@opengeni/runtime 0.14.1 → 0.14.15

package/dist/index.d.ts

@@ -1,596 +1,34 @@
-import * as _openai_agents from '@openai/agents';
-import { Tool, Computer, AgentInputItem, Model, MCPServer, ModelProvider, Agent, RunState, CallModelInputFilter, RunStreamEvent } from '@openai/agents';
-export { MaxTurnsExceededError, OpenAIChatCompletionsModel, OpenAIResponsesModel } from '@openai/agents';
-import { Settings, ResolvedModelProvider, ConfiguredModel, ModelProviderApi } from '@opengeni/config';
-export { collectSandboxEnvironment, parseExposedPorts } from '@opengeni/config';
-import { HumanInputResponse, ReasoningEffort, GitCredentialProvider, GitCredentialTransport, SessionEventType, ResourceRef, ToolRef, Permission, FirstPartyMcpToolName, McpServerConnectionRef, ToolAuthNeededPayload, RequestHumanInputToolInput } from '@opengeni/contracts';
-export { CAPABILITY_DESCRIPTORS, CapabilityDescriptor, DESKTOP_STREAM_PORT, StreamTokenPayload, StreamTokenPayload as StreamTokenPayloadType, TERMINAL_STREAM_PORT } from '@opengeni/contracts';
-import { SandboxSessionLike, Capability, SandboxSessionState, Manifest, Capabilities, LocalDirLazySkillSource, SandboxClient } from '@openai/agents/sandbox';
-import OpenAI from 'openai';
-import { R as RunCredentialSessionReady, a as RuntimeMetricsHooks } from './index-BraazrAO.js';
-export { A as ActiveBackendResolverDeps, b as ActiveBackendUnresolvableError, c as ActivePointer, B as BackendUnresolvableCode, C as ChannelAConflictError, d as ChannelAEmitter, e as ChannelAExecArgs, f as ChannelAExecResult, g as ChannelANotFoundError, h as ChannelASession, i as ChannelAUnavailableError, j as ChannelAUnsupportedError, k as ChannelAValidationError, l as ControlRpc, D as DEFAULT_DESKTOP_GEOMETRY, m as DISPLAY_STACK_TIMEOUT_MS, n as DefaultBackendLossResult, o as DesktopGeometry, p as DisplayStackCallerKind, q as DisplayStackClassification, r as DisplayStackError, s as DisplayStackTelemetryContext, t as DisplayStackTelemetryEvent, u as DisplayStackTelemetryStatus, v as DisplayStackUnsupportedError, E as EnsureDisplayStackOptions, w as EnsureDisplayStackResult, x as EnsureTerminalServerOptions, y as EnsureTerminalServerResult, z as EstablishedSandboxSession, F as ExposeStreamPortInput, G as ExposeStreamPortResult, H as ExposedPortEndpoint, I as FAULT_FIELD_WHAT_HAPPENED, J as FAULT_FIELD_WHAT_PRESERVED, K as FAULT_FIELD_WHAT_TO_TRY, L as FAULT_FIELD_WHICH_LAYER, M as LiveModalSandboxLeaseAttribution, N as MaterializeRunCredentialsOptions, O as MintStreamTokenInput, P as MockAgentResponder, Q as MockAgentResponderOptions, S as MockExecHandler, T as ModalModuleLoader, U as ModalOrphanSweepResult, V as ModalOrphanSweepTermination, W as ModalSandboxAttribution, X as NEVER_SENT_DETAIL_KEY, Y as NatsControlRpc, Z as NatsOpStreamConnection, _ as NatsOpStreamTransport, $ as NatsRequestConnection, a0 as NegotiationContext, a1 as NormalizedRunCredentialMaterial, a2 as NumstatEntry, a3 as OP_STREAM_ACK_INTERVAL_MS, a4 as OP_STREAM_DEFAULT_WINDOW_BYTES, a5 as OP_STREAM_RECONNECT_HOLD_MS, a6 as OP_STREAM_SILENCE_TIMEOUT_MS, a7 as OpStreamExecOutcome, a8 as OpStreamJournal, a9 as OpStreamSubscription, aa as OpStreamTransport, ab as OpStreamUnavailableError, ac as PROVIDER_REGISTRY, ad as ProviderConstructionContext, ae as ProviderRegistration, af as ProviderSandboxFailure, ag as ProviderSandboxFailureKind, ah as REPOSITORY_DISCOVERY_LIMIT, ai as RecordingArtifactMetadata, aj as RecordingCodec, ak as RecordingContentType, al as RecordingError, am as RecordingProcess, an as RecordingUnavailableError, ao as RepositoryDiscoveryDegradedReason, ap as RepositoryDiscoveryResult, aq as ResolvedActiveBackend, ar as RevalidateModalOrphanTermination, as as RoutableBackendSession, at as RoutableSandbox, au as RoutingBackendRecoveryRequiredError, av as RoutingMutationOutcomeUnknownError, aw as RoutingMutationSettlementResult, ax as RoutingRetainedProcess, ay as RoutingRetainedProcessAdoption, az as RoutingRetainedProcessNotFoundError, aA as RoutingRetainedProcessTerminalProof, aB as RoutingSandboxSession, aC as RoutingSandboxSessionDeps, aD as RoutingTransitionEvent, aE as RoutingUnsupportedError, aF as RunCredentialCommandRunner, aG as RunCredentialCommandSession, aH as RunCredentialExpectedScope, aI as RunCredentialValidationError, aJ as SELFHOSTED_DEFAULT_TIMEOUT_MS, aK as SELFHOSTED_DRAINING_MAX_RETRIES, aL as SELFHOSTED_EXEC_DRAINING_MAX_RETRIES, aM as SELFHOSTED_IDEMPOTENT_READONLY_OPS, aN as SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES, aO as SELFHOSTED_NEVER_SENT_MAX_RETRIES, aP as SELFHOSTED_RECONNECT_WINDOW_MS, aQ as SELFHOSTED_RELAY_STREAM_PATH, aR as SELFHOSTED_RETRY_BACKOFF_BASE_MS, aS as SELFHOSTED_RETRY_BACKOFF_CAP_MS, aT as SELFHOSTED_RETRY_BACKOFF_FACTOR, aU as SELFHOSTED_TIMEOUT_MAX_RETRIES, aV as STREAM_PORT, aW as STREAM_TOKEN_DEFAULT_TTL_SECONDS, aX as SandboxChannelAService, aY as SandboxChannelAServiceOptions, aZ as SandboxConfigError, a_ as SandboxCreatedCallback, a$ as SandboxExecReadinessError, b0 as SandboxProviderUnavailableError, b1 as SandboxReplacementProviderStateError, b2 as SandboxResumeStateUnavailableError, b3 as SelfhostedApplyDiff, b4 as SelfhostedControlError, b5 as SelfhostedEditor, b6 as SelfhostedEnrollment, b7 as SelfhostedExecArgs, b8 as SelfhostedExecResult, b9 as SelfhostedImageOutput, ba as SelfhostedLivenessState, bb as SelfhostedNegotiationInput, bc as SelfhostedOpObservation, bd as SelfhostedOpObserver, be as SelfhostedOpStreamDeps, bf as SelfhostedRelayConfig, bg as SelfhostedRetryClock, bh as SelfhostedRetryDecision, bi as SelfhostedSandboxClient, bj as SelfhostedSession, bk as SelfhostedSessionBuild, bl as SelfhostedSessionDeps, bm as SelfhostedSessionState, bn as SelfhostedUnavailableReason, bo as StartRecordingInput, bp as StreamPortUnavailableError, bq as SwapTargetEstablishability, br as TERMINAL_SERVER_TIMEOUT_MS, bs as TerminalServerError, bt as TerminalServerUnsupportedError, bu as ToolspaceTokenPathError, bv as VerifiedWorkspaceArchive, bw as WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION, bx as WorkspaceArchiveDescriptor, by as WorkspaceArchiveIntegrityCode, bz as WorkspaceArchiveIntegrityError, bA as WorkspaceTreeFingerprint, bB as agentErrorToControlError, bC as assertDescriptorRegistryInvariants, bD as assertProviderRegistryInvariants, bE as assertSafeRelPath, bF as backendSupportsOs, bG as buildDisplayStackScript, bH as buildSelfhostedBackendSession, bI as buildStreamUrl, bJ as buildTerminalServerScript, bK as captureVerifiedWorkspaceArchive, bL as classifyProviderSandboxFailure, bM as clearRunCredentials, bN as clearRunCredentialsForAttempt, bO as contentTypeForCodec, bP as createSandboxClient, bQ as createSandboxClientForBackend, bR as decideSelfhostedRetry, bS as decodeModalSnapshotId, bT as defaultSelfhostedRetryClock, bU as deletePriorPersistedSnapshot, bV as deleteRecordingArtifacts, bW as deserializeSandboxSessionStateEnvelope, bX as desktopCapableBackend, bY as drainingExhaustedError, bZ as drainingMessage, b_ as ensureDisplayStack, b$ as ensureModalRegistryImage, c0 as ensureTerminalServer, c1 as establishSandboxSessionFromEnvelope, c2 as execDeadlineHint, c3 as exposeStreamPort, c4 as extForCodec, c5 as fingerprintSandboxWorkspace, c6 as hasPersistableSandboxProviderIdentity, c7 as inspectRecordingArtifact, c8 as isExecSessionLostBanner, c9 as isProviderSandboxGoneDuringRoutedOperation, ca as isProviderSandboxNotFoundError, cb as isProviderSandboxTransientError, cc as isSelfhostedProviderNotFoundError, cd as makeActiveBackendResolver, ce as materializeRunCredentials, cf as mintStreamToken, cg as modalSandboxAttributionEnvironment, ch as modalSandboxAttributionTags, ci as negotiateCapabilities, cj as negotiateSelfhostedCapabilities, ck as nextDurableOpId, cl as normalizeRunCredentialsResolution, cm as offlineAgentError, cn as offlineControlResponse, co as opAckSubject, cp as opFrameSubject, cq as parseExecBannerExitCode, cr as parseExecBannerSessionId, cs as parseNumstatZ, ct as parsePorcelainV2, cu as parseUnifiedPatch, cv as parseWorkspaceArchiveDescriptor, cw as payloadTooLargeMessage, cx as readVerifiedWorkspaceArchive, cy as readWorkspaceArchiveFromEnvelopeSessionState, cz as recordingStorageKey, cA as renderSelfhostedFault, cB as requirePersistableReplacementSandboxEnvelope, cC as restoredSandboxSessionStateFromEntry, cD as runCredentialPointerFile, cE as runCredentialRoot, cF as runWithToolCallCorrelation, cG as sandboxStateEntryFromRunState, cH as sanitizeOpIdToken, cI as selectBackend, cJ as selfhostedFaultClass, cK as selfhostedLiveness, cL as selfhostedRetryBackoffMs, cM as serializeEstablishedSandboxEnvelope, cN as serializeReplacementSandboxEnvelope, cO as setSelfhostedApplyDiff, cP as startRecording, cQ as stopRecording, cR as stripExecBanner, cS as subjectFor, cT as swapTargetEstablishability, cU as sweepModalOrphanSandboxes, cV as tagModalSandbox, cW as tearDownDisplayStack, cX as tearDownTerminalServer, cY as terminateModalSandboxById, cZ as timeoutAgentError, c_ as timeoutControlResponse, c$ as toolspaceTokenFileForSession, d0 as toolspaceTokenFileFromEnvironment, d1 as uploadRecordingArtifact, d2 as verifyRestoredWorkspace, d3 as verifySandboxExecReadiness, d4 as verifyStreamToken, d5 as withRunCredentialEnvironment, d6 as withRunCredentialsClient, d7 as withRunCredentialsSession, d8 as withToolspaceTokenClient, d9 as withToolspaceTokenEnvironment, da as withToolspaceTokenSession } from './index-BraazrAO.js';
-export { SkillLibraryEntry, SkillLibraryFile, SkillLibrarySkill, getSkillLibraryEntry, isSkillLibraryEntryId, listSkillLibraryEntries, loadSkillLibrarySkill } from './skill-library.js';
-import 'modal';
-import '@opengeni/agent-proto';
-
-/**
- * Portable conversation context compaction, following Codex CLI's local path.
- *
- * The checkpoint model sees the current active history plus one fixed
- * checkpoint prompt, then the active history is rebuilt from the newest real
- * user messages within one cumulative 20k-token budget plus one summary.
