@opengeni/runtime 0.13.3 → 0.13.10

package/dist/mcp-network.d.ts

@@ -66,6 +66,7 @@ declare function boundedParallelMap<T, R>(values: readonly T[], concurrency: num
 declare function guardedMcpFetch<TInput extends string | URL | Request>(settings: Pick<Settings, "environment" | "integrationsAllowPrivateNetworkTargets">, fetchImpl: (input: TInput, init?: RequestInit) => Promise<Response>, options?: {
     maxResponseBytes?: number;
     dnsLookup?: DnsLookup;
+    pinResolvedDestination?: boolean;
     requireHttpsOutsideLocalTest?: boolean;
 }): (input: TInput, init?: RequestInit) => Promise<Response>;
 declare function boundMcpResponseBody(response: Response, maxBytes: number): Response;

package/dist/mcp-network.js

@@ -29,7 +29,7 @@ import {
   mcpOuterConnectTimeoutMs,
   mcpSerializedSizeBytes,
   undiciFetch
-} from "./chunk-SSB7VOLE.js";
+} from "./chunk-QYXOVIUK.js";
 import "./chunk-PZ5AY32C.js";
 export {
   MCP_DEFAULT_OUTER_CONNECT_TIMEOUT_MS,

package/dist/sandbox/index.d.ts

@@ -1,6 +1,6 @@
 export { collectSandboxEnvironment, parseExposedPorts } from '@opengeni/config';
 export { CAPABILITY_DESCRIPTORS, CapabilityDescriptor, DESKTOP_STREAM_PORT, StreamTokenPayload, StreamTokenPayload as StreamTokenPayloadType, TERMINAL_STREAM_PORT } from '@opengeni/contracts';
 import '@openai/agents/sandbox';
-export { A as ActiveBackendResolverDeps, b as ActiveBackendUnresolvableError, c as ActivePointer, B as BackendUnresolvableCode, C as ChannelAConflictError, d as ChannelAEmitter, e as ChannelAExecArgs, f as ChannelAExecResult, g as ChannelANotFoundError, h as ChannelASession, i as ChannelAUnavailableError, j as ChannelAUnsupportedError, k as ChannelAValidationError, l as ControlRpc, D as DEFAULT_DESKTOP_GEOMETRY, m as DISPLAY_STACK_TIMEOUT_MS, n as DefaultBackendLossResult, o as DesktopGeometry, p as DisplayStackCallerKind, q as DisplayStackClassification, r as DisplayStackError, s as DisplayStackTelemetryContext, t as DisplayStackTelemetryEvent, u as DisplayStackTelemetryStatus, v as DisplayStackUnsupportedError, E as EnsureDisplayStackOptions, w as EnsureDisplayStackResult, x as EnsureTerminalServerOptions, y as EnsureTerminalServerResult, z as EstablishedSandboxSession, F as ExposeStreamPortInput, G as ExposeStreamPortResult, H as ExposedPortEndpoint, I as FAULT_FIELD_WHAT_HAPPENED, J as FAULT_FIELD_WHAT_PRESERVED, K as FAULT_FIELD_WHAT_TO_TRY, L as FAULT_FIELD_WHICH_LAYER, M as LiveModalSandboxLeaseAttribution, N as MaterializeRunCredentialsOptions, O as MintStreamTokenInput, P as MockAgentResponder, Q as MockAgentResponderOptions, S as MockExecHandler, T as ModalModuleLoader, U as ModalOrphanSweepResult, V as ModalOrphanSweepTermination, W as ModalSandboxAttribution, X as NEVER_SENT_DETAIL_KEY, Y as NatsControlRpc, Z as NatsOpStreamConnection, _ as NatsOpStreamTransport, $ as NatsRequestConnection, a0 as NegotiationContext, a1 as NormalizedRunCredentialMaterial, a2 as NumstatEntry, a3 as OP_STREAM_ACK_INTERVAL_MS, a4 as OP_STREAM_DEFAULT_WINDOW_BYTES, a5 as OP_STREAM_RECONNECT_HOLD_MS, a6 as OP_STREAM_SILENCE_TIMEOUT_MS, a7 as OpStreamExecOutcome, a8 as OpStreamJournal, a9 as OpStreamSubscription, aa as OpStreamTransport, ab as OpStreamUnavailableError, ac as PROVIDER_REGISTRY, ad as ProviderConstructionContext, ae as ProviderRegistration, af as ProviderSandboxFailure, ag as ProviderSandboxFailureKind, ah as REPOSITORY_DISCOVERY_LIMIT, ai as RecordingArtifactMetadata, aj as RecordingCodec, ak as RecordingContentType, al as RecordingError, am as RecordingProcess, an as RecordingUnavailableError, ao as RepositoryDiscoveryDegradedReason, ap as RepositoryDiscoveryResult, aq as ResolvedActiveBackend, ar as RevalidateModalOrphanTermination, as as RoutableBackendSession, at as RoutableSandbox, au as RoutingBackendRecoveryRequiredError, av as RoutingMutationOutcomeUnknownError, aw as RoutingRetainedProcess, ax as RoutingRetainedProcessAdoption, ay as RoutingRetainedProcessNotFoundError, az as RoutingRetainedProcessTerminalProof, aA as RoutingSandboxSession, aB as RoutingSandboxSessionDeps, aC as