@opengeni/runtime 0.13.4 → 0.13.10

package/dist/index.js

@@ -175,7 +175,7 @@ import {
   withToolspaceTokenEnvironment,
   withToolspaceTokenSession,
   wrapCapabilityToolsForTurnCancellation
-} from "./chunk-JGUQSAG5.js";
+} from "./chunk-RHB7ETON.js";
 import {
   getSkillLibraryEntry,
   isSkillLibraryEntryId,
@@ -186,7 +186,10 @@ import {
   MCP_MAX_CONCURRENT_SERVER_OPERATIONS,
   MCP_MAX_TOOL_DEFINITION_BYTES,
   MCP_MAX_TOOL_RESULT_BYTES,
+  MCP_MAX_TOOL_SEARCH_DESCRIPTION_BYTES,
   MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES,
+  MCP_MAX_TOOL_SEARCH_SOURCES,
+  MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH,
   McpAggregateToolListBudget,
   assertMcpPayloadWithinBytes,
   assertMcpServerSelectionWithinBounds,
@@ -272,6 +275,7 @@ import {
   normalizeResourceMountPath,
   prefixedMcpToolName as sharedPrefixedMcpToolName,
   resourceMountPath,
+  redactSensitiveText as redactSensitiveText2,
   sessionEventMediaPreview,
   sessionEventMediaPreviewFromDataUrl,
   signDelegatedAccessToken,
@@ -6883,6 +6887,58 @@ var MAX_SEARCH_LIMIT = 20;
 function isCodexAppsFunctionTool(tool2) {
   return !!tool2 && typeof tool2 === "object" && tool2.type === "function" && typeof tool2.name === "string" && tool2.name.startsWith(CODEX_APPS_TOOL_PREFIX);
 }
+var MCP_TOOL_NAME_SEPARATOR = "__";
+var MANDATORY_FIRST_PARTY_MCP_SERVER_ID = "opengeni";
+var NO_MCP_SERVER_IDS = /* @__PURE__ */ new Set();
+function mcpServerIdForTool(tool2, mcpServerIds) {
+  if (!tool2 || typeof tool2 !== "object") return null;
+  if (tool2.type !== "function") return null;
+  const name = tool2.name;
+  if (typeof name !== "string") return null;
+  let match = null;
+  for (const serverId of mcpServerIds) {
+    if (typeof serverId !== "string" || serverId.length === 0 || !name.startsWith(`${serverId}${MCP_TOOL_NAME_SEPARATOR}`)) {
+      continue;
+    }
+    if (match === null || serverId.length > match.length) {
+      match = serverId;
+    }
+  }
+  return match;
+}
+function isSearchableMcpFunctionTool(tool2, mcpServerIds = NO_MCP_SERVER_IDS) {
+  const serverId = mcpServerIdForTool(tool2, mcpServerIds);
+  return serverId !== null && serverId !== MANDATORY_FIRST_PARTY_MCP_SERVER_ID;
+}
+function truncateUtf8(value, maxBytes) {
+  if (Buffer.byteLength(value) <= maxBytes) return value;
+  let output = "";
+  for (const character of value) {
+    const candidate = output + character;
+    if (Buffer.byteLength(candidate) > maxBytes) break;
+    output = candidate;
+  }
+  return output;
+}
+function searchSourceForTool(tool2, mcpServerIds) {
+  const serverId = mcpServerIdForTool(tool2, mcpServerIds);
+  return serverId && serverId !== MANDATORY_FIRST_PARTY_MCP_SERVER_ID ? truncateUtf8(serverId, MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH) : null;
+}
+function searchSourcesForTools(connectorNamespaces, tools, mcpServerIds) {
+  const sources = /* @__PURE__ */ new Set();
+  for (const source of connectorNamespaces) {
+    if (typeof source !== "string" || source.length === 0) continue;
+    if (sources.size >= MCP_MAX_TOOL_SEARCH_SOURCES) break;
+    sources.add(truncateUtf8(source, MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH));
+  }
+  for (const tool2 of tools) {
+    const source = isSearchableMcpFunctionTool(tool2, mcpServerIds) && !isCodexAppsFunctionTool(tool2) ? searchSourceForTool(tool2, mcpServerIds) : null;
+    if (!source || sources.has(source)) continue;
+    if (sources.size >= MCP_MAX_TOOL_SEARCH_SOURCES) break;
+    sources.add(source);
+  }
+  return sources;
+}
 var STOPWORDS = /* @__PURE__ */ new Set([
   "a",
   "an",
@@ -6987,14 +7043,23 @@ function parseSearchArgs(raw) {
 }
 function renderSearchToolDescription(connectorNamespaces) {
   const base = `Search the user's connected app tools by capability. Describe in plain language WHAT you need to do (for example: "send an email", "create a calendar event") rather than guessing exact tool names. Returns the matching connector tools, which then become callable.`;