- * Assistant messages, tool calls/results, reasoning, and images are removed
- * from the active model-facing history; the database audit rows remain.
- */
-type CompactionItem = Record<string, unknown>;
-/**
- * Marker stored on the synthetic summary item so the UI can render it and the
- * next rebuild can exclude old summaries from the retained user-message set.
- */
-declare const COMPACTION_SUMMARY_MARKER = "opengeni_context_summary";
-declare const SUMMARY_BUFFER_TOKENS = 20000;
-declare const COMPACT_USER_MESSAGE_MAX_TOKENS = 20000;
-declare const DEFAULT_COMPACTION_THRESHOLD_RATIO = 0.9;
-declare const MIN_COMPACTION_THRESHOLD_RATIO = 0.3;
-declare const MAX_COMPACTION_THRESHOLD_RATIO = 0.9;
-declare const COMPACTION_PROMPT: string;
-declare const SUMMARY_PREFIX = "Another language model started to solve this problem and produced a summary of its thinking process. You also have access to the state of the tools that were used by that language model. Use this to build on the work that has already been done and avoid duplicating work. Here is the summary produced by the other language model, use the information in this summary to assist with your own analysis:";
-declare const USER_MESSAGE_TRUNCATION_MARKER = "\n[... middle truncated for context compaction ...]\n";
-/** A user-authored `message` item is the only legal turn boundary. */
-declare function isUserMessage(item: unknown): boolean;
-/** True for our synthetic compaction summary item. */
-declare function isCompactionSummary(item: unknown): boolean;
-/** Serialized-item estimate for pre-call accounting and retained user budgets. */
-declare function estimateItemTokens(item: CompactionItem): number;
-declare function estimateTokens(items: readonly CompactionItem[]): number;
-declare function estimateSerializedValueTokens(value: unknown): number;
-type CompleteModelInputFootprint = {
-    input: readonly CompactionItem[];
-    instructionsTokens: number;
-    toolSchemaTokens: number;
-};
-type ProviderContextTokenSignal = {
-    /** Monotonic within one sampled run; advances after every model response. */
-    revision: number;
-    /** Provider total tokens after that response (input + generated output). */
-    totalTokens: number;
-};
-type CompleteModelInputEstimate = {
-    tokens: number;
-    source: "complete_estimate" | "provider_plus_local";
-    inputTokens: number;
-    instructionsTokens: number;
-    toolSchemaTokens: number;
-    appendedAfterModelTokens: number;
-};
-/**
- * Match Codex history accounting: after one provider response, start from its
- * authoritative TOTAL token count and add only local items placed after the
- * newest model-generated item. System instructions and tool schemas are
- * compared with the exact request footprint that produced the provider count;
- * positive growth is added. Without a bound anchor, estimate the entire
- * outgoing request rather than trusting stale usage from an earlier turn.
- */
-declare function estimateCompleteModelInput(input: {
-    current: CompleteModelInputFootprint;
-    provider?: ProviderContextTokenSignal | null;
-    providerRequestFootprint?: CompleteModelInputFootprint | null;
-}): CompleteModelInputEstimate;
-declare function hasModelGeneratedItem(items: readonly CompactionItem[]): boolean;
-declare function clampCompactionThresholdRatio(value: number | undefined | null): number;
-declare function compactionThresholdTokens(input: {
-    contextWindowTokens: number;
-    contextReservedOutputTokens: number;
-    contextAutoCompactThresholdTokens?: number | null | undefined;
-    contextCompactionThresholdRatio?: number | null | undefined;
-}): number;
-type CompactionDecision = {
-    shouldCompact: boolean;
-    reason: "force" | "above_threshold" | "below_threshold" | "no_history";
-    signalTokens: number;
-    thresholdTokens: number;
-};
-declare function decideCompaction(input: {
-    items: readonly CompactionItem[];
-    lastInputTokens?: number | null;
-    contextWindowTokens: number;
-    contextReservedOutputTokens: number;
-    contextAutoCompactThresholdTokens?: number | null | undefined;
-    contextCompactionThresholdRatio?: number | null | undefined;
-    force?: boolean;
-}): CompactionDecision;
-declare class CompactionNeededError extends Error {
-    readonly signalTokens: number;
-    readonly thresholdTokens: number;
-    readonly signalSource: "provider" | "estimate";
-    readonly trigger: "threshold" | "operator";
-    constructor(input: {
-        signalTokens: number;
-        thresholdTokens: number;
-        signalSource: "provider" | "estimate";
-        trigger?: "threshold" | "operator";
-    });
-}
-declare class EmptyCompactionSummaryError extends Error {
-    readonly diagnostics: Record<string, unknown>;
-    constructor(diagnostics?: Record<string, unknown>);
-}
-/**
- * The checkpoint model request ended in a provider/transport failure rather
- * than a successful response with an empty assistant message. Diagnostics are
- * deliberately bounded and content-free so this error can be persisted on a
- * turn without copying provider messages or conversation input into events.
- */
-declare class CompactionProviderResponseError extends Error {
-    readonly diagnostics: Record<string, unknown>;
-    readonly status?: number;
-    readonly code?: string;
-    readonly type?: string;
-    readonly cause?: unknown;
-    constructor(diagnostics?: Record<string, unknown>, cause?: unknown);
-}
-declare function findCompactionNeededError(error: unknown, seen?: WeakSet<object>): CompactionNeededError | null;
-/**
- * The exact checkpoint input shape: current active history followed by Codex's
- * checkpoint prompt as a synthesized user message.
- */
-declare function buildCompactionPromptInput(items: readonly CompactionItem[]): CompactionItem[];
-type PreparedCompactionPromptInput = {
-    input: CompactionItem[];
-    estimatedInputTokens: number;
-    rewrittenToolOutputs: number;
-    droppedHistoryItems: number;
-};
-/**
- * Fit the explicit checkpoint request without mutating canonical history.
- *
- * Codex first replaces oversized tool outputs in its temporary remote-
- * compaction input. OpenGeni does the same oldest-first, preserving the most
- * recent tool detail for the plaintext summary. If that is still insufficient,
- * whole oldest user-delimited work units are removed and the remaining suffix
- * is protocol-sanitized so no call/result/reasoning fragment is orphaned.
- * The raw active history is still the source for the eventual replacement and
- * remains unchanged if the provider call fails.
- */
-declare function prepareCompactionPromptInput(items: readonly CompactionItem[], maxInputTokens: number): PreparedCompactionPromptInput;
-/**
- * Build the active history after compaction:
- * the newest real user messages that fit one cumulative 20k-token budget
- * (prior summaries excluded, images removed) plus one marked summary item.
- */
-declare function buildCompactionReplacementHistory(items: readonly CompactionItem[], summaryBody: string): CompactionItem[];
-declare function compactionReplacementFingerprint(items: readonly CompactionItem[]): string;
-/** Fingerprint the latest durable replacement prefix in active history. */
-declare function latestCompactionReplacementFingerprint(items: readonly CompactionItem[]): string | null;
-/**
- * Build the synthetic summary item (a plain user message) appended to the
- * rebuilt active history.
- */
-declare function buildSummaryItem(summaryBody: string): CompactionItem;
-declare function renderCompactionPromptInputForChat(input: readonly CompactionItem[]): string;
-
-type CommandCancellationSession = {
-    cancelExecCommand?(opId: string): Promise<boolean>;
-    supportsPty?(): boolean;
-    hasRetainedProcess?(providerSessionId: number): boolean;
-    writeStdinForProcessMutation?(args: {
-        sessionId: number;
-        chars?: string;
-        yieldTimeMs?: number;
-        maxOutputTokens?: number;
-    }): Promise<string>;
-    writeStdinForProcessControl?(args: {
-        sessionId: number;
-        chars?: string;
-        yieldTimeMs?: number;
-        maxOutputTokens?: number;
-    }): Promise<string>;
-    execCommandForProcessControl?(providerSessionId: number, args: TurnSandboxCommandArgs): Promise<string>;
-};
-type TurnSandboxCommandArgs = {
-    cmd: string;
-    workdir?: string;
-    shell?: string;
-    login?: boolean;
-    tty?: boolean;
-    yieldTimeMs?: number;
-    maxOutputTokens?: number;
-    runAs?: string;
-};
-type TurnSandboxCommandResult = {
-    stdout: string;
-    stderr: string;
-    exitCode: number;
-    wallTimeSeconds: number;
-};
-type TurnSandboxCommandSession = CommandCancellationSession & {
-    exec?(args: TurnSandboxCommandArgs): Promise<unknown>;
-    execCommand?(args: TurnSandboxCommandArgs): Promise<string>;
-    writeStdin?(args: {
-        sessionId: number;
-        chars?: string;
-        yieldTimeMs?: number;
-        maxOutputTokens?: number;
-    }): Promise<string>;
-};
-/**
- * The worker may publish an attempt-quiesced receipt only after this fence
- * resolves. `cancel()` prevents new turn-owned sandbox calls, actively stops
- * shell processes, and `waitForQuiescence()` drains every capability call that
- * was already in flight. Cleanup/telemetry outside the sandbox capability set
- * remains independently attempt-fenced.
- */
-type TurnToolCancellationFence = {
-    cancel(reason?: unknown): void;
-    waitForQuiescence(): Promise<void>;
-    runSandboxCommand(session: TurnSandboxCommandSession, args: TurnSandboxCommandArgs): Promise<unknown>;
-    runSandboxCommandStructured(session: TurnSandboxCommandSession, args: TurnSandboxCommandArgs): Promise<TurnSandboxCommandResult>;
-};
-type TurnToolCancellationController = TurnToolCancellationFence & {
-    wrapTools<T>(tools: T[], session?: CommandCancellationSession): T[];
-};
-declare class TurnSandboxCommandCancelledError extends Error {
-    readonly name = "TurnSandboxCommandCancelledError";
-    constructor(reason: unknown);
-}
-declare function createTurnToolCancellationController(signal?: AbortSignal): TurnToolCancellationController;
-
-type ComputerButton = "left" | "right" | "wheel" | "back" | "forward";
-type SandboxComputerOptions = {
-    display?: string;
-    dimensions?: [number, number];
-    runAs?: string;
-    typeDelayMs?: number;
-    readOnly?: boolean;
-    screenshotTmpDir?: string;
-    screenshotWarmupBudgetMs?: number;
-    screenshotRetryDelayMs?: number;
-    /**
-     * One turn-scoped preparation hook, invoked by the first real computer action.
-     * The agent may advertise computer-use on every turn, but merely advertising the
-     * tool must not boot Xvfb/XFCE or start a recording. The runtime capability owns
-     * this hook and uses it to bring up :0 (and optionally notify the worker) only
-     * after the model actually chooses a computer tool.
-     */
-    prepare?: (session: SandboxSessionLike) => Promise<void>;
-};
-/** No exec/execCommand on the session, or the display is not up. */
-declare class ComputerUnavailableError extends Error {
-    constructor(message: string);
-}
-/** A write action attempted while readOnly. */
-declare class ComputerReadOnlyError extends Error {
-    constructor();
-}
-/** A nonzero xdotool/scrot exit, OR a command that did not finish before the
- *  yield window (F3 — "still running" is a failure, not a silent success). */
-declare class ComputerActionError extends Error {
-    cmd: string;
-    exitCode: number;
-    stderr: string;
-    constructor(cmd: string, exitCode: number, stderr: string);
-}
-/**
- * The Computer the agent drives. Every action issues ONE shell line through the
- * externally-owned session (exec ?? execCommand, F1), prefixed with the display.
- * screenshot() scrots to a /tmp file and reads the RAW bytes by running
- * `base64 <path>` over the SAME command primitive and stripping the banner — NOT
- * `session.readFile` (Modal's readFile path-validates against /workspace and rejects
- * /tmp with "escapes the workspace root", which would yield an empty frame and 400
- * the model). The base64-over-exec path is /tmp-readable and binary-safe.