RoutingTransitionEvent, aD as RoutingUnsupportedError, aE as RunCredentialCommandRunner, aF as RunCredentialCommandSession, aG as RunCredentialExpectedScope, R as RunCredentialSessionReady, aH as RunCredentialValidationError, aI as SELFHOSTED_DEFAULT_TIMEOUT_MS, aJ as SELFHOSTED_DRAINING_MAX_RETRIES, aK as SELFHOSTED_EXEC_DRAINING_MAX_RETRIES, aL as SELFHOSTED_IDEMPOTENT_READONLY_OPS, aM as SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES, aN as SELFHOSTED_NEVER_SENT_MAX_RETRIES, aO as SELFHOSTED_RECONNECT_WINDOW_MS, aP as SELFHOSTED_RELAY_STREAM_PATH, aQ as SELFHOSTED_RETRY_BACKOFF_BASE_MS, aR as SELFHOSTED_RETRY_BACKOFF_CAP_MS, aS as SELFHOSTED_RETRY_BACKOFF_FACTOR, aT as SELFHOSTED_TIMEOUT_MAX_RETRIES, aU as STREAM_PORT, aV as STREAM_TOKEN_DEFAULT_TTL_SECONDS, aW as SandboxChannelAService, aX as SandboxChannelAServiceOptions, aY as SandboxConfigError, aZ as SandboxCreatedCallback, a_ as SandboxExecReadinessError, a$ as SandboxProviderUnavailableError, b0 as SandboxReplacementProviderStateError, b1 as SandboxResumeStateUnavailableError, b2 as SelfhostedApplyDiff, b3 as SelfhostedControlError, b4 as SelfhostedEditor, b5 as SelfhostedEnrollment, b6 as SelfhostedExecArgs, b7 as SelfhostedExecResult, b8 as SelfhostedImageOutput, b9 as SelfhostedLivenessState, ba as SelfhostedNegotiationInput, bb as SelfhostedOpObservation, bc as SelfhostedOpObserver, bd as SelfhostedOpStreamDeps, be as SelfhostedRelayConfig, bf as SelfhostedRetryClock, bg as SelfhostedRetryDecision, bh as SelfhostedSandboxClient, bi as SelfhostedSession, bj as SelfhostedSessionBuild, bk as SelfhostedSessionDeps, bl as SelfhostedSessionState, bm as SelfhostedUnavailableReason, bn as StartRecordingInput, bo as StreamPortUnavailableError, bp as SwapTargetEstablishability, bq as TERMINAL_SERVER_TIMEOUT_MS, br as TerminalServerError, bs as TerminalServerUnsupportedError, bt as ToolspaceTokenPathError, bu as VerifiedWorkspaceArchive, bv as WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION, bw as WorkspaceArchiveDescriptor, bx as WorkspaceArchiveIntegrityCode, by as WorkspaceArchiveIntegrityError, bz as WorkspaceTreeFingerprint, bA as agentErrorToControlError, bB as assertDescriptorRegistryInvariants, bC as assertProviderRegistryInvariants, bD as assertSafeRelPath, bE as backendSupportsOs, bF as buildDisplayStackScript, bG as buildSelfhostedBackendSession, bH as buildStreamUrl, bI as buildTerminalServerScript, bJ as captureVerifiedWorkspaceArchive, bK as classifyProviderSandboxFailure, bL as clearRunCredentials, bM as clearRunCredentialsForAttempt, bN as contentTypeForCodec, bO as createSandboxClient, bP as createSandboxClientForBackend, bQ as decideSelfhostedRetry, bR as decodeModalSnapshotId, bS as defaultSelfhostedRetryClock, bT as deletePriorPersistedSnapshot, bU as deleteRecordingArtifacts, bV as deserializeSandboxSessionStateEnvelope, bW as desktopCapableBackend, bX as drainingExhaustedError, bY as drainingMessage, bZ as ensureDisplayStack, b_ as ensureModalRegistryImage, b$ as ensureTerminalServer, c0 as establishSandboxSessionFromEnvelope, c1 as execDeadlineHint, c2 as exposeStreamPort, c3 as extForCodec, c4 as fingerprintSandboxWorkspace, c5 as hasPersistableSandboxProviderIdentity, c6 as inspectRecordingArtifact, c7 as isExecSessionLostBanner, c8 as isProviderSandboxGoneDuringRoutedOperation, c9 as isProviderSandboxNotFoundError, ca as isProviderSandboxTransientError, cb as isSelfhostedProviderNotFoundError, cc as makeActiveBackendResolver, cd as materializeRunCredentials, ce as mintStreamToken, cf as modalSandboxAttributionEnvironment, cg as modalSandboxAttributionTags, ch as negotiateCapabilities, ci as negotiateSelfhostedCapabilities, cj as nextDurableOpId, ck as normalizeRunCredentialsResolution, cl as offlineAgentError, cm as offlineControlResponse, cn as opAckSubject, co as opFrameSubject, cp as parseExecBannerExitCode, cq as parseExecBannerSessionId, cr as parseNumstatZ, cs as parsePorcelainV2, ct as parseUnifiedPatch, cu as parseWorkspaceArchiveDescriptor, cv as payloadTooLargeMessage, cw as readVerifiedWorkspaceArchive, cx