@opengeni/runtime 0.14.0 → 0.14.1

package/dist/sandbox/index.js

@@ -170,7 +170,7 @@ import {
   withToolspaceTokenClient,
   withToolspaceTokenEnvironment,
   withToolspaceTokenSession
-} from "../chunk-3NUSY22C.js";
+} from "../chunk-HHWIZHQM.js";
 import "../chunk-4YJ5Z52Z.js";
 import "../chunk-K4V4QYCL.js";
 import "../chunk-PZ5AY32C.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/runtime",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -50,8 +50,8 @@
     "@openai/agents-extensions": "0.13.3",
     "@opengeni/agent-proto": "^0.3.0",
     "@opengeni/codex": "^0.2.7",
-    "@opengeni/config": "^0.7.10",
-    "@opengeni/contracts": "^0.21.0",
+    "@opengeni/config": "^0.7.11",
+    "@opengeni/contracts": "^0.22.0",
     "@opengeni/network": "^0.1.1",
     "debug": "4.4.3",
     "modal": "0.7.6",

package/src/context-compaction.ts

@@ -100,11 +100,6 @@ export function isCompactionSummary(item: unknown): boolean {
   );
 }
 
-/** Platform-authored system context exists for one inference and is never persisted. */
-export function isEphemeralInternalContext(item: unknown): boolean {
-  return itemType(item) === "message" && itemRole(item) === "system";
-}
-
 /**
  * Conservative tokenizer-independent text estimate used for every local input
  * budget. Preserve the stable ASCII `chars / 4` heuristic, but never discount

package/src/index.ts

@@ -15,6 +15,7 @@ import {
   approvalIdentifier,
   CAPABILITY_DESCRIPTORS,
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
+  DEFAULT_FIRST_PARTY_MCP_TOOLS,
   assertUniqueResourceMountPaths,
   gitCredentialBindingIdForRepository,
   gitCredentialProviderForRepository,
@@ -33,6 +34,7 @@ import {
   type HumanInputResponse,
   type McpServerConnectionRef,
   type Permission,
+  type FirstPartyMcpToolName,
   type ReasoningEffort,
   type ResourceRef,
   type SessionEventType,
@@ -177,6 +179,7 @@ import {
   type RunCredentialSessionReady,
 } from "./sandbox";
 import { runWithToolCallCorrelation } from "./sandbox/op-correlation";
+import { shellToolspacePath } from "./sandbox/toolspace-token";
 import {
   createTurnToolCancellationController,
   TurnSandboxCommandCancelledError,
@@ -296,7 +299,6 @@ export {
   MAX_COMPACTION_THRESHOLD_RATIO,
   SUMMARY_BUFFER_TOKENS,
   SUMMARY_PREFIX,
-  isEphemeralInternalContext,
   USER_MESSAGE_TRUNCATION_MARKER,
 } from "./context-compaction";
 export type {
@@ -2407,6 +2409,9 @@ export type PrepareToolsOptions = {
   // delegated token (manager-style sessions). The caller is responsible for
   // having validated the set against the session creator's grant.
   firstPartyPermissions?: Permission[];
+  // Exact model-visible catalog selection for the broad first-party server.
+  // Permissions are signed separately and remain the authorization boundary.
+  firstPartyTools?: FirstPartyMcpToolName[];
   resolveCredential?: (
     input: ResolveConnectionCredentialInput,
   ) => Promise<ResolveConnectionCredentialResult>;
@@ -3163,6 +3168,7 @@ async function signFirstPartyDelegatedBearer(
     subjectId: options.subjectId ?? "worker:first-party-mcp",
     ...(options.subjectLabel ? { subjectLabel: options.subjectLabel } : {}),
     permissions: options.firstPartyPermissions ?? [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS],
+    firstPartyMcpTools: options.firstPartyTools ?? [...DEFAULT_FIRST_PARTY_MCP_TOOLS],
     ...(options.sessionId ? { sessionId: options.sessionId } : {}),
     ...(options.turnId ? { turnId: options.turnId } : {}),
     ...(options.attemptId ? { attemptId: options.attemptId } : {}),
@@ -6812,10 +6818,10 @@ export function toolspaceTokenSeedCommand(
     '  seed_umask="$(umask)"',
     "  umask 077",
     options.tokenFile
-      ? `  token_file=${shellQuote(options.tokenFile)}`
+      ? `  token_file=${shellToolspacePath(options.tokenFile)}`
       : '  token_file="${OPENGENI_TOOLSPACE_TOKEN_FILE:-$HOME/.opengeni/toolspace-token}"',
     options.legacyTokenFile
-      ? `  legacy_token_file=${shellQuote(options.legacyTokenFile)}`
+      ? `  legacy_token_file=${shellToolspacePath(options.legacyTokenFile)}`
       : '  legacy_token_file=""',
     '  mkdir -p "$(dirname "$token_file")"',
     '  printf \'%s\' "$OPENGENI_TOOLSPACE_TOKEN_SEED" > "$token_file.tmp.$$"',