- */
-declare class SandboxComputer implements Computer {
-    readonly environment: "ubuntu";
-    readonly dimensions: [number, number];
-    private session;
-    private readonly display;
-    private readonly runAs?;
-    private readonly typeDelayMs;
-    private readonly readOnly;
-    private readonly tmp;
-    private readonly screenshotWarmupBudgetMs;
-    private readonly screenshotRetryDelayMs;
-    private readonly prepare;
-    private prepared;
-    private preparation;
-    constructor(session: SandboxSessionLike, opts?: SandboxComputerOptions);
-    /** Rebind to a freshly resumed-by-id session after a box rollover / re-establish. */
-    rebind(session: SandboxSessionLike): void;
-    private prepareOnce;
-    private x;
-    private guardWrite;
-    private shq;
-    screenshot(): Promise<string>;
-    private readCmdRaw;
-    private readScreenshotBytes;
-    click(xp: number, yp: number, button: ComputerButton): Promise<void>;
-    doubleClick(xp: number, yp: number): Promise<void>;
-    move(xp: number, yp: number): Promise<void>;
-    scroll(xp: number, yp: number, sx: number, sy: number): Promise<void>;
-    type(text: string): Promise<void>;
-    keypress(keys: string[]): Promise<void>;
-    drag(path: [number, number][]): Promise<void>;
-    wait(): Promise<void>;
-}
-/**
- * EXPLICIT tool-transport selection, decided by the caller that knows the
- * provider's true wire identity (the worker's model resolution — see agent-turn.ts),
- * NOT inferred from the bound model instance's constructor name. This is the
- * HARDENING seam: `supportsStructuredToolOutputTransport` string-sniffs the
- * constructor for "ChatCompletions", which a wrapped / proxied / minified model
- * instance would defeat — silently handing a chat-completions provider the HOSTED
- * `computer_use_preview` tool it 400s on every turn. When `toolMode` is set, tools()
- * OBEYS it and never consults the sniff:
- *   • "hosted"         → the single hosted `computer_use_preview` tool (Responses backends).
- *   • "function-image" → the FUNCTION `computer_*` tools with screenshots delivered as a
- *                        structured `{type:'image'}` output (the codex/ChatGPT backend,
- *                        which rejects hosted tool types but SEES structured image results).
- *   • "function-text"  → the FUNCTION tools with screenshots rendered as a text
- *                        `data:…;base64` URL (chat-completions providers, which can't read
- *                        structured image tool results).
- */
-type ComputerToolMode = "hosted" | "function-image" | "function-text";
-type ComputerUseArgs = {
-    dimensions?: [number, number];
-    readOnly?: boolean;
-    display?: string;
-    needsApproval?: boolean | ((ctx: unknown, action: unknown) => boolean | Promise<boolean>);
-    imageFunctionResults?: boolean;
-    toolMode?: ComputerToolMode;
-    /** Called after the display is ready on the first actual computer action. */
-    onReady?: (session: SandboxSessionLike) => Promise<void>;
-};
-declare function computerUse(args?: ComputerUseArgs): ComputerUseCapability;
-/**
- * A `Capability` subclass merged into the agent's tool set by SandboxAgent
- * (`tools = [...agent.tools, ...capability.tools()]`). `bind(session)` hands it
- * the LIVE externally-owned session, so the agent's actions and the viewers'
- * pixels are one display.
- *
- * `tools()` is TRANSPORT-AWARE, mirroring the SDK's `filesystem()` capability
- * (which branches its `view_image` / `apply_patch` on
- * `supportsStructuredToolOutputTransport(this._modelInstance)`):
- *   • structured transport (the Responses/OpenAI backend) → the single HOSTED
- *     `computer_use_preview` tool over a Computer bound to the session (unchanged).
- *   • text transport (codex / ChatGPT backend — or an unbound model) → a set of
- *     FUNCTION tools ({@link computerFunctionTools}) that route to the SAME Computer,
- *     because the codex backend rejects the hosted computer tool type.
- * The bound model instance is captured by the SDK's `bind().bindRunAs().bindModel()`
- * chain (base `Capability._modelInstance`); the codex path in index.ts neutralizes
- * `bindModel` so `_modelInstance` stays undefined here → the function tools win.
- */
-declare class ComputerUseCapability extends Capability {
-    private args;
-    readonly type = "computer-use";
-    constructor(args?: ComputerUseArgs);
-    tools(): Tool<unknown>[];
-    /** The single HOSTED `computer_use_preview` tool bound to `computer` — identical
-     *  construction for the explicit "hosted" mode and the legacy structured-sniff path. */
-    private hostedComputerTool;
-}
-
-type WorkspaceSkillSearchPath = Readonly<{
-    path: string;
-    source: string;
-}>;
-
-/**
- * Read-path sanitizer for replayed conversation history (issue: orphaned
- * tool outputs brick a session).
- *
- * Conversation truth is persisted as a flat list of SDK history items in
- * `session_history_items` and replayed verbatim into the model on every turn.
- * The OpenAI Responses API rejects the whole request (HTTP 400) when that list
- * violates its tool-call pairing rules — most destructively:
- *
- *   `400 No tool call found for function call output with call_id <X>`
- *
- * when a `function_call_result` (a.k.a. function_call_output) has no matching
- * `function_call` earlier in the list. Because the corrupt item is replayed on
- * every subsequent turn, one orphaned output permanently bricks the session
- * across revival — it stays dead until the row is hand-deleted.
- *
- * This module is the reliability net: before history items are sent to the
- * model they pass through `sanitizeHistoryItemsForModel`, which removes any
- * item that would make the request invalid. It mirrors the SDK's own
- * `dropOrphanToolCalls` continuation logic (which only runs over the SDK's
- * in-memory `state.history`, not over rows we reload from the database) so a
- * reloaded history is shaped exactly like a freshly-generated one.
- *
- * It is a pure function over plain JSON item shapes (no SDK import, no I/O) so
- * it is cheap to unit-test exhaustively. It NEVER mutates its input items and
- * NEVER touches the stored rows — only the in-memory copy sent to the model is
- * filtered, keeping the persisted audit trail intact.
- */
-/** A history item is any JSON object; we only inspect a few discriminator fields. */
-type HistoryItem = Record<string, unknown>;
-/**
- * Remove superseded `view_image` call/result pairs for the SAME local path,
- * retaining the newest fully-paired observation. A `view_image` result can be
- * hundreds of kilobytes of base64. When a model re-opens the same attachment,
- * replaying every older copy on each subsequent model call grows input
- * quadratically and can trap a turn in context-compaction/requeue recovery.
- *
- * This is state-based rather than count-based: every distinct path is kept,
- * and an older observation is removed only after a newer successful pair for
- * that exact path exists. The reasoning items immediately attached to a
- * removed call are removed with it, preserving Responses API item validity.
- */
-declare function elideSupersededViewImagePairs<T extends HistoryItem>(items: readonly T[]): T[];
-/**
- * Sanitize a replayed history item list into a sequence the Responses API
- * accepts. Pure: returns a new array of the same item references in order,
- * with invalid items omitted. Valid histories come back byte-identical
- * (same references, same order).
- *
- * Rules, each motivated by a concrete 400 the API raises:
- *
- *  1. Drop every tool-call RESULT whose matching tool CALL does not appear
- *     earlier in the list. This is the session-bricking orphan: a
- *     `function_call_result` with no preceding `function_call` of the same
- *     `call_id`. ("No tool call found for function call output…")
- *
- *  2. Drop every tool CALL that has no matching RESULT anywhere after it.
- *     The Responses API requires each tool call to be settled by its output
- *     before the conversation can continue; a dangling call left in replayed
- *     history 400s with "No tool output found for function call…". Dropping
- *     the dangling call (rather than synthesizing a fake output) is what the
- *     SDK itself does for in-memory continuation, so a reloaded history is
- *     shaped identically. The matching result, if it later exists, is kept;
- *     only genuinely unpaired calls are removed.
- *
- *  3. Drop any `reasoning` item that immediately precedes (across a run of
- *     reasoning items) a dropped tool call. The Responses API ties an
- *     encrypted reasoning item to the tool call it produced; a reasoning item
- *     orphaned by rule 2 trips "Item 'rs_…' of type 'reasoning' was provided
- *     without its required following item". Mirrors the SDK's
- *     `dropReasoningItemsPrecedingDroppedCalls`.
- *
- * A `call_id` is paired only when BOTH a call and a result of the matching
- * types exist with that id, the call appearing before the result. Calls and
- * results that satisfy that survive untouched.
- */
-declare function sanitizeHistoryItemsForModel<T extends HistoryItem>(items: readonly T[], toolOutputTruncationTokens?: number): T[];
-/**
- * Drop the account/org-bound `reasoning.encrypted_content` blob from a single
- * history item, preserving everything else (the visible chain-of-thought text in
- * `summary`/`content`, and every non-reasoning field). Pure + non-mutating: when
- * there is nothing to strip the SAME reference is returned (so the common,
- * same-account path stays byte-identical); otherwise a shallow clone is returned.
- *
- * WHY. A codex-subscription turn round-trips `reasoning.encrypted_content` — an
- * opaque blob minted by the ChatGPT/Codex backend that is bound to the account
- * (org) that produced it. After a manual switch from codex account A to B, the
- * carried history items still hold A-minted blobs; replaying them into a turn
- * running on B is rejected (400). The blob is purely a chain-of-thought
- * continuity optimization — dropping it costs at most one turn of lost CoT
- * continuity and never any message content.
- *
- * USED FOR `compaction` items only on the history-items read path: a foreign
- * `compaction` summary carries account-bound `encrypted_content` but its summary
- * is real conversation content that must be preserved, so we strip only the blob
- * (we do NOT drop the whole item). Foreign `reasoning` items are instead dropped
- * WHOLESALE by the caller (id + blob), because the Responses backend validates
- * the foreign `rs_…` id and rejects a reasoning item that has a foreign id and no
- * encrypted_content (so blanking the blob alone is not enough — see
- * {@link applyCodexHistoryStrip}).
- *
- * The SDK's Responses converter reads the blob via `providerData.encryptedContent`
- * (camel) or `providerData.encrypted_content` (snake); persisted rows use the
- * snake form, but we delete both casings defensively. We also clear a top-level
- * `encrypted_content` (the `compaction`-item shape) belt-and-braces — that blob
- * is likewise source-bound. Only `reasoning` and `compaction` items are touched;
- * messages, tool calls, and tool outputs pass through untouched by reference.
- */
-declare function stripReasoningEncryptedContent<T extends HistoryItem>(item: T): T;
-/**
- * Neutralize the account/org-bound identity of EVERY `reasoning` item embedded
- * in a serialized RunState JSON string, returning the re-serialized string. Pure:
- * a parse failure or a no-op returns the SAME string reference (so an unchanged
- * or non-codex run-state replays byte-for-byte).
- *
- * WHY (HOLE C — approval replay). An approval decision resumes the serialized
- * RunState blob. That blob round-trips `reasoning.encrypted_content` minted by the ChatGPT/Codex
- * backend (bound to the freezing account/org — a foreign account 400s it) AND the
- * foreign `rs_…` reasoning ids the Responses backend validates (rejected once the
- * blob is gone). Unlike `session_history_items`, the blob carries NO per-item
- * producer tag, so foreign-ness cannot be decided per item; the worker instead
- * records the FREEZING codex account on the run-state row and calls this only when
- * the resuming turn's codex account DIFFERS from it. When the accounts differ we
- * conservatively neutralize every reasoning item: delete its provider id and its
- * `encrypted_content` (both casings, in `providerData`). The visible reasoning
- * `content`/`summary` and every message / tool-call / tool-output item are left
- * intact (message and tool content are never account-bound).
- *
- * A reasoning item with no id and no encrypted_content is exactly the shape the
- * production Azure path already sends (see `stripProviderItemIdsFilter`), so it
- * deserializes and replays cleanly. Reasoning items live in several places in the
- * blob — `originalInput` (when an array), each `modelResponses[].output`,
- * `lastModelResponse.output`, and the `generatedItems` wrappers (`reasoning_item`
- * → `rawItem`) — and we scrub all of them. `compaction` items are deliberately
- * left untouched: their `encrypted_content` is a protocol-REQUIRED field whose
- * removal would fail the SDK's run-state schema validation on deserialize.
- */
-declare function stripReasoningIdentityFromSerializedRunState(serialized: string): string;
-/**
- * Neutralize tool_search items IN PLACE in a serialized RunState blob for a
- * cross-account codex resume — the run-state sibling of
- * `applyCodexHistoryStrip`'s tool_search rule, but COUNT-PRESERVING (HOLE E: the
- * blob path's reconcile watermark counts the blob's history length, so items
- * must never be removed — only mutated, exactly like the reasoning
- * neutralization above).