as readWorkspaceArchiveFromEnvelopeSessionState, cy as recordingStorageKey, cz as renderSelfhostedFault, cA as requirePersistableReplacementSandboxEnvelope, cB as restoredSandboxSessionStateFromEntry, cC as runCredentialPointerFile, cD as runCredentialRoot, cE as runWithToolCallCorrelation, cF as sandboxStateEntryFromRunState, cG as sanitizeOpIdToken, cH as selectBackend, cI as selfhostedFaultClass, cJ as selfhostedLiveness, cK as selfhostedRetryBackoffMs, cL as serializeEstablishedSandboxEnvelope, cM as serializeReplacementSandboxEnvelope, cN as setSelfhostedApplyDiff, cO as startRecording, cP as stopRecording, cQ as stripExecBanner, cR as subjectFor, cS as swapTargetEstablishability, cT as sweepModalOrphanSandboxes, cU as tagModalSandbox, cV as tearDownDisplayStack, cW as tearDownTerminalServer, cX as terminateModalSandboxById, cY as timeoutAgentError, cZ as timeoutControlResponse, c_ as toolspaceTokenFileForSession, c$ as toolspaceTokenFileFromEnvironment, d0 as uploadRecordingArtifact, d1 as verifyRestoredWorkspace, d2 as verifySandboxExecReadiness, d3 as verifyStreamToken, d4 as withRunCredentialEnvironment, d5 as withRunCredentialsClient, d6 as withRunCredentialsSession, d7 as withToolspaceTokenClient, d8 as withToolspaceTokenEnvironment, d9 as withToolspaceTokenSession } from '../index-DU-KXVlx.js';
+export { A as ActiveBackendResolverDeps, b as ActiveBackendUnresolvableError, c as ActivePointer, B as BackendUnresolvableCode, C as ChannelAConflictError, d as ChannelAEmitter, e as ChannelAExecArgs, f as ChannelAExecResult, g as ChannelANotFoundError, h as ChannelASession, i as ChannelAUnavailableError, j as ChannelAUnsupportedError, k as ChannelAValidationError, l as ControlRpc, D as DEFAULT_DESKTOP_GEOMETRY, m as DISPLAY_STACK_TIMEOUT_MS, n as DefaultBackendLossResult, o as DesktopGeometry, p as DisplayStackCallerKind, q as DisplayStackClassification, r as DisplayStackError, s as DisplayStackTelemetryContext, t as DisplayStackTelemetryEvent, u as DisplayStackTelemetryStatus, v as DisplayStackUnsupportedError, E as EnsureDisplayStackOptions, w as EnsureDisplayStackResult, x as EnsureTerminalServerOptions, y as EnsureTerminalServerResult, z as EstablishedSandboxSession, F as ExposeStreamPortInput, G as ExposeStreamPortResult, H as ExposedPortEndpoint, I as FAULT_FIELD_WHAT_HAPPENED, J as FAULT_FIELD_WHAT_PRESERVED, K as FAULT_FIELD_WHAT_TO_TRY, L as FAULT_FIELD_WHICH_LAYER, M as LiveModalSandboxLeaseAttribution, N as MaterializeRunCredentialsOptions, O as MintStreamTokenInput, P as MockAgentResponder, Q as MockAgentResponderOptions, S as MockExecHandler, T as ModalModuleLoader, U as ModalOrphanSweepResult, V as ModalOrphanSweepTermination, W as ModalSandboxAttribution, X as NEVER_SENT_DETAIL_KEY, Y as NatsControlRpc, Z as NatsOpStreamConnection, _ as NatsOpStreamTransport, $ as NatsRequestConnection, a0 as NegotiationContext, a1 as NormalizedRunCredentialMaterial, a2 as NumstatEntry, a3 as OP_STREAM_ACK_INTERVAL_MS, a4 as OP_STREAM_DEFAULT_WINDOW_BYTES, a5 as OP_STREAM_RECONNECT_HOLD_MS, a6 as OP_STREAM_SILENCE_TIMEOUT_MS, a7 as OpStreamExecOutcome, a8 as OpStreamJournal, a9 as OpStreamSubscription, aa as OpStreamTransport, ab as OpStreamUnavailableError, ac as PROVIDER_REGISTRY, ad as ProviderConstructionContext, ae as ProviderRegistration, af as ProviderSandboxFailure, ag as ProviderSandboxFailureKind, ah as REPOSITORY_DISCOVERY_LIMIT, ai as RecordingArtifactMetadata, aj as RecordingCodec, ak as RecordingContentType, al as RecordingError, am as RecordingProcess, an as RecordingUnavailableError, ao as RepositoryDiscoveryDegradedReason, ap as RepositoryDiscoveryResult, aq as ResolvedActiveBackend, ar as RevalidateModalOrphanTermination, as as RoutableBackendSession, at as RoutableSandbox, au as RoutingBackendRecoveryRequiredError, av as RoutingMutationOutcomeUnknownError, aw as RoutingMutationSettlementResult, ax as RoutingRetainedProcess, ay as RoutingRetainedProcessAdoption, az as RoutingRetainedProcessNotFoundError, aA as RoutingRetainedProcessTerminalProof, aB as