-  const sources = Array.from(connectorNamespaces).filter((n) => typeof n === "string" && n.length > 0).sort();
+  const sources = Array.from(connectorNamespaces).filter((n) => typeof n === "string" && n.length > 0).slice(0, MCP_MAX_TOOL_SEARCH_SOURCES).map((source) => truncateUtf8(source, MCP_MAX_TOOL_SEARCH_SOURCE_LABEL_LENGTH)).filter(Boolean).sort();
   if (sources.length === 0) {
     return `${base}
 Connected sources: none currently available.`;
   }
-  return `${base}
-You have access to tools from the following sources:
-${sources.map((s) => `- ${s}`).join("\n")}`;
+  const header = `${base}
+You have access to tools from the following sources:`;
+  const lines = [];
+  for (const source of sources) {
+    const candidate = `${header}${[...lines, `- ${source}`].map((line) => `
+${line}`).join("")}`;
+    if (Buffer.byteLength(candidate) > MCP_MAX_TOOL_SEARCH_DESCRIPTION_BYTES) break;
+    lines.push(`- ${source}`);
+  }
+  return lines.length > 0 ? `${header}
+${lines.join("\n")}` : `${base}
+Connected sources: none currently available.`;
 }
 var SEARCH_TOOL_PARAMETERS = {
   type: "object",
@@ -7008,8 +7073,10 @@ var SEARCH_TOOL_PARAMETERS = {
   required: ["query"],
   additionalProperties: false
 };
-function codexToolSearchExecutor(args) {
-  const deferred = (args.availableTools ?? []).filter(isCodexAppsFunctionTool);
+function codexToolSearchExecutor(args, mcpServerIds) {
+  const deferred = (args.availableTools ?? []).filter(
+    (tool2) => isSearchableMcpFunctionTool(tool2, mcpServerIds)
+  );
   if (deferred.length === 0) return [];
   const { query, limit } = parseSearchArgs(args.toolCall?.arguments);
   const ranked = bm25RankTools(deferred, query, limit);
@@ -7047,45 +7114,54 @@ function resolveSearchToolDescription(connectorNamespaces, freeze) {
   }
   return rendered;
 }
-function buildCodexToolSearchToolFromDescription(description) {
+function buildCodexToolSearchToolFromDescription(description, mcpServerIds) {
   return toolSearchTool({
     execution: "client",
     description,
     parameters: SEARCH_TOOL_PARAMETERS,
-    execute: codexToolSearchExecutor
+    execute: (args) => codexToolSearchExecutor(args, mcpServerIds)
   });
 }
 function isToolSearchTool(tool2) {
   const t = tool2;
   return !!t && (t.name === "tool_search" || t.providerData?.type === "tool_search");
 }
-function applyCodexToolSearch(tools, connectorNamespaces = NO_NAMESPACES, descriptionFreeze) {
+function applyCodexToolSearch(tools, connectorNamespaces = NO_NAMESPACES, descriptionFreeze, mcpServerIds = NO_MCP_SERVER_IDS) {
   for (const tool2 of tools) {
-    if (isCodexAppsFunctionTool(tool2) && tool2.deferLoading !== true) {
+    if (isSearchableMcpFunctionTool(tool2, mcpServerIds) && tool2.deferLoading !== true) {
       tool2.deferLoading = true;
     }
   }
   if (tools.some(isToolSearchTool)) {
     return tools;
   }
-  const description = resolveSearchToolDescription(connectorNamespaces, descriptionFreeze);
-  return [...tools, buildCodexToolSearchToolFromDescription(description)];
+  const description = resolveSearchToolDescription(
+    searchSourcesForTools(connectorNamespaces, tools, mcpServerIds),
+    descriptionFreeze
+  );
+  return [...tools, buildCodexToolSearchToolFromDescription(description, mcpServerIds)];
 }
-function installCodexToolSearch(agent, connectorNamespaces = NO_NAMESPACES) {
-  installCodexToolSearchWithFreeze(agent, connectorNamespaces, { value: null });
+function installCodexToolSearch(agent, connectorNamespaces = NO_NAMESPACES, mcpServerIds = NO_MCP_SERVER_IDS) {
+  installCodexToolSearchWithFreeze(agent, connectorNamespaces, mcpServerIds, { value: null });
 }
-function installCodexToolSearchWithFreeze(agent, connectorNamespaces, descriptionFreeze) {
+function installCodexToolSearchWithFreeze(agent, connectorNamespaces, mcpServerIds, descriptionFreeze) {
   const originalGetAllTools = agent.getAllTools.bind(agent);