- *
- * The hazard: on deserialize, the SDK re-runs the registered CLIENT tool_search
- * execute callback per frozen pair (`rehydrateToolSearchRuntimeTools`) and
- * THROWS a UserError when the re-run's runtime-tool keys mismatch the serialized
- * expectation — which is exactly what happens when the RESUMING account's
- * connector pool differs from the FREEZING account's. The SDK skips that
- * rehydration entirely for `execution === 'server'` calls, so flipping the
- * frozen pairs' `execution` to `"server"` in place defuses the throw without
- * touching counts, ids, pairing, or content. The flipped shape is wire-safe:
- * LIVE-VERIFIED against /codex/responses — a replayed server-execution pair is
- * accepted (200) and its disclosure still holds. The account-bound `tsc_…` id is
- * separately stripped by the codex transport normalizer (all input item ids).
- *
- * Walks the same blob locations as {@link stripReasoningIdentityFromSerializedRunState}:
- * `originalInput` (array form), `generatedItems` (SDK run-item wrappers — the
- * raw shape under `rawItem`), every `modelResponses[].output`, and
- * `lastModelResponse.output`. Returns the input string unchanged when nothing
- * matched.
- */
-declare function neutralizeToolSearchItemsInSerializedRunState(serialized: string): string;
-
-type UsageDetails = Record<string, unknown> | Array<Record<string, unknown>>;
-type RequestUsageEntry = {
-    inputTokens?: unknown;
-    input_tokens?: unknown;
-    outputTokens?: unknown;
-    output_tokens?: unknown;
-    totalTokens?: unknown;
-    total_tokens?: unknown;
-    inputTokensDetails?: UsageDetails | undefined;
-    input_tokens_details?: UsageDetails | undefined;
-    outputTokensDetails?: UsageDetails | undefined;
-    output_tokens_details?: UsageDetails | undefined;
-};
-type ModelCallUsageInput = {
-    inputTokens?: unknown;
-    outputTokens?: unknown;
-    totalTokens?: unknown;
-    inputTokensDetails?: UsageDetails | undefined;
-    outputTokensDetails?: UsageDetails | undefined;
-    requestUsageEntries?: RequestUsageEntry[] | undefined;
-};
-/**
- * A single provider usage frame above one billion tokens is outside every
- * supported OpenGeni model contract. Keeping the ceiling explicit also prevents
- * malformed-but-finite provider values from corrupting durable accounting or a
- * process-lifetime Prometheus counter.
- */
-declare const MAX_MODEL_USAGE_TOKEN_COUNT = 1000000000;
-type ModelCallUsageTelemetry = {
-    inputTokens: number | null;
-    outputTokens: number | null;
-    cachedTokens: number | null;
-    cacheWriteTokens: number | null;
-    reasoningTokens: number | null;
-};
-type ModelCallUsageNormalization = {
-    telemetry: ModelCallUsageTelemetry;
-    totalTokens: number | null;
-    /** Bounded field paths only; raw provider values are never retained. */
-    rejectedFields: string[];
-};
-declare function modelUsageTokenCountOrNull(value: unknown): number | null;
-declare function normalizeModelCallUsage(usage: ModelCallUsageInput | null | undefined): ModelCallUsageNormalization;
-declare function modelCallUsageTelemetry(usage: ModelCallUsageInput | null | undefined): ModelCallUsageTelemetry;
-
-type NormalizedRuntimeEvent = {
+import type { ConfiguredModel, ModelProviderApi, ResolvedModelProvider, Settings } from "@opengeni/config";
+import { RequestHumanInputToolInput, type GitCredentialProvider, type GitCredentialTransport, type HumanInputResponse, type McpServerConnectionRef, type Permission, type FirstPartyMcpToolName, type LatencyMode, type ReasoningEffort, type ResourceRef, type SessionEventType, type ToolAuthNeededPayload, type ToolRef } from "@opengeni/contracts";
+import { Agent, RunState, type AgentInputItem, type CallModelInputFilter, type MCPServer, type Model, type ModelProvider, type RunStreamEvent, type Tool } from "@openai/agents";
+import { Capabilities, Manifest, type LocalDirLazySkillSource, type SandboxClient, type SandboxSessionLike, type SandboxSessionState } from "@openai/agents/sandbox";
+import OpenAI from "openai";
+import { type ProviderContextTokenSignal } from "./context-compaction";
+import { type RunCredentialSessionReady } from "./sandbox";
+import { type TurnSandboxCommandArgs, type TurnSandboxCommandSession, type TurnToolCancellationFence } from "./sandbox/turn-tool-cancellation";
+import { type ComputerToolMode } from "./sandbox-computer";
+import type { RuntimeMetricsHooks } from "./metrics";
+import { type WorkspaceSkillSearchPath } from "./workspace-skills";
+export { getSkillLibraryEntry, isSkillLibraryEntryId, listSkillLibraryEntries, loadSkillLibrarySkill, type SkillLibraryEntry, type SkillLibraryFile, type SkillLibrarySkill, } from "./skill-library";
+export type { RuntimeMetricsHooks } from "./metrics";
+export { createTurnToolCancellationController, TurnSandboxCommandCancelledError, } from "./sandbox/turn-tool-cancellation";
+export type { TurnSandboxCommandArgs, TurnSandboxCommandSession, TurnToolCancellationController, TurnToolCancellationFence, } from "./sandbox/turn-tool-cancellation";
+export { SandboxComputer, ComputerUseCapability, computerUse, ComputerUnavailableError, ComputerReadOnlyError, ComputerActionError, type SandboxComputerOptions, type ComputerUseArgs, type ComputerToolMode, } from "./sandbox-computer";
+export * from "./sandbox";
+export { elideSupersededViewImagePairs, sanitizeHistoryItemsForModel, stripReasoningEncryptedContent, stripReasoningIdentityFromSerializedRunState, neutralizeToolSearchItemsInSerializedRunState, } from "./history-sanitizer";
+export type { HistoryItem } from "./history-sanitizer";
+export { OpenAIChatCompletionsModel, OpenAIResponsesModel } from "@openai/agents";
+export { CompactionNeededError, CompactionProviderResponseError, EmptyCompactionSummaryError, buildCompactionPromptInput, buildCompactionReplacementHistory, compactionReplacementFingerprint, compactionThresholdTokens, clampCompactionThresholdRatio, decideCompaction, buildSummaryItem, buildRemoteCompactionV2PromptInput, buildRemoteV2ReplacementHistory, extractRemoteCompactionV2OutputItem, findCompactionNeededError, isCompactionSummary, isRemoteCompactionItem, isRetainedRemoteV2Message, latestCompactionReplacementFingerprint, prepareCompactionPromptInput, isUserMessage, estimateTokens, estimateTokensBreakdown, estimateItemTokens, estimateItemTokenBreakdown, estimateOpaqueEncryptedModelVisibleBytes, estimateOpaqueEncryptedTokens, opaqueEncryptedContentLength, estimateNativeImageTokens, estimateCompleteModelInput, estimateSerializedValueTokens, hasModelGeneratedItem, renderCompactionPromptInputForChat, COMPACTION_SUMMARY_MARKER, COMPACTION_PROMPT, COMPACT_USER_MESSAGE_MAX_TOKENS, REMOTE_V2_RETAINED_MESSAGE_TOKEN_BUDGET, REMOTE_COMPACTION_V2_IMPLEMENTATION, REMOTE_COMPACTION_V2_BETA_FEATURE, DEFAULT_COMPACTION_THRESHOLD_RATIO, MIN_COMPACTION_THRESHOLD_RATIO, MAX_COMPACTION_THRESHOLD_RATIO, SUMMARY_BUFFER_TOKENS, SUMMARY_PREFIX, USER_MESSAGE_TRUNCATION_MARKER, UNKNOWN_IMAGE_TOKENS, MAX_NATIVE_IMAGE_TOKENS, } from "./context-compaction";
+export type { CompactionDecision, ModelInputTokenBreakdown, NativeImageEstimateReason, NativeImageTokenEstimate, CompactionItem, PreparedCompactionPromptInput, } from "./context-compaction";
+export { MAX_MODEL_USAGE_TOKEN_COUNT, modelCallUsageTelemetry, modelUsageTokenCountOrNull, normalizeModelCallUsage, } from "./usage-telemetry";
+export type { ModelCallUsageInput, ModelCallUsageNormalization, ModelCallUsageTelemetry, } from "./usage-telemetry";
+export type NormalizedRuntimeEvent = {
     type: SessionEventType;
     payload: unknown;
 };
-type ModelResponseUsage = {
+export type ModelResponseUsage = {
     responseId?: string;
+    serviceTier?: string;
     usage: {
         inputTokens?: number;
         outputTokens?: number;
@@ -612,7 +50,7 @@ type ModelResponseUsage = {
     };
 };
 type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-type ResolveConnectionCredentialInput = {
+export type ResolveConnectionCredentialInput = {
     workspaceId: string;
     subjectId?: string;
     serverId: string;
@@ -622,7 +60,7 @@ type ResolveConnectionCredentialInput = {
     destinationUrl: string;
     forceRefresh?: boolean;
 };
-type ResolveConnectionCredentialResult = {
+export type ResolveConnectionCredentialResult = {
     status: "ok";
     headers: Record<string, string>;
     connectionId: string;
@@ -638,8 +76,8 @@ type ResolveConnectionCredentialResult = {
     selectedResources?: McpServerConnectionRef["selectedResources"];
     authorizationUrl?: string;
 };
-declare function ensureReadableStreamFrom(): void;
-type AgentSegmentInput = {
+export declare function ensureReadableStreamFrom(): void;
+export type AgentSegmentInput = {
     kind: "message";
     /** A real human/API prompt. Omitted when resuming the same inference. */
     text?: string;
@@ -658,16 +96,16 @@ type AgentSegmentInput = {
     serializedRunState: string;
     toolCallId: string;
 };
-type PreparedAgentInput = {
+export type PreparedAgentInput = {
     input: string | AgentInputItem[] | RunState<any, any>;
     sandboxSessionState?: SandboxSessionState;
 };
-declare const HUMAN_INPUT_TOOL_NAME = "request_human_input";
-type SerializedHumanInputInterruption = {
+export declare const HUMAN_INPUT_TOOL_NAME = "request_human_input";
+export type SerializedHumanInputInterruption = {
     toolCallId: string;
     input: ReturnType<typeof RequestHumanInputToolInput.parse>;
 };
-type SandboxFileDownload = {
+export type SandboxFileDownload = {
     fileId: string;
     mountPath: string;
     filename: string;
@@ -676,7 +114,7 @@ type SandboxFileDownload = {
     expiresAt?: Date | string;
     sizeBytes?: number;
 };
-type SandboxFileDownloadFailure = {
+export type SandboxFileDownloadFailure = {
     fileId: string;
     filename: string;
     path: string;
@@ -684,11 +122,11 @@ type SandboxFileDownloadFailure = {
     exitCode?: number;
     output?: string;
 };
-type SandboxFileDownloadMaterializationResult = {
+export type SandboxFileDownloadMaterializationResult = {
     failures: SandboxFileDownloadFailure[];
 };
-declare function configureRuntimeMetricsHooks(hooks: RuntimeMetricsHooks | null | undefined): void;
-type OpenGeniRuntime = {
+export declare function configureRuntimeMetricsHooks(hooks: RuntimeMetricsHooks | null | undefined): void;
+export type OpenGeniRuntime = {
     configure: (settings: Settings) => void;
     resolveTurnModel: (settings: Settings, modelId: string) => ReturnType<typeof resolveTurnModel>;
     buildAgent: (settings: Settings, resources: ResourceRef[], options?: BuildAgentOptions) => Agent<any, any>;
@@ -698,12 +136,12 @@ type OpenGeniRuntime = {
     serializeApprovals: (interruptions: unknown[]) => unknown[];
     serializeHumanInputRequests?: (interruptions: unknown[]) => SerializedHumanInputInterruption[];
 };
-type ProductionRuntimeOverrides = {
+export type ProductionRuntimeOverrides = {
     model?: Model;
     sandboxClient?: unknown;
     metrics?: RuntimeMetricsHooks;
 };
-declare function createProductionAgentRuntime(overrides?: ProductionRuntimeOverrides): OpenGeniRuntime;
+export declare function createProductionAgentRuntime(overrides?: ProductionRuntimeOverrides): OpenGeniRuntime;
 /**
  * Build an OpenAI client from settings for the configured provider. Mirrors the
  * client construction in configureOpenAI so a direct API call (the compaction
@@ -711,8 +149,8 @@ declare function createProductionAgentRuntime(overrides?: ProductionRuntimeOverr
  * the OpenAI-platform path has only a key (the SDK default client is used via
  * setDefaultOpenAIKey there); the caller then constructs a key-only client.