RoutingSandboxSession, aC as RoutingSandboxSessionDeps, aD as RoutingTransitionEvent, aE as RoutingUnsupportedError, aF as RunCredentialCommandRunner, aG as RunCredentialCommandSession, aH as RunCredentialExpectedScope, R as RunCredentialSessionReady, aI as RunCredentialValidationError, aJ as SELFHOSTED_DEFAULT_TIMEOUT_MS, aK as SELFHOSTED_DRAINING_MAX_RETRIES, aL as SELFHOSTED_EXEC_DRAINING_MAX_RETRIES, aM as SELFHOSTED_IDEMPOTENT_READONLY_OPS, aN as SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES, aO as SELFHOSTED_NEVER_SENT_MAX_RETRIES, aP as SELFHOSTED_RECONNECT_WINDOW_MS, aQ as SELFHOSTED_RELAY_STREAM_PATH, aR as SELFHOSTED_RETRY_BACKOFF_BASE_MS, aS as SELFHOSTED_RETRY_BACKOFF_CAP_MS, aT as SELFHOSTED_RETRY_BACKOFF_FACTOR, aU as SELFHOSTED_TIMEOUT_MAX_RETRIES, aV as STREAM_PORT, aW as STREAM_TOKEN_DEFAULT_TTL_SECONDS, aX as SandboxChannelAService, aY as SandboxChannelAServiceOptions, aZ as SandboxConfigError, a_ as SandboxCreatedCallback, a$ as SandboxExecReadinessError, b0 as SandboxProviderUnavailableError, b1 as SandboxReplacementProviderStateError, b2 as SandboxResumeStateUnavailableError, b3 as SelfhostedApplyDiff, b4 as SelfhostedControlError, b5 as SelfhostedEditor, b6 as SelfhostedEnrollment, b7 as SelfhostedExecArgs, b8 as SelfhostedExecResult, b9 as SelfhostedImageOutput, ba as SelfhostedLivenessState, bb as SelfhostedNegotiationInput, bc as SelfhostedOpObservation, bd as SelfhostedOpObserver, be as SelfhostedOpStreamDeps, bf as SelfhostedRelayConfig, bg as SelfhostedRetryClock, bh as SelfhostedRetryDecision, bi as SelfhostedSandboxClient, bj as SelfhostedSession, bk as SelfhostedSessionBuild, bl as SelfhostedSessionDeps, bm as SelfhostedSessionState, bn as SelfhostedUnavailableReason, bo as StartRecordingInput, bp as StreamPortUnavailableError, bq as SwapTargetEstablishability, br as TERMINAL_SERVER_TIMEOUT_MS, bs as TerminalServerError, bt as TerminalServerUnsupportedError, bu as ToolspaceTokenPathError, bv as VerifiedWorkspaceArchive, bw as WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION, bx as WorkspaceArchiveDescriptor, by as WorkspaceArchiveIntegrityCode, bz as WorkspaceArchiveIntegrityError, bA as WorkspaceTreeFingerprint, bB as agentErrorToControlError, bC as assertDescriptorRegistryInvariants, bD as assertProviderRegistryInvariants, bE as assertSafeRelPath, bF as backendSupportsOs, bG as buildDisplayStackScript, bH as buildSelfhostedBackendSession, bI as buildStreamUrl, bJ as buildTerminalServerScript, bK as captureVerifiedWorkspaceArchive, bL as classifyProviderSandboxFailure, bM as clearRunCredentials, bN as clearRunCredentialsForAttempt, bO as contentTypeForCodec, bP as createSandboxClient, bQ as createSandboxClientForBackend, bR as decideSelfhostedRetry, bS as decodeModalSnapshotId, bT as defaultSelfhostedRetryClock, bU as deletePriorPersistedSnapshot, bV as deleteRecordingArtifacts, bW as deserializeSandboxSessionStateEnvelope, bX as desktopCapableBackend, bY as drainingExhaustedError, bZ as drainingMessage, b_ as ensureDisplayStack, b$ as ensureModalRegistryImage, c0 as ensureTerminalServer, c1 as establishSandboxSessionFromEnvelope, c2 as execDeadlineHint, c3 as exposeStreamPort, c4 as extForCodec, c5 as fingerprintSandboxWorkspace, c6 as hasPersistableSandboxProviderIdentity, c7 as inspectRecordingArtifact, c8 as isExecSessionLostBanner, c9 as isProviderSandboxGoneDuringRoutedOperation, ca as isProviderSandboxNotFoundError, cb as isProviderSandboxTransientError, cc as isSelfhostedProviderNotFoundError, cd as makeActiveBackendResolver, ce as materializeRunCredentials, cf as mintStreamToken, cg as modalSandboxAttributionEnvironment, ch as modalSandboxAttributionTags, ci as negotiateCapabilities, cj as negotiateSelfhostedCapabilities, ck as nextDurableOpId, cl as normalizeRunCredentialsResolution, cm as offlineAgentError, cn as offlineControlResponse, co as opAckSubject, cp as opFrameSubject, cq as parseExecBannerExitCode, cr as parseExecBannerSessionId, cs as parseNumstatZ, ct as parsePorcelainV2, cu as parseUnifiedPatch, cv as parseWorkspaceArchiveDescriptor, cw