount += bytes.byteLength;
+      if (byteCount > MAX_SKILL_BYTES) {
+        throw new Error(`Workspace skill exceeds ${MAX_SKILL_BYTES} bytes`);
+      }
+      hash.update(bytes);
+      hash.update("\0");
+    }
+  }
+  await visit(root, "");
+  return hash.digest("hex");
+}
+function parseSkillFrontmatter(markdown) {
+  const lines = markdown.split(/\r?\n/);
+  if (lines[0]?.trim() !== "---") return {};
+  const end = lines.findIndex((line, index) => index > 0 && line.trim() === "---");
+  if (end === -1) return {};
+  const values = {};
+  for (const line of lines.slice(1, end)) {
+    const separator = line.indexOf(":");
+    if (separator === -1) continue;
+    const key = line.slice(0, separator).trim();
+    if (key !== "name" && key !== "description") continue;
+    values[key] = unquote(line.slice(separator + 1).trim());
+  }
+  return values;
+}
+function unquote(value) {
+  if (value.length >= 2 && value[0] === value[value.length - 1] && (value[0] === '"' || value[0] === "'")) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+function joinWorkspacePath(parent, child) {
+  return `${parent.replace(/\/+$/, "")}/${child}`;
+}
+function requireWorkspaceSkillSession(session) {
+  if (!session) {
+    throw new Error('capability "workspace-skills" used before bind(session)');
+  }
+  return session;
+}
+
 // src/usage-telemetry.ts
 var MAX_MODEL_USAGE_TOKEN_COUNT = 1e9;
 function modelUsageTokenCountOrNull(value) {
@@ -9574,6 +9751,8 @@ function buildOpenGeniAgent(settings, resources, options = {}) {
     ...runAs ? { runAs } : {},
     capabilities: buildAgentCapabilities(settings, options.packSkills ?? [], {
       ...options.skillLibrarySkills?.length ? { skillLibrarySkills: options.skillLibrarySkills } : {},
+      ...options.sessionSkills?.length ? { sessionSkills: options.sessionSkills } : {},
+      ...repositoryWorkspaceSkillPathsOption(resources),
       ...options.structuredToolTransport !== void 0 ? { structuredToolTransport: options.structuredToolTransport } : {},
       ...options.computerToolMode !== void 0 ? { computerToolMode: options.computerToolMode } : {},
       ...options.onComputerUseReady ? { onComputerUseReady: options.onComputerUseReady } : {},
@@ -9587,7 +9766,8 @@ function buildOpenGeniAgent(settings, resources, options = {}) {
       effectiveSkillSelections(
         options.skillLibrarySelections ?? [],
         options.skillLibrarySkills ?? [],
-        options.packSkills ?? []
+        options.packSkills ?? [],
+        options.sessionSkills ?? []
       ).map((selection) => Object.freeze(selection))
     )
   );
@@ -9739,11 +9919,29 @@ function buildAgentCapabilities(settings, packSkills, options = {}) {
     filesystemCapability,
     shell({ ...toolCancellation ? {} : { configureTools: withExecOpCorrelation } })
   ];
+  const sessionSkills = sessionSkillsForMaterialization(
+    packSkills,
+    options.skillLibrarySkills ?? [],
+    options.sessionSkills ?? []
+  );
   caps.push(
     skills({
-      lazyFrom: lazySkillSourceWithPackSkills(packSkills, options.skillLibrarySkills ?? [])
+      lazyFrom: lazySkillSourceWithPackSkills(
+        [...packSkills, ...sessionSkills],
+        options.skillLibrarySkills ?? []
+      )
     })
   );
+  if (options.workspaceSkillPaths?.length) {
+    caps.push(
+      workspaceSkills(options.workspaceSkillPaths, [
+        ...bundledSkillDirNames(bundledSkillsDir()),
+        ...(options.skillLibrarySkills ?? []).map((skill) => skill.name),
+        ...packSkills.map((skill) => skill.name),
+        ...sessionSkills.map((skill) => skill.name)
+      ])
+    );
+  }
   if (settings.computerUseEnabled && settings.sandboxDesktopEnabled && desktopCapableBackend(settings.sandboxBackend)) {
     const explicitMode = options.computerToolMode;
     const computerCapability = computerUse({
@@ -9830,6 +10028,14 @@ async function prepareAgentTools(settings, tools, options = {}) {
     }, codexConnectorNamespaces };
   }
   const registry = new Map(settings.mcpServers.map((server) => [server.id, server]));
+  const subjectOwnedTool = tools.find(