  */
-declare function buildOpenAIClientFromSettings(settings: Settings, providerId?: string): OpenAI;
-declare function buildProviderClient(provider: ResolvedModelProvider, settings: Settings): OpenAI;
+export declare function buildOpenAIClientFromSettings(settings: Settings, providerId?: string): OpenAI;
+export declare function buildProviderClient(provider: ResolvedModelProvider, settings: Settings): OpenAI;
 /**
  * Bind a model id to a provider's OpenAI client as an @openai/agents `Model`
  * instance, choosing the wire API by the provider's declared `api`: the "chat"
@@ -722,7 +160,7 @@ declare function buildProviderClient(provider: ResolvedModelProvider, settings:
  * the agent is what routes a turn to its provider without mutating the global
  * default client.
  */
-declare function buildModelInstance(provider: ResolvedModelProvider, client: OpenAI, modelId: string): Model;
+export declare function buildModelInstance(provider: ResolvedModelProvider, client: OpenAI, modelId: string): Model;
 /**
  * Resolved per-turn model routing: the provider that serves `modelId`, its
  * (cached) OpenAI client, the provider-bound `Model` instance, and the
@@ -731,7 +169,7 @@ declare function buildModelInstance(provider: ResolvedModelProvider, client: Ope
  * back to the legacy global-client path (settings.openaiModel + the default
  * client configured by configureOpenAI), preserved byte-for-byte.
  */
-declare function resolveTurnModel(settings: Settings, modelId: string): {
+export declare function resolveTurnModel(settings: Settings, modelId: string): {
     provider: ResolvedModelProvider;
     client: OpenAI;
     model: Model;
@@ -757,7 +195,7 @@ declare function resolveTurnModel(settings: Settings, modelId: string): {
  * The process default remains only as a boot-time fallback. Falls back to the
  * SDK default provider for a model that is in no provider's allow-list.
  */
-declare class MultiProviderModelProvider implements ModelProvider {
+export declare class MultiProviderModelProvider implements ModelProvider {
     private readonly settings;
     private fallback;
     constructor(settings: Settings);
@@ -772,7 +210,7 @@ declare class MultiProviderModelProvider implements ModelProvider {
  * and carries no status/code, so agentRunFailurePayload surfaces it verbatim as
  * a non-retryable turn.failed the session UI shows.
  */
-declare class CodexSubscriptionUnavailableError extends Error {
+export declare class CodexSubscriptionUnavailableError extends Error {
     constructor(modelName: string);
 }
 /**
@@ -783,10 +221,10 @@ declare class CodexSubscriptionUnavailableError extends Error {
  * the paid built-in client. Like CodexSubscriptionUnavailableError the message
  * is user-actionable and surfaces verbatim as a non-retryable turn.failed.
  */
-declare class WorkspaceModelPolicyBlockedError extends Error {
+export declare class WorkspaceModelPolicyBlockedError extends Error {
     constructor(modelName: string, providerId: string, reason: "provider" | "model");
 }
-declare function configureOpenAI(settings: Settings): void;
+export declare function configureOpenAI(settings: Settings): void;
 /**
  * Run the compaction summarizer as one plain, tool-less, non-streaming model
  * call against the resolved provider. `input` is the active history plus
@@ -804,7 +242,7 @@ declare function configureOpenAI(settings: Settings): void;
  * supplied it uses the built-in OpenAI/Azure Responses path. store:false is set
  * only on the OpenAI-platform Responses path (Azure rejects it; chat ignores it).
  */
-declare function summarizeForCompaction(settings: Settings, input: Array<Record<string, unknown>>, options?: {
+export declare function summarizeForCompaction(settings: Settings, input: Array<Record<string, unknown>>, options?: {
     client?: OpenAI;
     api?: ModelProviderApi;
     maxOutputTokens?: number;
@@ -813,10 +251,21 @@ declare function summarizeForCompaction(settings: Settings, input: Array<Record<
     systemInstructions?: string;
     onUsage?: (usage: ModelResponseUsage) => void | Promise<void>;
 }): Promise<string>;
+/**
+ * Codex remote compaction v2: send active history + `compaction_trigger`, collect
+ * exactly one `{ type: "compaction", encrypted_content }` output item.
+ * Must run inside Codex ALS with `remote_compaction_v2` beta + turn metadata.
+ */
+export declare function requestRemoteCompactionV2(settings: Settings, input: Array<Record<string, unknown>>, options: {
+    client: OpenAI;
+    model: string;
+    promptCacheKey?: string;
+    onUsage?: (usage: ModelResponseUsage) => void | Promise<void>;
+}): Promise<Record<string, unknown>>;
 /** Bounded provider diagnostics: identifiers and classifications, never messages or model data. */
-declare function compactionProviderFailureDiagnostics(error: unknown): Record<string, unknown>;
+export declare function compactionProviderFailureDiagnostics(error: unknown): Record<string, unknown>;
 /** Bounded, content-free diagnostics for a semantically empty checkpoint. */
-declare function compactionResponseDiagnostics(response: unknown, extractedText?: string): Record<string, unknown>;
+export declare function compactionResponseDiagnostics(response: unknown, extractedText?: string): Record<string, unknown>;
 /**
  * Pull the assistant text out of a Responses API result, shape-tolerant. Only
  * `role === "assistant"` message items contribute: a provider whose Responses
@@ -825,9 +274,9 @@ declare function compactionResponseDiagnostics(response: unknown, extractedText?
  * otherwise corrupt the summary with the prompt it was given. The OpenAI/Azure
  * Responses API only emits assistant messages, so this guard is a no-op there.
  */
-declare function extractResponseOutputText(response: unknown): string;
-type GitTokenSeeds = Partial<Record<GitCredentialProvider, string>>;
-type GitCredentialBindingSeed = {
+export declare function extractResponseOutputText(response: unknown): string;
+export type GitTokenSeeds = Partial<Record<GitCredentialProvider, string>>;
+export type GitCredentialBindingSeed = {
     credentialBindingId: string;
     provider: GitCredentialProvider;
     token: string;
@@ -836,9 +285,9 @@ type GitCredentialBindingSeed = {
     /** Total active bindings for this provider, used to suppress unsafe aliases. */
     providerBindingCount?: number;
 };
-type GitCredentialTokenWriterSession = SandboxSessionLike;
-type ToolspaceTokenWriterSession = SandboxSessionLike;
-type EffectiveSkillSelection = Readonly<{
+export type GitCredentialTokenWriterSession = SandboxSessionLike;
+export type ToolspaceTokenWriterSession = SandboxSessionLike;
+export type EffectiveSkillSelection = Readonly<{
     id: string;
     name: string;
     source: "bundled" | "library" | "pack" | "session";
@@ -852,8 +301,8 @@ type EffectiveSkillSelection = Readonly<{
  * effective configuration inspection cannot accidentally expose credentials or
  * turn skill activation into an authorization change.
  */
-declare function effectiveSkillSelectionsForAgent(agent: object): readonly EffectiveSkillSelection[];
-type BuildAgentOptions = {
+export declare function effectiveSkillSelectionsForAgent(agent: object): readonly EffectiveSkillSelection[];
+export type BuildAgentOptions = {
     model?: Model;
     /** Settled response for the one internal human-input interruption resumed by this run. */
     humanInputResponse?: {
@@ -862,6 +311,10 @@ type BuildAgentOptions = {
         response: HumanInputResponse;
     };
     reasoningEffort?: ReasoningEffort;
+    /** Product latency selection frozen onto this turn. */
+    latencyMode?: LatencyMode;
+    /** Provider-specific wire value resolved by the worker (`fast` or `priority`). */
+    serviceTier?: "fast" | "priority";
     hostedWebSearch?: boolean;
     encryptedReasoning?: boolean;
     structuredToolTransport?: boolean;
@@ -911,11 +364,11 @@ type BuildAgentOptions = {
      */
     onToolCancellationFence?: (fence: TurnToolCancellationFence) => void;
 };
-type PackSkillFile = {
+export type PackSkillFile = {
     path: string;
     content: string;
 };
-type PackSkill = {
+export type PackSkill = {
     name: string;
     description?: string | null | undefined;
     files: PackSkillFile[];
@@ -928,12 +381,12 @@ type PackSkill = {
  * agent must not have to rediscover that by enumerating `env` and guessing.
  * Only metadata belongs here — never variable values.
  */
-type WorkspaceEnvironmentContext = {
+export type WorkspaceEnvironmentContext = {
     name: string;
     description?: string | null;
     variableNames?: string[];
 };
-type PersistentSessionSettings = {
+export type PersistentSessionSettings = {
     titleIsSet: boolean;
 };
 /**
@@ -943,12 +396,12 @@ type PersistentSessionSettings = {
  * machine definition and how to promote a durable change. Absent for rig-less
  * sessions (the block never renders).
  */
-type RigInstructionsContext = {
+export type RigInstructionsContext = {
     name: string;
     version: number;
 };
-declare function rigInstructions(rig: RigInstructionsContext): string[];
-declare function workspaceEnvironmentInstructions(environment: WorkspaceEnvironmentContext): string[];
+export declare function rigInstructions(rig: RigInstructionsContext): string[];
+export declare function workspaceEnvironmentInstructions(environment: WorkspaceEnvironmentContext): string[];
 /**
  * The non-bypassable CORE of the agent instructions: the goal-loop ownership
  * line (which names the opengeni__goal_* tools and is what keeps a long-running
@@ -960,7 +413,7 @@ declare function workspaceEnvironmentInstructions(environment: WorkspaceEnvironm
  * drop: composeAgentInstructions() substitutes it at the persona template's
  * {{core}} marker, and appends it when the marker is absent.
  */
-declare function coreInstructions(workspaceEnvironment?: WorkspaceEnvironmentContext, rig?: RigInstructionsContext): string[];
+export declare function coreInstructions(workspaceEnvironment?: WorkspaceEnvironmentContext, rig?: RigInstructionsContext): string[];
 /**
  * Composes the final agent instructions from a (possibly white-labelled)
  * persona template and the non-bypassable CORE. The CORE is substituted at the
@@ -969,7 +422,7 @@ declare function coreInstructions(workspaceEnvironment?: WorkspaceEnvironmentCon
  * and the append both join by " ", so the DEFAULT_AGENT_INSTRUCTIONS template
  * with an empty environment reproduces the historical preamble byte-for-byte.
  */
-declare function composeAgentInstructions(template: string, workspaceEnvironment?: WorkspaceEnvironmentContext, rig?: RigInstructionsContext): string;
+export declare function composeAgentInstructions(template: string, workspaceEnvironment?: WorkspaceEnvironmentContext, rig?: RigInstructionsContext): string;
 /**
  * Appends the per-session persona instructions to the already-composed
  * (workspace + CORE) instructions, joined by " " — exactly the join used
@@ -977,9 +430,9 @@ declare function composeAgentInstructions(template: string, workspaceEnvironment
  * (session-specific refinement of the workspace persona). An absent/blank value
  * is a no-op that returns the composed string byte-for-byte.
  */
-declare function appendSessionInstructions(composed: string, sessionInstructions?: string): string;
+export declare function appendSessionInstructions(composed: string, sessionInstructions?: string): string;
 /** Append system instructions that apply to this exact turn only. */
-declare function appendTurnInstructions(composed: string, turnInstructions?: string): string;
+export declare function appendTurnInstructions(composed: string, turnInstructions?: string): string;
 /**
  * Append the durable session metadata the model otherwise cannot observe.
  * This is deliberately declarative and excludes the title text: the title is
@@ -987,7 +440,7 @@ declare function appendTurnInstructions(composed: string, turnInstructions?: str
  * initialization has already happened. The block is present on every turn when
  * supplied so compaction cannot erase knowledge that these settings persist.
  */
-declare function appendPersistentSessionSettings(composed: string, settings?: PersistentSessionSettings): string;
+export declare function appendPersistentSessionSettings(composed: string, settings?: PersistentSessionSettings): string;
 /**
  * Appends the workspace memory working-set block to the already-composed
  * (workspace + CORE + generic substrate) instructions, joined by " ". The
@@ -995,7 +448,7 @@ declare function appendPersistentSessionSettings(composed: string, settings?: Pe
  * per-session instructions. An absent/blank value is a no-op that returns the
  * composed string byte-for-byte.