as payloadTooLargeMessage, cx as readVerifiedWorkspaceArchive, cy as readWorkspaceArchiveFromEnvelopeSessionState, cz as recordingStorageKey, cA as renderSelfhostedFault, cB as requirePersistableReplacementSandboxEnvelope, cC as restoredSandboxSessionStateFromEntry, cD as runCredentialPointerFile, cE as runCredentialRoot, cF as runWithToolCallCorrelation, cG as sandboxStateEntryFromRunState, cH as sanitizeOpIdToken, cI as selectBackend, cJ as selfhostedFaultClass, cK as selfhostedLiveness, cL as selfhostedRetryBackoffMs, cM as serializeEstablishedSandboxEnvelope, cN as serializeReplacementSandboxEnvelope, cO as setSelfhostedApplyDiff, cP as startRecording, cQ as stopRecording, cR as stripExecBanner, cS as subjectFor, cT as swapTargetEstablishability, cU as sweepModalOrphanSandboxes, cV as tagModalSandbox, cW as tearDownDisplayStack, cX as tearDownTerminalServer, cY as terminateModalSandboxById, cZ as timeoutAgentError, c_ as timeoutControlResponse, c$ as toolspaceTokenFileForSession, d0 as toolspaceTokenFileFromEnvironment, d1 as uploadRecordingArtifact, d2 as verifyRestoredWorkspace, d3 as verifySandboxExecReadiness, d4 as verifyStreamToken, d5 as withRunCredentialEnvironment, d6 as withRunCredentialsClient, d7 as withRunCredentialsSession, d8 as withToolspaceTokenClient, d9 as withToolspaceTokenEnvironment, da as withToolspaceTokenSession } from '../index-Ciehex_q.js';
 import 'modal';
 import '@opengeni/agent-proto';

package/dist/sandbox/index.js

@@ -170,7 +170,7 @@ import {
   withToolspaceTokenClient,
   withToolspaceTokenEnvironment,
   withToolspaceTokenSession
-} from "../chunk-JGUQSAG5.js";
+} from "../chunk-RHB7ETON.js";
 import "../chunk-4YJ5Z52Z.js";
 import "../chunk-K4V4QYCL.js";
 import "../chunk-PZ5AY32C.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/runtime",
-  "version": "0.13.3",
+  "version": "0.13.10",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -50,8 +50,8 @@
     "@openai/agents-extensions": "0.13.3",
     "@opengeni/agent-proto": "^0.3.0",
     "@opengeni/codex": "^0.2.7",
-    "@opengeni/config": "^0.7.0",
-    "@opengeni/contracts": "^0.19.0",
+    "@opengeni/config": "^0.7.6",
+    "@opengeni/contracts": "^0.19.4",
     "@opengeni/network": "^0.1.1",
     "debug": "4.4.3",
     "modal": "0.7.6",

package/src/bundled_hashicorp_terraform_skills/terraform-stacks/references/troubleshooting.md

@@ -438,7 +438,7 @@ component "vpc" {
 
 # Incorrect (absolute paths don't work)
 component "vpc" {
-  source = "/Users/username/project/modules/vpc"
+  source = "/path/to/project/modules/vpc"
 }
 ```
 

package/src/codex-tool-search.ts

@@ -1,14 +1,14 @@
-// Progressive connector disclosure for the ChatGPT/Codex backend — parity with
-// how the Codex CLI surfaces its ~217 `codex_apps` connector tools WITHOUT paying
-// their schemas in every turn's context.
+// Progressive MCP disclosure for the ChatGPT/Codex backend — parity with how the
+// Codex CLI surfaces its ~217 `codex_apps` connector tools WITHOUT paying their
+// schemas in every turn's context, while applying the same bounded search seam to
+// other selected MCP servers.
 //
-// WHY. OpenGeni connects the codex_apps MCP server as a CLIENT and the SDK
-// materializes EVERY connector tool as a `function` tool in request.tools[] on
-// every codex turn (~217 tools ≈ tens of thousands of context tokens). The Codex
-// CLI instead uses the backend's NATIVE tool-search: the model gets one compact
-// search tool + all connector tools flagged `defer_loading:true` (schemas dropped
-// from model context), searches by capability, and only the matched tools are
-// disclosed back and become callable.
+// WHY. OpenGeni connects MCP servers as CLIENTs and the SDK materializes every
+// selected MCP tool as a `function` tool in request.tools[] on a Codex turn. The
+// Codex CLI instead uses the backend's NATIVE tool-search: the model gets one
+// compact search tool + deferred MCP tools (schemas dropped from model context),
+// searches by capability, and only matched tools are disclosed back and become
+// callable.