   agent.getAllTools = async (runContext) => applyCodexToolSearch(
     await originalGetAllTools(runContext),
     connectorNamespaces,
-    descriptionFreeze
+    descriptionFreeze,
+    mcpServerIds
   );
   const originalClone = agent.clone?.bind(agent);
   if (originalClone) {
     const cloneWithToolSearch = (config) => {
       const cloned = originalClone(config);
-      installCodexToolSearchWithFreeze(cloned, connectorNamespaces, descriptionFreeze);
+      installCodexToolSearchWithFreeze(
+        cloned,
+        connectorNamespaces,
+        mcpServerIds,
+        descriptionFreeze
+      );
       return cloned;
     };
     agent.clone = cloneWithToolSearch;
@@ -7630,6 +7706,7 @@ import {
   PointerAction,
   PointerButton
 } from "@opengeni/agent-proto";
+import { redactSensitiveText } from "@opengeni/contracts";
 function requireBoundSession(capabilityType, session) {
   if (!session) {
     throw new ComputerUnavailableError(`capability "${capabilityType}" used before bind(session)`);
@@ -7783,7 +7860,7 @@ var SandboxComputer = class {
     const output = sandboxCommandOutput(result);
     if (sandboxCommandStillRunning(result)) {
       console.warn(
-        `[SandboxComputer] action command did not finish before the ${ACTION_YIELD_MS}ms yield window \u2014 proceeding to screenshot: ${cmd}`
+        `[SandboxComputer] action command did not finish before the ${ACTION_YIELD_MS}ms yield window \u2014 proceeding to screenshot: ${redactSensitiveText(cmd)}`
       );
       return output;
     }
@@ -8040,7 +8117,9 @@ var NativeDesktopComputer = class {
         break;
       }
     }
-    const reason = lastError instanceof Error ? lastError.message : String(lastError);
+    const reason = redactSensitiveText(
+      lastError instanceof Error ? lastError.message : String(lastError)
+    );
     console.warn(
       `[NativeDesktopComputer] screenshot failed after ${attempt} attempt(s): ${reason}`
     );
@@ -8750,6 +8829,8 @@ function rejectField(rejectedFields, field) {
 }
 
 // src/index.ts
+process.env.OPENAI_AGENTS_DONT_LOG_MODEL_DATA = "1";
+process.env.OPENAI_AGENTS_DONT_LOG_TOOL_DATA = "1";
 setSelfhostedApplyDiff(
   applyDiff
 );
@@ -9319,6 +9400,19 @@ function appendWorkspaceMemory(composed, workspaceMemory) {
 function appendToolspaceInstructions(composed, toolspaceAvailable) {
   return toolspaceAvailable ? `${composed} ${TOOLSPACE_PROGRAMMATIC_DIRECTIVE}` : composed;
 }
+var GIT_BINDING_DISCOVERY_DIRECTIVE = "This managed sandbox has multiple credential bindings for at least one Git provider. Native Git selects credentials from the repository remote. For gh, glab, or az, run inside the intended attached repository so its origin selects the binding; when running elsewhere, inspect $HOME/.opengeni/git-bindings.json and set OPENGENI_GIT_BINDING to the listed credentialBindingId. The inventory contains identifiers and repository routes, never credential values. A binding marked git_http_broker is Git-only, so use the configured provider MCP tools for provider API operations on it.";
+function appendGitCredentialBindingInstructions(composed, bindings, activeSandboxBackend) {
+  if (activeSandboxBackend === "selfhosted" || !bindings?.length) {
+    return composed;
+  }
+  const bindingsByProvider = /* @__PURE__ */ new Map();
+  for (const binding of bindings) {
+    const ids = bindingsByProvider.get(binding.provider) ?? /* @__PURE__ */ new Set();
+    ids.add(binding.credentialBindingId);
+    bindingsByProvider.set(binding.provider, ids);
+  }
+  return [...bindingsByProvider.values()].some((ids) => ids.size > 1) ? `${composed} ${GIT_BINDING_DISCOVERY_DIRECTIVE}` : composed;
+}
 function appendGenesisTitleDirective(instructions, genesisTitleHint) {
   return genesisTitleHint ? `${instructions} ${GENESIS_TITLE_DIRECTIVE}` : instructions;
 }
@@ -9333,7 +9427,7 @@ var agentActiveSandboxBackend = /* @__PURE__ */ new WeakMap();
 var agentRigSetup = /* @__PURE__ */ new WeakMap();