  */
-declare function appendWorkspaceMemory(composed: string, workspaceMemory?: string): string;
+export declare function appendWorkspaceMemory(composed: string, workspaceMemory?: string): string;
 /**
  * Appends the generic programmatic-tool-calling (toolspace) directive to the
  * composed workspace + CORE instructions, joined by " ". This is GENERIC
@@ -1011,7 +464,7 @@ declare function appendWorkspaceMemory(composed: string, workspaceMemory?: strin
  * per-session instructions so host/session specificity still wins over this
  * substrate note.
  */
-declare function appendToolspaceInstructions(composed: string, toolspaceAvailable: boolean): string;
+export declare function appendToolspaceInstructions(composed: string, toolspaceAvailable: boolean): string;
 /**
  * Make multi-account provider-CLI selection discoverable to the model.
  *
@@ -1019,13 +472,13 @@ declare function appendToolspaceInstructions(composed: string, toolspaceAvailabl
  * secret-free repository mapping is materialized in the sandbox by the Git
  * setup hook so prompts stay compact.
  */
-declare function appendGitCredentialBindingInstructions(composed: string, bindings: GitCredentialBindingSeed[] | undefined, activeSandboxBackend?: Settings["sandboxBackend"]): string;
+export declare function appendGitCredentialBindingInstructions(composed: string, bindings: GitCredentialBindingSeed[] | undefined, activeSandboxBackend?: Settings["sandboxBackend"]): string;
 /**
  * Appends the one-shot genesis title directive (genesis turn only), joined by
  * " " and always LAST so a white-label persona template or a per-session
  * instruction can't drop it. A no-op when the hint is absent.
  */
-declare function appendGenesisTitleDirective(instructions: string, genesisTitleHint?: boolean): string;
+export declare function appendGenesisTitleDirective(instructions: string, genesisTitleHint?: boolean): string;
 /**
  * The tool output emitted for an MCP tool call that FAILED with a THROWN error
  * — a JSON-RPC protocol error (e.g. -32602 invalid params), an auth 401/403, a
@@ -1050,14 +503,14 @@ declare function appendGenesisTitleDirective(instructions: string, genesisTitleH
  * requires an SDK-level change (preserve `isError`) or reading the raw
  * CallToolResult — tracked separately.
  */
-declare function mcpToolErrorOutput(error: unknown): {
+export declare function mcpToolErrorOutput(error: unknown): {
     isError: true;
     content: [{
         type: "text";
         text: string;
     }];
 };
-declare function buildOpenGeniAgent(settings: Settings, resources: ResourceRef[], options?: BuildAgentOptions): Agent<any, any>;
+export declare function buildOpenGeniAgent(settings: Settings, resources: ResourceRef[], options?: BuildAgentOptions): Agent<any, any>;
 /**
  * Codex accepts ordinary FUNCTION tools but also accepts `input_image` content
  * inside a function_call_output (the same transport used by codex-rs
@@ -1067,8 +520,8 @@ declare function buildOpenGeniAgent(settings: Settings, resources: ResourceRef[]
  * base64 characters. Re-wrap only successful data-URL results as a structured
  * image. Text errors remain text, and the tool itself remains a normal function.
  */
-declare function withStructuredViewImageFunctionResults(tools: Tool<unknown>[]): Tool<unknown>[];
-declare function buildAgentCapabilities(settings: Settings, packSkills: PackSkill[], options?: {
+export declare function withStructuredViewImageFunctionResults(tools: Tool<unknown>[]): Tool<unknown>[];
+export declare function buildAgentCapabilities(settings: Settings, packSkills: PackSkill[], options?: {
     skillLibrarySkills?: PackSkill[];
     sessionSkills?: PackSkill[];
     workspaceSkillPaths?: readonly WorkspaceSkillSearchPath[];
@@ -1078,13 +531,13 @@ declare function buildAgentCapabilities(settings: Settings, packSkills: PackSkil
     turnCancellationSignal?: AbortSignal;
     onToolCancellationFence?: (fence: TurnToolCancellationFence) => void;
 }): ReturnType<typeof Capabilities.default>;
-declare function sandboxRunAs(_settings: Settings): string | undefined;
-type PreparedAgentTools = {
+export declare function sandboxRunAs(_settings: Settings): string | undefined;
+export type PreparedAgentTools = {
     mcpServers: MCPServer[];
     close: () => Promise<void>;
     codexConnectorNamespaces: Set<string>;
 };
-type PrepareToolsOptions = {
+export type PrepareToolsOptions = {
     accountId?: string;
     workspaceId?: string;
     sessionId?: string;
@@ -1101,7 +554,7 @@ type PrepareToolsOptions = {
     /** Injectable final MCP transport for tests and embedded hosts. */
     mcpFetchImpl?: FetchLike;
 };
-type ConnectedMcpServerBatches = {
+export type ConnectedMcpServerBatches = {
     active: MCPServer[];
     failed: MCPServer[];
     errors: ReadonlyMap<MCPServer, Error>;
@@ -1112,17 +565,30 @@ type ConnectedMcpServerBatches = {
  * failing strict batch; this wrapper additionally closes every earlier batch
  * before rethrowing, so a later-batch failure cannot leak live connections.
  */
-declare function connectMcpServersInBatches(servers: MCPServer[], options: {
+export declare function connectMcpServersInBatches(servers: MCPServer[], options: {
     strict: boolean;
     connectTimeoutMs?: number;
 }): Promise<ConnectedMcpServerBatches>;
-declare function prepareAgentTools(settings: Settings, tools: ToolRef[], options?: PrepareToolsOptions): Promise<PreparedAgentTools>;
-declare function prefixedMcpToolName(registryId: string, toolName: string): string;
-type PrepareInputOptions = {
+export declare function prepareAgentTools(settings: Settings, tools: ToolRef[], options?: PrepareToolsOptions): Promise<PreparedAgentTools>;
+type SafeMcpTransportError = Error & {
+    status?: number;
+    code?: number;
+    mcpTransportFailureKind?: "request_timeout";
+};
+/**
+ * Preserve the MCP SDK's exact request-timeout meaning without retaining or
+ * exposing a raw HTTP response body. The numeric code is not sufficient:
+ * Streamable HTTP also uses -32001 for "Session not found" and arbitrary
+ * AbortSignal reasons, so only the SDK's two owned timeout messages qualify.
+ */
+export declare function isMcpRequestTimeoutError(error: unknown, seen?: WeakSet<object>): boolean;
+export declare function safeMcpTransportError(error: unknown): SafeMcpTransportError;
+export declare function prefixedMcpToolName(registryId: string, toolName: string): string;
+export type PrepareInputOptions = {
     sandboxClient?: unknown;
 };
-declare function prepareRunInput(agent: Agent<any, any>, input: AgentSegmentInput, options?: PrepareInputOptions): Promise<PreparedAgentInput>;
-type RunAgentStreamOptions = {
+export declare function prepareRunInput(agent: Agent<any, any>, input: AgentSegmentInput, options?: PrepareInputOptions): Promise<PreparedAgentInput>;
+export type RunAgentStreamOptions = {
     /** Abort the provider/tool loop when the owning activity is cancelled. */
     signal?: AbortSignal;
     sandboxClient?: unknown;
@@ -1151,12 +617,12 @@ type RunAgentStreamOptions = {
     turnToolCancellationFence?: TurnToolCancellationFence;
     callModelInputFilter?: CallModelInputFilter;
 };
-type ContextRobustnessFilterOptions = {
+export type ContextRobustnessFilterOptions = {
     contextCompactionSignal?: () => ProviderContextTokenSignal | null | undefined;
     contextCompactionRequested?: () => boolean | Promise<boolean>;
     throwOnCompactionNeeded?: boolean;
 };
-declare const GENESIS_TITLE_DIRECTIVE = "This is the first turn of a new session. Before responding to the user, call the opengeni__set_session_title tool with a concise 3-7 word title that summarizes what this session is about, then address the user's request normally.";
+export declare const GENESIS_TITLE_DIRECTIVE = "This is the first turn of a new session. Before responding to the user, call the opengeni__set_session_title tool with a concise 3-7 word title that summarizes what this session is about, then address the user's request normally.";
 /**
  * Inject the genesis-title directive into exactly one model request. Agent
  * instructions are reused for every model call in a tool loop, so placing this
@@ -1164,8 +630,8 @@ declare const GENESIS_TITLE_DIRECTIVE = "This is the first turn of a new session
  * calls. The closure is intentionally consumed even when the first request
  * fails: a retry/recovery must continue the task, not restart setup.
  */
-declare function oneShotGenesisTitleInputFilter(): CallModelInputFilter;
-declare const TOOLSPACE_PROGRAMMATIC_DIRECTIVE = "Every tool on your MCP surface is also callable programmatically from the sandbox shell, so scripts can invoke tools without a model round trip per call. If `ogtool` is installed, run `ogtool list` to see the available tools and their input schemas (from tools/list), then `ogtool call <tool-name> '<json-args>'`. If it is absent and both npm and $OPENGENI_OGTOOL_PACKAGE_SPEC are available, run the exact deployment-pinned package with `npm exec --yes --package=\"$OPENGENI_OGTOOL_PACKAGE_SPEC\" -- ogtool ...`; never guess a version or install `latest`. Otherwise POST MCP JSON-RPC directly to $OPENGENI_TOOLSPACE_URL with the bearer token read from $OPENGENI_TOOLSPACE_TOKEN_FILE. Prefer programmatic calls for loops, polling, and bulk filtering: their results stay in the sandbox and do not consume your context window. Tools that require human approval must still be invoked normally \u2014 called programmatically they return a typed error.";
+export declare function oneShotGenesisTitleInputFilter(): CallModelInputFilter;
+export declare const TOOLSPACE_PROGRAMMATIC_DIRECTIVE = "Every tool on your MCP surface is also callable programmatically from the sandbox shell, so scripts can invoke tools without a model round trip per call. If `ogtool` is installed, run `ogtool list` to see the available tools and their input schemas (from tools/list), then `ogtool call <tool-name> '<json-args>'`. If it is absent and both npm and $OPENGENI_OGTOOL_PACKAGE_SPEC are available, run the exact deployment-pinned package with `npm exec --yes --package=\"$OPENGENI_OGTOOL_PACKAGE_SPEC\" -- ogtool ...`; never guess a version or install `latest`. Otherwise POST MCP JSON-RPC directly to $OPENGENI_TOOLSPACE_URL with the bearer token read from $OPENGENI_TOOLSPACE_TOKEN_FILE. Prefer programmatic calls for loops, polling, and bulk filtering: their results stay in the sandbox and do not consume your context window. Tools that require human approval must still be invoked normally \u2014 called programmatically they return a typed error.";
 /**
  * callModelInputFilter that removes provider-assigned item ids (rs_/msg_/fc_…)
  * from every input item immediately before each model call. Responses-API
@@ -1179,7 +645,7 @@ declare const TOOLSPACE_PROGRAMMATIC_DIRECTIVE = "Every tool on your MCP surface
  * fragility without adding information. Pairing fields (`call_id`/`callId`)
  * are separate properties and stay untouched; items are cloned, never mutated.
  */
-declare const stripProviderItemIdsFilter: CallModelInputFilter;
+export declare const stripProviderItemIdsFilter: CallModelInputFilter;
 /**
  * callModelInputFilter that normalizes every `computer_call` carrying BOTH
  * `action` and `actions` down to EXACTLY ONE (keeps `actions`, drops `action`).
@@ -1194,20 +660,14 @@ declare const stripProviderItemIdsFilter: CallModelInputFilter;
  * which the turn-start `prepareRunInput` sanitizer never sees. Items are cloned,
  * never mutated.
  */
-declare const normalizeComputerCallsFilter: CallModelInputFilter;
-/**
- * Per-call state compaction for local image inspection. Re-opening the same
- * path supersedes its prior base64 result; carrying both provides no newer
- * information and can otherwise balloon every following model request.
- */
-declare const elideSupersededViewImagesFilter: CallModelInputFilter;
+export declare const normalizeComputerCallsFilter: CallModelInputFilter;
 /**
  * Canonical Codex-style tool-result bound at the final model-input seam. The
  * identical pure normalizer also runs before conversation rows are persisted,
  * so this is a live-turn defense rather than a request-only alternate history.