 //
 // PROVEN LIVE (Phase 0 probe against /codex/responses on gpt-5.6-sol): the backend
 // HONORS `defer_loading:true` on function tools — 50 fat tools dropped input_tokens
@@ -16,19 +16,22 @@
 // disclosed it (V3). The model emits `tool_search_call` on our slug.
 //
 // HOW. We wrap the agent's `getAllTools` (codex turns only, flag-gated): tag every
-// `codex_apps__*` function tool `deferLoading = true` (converTool then serializes
+// non-mandatory MCP function tool `deferLoading = true` (converTool then serializes
 // `defer_loading:true`, dropping the schema from context) and append one
 // client-executed `toolSearchTool`. The SDK routes a `tool_search_call` to our
 // executor (ClientToolSearchExecutor), which BM25-ranks the deferred pool and
-// returns the matched tools BY REFERENCE — the SDK emits the `tool_search_output`
-// that discloses them; the subsequent `function_call` resolves through the normal
-// PrefixedMcpServer.callTool path (auth + name-sanitize + structuredContent inline
-// all unchanged). Invocation is untouched; only the wire tool-set shrinks.
+// returns matched tools BY REFERENCE — the SDK emits the `tool_search_output` that
+// discloses them; the subsequent `function_call` resolves through the normal
+// `PrefixedMcpServer.callTool` path (auth + name-sanitize + structuredContent
+// inline all unchanged). Invocation is untouched; only the wire tool-set shrinks.
 
 import { toolSearchTool, type Tool } from "@openai/agents";
 import {
   MCP_MAX_TOOL_DEFINITION_BYTES,
+  MCP_MAX_TOOL_SEARCH_DESCRIPTION_BYTES,
   MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES,
+  MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH,
+  MCP_MAX_TOOL_SEARCH_SOURCES,
   mcpSerializedSizeBytes,
 } from "./mcp-network";
 
@@ -50,6 +53,91 @@ export function isCodexAppsFunctionTool(
   );
 }
 
+const MCP_TOOL_NAME_SEPARATOR = "__";
+const MANDATORY_FIRST_PARTY_MCP_SERVER_ID = "opengeni";
+const NO_MCP_SERVER_IDS: ReadonlySet<string> = new Set();
+
+/** Return the authorized server id for a runtime MCP function tool name. */
+function mcpServerIdForTool(tool: unknown, mcpServerIds: ReadonlySet<string>): string | null {
+  if (!tool || typeof tool !== "object") return null;
+  if ((tool as { type?: unknown }).type !== "function") return null;
+  const name = (tool as { name?: unknown }).name;
+  if (typeof name !== "string") return null;
+  let match: string | null = null;
+  for (const serverId of mcpServerIds) {
+    if (
+      typeof serverId !== "string" ||
+      serverId.length === 0 ||
+      !name.startsWith(`${serverId}${MCP_TOOL_NAME_SEPARATOR}`)
+    ) {
+      continue;
+    }
+    if (match === null || serverId.length > match.length) {
+      match = serverId;
+    }
+  }
+  return match;
+}
+
+/**
+ * True for non-mandatory MCP function tools on the effective agent surface.
+ * The prefix is the same runtime namespace used by PrefixedMcpServer; this
+ * intentionally does not inspect the global registry, connection metadata, or
+ * credentials, so search cannot widen the already-authorized tool set.
+ */
+export function isSearchableMcpFunctionTool(
+  tool: unknown,
+  mcpServerIds: ReadonlySet<string> = NO_MCP_SERVER_IDS,
+): tool is Tool & { name: string; deferLoading?: boolean } {
+  const serverId = mcpServerIdForTool(tool, mcpServerIds);
+  return serverId !== null && serverId !== MANDATORY_FIRST_PARTY_MCP_SERVER_ID;
+}
+
+function truncateUtf8(value: string, maxBytes: number): string {
+  if (Buffer.byteLength(value) <= maxBytes) return value;
+  let output = "";
+  for (const character of value) {
+    const candidate = output + character;
+    if (Buffer.byteLength(candidate) > maxBytes) break;
+    output = candidate;
+  }
+  return output;
+}
+
+function searchSourceForTool(tool: Tool, mcpServerIds: ReadonlySet<string>): string | null {
+  const serverId = mcpServerIdForTool(tool, mcpServerIds);
+  return serverId && serverId !== MANDATORY_FIRST_PARTY_MCP_SERVER_ID
+    ? truncateUtf8(serverId, MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH)
+    : null;
+}
+
+function searchSourcesForTools(
+  connectorNamespaces: ReadonlySet<string>,
+  tools: readonly Tool[],
+  mcpServerIds: ReadonlySet<string>,
+): Set<string> {
+  const sources = new Set<string>();
+  for (const source of connectorNamespaces) {
+    if (typeof source !== "string" || source.length === 0) continue;
+    if (sources.size >= MCP_MAX_TOOL_SEARCH_SOURCES) break;
+    sources.add(truncateUtf8(source, MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH));
+  }
+  for (const tool of tools) {
+    // Codex connector labels come from the transport's original namespace set
+    // (for example, `gmail`), not from the synthetic `codex_apps__` prefix.