 var agentRigCredentialHooks = /* @__PURE__ */ new WeakMap();
 function mcpToolErrorOutput(error) {
-  const details = error instanceof Error ? error.message : String(error);
+  const details = redactSensitiveText2(error instanceof Error ? error.message : String(error));
   return {
     isError: true,
     content: [
@@ -9395,12 +9489,14 @@ function buildOpenGeniAgent(settings, resources, options = {}) {
     //      when a toolspace token was minted for this turn (feature enabled + a
     //      per-turn seed — the mint gate, which includes selfhosted turns since
     //      they now receive the token too) — appendToolspaceInstructions,
-    //   3. + workspace memory working set, ONLY when the workspace setting is on
+    //   3. + managed-sandbox Git binding discovery, ONLY when one provider has
+    //      multiple credential bindings,
+    //   4. + workspace memory working set, ONLY when the workspace setting is on
     //      and the worker resolved a nonblank block — appendWorkspaceMemory,
-    //   4. + the per-session persona instructions (session-specific, so it
+    //   5. + the per-session persona instructions (session-specific, so it
     //      refines both the workspace persona and the substrate note),
-    //   5. + host context for this exact turn, when supplied,
-    //   6. + durable session-setting state (title present + child notification
+    //   6. + host context for this exact turn, when supplied,
+    //   7. + durable session-setting state (title present + child notification
     //      mode), when supplied by the worker,
     // The genesis title directive is deliberately NOT part of this persistent
     // string. runAgentStream injects it into the first model call only.
@@ -9408,13 +9504,17 @@ function buildOpenGeniAgent(settings, resources, options = {}) {
       appendTurnInstructions(
         appendSessionInstructions(
           appendWorkspaceMemory(
-            appendToolspaceInstructions(
-              composeAgentInstructions(
-                options.instructionsTemplate ?? settings.agentInstructionsTemplate,
-                options.workspaceEnvironment,
-                options.rig
+            appendGitCredentialBindingInstructions(
+              appendToolspaceInstructions(
+                composeAgentInstructions(
+                  options.instructionsTemplate ?? settings.agentInstructionsTemplate,
+                  options.workspaceEnvironment,
+                  options.rig
+                ),
+                settings.toolspaceEnabled && Boolean(options.toolspaceTokenSeed)
               ),
-              settings.toolspaceEnabled && Boolean(options.toolspaceTokenSeed)
+              options.gitCredentialBindings,
+              options.activeSandboxBackend
             ),
             options.workspaceMemory
           ),
@@ -9533,9 +9633,15 @@ function buildOpenGeniAgent(settings, resources, options = {}) {
 }
 function maybeInstallCodexToolSearch(agent, settings, options) {
   if (settings.codexToolSearchEnabled && options.structuredToolTransport === false) {
+    const mcpServers = options.mcpServers ?? [];
+    for (const server of mcpServers) {
+      if (server.name === "opengeni") continue;
+      server.deferModelToolSchemaAccounting?.();
+    }
     installCodexToolSearch(
       agent,
-      options.codexConnectorNamespaces ?? /* @__PURE__ */ new Set()
+      options.codexConnectorNamespaces ?? /* @__PURE__ */ new Set(),
+      new Set(mcpServers.map((server) => server.name))
     );
   }
 }
@@ -9754,6 +9860,10 @@ async function prepareAgentTools(settings, tools, options = {}) {
           url,
           name: config.name ?? config.id,
           cacheToolsList: config.cacheToolsList,
+          // The upstream transport logger receives raw thrown errors, whose
+          // messages may contain response bodies, URLs, headers, or echoed
+          // credentials. Keep its diagnostic surface structural only.