  */
-declare function boundModelToolOutputsFilterForSettings(settings: Settings): CallModelInputFilter;
-declare function contextRobustnessFilterForSettings(settings: Settings, options?: ContextRobustnessFilterOptions): CallModelInputFilter;
+export declare function boundModelToolOutputsFilterForSettings(settings: Settings): CallModelInputFilter;
+export declare function contextRobustnessFilterForSettings(settings: Settings, options?: ContextRobustnessFilterOptions): CallModelInputFilter;
 /**
  * The model-input filter applied before every model call. The computer_call
  * action/actions normalizer is ALWAYS on (the Azure endpoint 400s without it);
@@ -1216,9 +676,9 @@ declare function contextRobustnessFilterForSettings(settings: Settings, options?
  * compaction signal on the client-compaction path. It never trims history from
  * an individual request.
  */
-declare function callModelInputFilterForSettings(settings: Settings, options?: ContextRobustnessFilterOptions): CallModelInputFilter | undefined;
-declare function runAgentStream(agent: Agent<any, any>, input: PreparedAgentInput | string | RunState<any, any>, settings: Settings, overrides?: RunAgentStreamOptions): Promise<_openai_agents.StreamedRunResult<any, Agent<any, any>>>;
-
+export declare function callModelInputFilterForSettings(settings: Settings, options?: ContextRobustnessFilterOptions): CallModelInputFilter | undefined;
+export declare function runAgentStream(agent: Agent<any, any>, input: PreparedAgentInput | string | RunState<any, any>, settings: Settings, overrides?: RunAgentStreamOptions): Promise<import("@openai/agents").StreamedRunResult<any, Agent<any, any>>>;
+export { MaxTurnsExceededError } from "@openai/agents";
 /**
  * Detects the agents SDK per-segment turn cap. The cap is a pacing valve, not
  * a session failure: callers should end the segment gracefully (idle) so an
@@ -1226,7 +686,7 @@ declare function runAgentStream(agent: Agent<any, any>, input: PreparedAgentInpu
  * the work. When the SDK attached the run state at the moment the cap hit,
  * the serialized form is returned so the resumed turn keeps full context.
  */
-declare function maxTurnsExceededRunState(error: unknown): {
+export declare function maxTurnsExceededRunState(error: unknown): {
     serializedRunState: string | null;
 } | null;
 /**
@@ -1235,15 +695,15 @@ declare function maxTurnsExceededRunState(error: unknown): {
  * must treat a null here as "resume from the previous snapshot" rather than
  * an error.
  */
-declare function agentsErrorRunState(error: unknown): string | null;
-declare function withManifestRefreshOnResume(client: SandboxClient, targetManifest: Manifest | undefined, context?: Pick<SandboxLifecycleHookContext, "onRuntimeEvent">): SandboxClient;
-declare function applyMissingManifestEntries(session: SandboxSessionLike, targetManifest: Manifest, context?: Pick<SandboxLifecycleHookContext, "onRuntimeEvent">): Promise<void>;
+export declare function agentsErrorRunState(error: unknown): string | null;
+export declare function withManifestRefreshOnResume(client: SandboxClient, targetManifest: Manifest | undefined, context?: Pick<SandboxLifecycleHookContext, "onRuntimeEvent">): SandboxClient;
+export declare function applyMissingManifestEntries(session: SandboxSessionLike, targetManifest: Manifest, context?: Pick<SandboxLifecycleHookContext, "onRuntimeEvent">): Promise<void>;
 /**
  * Key-level diff of the live box's baked manifest env vs the freshly recomputed
  * target env. Returns null when identical. Key NAMES only — values are secrets
  * and must never leave this function's comparison.
  */
-declare function manifestEnvironmentDrift(current: Manifest, target: Manifest): {
+export declare function manifestEnvironmentDrift(current: Manifest, target: Manifest): {
     added: string[];
     removed: string[];
     changed: string[];
@@ -1259,7 +719,7 @@ declare function manifestEnvironmentDrift(current: Manifest, target: Manifest):
  * names only) instead of letting it kill the session. Fresh env lands at the
  * next cold-create; rotating values ride OFF-manifest (TOKEN-BROKER B1/B2).
  */
-declare function pinProvidedSessionManifestEnvironment(agent: Agent<any, any>, session: SandboxSessionLike, context?: Pick<SandboxLifecycleHookContext, "onRuntimeEvent">): Promise<void>;
+export declare function pinProvidedSessionManifestEnvironment(agent: Agent<any, any>, session: SandboxSessionLike, context?: Pick<SandboxLifecycleHookContext, "onRuntimeEvent">): Promise<void>;
 /**
  * The one-truth owned-path platform setup: the manifest-env pin (align the turn's
  * manifest to the live box's baked env + report drift, NEVER die on it) plus the
@@ -1281,7 +741,7 @@ declare function pinProvidedSessionManifestEnvironment(agent: Agent<any, any>, s
  * run-scoped provider tokens (minted at establish time, not turn start);
  * unset ⇒ read the seeds off the agent exactly as the eager path does.
  */
-declare function runOwnedSandboxSetup(agent: Agent<any, any>, session: SandboxSessionLike, setupSession: SandboxSessionLike, opts: {
+export declare function runOwnedSandboxSetup(agent: Agent<any, any>, session: SandboxSessionLike, setupSession: SandboxSessionLike, opts: {
     settings: Settings;
     environment: Record<string, string>;
     preparedInput?: PreparedAgentInput;
@@ -1293,30 +753,40 @@ declare function runOwnedSandboxSetup(agent: Agent<any, any>, session: SandboxSe
     toolspaceTokenSeedOverride?: string;
     commandRunner?: SandboxLifecycleCommandRunner;
 }): Promise<void>;
-declare function withSandboxFileDownloads(client: SandboxClient, downloads: SandboxFileDownload[], context?: Pick<SandboxLifecycleHookContext, "onRuntimeEvent" | "runAs" | "commandRunner">): SandboxClient;
-declare function materializeSandboxFileDownloads(session: SandboxSessionLike, downloads: SandboxFileDownload[], context?: Pick<SandboxLifecycleHookContext, "onRuntimeEvent" | "runAs" | "commandRunner">): Promise<SandboxFileDownloadMaterializationResult>;
-declare function sandboxFileDownloadFailureNote(failures: SandboxFileDownloadFailure[]): string;
-declare function sandboxFileDownloadsForAgent(agent: unknown): SandboxFileDownload[];
+export declare function withSandboxFileDownloads(client: SandboxClient, downloads: SandboxFileDownload[], context?: Pick<SandboxLifecycleHookContext, "onRuntimeEvent" | "runAs" | "commandRunner">): SandboxClient;
+export declare function materializeSandboxFileDownloads(session: SandboxSessionLike, downloads: SandboxFileDownload[], context?: Pick<SandboxLifecycleHookContext, "onRuntimeEvent" | "runAs" | "commandRunner">): Promise<SandboxFileDownloadMaterializationResult>;
+export declare function sandboxFileDownloadFailureNote(failures: SandboxFileDownloadFailure[]): string;
+export declare function sandboxFileDownloadsForAgent(agent: unknown): SandboxFileDownload[];
 /**
  * Normalize a tool-call output for the lossy `agent.toolCall.output` audit event.
  * Inline image bytes/data URLs become a compact `media_preview` with exact byte
  * length where knowable and `fullOutputAvailable:false`. The model-facing output
  * is not changed here, and mixed arrays retain their non-image text/error facts.
  */
-declare function normalizeToolOutputForEvent(output: unknown): unknown;
-declare function normalizeSdkEvent(event: RunStreamEvent): NormalizedRuntimeEvent[];
-declare function modelResponseUsageFromSdkEvent(event: RunStreamEvent): ModelResponseUsage | null;
+export declare function normalizeToolOutputForEvent(output: unknown): unknown;
+export declare function normalizeSdkEvent(event: RunStreamEvent): NormalizedRuntimeEvent[];
+export declare function modelResponseUsageFromSdkEvent(event: RunStreamEvent): ModelResponseUsage | null;
 /** Normalize usage from either a Responses or Chat Completions result. */
-declare function modelResponseUsageFromResponse(response: unknown): ModelResponseUsage | null;
-declare function serializeApprovals(interruptions: unknown[]): unknown[];
-declare function serializeHumanInputRequests(interruptions: unknown[]): SerializedHumanInputInterruption[];
-declare function buildManifest(settings: Settings, resources: ResourceRef[], environment?: Record<string, string>, fileResourceDownloads?: SandboxFileDownload[]): Manifest;
-declare function repositoryWorkspaceSkillPathsOption(resources: readonly ResourceRef[]): {
+export declare function modelResponseUsageFromResponse(response: unknown): ModelResponseUsage | null;
+export type ModelResponseServiceTierEvent = {
+    source: "normalized" | "provider";
+    serviceTier: string | null;
+};
+/**
+ * Read the provider's terminal service tier without depending on usage being
+ * present. The normalized terminal can omit provider-only fields, so callers
+ * should treat the raw provider response as the fail-closed authority.
+ */
+export declare function modelResponseServiceTierFromSdkEvent(event: RunStreamEvent): ModelResponseServiceTierEvent | null;
+export declare function serializeApprovals(interruptions: unknown[]): unknown[];
+export declare function serializeHumanInputRequests(interruptions: unknown[]): SerializedHumanInputInterruption[];
+export declare function buildManifest(settings: Settings, resources: ResourceRef[], environment?: Record<string, string>, fileResourceDownloads?: SandboxFileDownload[]): Manifest;
+export declare function repositoryWorkspaceSkillPathsOption(resources: readonly ResourceRef[]): {
     workspaceSkillPaths?: readonly WorkspaceSkillSearchPath[];
 };
-type SandboxLifecycleHookPhase = "beforeAgentStart";
-type SandboxLifecycleCommandRunner = (session: TurnSandboxCommandSession, args: TurnSandboxCommandArgs) => Promise<unknown>;
-type SandboxLifecycleHookContext = {
+export type SandboxLifecycleHookPhase = "beforeAgentStart";
+export type SandboxLifecycleCommandRunner = (session: TurnSandboxCommandSession, args: TurnSandboxCommandArgs) => Promise<unknown>;
+export type SandboxLifecycleHookContext = {
     environment: Record<string, string>;
     onRuntimeEvent?: (event: NormalizedRuntimeEvent) => Promise<void> | void;
     runAs?: string;
@@ -1328,20 +798,20 @@ type SandboxLifecycleHookContext = {
     rigSetup?: RigSetupDescriptor;
     commandRunner?: SandboxLifecycleCommandRunner;
 };
-type RigSetupDescriptor = {
+export type RigSetupDescriptor = {
     rigId: string;
     versionId: string;
     rigName: string;
     script: string;
     timeoutMs: number;
 };
-type SandboxLifecycleHook = {
+export type SandboxLifecycleHook = {
     id: string;
     phase: SandboxLifecycleHookPhase;
     shouldRun?: (context: SandboxLifecycleHookContext) => boolean;
     run: (session: SandboxSessionLike, context: SandboxLifecycleHookContext) => Promise<void>;
 };
-declare function sandboxLifecycleHooksForIds(ids: string[]): SandboxLifecycleHook[];
+export declare function sandboxLifecycleHooksForIds(ids: string[]): SandboxLifecycleHook[];
 /**
  * Run the beforeAgentStart lifecycle hooks directly against an already-live box.
  *
@@ -1353,8 +823,8 @@ declare function sandboxLifecycleHooksForIds(ids: string[]): SandboxLifecycleHoo
  * before starting the run so the box still gets its beforeAgentStart preparation
  * (repository clone + B1 askpass/token-file seed, azure-cli-login).
  */
-declare function runBeforeAgentStartHooks(session: SandboxSessionLike, hooks: SandboxLifecycleHook[], context: SandboxLifecycleHookContext): Promise<void>;
-declare function withSandboxLifecycleHooks(client: SandboxClient, hooks: SandboxLifecycleHook[], context: SandboxLifecycleHookContext): SandboxClient;
+export declare function runBeforeAgentStartHooks(session: SandboxSessionLike, hooks: SandboxLifecycleHook[], context: SandboxLifecycleHookContext): Promise<void>;
+export declare function withSandboxLifecycleHooks(client: SandboxClient, hooks: SandboxLifecycleHook[], context: SandboxLifecycleHookContext): SandboxClient;
 /**
  * Whether the platform should seed a repository resource by `git clone` inside
  * the sandbox before the agent starts.
@@ -1373,10 +843,10 @@ declare function withSandboxLifecycleHooks(client: SandboxClient, hooks: Sandbox
  * is gated with no caller change, and every cloud path is byte-for-byte
  * unchanged.