+    // Keep that authoritative path intact; derive fallback labels only for
+    // directly materialized non-Codex MCP tools such as selected Slack tools.
+    const source =
+      isSearchableMcpFunctionTool(tool, mcpServerIds) && !isCodexAppsFunctionTool(tool)
+        ? searchSourceForTool(tool, mcpServerIds)
+        : null;
+    if (!source || sources.has(source)) continue;
+    if (sources.size >= MCP_MAX_TOOL_SEARCH_SOURCES) break;
+    sources.add(source);
+  }
+  return sources;
+}
+
 // Minimal English stopword set: query phrasings like "send an email to someone"
 // should match on capability words, not drown in glue words (parity with
 // codex-rs, whose search normalizes tokens server-side).
@@ -211,11 +299,23 @@ export function renderSearchToolDescription(connectorNamespaces: ReadonlySet<str
     "rather than guessing exact tool names. Returns the matching connector tools, which then become callable.";
   const sources = Array.from(connectorNamespaces)
     .filter((n) => typeof n === "string" && n.length > 0)
+    .slice(0, MCP_MAX_TOOL_SEARCH_SOURCES)
+    .map((source) => truncateUtf8(source, MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH))
+    .filter(Boolean)
     .sort();
   if (sources.length === 0) {
     return `${base}\nConnected sources: none currently available.`;
   }
-  return `${base}\nYou have access to tools from the following sources:\n${sources.map((s) => `- ${s}`).join("\n")}`;
+  const header = `${base}\nYou have access to tools from the following sources:`;
+  const lines: string[] = [];
+  for (const source of sources) {
+    const candidate = `${header}${[...lines, `- ${source}`].map((line) => `\n${line}`).join("")}`;
+    if (Buffer.byteLength(candidate) > MCP_MAX_TOOL_SEARCH_DESCRIPTION_BYTES) break;
+    lines.push(`- ${source}`);
+  }
+  return lines.length > 0
+    ? `${header}\n${lines.join("\n")}`
+    : `${base}\nConnected sources: none currently available.`;
 }
 
 const SEARCH_TOOL_PARAMETERS = {
@@ -232,16 +332,21 @@ const SEARCH_TOOL_PARAMETERS = {
 } as const;
 
 /**
- * The client tool-search executor: BM25 over the deferred codex_apps pool from the
+ * The client tool-search executor: BM25 over the deferred MCP pool from the
  * turn's live `availableTools`, returning matched tools BY REFERENCE (the only legal
  * return — the SDK emits the disclosing `tool_search_output` and flips the loaded
  * gate; returning copies would throw). Stateless — reads the pool per call.
  */
-function codexToolSearchExecutor(args: {
-  availableTools?: Tool[];
-  toolCall?: { arguments?: unknown };
-}): Tool[] {
-  const deferred = (args.availableTools ?? []).filter(isCodexAppsFunctionTool);
+function codexToolSearchExecutor(
+  args: {
+    availableTools?: Tool[];
+    toolCall?: { arguments?: unknown };
+  },
+  mcpServerIds: ReadonlySet<string>,
+): Tool[] {
+  const deferred = (args.availableTools ?? []).filter((tool) =>
+    isSearchableMcpFunctionTool(tool, mcpServerIds),
+  );
   if (deferred.length === 0) return [];
   const { query, limit } = parseSearchArgs(args.toolCall?.arguments);
   const ranked = bm25RankTools(deferred, query, limit);
@@ -320,20 +425,28 @@ function resolveSearchToolDescription(
 }
 
 /** Build the client-executed tool_search tool from an already-rendered description. */
-function buildCodexToolSearchToolFromDescription(description: string): Tool {
+function buildCodexToolSearchToolFromDescription(
+  description: string,
+  mcpServerIds: ReadonlySet<string>,
+): Tool {
   return toolSearchTool({
     execution: "client",
     description,
     parameters: SEARCH_TOOL_PARAMETERS as unknown as Record<string, unknown>,
-    execute: codexToolSearchExecutor as never,
+    execute: ((args: Parameters<typeof codexToolSearchExecutor>[0]) =>
+      codexToolSearchExecutor(args, mcpServerIds)) as never,
   }) as unknown as Tool;
 }
 
-/** Build the client-executed tool_search tool that discloses codex_apps connectors on demand. */
+/** Build the client-executed tool_search tool that discloses deferred MCP tools on demand. */
 export function buildCodexToolSearchTool(
   connectorNamespaces: ReadonlySet<string> = NO_NAMESPACES,
+  mcpServerIds: ReadonlySet<string> = NO_MCP_SERVER_IDS,
 ): Tool {
-  return buildCodexToolSearchToolFromDescription(renderSearchToolDescription(connectorNamespaces));
+  return buildCodexToolSearchToolFromDescription(
+    renderSearchToolDescription(connectorNamespaces),
+    mcpServerIds,
+  );
 }
 
 /** True for the built-in tool_search tool (so we never add a second one). */
@@ -343,15 +456,15 @@ function isToolSearchTool(tool: unknown): boolean {
 }
 
 /**
- * The transform applied to a turn's resolved tool list: tag every codex_apps
- * connector function tool `deferLoading = true`, and — unless one is already
+ * The transform applied to a turn's resolved tool list: tag every searchable
+ * non-mandatory MCP function tool `deferLoading = true`, and — unless one is already
  * present — append the client tool_search tool. Pure (mutates the passed tools +
  * returns the possibly-extended array); the SDK's `getTools` gate requires a
  * tool_search whenever a deferred tool is present, which appending here satisfies
  * in the same request.