+    (tool2) => registry.get(tool2.id)?.connectionRef?.subjectScope === "subject"
+  );
+  if (subjectOwnedTool && !options.credentialSubjectId) {
+    throw new Error(
+      `subject-owned connection for MCP server ${subjectOwnedTool.id} requires a human turn initiator`
+    );
+  }
   const aggregateToolBudget = new McpAggregateToolListBudget();
   const useBunNativeFetch = options.mcpFetchImpl === void 0 && !!process.versions.bun;
   const mcpFetchImpl = options.mcpFetchImpl ?? (useBunNativeFetch ? globalThis.fetch.bind(globalThis) : undiciFetch);
@@ -10048,7 +10254,7 @@ async function resolveConnectionForRequest(options, serverId, connectionRef, des
     destinationUrl,
     forceRefresh,
     ...toolName ? { toolName } : {},
-    ...options.subjectId ? { subjectId: options.subjectId } : {}
+    ...options.credentialSubjectId ? { subjectId: options.credentialSubjectId } : {}
   };
   try {
     return await options.resolveCredential(request);
@@ -10280,6 +10486,7 @@ async function signFirstPartyDelegatedBearer(settings, options) {
     subjectId: options.subjectId ?? "worker:first-party-mcp",
     ...options.subjectLabel ? { subjectLabel: options.subjectLabel } : {},
     permissions: options.firstPartyPermissions ?? [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS],
+    firstPartyMcpTools: options.firstPartyTools ?? [...DEFAULT_FIRST_PARTY_MCP_TOOLS],
     ...options.sessionId ? { sessionId: options.sessionId } : {},
     ...options.turnId ? { turnId: options.turnId } : {},
     ...options.attemptId ? { attemptId: options.attemptId } : {},
@@ -11661,6 +11868,24 @@ function buildManifest(settings, resources, environment = collectSandboxEnvironm
     environment
   });
 }
+function repositoryWorkspaceSkillPathsOption(resources) {
+  const repositories = resources.filter(
+    (resource) => resource.kind === "repository"
+  );
+  if (repositories.length === 0) return {};
+  const paths = /* @__PURE__ */ new Map();
+  const add = (path, source) => {
+    if (!paths.has(path)) paths.set(path, { path, source });
+  };
+  add(".agents/skills", "workspace .agents/skills");
+  add(".claude/skills", "workspace .claude/skills");
+  for (const repository of repositories) {
+    const mountPath = resourceMountPath(repository);
+    add(`${mountPath}/.agents/skills`, `${mountPath}/.agents/skills`);
+    add(`${mountPath}/.claude/skills`, `${mountPath}/.claude/skills`);
+  }
+  return { workspaceSkillPaths: [...paths.values()] };
+}
 function sandboxDownloadDirectory(download, mountPath) {
   if (download.mountPath !== mountPath) {
     throw new Error(
@@ -11999,7 +12224,7 @@ function gitProviderSeedEnv(provider) {
   return `OPENGENI_GIT_${provider.toUpperCase()}_TOKEN_SEED`;
 }
 function gitCredentialBindingHash(credentialBindingId) {
-  return createHash2("sha256").update(credentialBindingId, "utf8").digest("hex").slice(0, 32);
+  return createHash3("sha256").update(credentialBindingId, "utf8").digest("hex").slice(0, 32);
 }
 function gitBindingSeedEnv(binding) {
   return `OPENGENI_GIT_BINDING_${gitCredentialBindingHash(binding.credentialBindingId).toUpperCase()}_TOKEN_SEED`;
@@ -12742,8 +12967,8 @@ function toolspaceTokenSeedCommand(options = {}) {
     'if [ -n "${OPENGENI_TOOLSPACE_TOKEN_SEED:-}" ]; then',
     '  seed_umask="$(umask)"',
     "  umask 077",
-    options.tokenFile ? `  token_file=${shellQuote(options.tokenFile)}` : '  token_file="${OPENGENI_TOOLSPACE_TOKEN_FILE:-$HOME/.opengeni/toolspace-token}"',
-    options.legacyTokenFile ? `  legacy_token_file=${shellQuote(options.legacyTokenFile)}` : '  legacy_token_file=""',
+    options.tokenFile ? `  token_file=${shellToolspacePath(options.tokenFile)}` : '  token_file="${OPENGENI_TOOLSPACE_TOKEN_FILE:-$HOME/.opengeni/toolspace-token}"',
+    options.legacyTokenFile ? `  legacy_token_file=${shellToolspacePath(options.legacyTokenFile)}` : '  legacy_token_file=""',
     '  mkdir -p "$(dirname "$token_file")"',
     `  printf '%s' "$OPENGENI_TOOLSPACE_TOKEN_SEED" > "$token_file.tmp.$$"`,
     '  mv -f "$token_file.tmp.$$" "$token_file"',