  */
-declare function repositoryUsesSandboxClone(settings: Settings, resource: Extract<ResourceRef, {
+export declare function repositoryUsesSandboxClone(settings: Settings, resource: Extract<ResourceRef, {
     kind: "repository";
 }>, activeSandboxBackend?: Settings["sandboxBackend"]): boolean;
-declare function gitCredentialBindingHash(credentialBindingId: string): string;
+export declare function gitCredentialBindingHash(credentialBindingId: string): string;
 /**
  * Build the off-manifest command used to atomically replace provider token files.
  *
@@ -1385,25 +855,25 @@ declare function gitCredentialBindingHash(credentialBindingId: string): string;
  * in-flight multi-day turn observes the replacement without changing its
  * manifest environment or rebuilding the sandbox.
  */
-declare function gitProviderTokenRefreshCommand(seeds: GitTokenSeeds): string;
-declare function gitCredentialBindingTokenRefreshCommand(bindings: GitCredentialBindingSeed[]): string;
-declare function refreshGitProviderTokenFiles(session: GitCredentialTokenWriterSession, seeds: GitTokenSeeds, options?: {
+export declare function gitProviderTokenRefreshCommand(seeds: GitTokenSeeds): string;
+export declare function gitCredentialBindingTokenRefreshCommand(bindings: GitCredentialBindingSeed[]): string;
+export declare function refreshGitProviderTokenFiles(session: GitCredentialTokenWriterSession, seeds: GitTokenSeeds, options?: {
     runAs?: string;
     commandRunner?: SandboxLifecycleCommandRunner;
 }): Promise<void>;
-declare function refreshGitCredentialBindingTokenFiles(session: GitCredentialTokenWriterSession, bindings: GitCredentialBindingSeed[], options?: {
+export declare function refreshGitCredentialBindingTokenFiles(session: GitCredentialTokenWriterSession, bindings: GitCredentialBindingSeed[], options?: {
     runAs?: string;
     commandRunner?: SandboxLifecycleCommandRunner;
 }): Promise<void>;
-declare function repositoryCloneCommand(resources: Extract<ResourceRef, {
+export declare function repositoryCloneCommand(resources: Extract<ResourceRef, {
     kind: "repository";
 }>[], bindings?: GitCredentialBindingSeed[]): string;
-declare function toolspaceTokenSeedCommand(options?: {
+export declare function toolspaceTokenSeedCommand(options?: {
     tokenFile?: string;
     legacyTokenFile?: string;
 }): string;
-declare function runToolspaceTokenSeedHook(session: SandboxSessionLike, context: SandboxLifecycleHookContext): Promise<void>;
-declare function refreshToolspaceTokenFile(session: ToolspaceTokenWriterSession, token: string, options?: {
+export declare function runToolspaceTokenSeedHook(session: SandboxSessionLike, context: SandboxLifecycleHookContext): Promise<void>;
+export declare function refreshToolspaceTokenFile(session: ToolspaceTokenWriterSession, token: string, options?: {
     runAs?: string;
     commandRunner?: SandboxLifecycleCommandRunner;
     tokenFile?: string;
@@ -1423,7 +893,7 @@ declare function refreshToolspaceTokenFile(session: ToolspaceTokenWriterSession,
  * The heredoc delimiter is quoted, so the script content is executed verbatim
  * with no host-side expansion.
  */
-declare function rigSetupScriptCommand(script: string, versionId: string, timeoutMs?: number, markerRoot?: string): string;
+export declare function rigSetupScriptCommand(script: string, versionId: string, timeoutMs?: number, markerRoot?: string): string;
 /**
  * The rig-setup beforeAgentStart hook (M3). Runs the frozen rig version's setup
  * script exactly once per box (marker-guarded), under the RIG's own timeout
@@ -1435,16 +905,16 @@ declare function rigSetupScriptCommand(script: string, versionId: string, timeou
  * and on failure THROWS (fail the turn closed) with a message naming the
  * rig/version and a bounded tail of the setup output.
  */
-declare function runRigSetupHook(session: SandboxSessionLike, context?: SandboxLifecycleHookContext): Promise<void>;
-declare function runRepositoryCloneHook(session: SandboxSessionLike, resources: Extract<ResourceRef, {
+export declare function runRigSetupHook(session: SandboxSessionLike, context?: SandboxLifecycleHookContext): Promise<void>;
+export declare function runRepositoryCloneHook(session: SandboxSessionLike, resources: Extract<ResourceRef, {
     kind: "repository";
 }>[], context?: SandboxLifecycleHookContext): Promise<void>;
-declare function azureCliLoginCommand(): string;
-declare function sandboxCommandExitCode(result: unknown): number | null;
-declare function sandboxCommandOutput(result: unknown): string;
-declare function sandboxCommandStillRunning(result: unknown): boolean;
-declare function runAzureCliLoginHook(session: SandboxSessionLike, context?: SandboxLifecycleHookContext): Promise<void>;
-declare function azureOpenAIDefaultQuery(settings: Pick<Settings, "azureOpenaiApiVersion">, baseURL: string): Record<string, string> | undefined;
+export declare function azureCliLoginCommand(): string;
+export declare function sandboxCommandExitCode(result: unknown): number | null;
+export declare function sandboxCommandOutput(result: unknown): string;
+export declare function sandboxCommandStillRunning(result: unknown): boolean;
+export declare function runAzureCliLoginHook(session: SandboxSessionLike, context?: SandboxLifecycleHookContext): Promise<void>;
+export declare function azureOpenAIDefaultQuery(settings: Pick<Settings, "azureOpenaiApiVersion">, baseURL: string): Record<string, string> | undefined;
 /**
  * The skill source fed to the SDK Skills capability. Without pack or curated
  * skills this is the plain bundled local-dir source, byte-for-byte the
@@ -1455,6 +925,4 @@ declare function azureOpenAIDefaultQuery(settings: Pick<Settings, "azureOpenaiAp
  * `load_skill` for all of them. A pack skill shadows a bundled or curated
  * skill with the same directory name, case-insensitively.
  */
-declare function lazySkillSourceWithPackSkills(packSkills: PackSkill[], skillLibrarySkills?: PackSkill[]): LocalDirLazySkillSource;
-
-export { type AgentSegmentInput, type BuildAgentOptions, COMPACTION_PROMPT, COMPACTION_SUMMARY_MARKER, COMPACT_USER_MESSAGE_MAX_TOKENS, CodexSubscriptionUnavailableError, type CompactionDecision, type CompactionItem, CompactionNeededError, CompactionProviderResponseError, ComputerActionError, ComputerReadOnlyError, type ComputerToolMode, ComputerUnavailableError, type ComputerUseArgs, ComputerUseCapability, type ConnectedMcpServerBatches, type ContextRobustnessFilterOptions, DEFAULT_COMPACTION_THRESHOLD_RATIO, type EffectiveSkillSelection, EmptyCompactionSummaryError, GENESIS_TITLE_DIRECTIVE, type GitCredentialBindingSeed, type GitCredentialTokenWriterSession, type GitTokenSeeds, HUMAN_INPUT_TOOL_NAME, type HistoryItem, MAX_COMPACTION_THRESHOLD_RATIO, MAX_MODEL_USAGE_TOKEN_COUNT, MIN_COMPACTION_THRESHOLD_RATIO, type ModelCallUsageInput, type ModelCallUsageNormalization, type ModelCallUsageTelemetry, type ModelResponseUsage, MultiProviderModelProvider, type NormalizedRuntimeEvent, type OpenGeniRuntime, type PackSkill, type PackSkillFile, type PersistentSessionSettings, type PrepareInputOptions, type PrepareToolsOptions, type PreparedAgentInput, type PreparedAgentTools, type PreparedCompactionPromptInput, type ProductionRuntimeOverrides, type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult, type RigInstructionsContext, type RigSetupDescriptor, type RunAgentStreamOptions, RunCredentialSessionReady, RuntimeMetricsHooks, SUMMARY_BUFFER_TOKENS, SUMMARY_PREFIX, SandboxComputer, type SandboxComputerOptions, type SandboxFileDownload, type SandboxFileDownloadFailure, type SandboxFileDownloadMaterializationResult, type SandboxLifecycleCommandRunner, type SandboxLifecycleHook, type SandboxLifecycleHookContext, type SandboxLifecycleHookPhase, type SerializedHumanInputInterruption, TOOLSPACE_PROGRAMMATIC_DIRECTIVE, type ToolspaceTokenWriterSession, type TurnSandboxCommandArgs, TurnSandboxCommandCancelledError, type TurnSandboxCommandSession, type TurnToolCancellationController, type TurnToolCancellationFence, USER_MESSAGE_TRUNCATION_MARKER, type WorkspaceEnvironmentContext, WorkspaceModelPolicyBlockedError, agentsErrorRunState, appendGenesisTitleDirective, appendGitCredentialBindingInstructions, appendPersistentSessionSettings, appendSessionInstructions, appendToolspaceInstructions, appendTurnInstructions, appendWorkspaceMemory, applyMissingManifestEntries, azureCliLoginCommand, azureOpenAIDefaultQuery, boundModelToolOutputsFilterForSettings, buildAgentCapabilities, buildCompactionPromptInput, buildCompactionReplacementHistory, buildManifest, buildModelInstance, buildOpenAIClientFromSettings, buildOpenGeniAgent, buildProviderClient, buildSummaryItem, callModelInputFilterForSettings, clampCompactionThresholdRatio, compactionProviderFailureDiagnostics, compactionReplacementFingerprint, compactionResponseDiagnostics, compactionThresholdTokens, composeAgentInstructions, computerUse, configureOpenAI, configureRuntimeMetricsHooks, connectMcpServersInBatches, contextRobustnessFilterForSettings, coreInstructions, createProductionAgentRuntime, createTurnToolCancellationController, decideCompaction, effectiveSkillSelectionsForAgent, elideSupersededViewImagePairs, elideSupersededViewImagesFilter, ensureReadableStreamFrom, estimateCompleteModelInput, estimateItemTokens, estimateSerializedValueTokens, estimateTokens, extractResponseOutputText, findCompactionNeededError, gitCredentialBindingHash, gitCredentialBindingTokenRefreshCommand, gitProviderTokenRefreshCommand, hasModelGeneratedItem, isCompactionSummary, isUserMessage, latestCompactionReplacementFingerprint, lazySkillSourceWithPackSkills, manifestEnvironmentDrift, materializeSandboxFileDownloads, maxTurnsExceededRunState, mcpToolErrorOutput, modelCallUsageTelemetry, modelResponseUsageFromResponse, modelResponseUsageFromSdkEvent, modelUsageTokenCountOrNull, neutralizeToolSearchItemsInSerializedRunState, normalizeComputerCallsFilter, normalizeModelCallUsage, normalizeSdkEvent, normalizeToolOutputForEvent, oneShotGenesisTitleInputFilter, pinProvidedSessionManifestEnvironment, prefixedMcpToolName, prepareAgentTools, prepareCompactionPromptInput, prepareRunInput, refreshGitCredentialBindingTokenFiles, refreshGitProviderTokenFiles, refreshToolspaceTokenFile, renderCompactionPromptInputForChat, repositoryCloneCommand, repositoryUsesSandboxClone, repositoryWorkspaceSkillPathsOption, resolveTurnModel, rigInstructions, rigSetupScriptCommand, runAgentStream, runAzureCliLoginHook, runBeforeAgentStartHooks, runOwnedSandboxSetup, runRepositoryCloneHook, runRigSetupHook, runToolspaceTokenSeedHook, sandboxCommandExitCode, sandboxCommandOutput, sandboxCommandStillRunning, sandboxFileDownloadFailureNote, sandboxFileDownloadsForAgent, sandboxLifecycleHooksForIds, sandboxRunAs, sanitizeHistoryItemsForModel, serializeApprovals, serializeHumanInputRequests, stripProviderItemIdsFilter, stripReasoningEncryptedContent, stripReasoningIdentityFromSerializedRunState, summarizeForCompaction, toolspaceTokenSeedCommand, withManifestRefreshOnResume, withSandboxFileDownloads, withSandboxLifecycleHooks, withStructuredViewImageFunctionResults, workspaceEnvironmentInstructions };
+export declare function lazySkillSourceWithPackSkills(packSkills: PackSkill[], skillLibrarySkills?: PackSkill[]): LocalDirLazySkillSource;