  *
  * The search tool is appended UNCONDITIONALLY (even when the turn has no
- * codex_apps tools, e.g. the best-effort codex_apps connect was dropped this
+ * searchable MCP tools, e.g. a best-effort connector was dropped this
  * turn): a prior turn's history may carry tool_search_call/output items, and
  * replaying those without a tool_search tool in the request risks a backend
  * reject; a search over an empty pool simply discloses nothing. The description
@@ -362,10 +475,11 @@ export function applyCodexToolSearch(
   tools: Tool[],
   connectorNamespaces: ReadonlySet<string> = NO_NAMESPACES,
   descriptionFreeze?: CodexToolSearchDescriptionFreeze,
+  mcpServerIds: ReadonlySet<string> = NO_MCP_SERVER_IDS,
 ): Tool[] {
   for (const tool of tools) {
     if (
-      isCodexAppsFunctionTool(tool) &&
+      isSearchableMcpFunctionTool(tool, mcpServerIds) &&
       (tool as { deferLoading?: boolean }).deferLoading !== true
     ) {
       (tool as { deferLoading?: boolean }).deferLoading = true;
@@ -376,8 +490,11 @@ export function applyCodexToolSearch(
   }
   // AM-8: render through the per-turn freeze so the tools-block prefix stays
   // byte-stable across a turn's model calls once connectors are discovered.
-  const description = resolveSearchToolDescription(connectorNamespaces, descriptionFreeze);
-  return [...tools, buildCodexToolSearchToolFromDescription(description)];
+  const description = resolveSearchToolDescription(
+    searchSourcesForTools(connectorNamespaces, tools, mcpServerIds),
+    descriptionFreeze,
+  );
+  return [...tools, buildCodexToolSearchToolFromDescription(description, mcpServerIds)];
 }
 
 type CloneCapableAgent = {
@@ -386,11 +503,11 @@ type CloneCapableAgent = {
 };
 
 /**
- * Install progressive connector disclosure on a codex-path agent by wrapping
+ * Install progressive MCP disclosure on a Codex-path agent by wrapping
  * `getAllTools` so every per-model-call tool resolution runs
  * {@link applyCodexToolSearch}. Idempotent-per-call (re-tags each
  * freshly-materialized MCP tool under cacheToolsList:false). Gated by the caller
- * (flag + codex path).
+ * (flag + Codex path).
  *
  * CLONE SURVIVAL (the part that makes this work on the REAL sandbox path): the
  * SDK's sandbox runtime routes EVERY model call through
@@ -408,17 +525,19 @@ type CloneCapableAgent = {
 export function installCodexToolSearch(
   agent: CloneCapableAgent,
   connectorNamespaces: ReadonlySet<string> = NO_NAMESPACES,
+  mcpServerIds: ReadonlySet<string> = NO_MCP_SERVER_IDS,
 ): void {
   // ONE freeze cell per install (i.e. per turn), shared BY REFERENCE into every
   // clone re-install below so the whole turn — the built agent and every clone the
   // sandbox runtime resolves tools on — agrees on the same frozen description
   // (AM-8). Created here, at the top-level install, never per clone.
-  installCodexToolSearchWithFreeze(agent, connectorNamespaces, { value: null });
+  installCodexToolSearchWithFreeze(agent, connectorNamespaces, mcpServerIds, { value: null });
 }
 
 function installCodexToolSearchWithFreeze(
   agent: CloneCapableAgent,
   connectorNamespaces: ReadonlySet<string>,
+  mcpServerIds: ReadonlySet<string>,
   descriptionFreeze: CodexToolSearchDescriptionFreeze,
 ): void {
   const originalGetAllTools = agent.getAllTools.bind(agent);
@@ -427,12 +546,18 @@ function installCodexToolSearchWithFreeze(
       await originalGetAllTools(runContext),
       connectorNamespaces,
       descriptionFreeze,
+      mcpServerIds,
     )) as typeof agent.getAllTools;
   const originalClone = agent.clone?.bind(agent);
   if (originalClone) {
     const cloneWithToolSearch: NonNullable<CloneCapableAgent["clone"]> = (config: unknown) => {
       const cloned = originalClone(config);
-      installCodexToolSearchWithFreeze(cloned, connectorNamespaces, descriptionFreeze);
+      installCodexToolSearchWithFreeze(
+        cloned,
+        connectorNamespaces,
+        mcpServerIds,
+        descriptionFreeze,
+      );
       return cloned;
     };
     agent.clone = cloneWithToolSearch;