package/src/sandbox/toolspace-token.ts

@@ -9,6 +9,7 @@ import type {
 } from "@openai/agents/sandbox";
 
 const MAX_TOOLSPACE_SESSION_ID_BYTES = 512;
+const HOME_RELATIVE_TOOLSPACE_PREFIX = "$HOME/";
 
 export class ToolspaceTokenPathError extends Error {
   constructor(message: string) {
@@ -33,6 +34,36 @@ function assertToolspaceSessionId(sessionId: string): string {
   return sessionId;
 }
 
+function isHomeRelativeToolspacePath(value: string): boolean {
+  if (!value.startsWith(HOME_RELATIVE_TOOLSPACE_PREFIX)) return false;
+  const relative = value.slice(HOME_RELATIVE_TOOLSPACE_PREFIX.length);
+  const segments = relative.split("/");
+  return (
+    relative.length > 0 &&
+    !relative.includes("\0") &&
+    segments.every(
+      (segment) => segment !== "." && segment !== ".." && /^[A-Za-z0-9._-]+$/.test(segment),
+    ) &&
+    posixPath.normalize(relative) === relative
+  );
+}
+
+function assertToolspaceFilePath(value: string, label: string): string {
+  if (
+    !value ||
+    value.includes("\0") ||
+    (!posixPath.isAbsolute(value) && !isHomeRelativeToolspacePath(value))
+  ) {
+    throw new ToolspaceTokenPathError(`${label} must be absolute or use the trusted $HOME/ prefix`);
+  }
+  return posixPath.isAbsolute(value) ? posixPath.normalize(value) : value;
+}
+
+export function shellToolspacePath(value: string): string {
+  const validated = assertToolspaceFilePath(value, "Toolspace token file");
+  return isHomeRelativeToolspacePath(validated) ? `"${validated}"` : shellQuote(validated);
+}
+
 /**
  * Derive the per-session token file beside the legacy manifest pointer.
  *
@@ -44,14 +75,10 @@ function assertToolspaceSessionId(sessionId: string): string {
  * authority boundary for Toolspace calls.
  */
 export function toolspaceTokenFileForSession(manifestTokenFile: string, sessionId: string): string {
-  if (
-    !manifestTokenFile ||
-    manifestTokenFile.includes("\0") ||
-    !posixPath.isAbsolute(manifestTokenFile)
-  ) {
-    throw new ToolspaceTokenPathError("Toolspace manifest token file must be absolute");
-  }
-  const normalizedManifestFile = posixPath.normalize(manifestTokenFile);
+  const normalizedManifestFile = assertToolspaceFilePath(
+    manifestTokenFile,
+    "Toolspace manifest token file",
+  );
   const digest = createHash("sha256").update(assertToolspaceSessionId(sessionId)).digest("hex");
   return posixPath.join(posixPath.dirname(normalizedManifestFile), "toolspace-tokens", digest);
 }
@@ -68,10 +95,7 @@ export function toolspaceTokenFileFromEnvironment(
 
 /** Prefix one sandbox command with its session-specific Toolspace pointer. */
 export function withToolspaceTokenEnvironment(cmd: string, tokenFile: string): string {
-  if (!tokenFile || tokenFile.includes("\0") || !posixPath.isAbsolute(tokenFile)) {
-    throw new ToolspaceTokenPathError("Toolspace token file must be absolute");
-  }
-  return [`export OPENGENI_TOOLSPACE_TOKEN_FILE=${shellQuote(tokenFile)}`, cmd].join("\n");
+  return [`export OPENGENI_TOOLSPACE_TOKEN_FILE=${shellToolspacePath(tokenFile)}`, cmd].join("\n");
 }
 
 /** Preserve provider identity/capabilities while decorating command creation. */