+          logger: safeMcpTransportLogger(config.id),
           // codex_apps returns connector tools with empty `outputSchema: {}` that the
           // MCP SDK's strict Tool schema rejects (fails the turn during tools/list);
           // sanitize the response on the wire before validation. The namespace Set
@@ -9813,7 +9923,7 @@ async function prepareAgentTools(settings, tools, options = {}) {
       const error = connectedBestEffort.errors.get(failed);
       console.warn(
         `[mcp] optional server "${failed.name}" failed to connect/list tools; skipping it for this turn`,
-        error instanceof Error ? error.message : error
+        safeMcpErrorFields(error)
       );
     }
   }
@@ -10093,6 +10203,41 @@ function safeMcpErrorFields(error) {
   }
   return { errorClass, status };
 }
+function safeMcpTransportError(error) {
+  const fields = safeMcpErrorFields(error);
+  const safeError = new Error(
+    `MCP transport operation failed (${mcpErrorReason(fields)})`
+  );
+  safeError.name = "McpTransportError";
+  if (fields.status !== void 0) {
+    safeError.status = fields.status;
+    safeError.code = fields.status;
+  }
+  return safeError;
+}
+function safeMcpTransportLogger(serverId) {
+  const logFailure = (_message, ...args) => {
+    let error;
+    for (let index = args.length - 1; index >= 0; index -= 1) {
+      if (args[index] instanceof Error) {
+        error = args[index];
+        break;
+      }
+    }
+    console.warn("[mcp] transport operation failed", {
+      serverId,
+      ...safeMcpErrorFields(error)
+    });
+  };
+  return {
+    namespace: "opengeni:mcp-transport",
+    debug: () => void 0,
+    error: logFailure,
+    warn: logFailure,
+    dontLogModelData: true,
+    dontLogToolData: true
+  };
+}
 function mcpErrorReason(fields) {
   return fields.status === void 0 ? fields.errorClass : `${fields.errorClass} ${fields.status}`;
 }
@@ -10271,8 +10416,11 @@ var PrefixedMcpServer = class {
   bestEffort;
   loggedListToolsFailure = false;
   listedToolSchemaTokens = 0;
+  modelToolSchemaAccountingDeferred = false;
   connect() {
-    return this.inner.connect();
+    return this.inner.connect().catch((error) => {
+      throw safeMcpTransportError(error);
+    });
   }
   close() {
     this.releaseAggregateBudget();
@@ -10310,7 +10458,15 @@ var PrefixedMcpServer = class {
   }
   /** Latest exact tools/list projection used to build the model request. */
   modelToolSchemaTokens() {
-    return this.listedToolSchemaTokens;
+    return this.modelToolSchemaAccountingDeferred ? 0 : this.listedToolSchemaTokens;
+  }
+  /**
+   * Keep model-input accounting aligned with Codex `defer_loading`: the full
+   * schema is not provider context until a tool_search_output discloses it.
+   * Instances are turn-local, so this cannot leak into a non-Codex turn.