@@ -13187,7 +13412,7 @@ function lazySkillSourceWithPackSkills(packSkills, skillLibrarySkills = []) {
     ]
   };
 }
-function effectiveSkillSelections(librarySelections, librarySkills, packSkills) {
+function effectiveSkillSelections(librarySelections, librarySkills, packSkills, sessionSkills) {
   const defaultSelections = bundledSkillDirNames(bundledSkillsDir()).map((name) => ({
     id: `bundled:${name}`,
     name,
@@ -13198,14 +13423,22 @@ function effectiveSkillSelections(librarySelections, librarySkills, packSkills)
   }));
   const libraryNameKeys = new Set(librarySkills.map((skill) => skill.name.toLowerCase()));
   const packNameKeys = new Set(packSkills.map((skill) => skill.name.toLowerCase()));
+  const effectiveSessionSkills = sessionSkillsForMaterialization(
+    packSkills,
+    librarySkills,
+    sessionSkills
+  );
+  const sessionNameKeys = new Set(effectiveSessionSkills.map((skill) => skill.name.toLowerCase()));
   const selected = librarySelections.filter(
     (selection) => libraryNameKeys.has(selection.name.toLowerCase())
   );
   return [
     ...defaultSelections.filter(
-      (selection) => !libraryNameKeys.has(selection.name.toLowerCase()) && !packNameKeys.has(selection.name.toLowerCase())
+      (selection) => !libraryNameKeys.has(selection.name.toLowerCase()) && !packNameKeys.has(selection.name.toLowerCase()) && !sessionNameKeys.has(selection.name.toLowerCase())
+    ),
+    ...selected.filter(
+      (selection) => !packNameKeys.has(selection.name.toLowerCase()) && !sessionNameKeys.has(selection.name.toLowerCase())
     ),
-    ...selected.filter((selection) => !packNameKeys.has(selection.name.toLowerCase())),
     ...packSkills.map((skill) => ({
       id: `pack:${skill.name}`,
       name: skill.name,
@@ -13213,9 +13446,48 @@ function effectiveSkillSelections(librarySelections, librarySkills, packSkills)
       version: null,
       contentSha256: null,
       reason: "enabled capability pack"
+    })),
+    ...effectiveSessionSkills.map((skill) => ({
+      id: `session:${skill.name}`,
+      name: skill.name,
+      source: "session",
+      version: null,
+      contentSha256: null,
+      reason: "attached to session"
     }))
   ];
 }
+function sessionSkillsForMaterialization(packSkills, librarySkills, sessionSkills) {
+  const configured = /* @__PURE__ */ new Map();
+  for (const skill of [...librarySkills, ...packSkills]) {
+    configured.set(skill.name.toLowerCase(), skill);
+  }
+  const bundledNames = new Set(
+    bundledSkillDirNames(bundledSkillsDir()).map((name) => name.toLowerCase())
+  );
+  const selected = /* @__PURE__ */ new Map();
+  for (const skill of sessionSkills) {
+    assertSafePackSkillName(skill.name);
+    const key = skill.name.toLowerCase();
+    if (bundledNames.has(key)) {
+      throw new Error(`Session skill "${skill.name}" conflicts with a bundled skill`);
+    }
+    const existing = selected.get(key) ?? configured.get(key);
+    if (existing) {
+      if (skillFingerprint(existing) !== skillFingerprint(skill)) {
+        throw new Error(`Conflicting skill definitions for "${skill.name}"`);
+      }
+      continue;
+    }
+    selected.set(key, skill);
+  }
+  return [...selected.values()];
+}
+function skillFingerprint(skill) {
+  return JSON.stringify(
+    [...skill.files].sort((left, right) => left.path.localeCompare(right.path)).map(({ path, content }) => ({ path, content }))
+  );
+}
 function removeSkillChildByNameKey(children, nameKey) {
   for (const name of Object.keys(children)) {
     if (name.toLowerCase() === nameKey) {
@@ -13528,7 +13800,6 @@ export {
   hasPersistableSandboxProviderIdentity,
   inspectRecordingArtifact,
   isCompactionSummary,
-  isEphemeralInternalContext,
   isExecSessionLostBanner,
   isProviderSandboxGoneDuringRoutedOperation,
   isProviderSandboxNotFoundError,
@@ -13590,6 +13861,7 @@ export {
   renderSelfhostedFault,
   repositoryCloneCommand,
   repositoryUsesSandboxClone,
+  repositoryWorkspaceSkillPathsOption,
   requirePersistableReplacementSandboxEnvelope,
   resolveTurnModel,
   restoredSandboxSessionStateFromEntry,