+   */
+  deferModelToolSchemaAccounting() {
+    this.modelToolSchemaAccountingDeferred = true;
   }
   async callTool(toolName, args, meta) {
     const unprefixed = this.unprefixToolName(toolName);
@@ -11641,6 +11797,7 @@ function sandboxFileDownloadCommand(download, targetPath) {
   const targetDir = posixPath.dirname(targetPath);
   const tmpPath = `${targetPath}.opengeni-download-$$`;
   return [
+    "set +x",
     "set -eu",
     `mkdir -p -- ${shellQuote(targetDir)}`,
     `if [ ! -f ${shellQuote(targetPath)} ]; then`,
@@ -11896,10 +12053,51 @@ function runtimeGitBindingDescriptors(resources) {
       protocol: url.protocol.replace(/:$/, "").toLowerCase(),
       host: url.host.toLowerCase(),
       path,
-      uri: resource.uri
+      uri: resource.uri,
+      mountPath: `/workspace/${resourceMountPath(resource)}`
     };
   });
 }
+function gitCredentialBindingInventoryCommandLines(resources, bindings) {
+  const bindingTransports = new Map(
+    bindings.map((binding) => [
+      gitCredentialBindingKey(binding.provider, binding.credentialBindingId),
+      binding.transport?.kind === "http_broker" ? "git_http_broker" : "direct_token"
+    ])
+  );
+  const entries = /* @__PURE__ */ new Map();
+  for (const descriptor of runtimeGitBindingDescriptors(resources)) {
+    const key = gitCredentialBindingKey(descriptor.provider, descriptor.credentialBindingId);
+    const transport = bindingTransports.get(key);
+    if (!transport) continue;
+    const entry = entries.get(key) ?? {
+      credentialBindingId: descriptor.credentialBindingId,
+      provider: descriptor.provider,
+      transport,
+      repositories: []
+    };
+    entry.repositories.push({ uri: descriptor.uri, mountPath: descriptor.mountPath });
+    entries.set(key, entry);
+  }
+  const inventory = `${JSON.stringify(
+    {
+      version: 1,
+      bindings: [...entries.values()]
+    },
+    null,
+    2
+  )}
+`;
+  return [
+    'git_binding_inventory="${OPENGENI_GIT_BINDINGS_FILE:-$HOME/.opengeni/git-bindings.json}"',
+    'mkdir -p "$(dirname "$git_binding_inventory")"',
+    'inventory_umask="$(umask)"',
+    "umask 077",
+    `printf '%s' ${shellQuote(inventory)} > "$git_binding_inventory.tmp.$$"`,
+    'mv -f "$git_binding_inventory.tmp.$$" "$git_binding_inventory"',
+    'umask "$inventory_umask"'
+  ];
+}
 function gitCredentialBindingKey(provider, credentialBindingId) {
   return `${provider}\0${credentialBindingId}`;
 }
@@ -12170,6 +12368,7 @@ function gitCredentialHelperCommandLines(resources = [], bindings = []) {
   const brokerOnlyProviders = [...providerBindingKinds.entries()].filter(([, counts]) => counts.brokered > 0 && counts.direct === 0).map(([provider]) => provider);
   return [
     ...gitCredentialTokenWriterCommandLines(bindings),
+    ...gitCredentialBindingInventoryCommandLines(resources, bindings),
     // Provision git/provider-CLI helpers at SETUP (runtime) before any clone
     // runs. Renewal updates only token files and deliberately leaves these
     // repository-specific host mappings intact.
@@ -12332,7 +12531,7 @@ function gitCredentialHelperCommandLines(resources = [], bindings = []) {
     `      *" $provider "*) printf '%s\\n' "$tool provider API authentication is host-brokered for this session; use the configured provider MCP tools" >&2; exit 2 ;;`,
     "    esac",
     '    case " $multi_binding_providers " in',
-    `      *" $provider "*) printf '%s\\n' "Unable to select one of multiple $provider credentials; run inside an attached repository or set OPENGENI_GIT_BINDING" >&2; exit 2 ;;`,
+    `      *" $provider "*) printf '%s\\n' "Unable to select one of multiple $provider credentials; run inside an attached repository, or inspect \${OPENGENI_GIT_BINDINGS_FILE:-$HOME/.opengeni/git-bindings.json} and set OPENGENI_GIT_BINDING" >&2; exit 2 ;;`,
     "    esac",
     '    case "$provider" in',
     '      github) token_file="${OPENGENI_GIT_TOKEN_FILE:-$HOME/.opengeni/git-token}" ;;',
@@ -12377,6 +12576,7 @@ function gitProviderTokenRefreshCommand(seeds) {
     return "";
   }
   return [
+    "set +x",
     seedPrefix,
     "set -eu",
     'export HOME="${HOME:-/workspace}"',
@@ -12387,6 +12587,7 @@ function gitCredentialBindingTokenRefreshCommand(bindings) {
   const seedPrefix = gitCredentialBindingSeedExportPrefix(bindings);
   if (!seedPrefix) return "";
   return [
+    "set +x",
     seedPrefix,
     "set -eu",
     'export HOME="${HOME:-/workspace}"',
@@ -12428,6 +12629,7 @@ async function refreshGitCredentialBindingTokenFiles(session, bindings, options
 function repositoryCloneCommand(resources, bindings = []) {
   assertUniqueResourceMountPaths(resources);
   const commands = [
+    "set +x",
     "set -eu",
     'export HOME="${HOME:-/workspace}"',
     'export GIT_TERMINAL_PROMPT="${GIT_TERMINAL_PROMPT:-0}"',
@@ -12534,6 +12736,7 @@ function repositoryCloneCommand(resources, bindings = []) {
 }
 function toolspaceTokenSeedCommand(options = {}) {
   return [
+    "set +x",
     "set -eu",
     'export HOME="${HOME:-/workspace}"',
     'if [ -n "${OPENGENI_TOOLSPACE_TOKEN_SEED:-}" ]; then',
@@ -12555,7 +12758,8 @@ async function runToolspaceTokenSeedHook(session, context) {
   if (!context.toolspaceTokenSeed) {
     return;
   }
-  const command = `export OPENGENI_TOOLSPACE_TOKEN_SEED=${shellQuote(context.toolspaceTokenSeed)}
+  const command = `set +x
+export OPENGENI_TOOLSPACE_TOKEN_SEED=${shellQuote(context.toolspaceTokenSeed)}
 ${toolspaceTokenSeedCommand(
     {
       ...context.toolspaceTokenFile ? { tokenFile: context.toolspaceTokenFile } : {},
@@ -12576,7 +12780,8 @@ ${toolspaceTokenSeedCommand(
   assertSandboxCommandSucceeded(result, "Toolspace token seed hook");
 }
 async function refreshToolspaceTokenFile(session, token, options = {}) {
-  const command = `export OPENGENI_TOOLSPACE_TOKEN_SEED=${shellQuote(token)}
+  const command = `set +x
+export OPENGENI_TOOLSPACE_TOKEN_SEED=${shellQuote(token)}
 ${toolspaceTokenSeedCommand(
     {
       ...options.tokenFile ? { tokenFile: options.tokenFile } : {},
@@ -12724,7 +12929,8 @@ async function runRepositoryCloneHook(session, resources, context = { environmen
       gitCredentialBindingSeedExportPrefix(gitCredentialBindings)
     ].filter(Boolean).join("\n");
     const cloneCommand = repositoryCloneCommand(resources, gitCredentialBindings);
-    const command = seedPrefix ? `${seedPrefix}
+    const command = seedPrefix ? `set +x
+${seedPrefix}
 ${cloneCommand}` : cloneCommand;
     const result = await runSandboxLifecycleCommand(
       session,
@@ -12755,6 +12961,7 @@ ${cloneCommand}` : cloneCommand;
 }
 function azureCliLoginCommand() {
   return [
+    "set +x",
     'export HOME="${HOME:-/workspace}"',
     'mkdir -p "$HOME/.azure"',
     'CLIENT_ID="${AZURE_CLIENT_ID:-${ARM_CLIENT_ID:-}}"',
@@ -13235,6 +13442,7 @@ export {
   agentErrorToControlError,
   agentsErrorRunState,
   appendGenesisTitleDirective,
+  appendGitCredentialBindingInstructions,
   appendPersistentSessionSettings,
   appendSessionInstructions,
   appendToolspaceInstructions,