@opengeni/runtime 0.3.1 → 0.5.0

package/dist/index.js

@@ -95,11 +95,11 @@ import {
   timeoutAgentError,
   timeoutControlResponse,
   verifyStreamToken
-} from "./chunk-HGQ252FL.js";
+} from "./chunk-Q36E4MDM.js";
 
 // src/index.ts
 import { AGENT_INSTRUCTIONS_CORE_PLACEHOLDER, collectSandboxEnvironment as collectSandboxEnvironment2, contextInputBudgetTokens, contextServerCompactThreshold, firstPartyMcpBaseUrl, resolveContextCompactionMode, resolveModelProvider, sandboxLifecycleHookIds } from "@opengeni/config";
-import { CAPABILITY_DESCRIPTORS as CAPABILITY_DESCRIPTORS2, isClearedRunStateBlob, signDelegatedAccessToken } from "@opengeni/contracts";
+import { CAPABILITY_DESCRIPTORS as CAPABILITY_DESCRIPTORS2, isClearedRunStateBlob, prefixedMcpToolName as sharedPrefixedMcpToolName, signDelegatedAccessToken } from "@opengeni/contracts";
 import {
   Agent,
   AgentsError,
@@ -150,7 +150,7 @@ import { fileURLToPath } from "url";
 var SCREENSHOT_FAILURE_CARD_IMAGE_URL = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABVMAAAGYCAYAAABPvXKBAAAh90lEQVR42u3dMXLkxhJF0VnEGDQQXLY2CaedtkcLkEJBBaqrXmYe43j6bDZQKGTd+RH89df39x8AAAAAAP7bLxcBAAAAAEBMBQAAAAAQUwEAAAAAxFQAAAAAADEVAAAAAEBMBQAAAAAQUwEAAAAAxFQAAAAAAMRUAAAAAAAxFQAAAABATAUAAAAAEFMBAAAAAMRUAAAAAAAxFQAAAABATAUAAAAAQEwFAAAAABBTAQAAAADEVAAAAAAAMRUAAAAAQEwFAAAAABBTAQAAAADEVAAAAAAAMRUAAAAAgMCY+n7dSyV9bpfvdur7Pvnc1Wsy/eGtuNam7RHp63nade7yrE57fk89R9Pev4ZiAAAQU8VUMVVMFWPEVPuVmCqmiqliKgAAiKliqpgqpooxIpCYKqaKqWKqmAoAAGKqmCqmiqliqpgqpoqpnl8xVUwFAAAxVUwVU8VUMVVMFVPFVM+vmCqmAgCAmBp9uKn4uRUPkUmH1y4x1Xq+S34P1/lu848Xnt95P8/9FVgBAEBMFZ/EVDFV5PPzxFTPr5/n/oqpAAAgpopPYqqYaj2LQGKqmGrdmzfEVAAAEFMdbsRUMdV6FoHEVDHVujdviKkAACCm+lwxVUy1nkUgMVVMFVNdZzEVAADEVIcbMfXg53aJO9azCCSmiqnWvXlDTAUAADHV54qpYqr1LAKJqWKqmCqmiqkAACCmOtyIqWKq9Symus5iqtgmpoqpAAAgpjrciBNiqhgjpoqpYqrnV0x1fwEAQEx1yBBTxVQxRkwVU8VUz6+Y6v4CAABbY+qTv8Re8a+zP/luq7/vtM8VU/PX85P7sWNdiam9942k57fidRZTa74HxVQAABBTHap8rpgqpoqpYqqYKqZ674upAAAgpoqpYqqYKqaKqWKqmCqmiqliKgAAiKliqpgqpoqpYqqYKqaKqWKqmAoAAGKqmCpqiqliqpgqpoqpYqqYKqYCAICYWi4qdfkr8/6K8frPrRhopv216Gn3I/06izae34k/z/0VUwEAQEwVUx0ixVQxVaQSUz2/fp77K6YCAICYKqY6RIqpYqqYKqaKqWKq96DnEgAAxFQx1SFSTBVTxVQxVUwVP70HPZcAACCmiqkOkWKqw7qYKqaKqdap6yymAgCAmCqmxv9vHSK/xVQxVUwdsF95fsVU99dzCQAAYqqY6hAppoqpYqqYKqaKqd6DYioAAIipYqpDpEOkmCqmiqliqvjpPSimAgCAmCqmiqkOka6z+yGmiqnWqZjqPQgAAGKqmCqmOkS6zmKqmCra2CfFVO9BAAAQUx8O50+k/y5JUeTU9+18ndMDTef1PC2O7dgnp+1XYqr3kc+t8cwAAICYKqY6vIqpYqqYKqaKqWKqqCmmAgCAmCqmOryKqWKqmCqmiqliqveRmAoAAGKqmCqmiqliqpgqpoqpYqr3kZgKAACIqWKqmCqmiqliqpgqpnof+VxDMQAAhMRUAAAAAAAxFQAAAABATAUAAAAAQEwFAAAAABBTAQAAAADEVAAAAAAAMRUAAAAAQEwFAAAAABBTAQAAAADEVAAAAAAAMRUAAAAAADEVAAAAAEBMBQAAAAAQUwEAAAAAxFQAAAAAADEVAAAAAEBMBQAAAAAQUwEAAAAAEFMBAAAAAMRUAAAAAAAxFQAAAABATAUAAAAAEFMBAAAAAMRUAAAAAAAxFQAAAAAAMRUAAAAAQEwFAAAAABBTAQAAAADEVAAAAAAAMRUAAAAAoGJM/fp9/fmk9+v+uJ9+7urvkfR9Tzn13ZKus/Wcf53T17Nn+tz9PfUcdb6XSWv31M+b9h60N817trz3a66rLvNkxes8bZ4E6E5MFVMdbsRUMdXwK6aKqWKqmGrecJ29F8RUMVVMBUBMFVMN2GKqmCqmOjSLqWKqmGrecJ29F6wrMVVMBUBMFZ8M2GKqmCqmeqbFVOtZTDVvuM6uvZgqpoqpAIiphgWHGzHVehZTPdNiqpgqpop85g3XXkw1T4qpAIyKqRUPQRUPzdPuW1KcSP/cHb+z5/cquR90eY4qHiK9V88Fn2n7Rud/6DHXeS94fl1n718AxFTDgsONmCqmOlQ5NDvMOcyJqQ7h5jrvBe9985X3r5gKIKYaFgzdhiMx1bDv0Oww5zAnprpv5g0x1XvffOX9K6YCiKlijKHbcCSmen7FVPfXdRZTxVT7hrnOe8HP8/61jwOIqV46hm7XWUz1/Iqp9g2HOTFVPDFvmOvcXzHV+9c+DiCmiqmGbte5zSHD0CimOjQ7zFnPa+6HGGPeMNd5L4ip3r/2cQDEVEO34VdM9fyKqQ7N9isxVUw1b5jr7Ffip/ev9y8AYqqh2+HGIcPQKKY6NDvMWc9iqphqrvNe8Py6zt6/AIiphm6HGzHV0CimOjQ7zDnMialiqrnOe0FMdZ29f4UMADHVsGDoFlNdF4cqh2aHOYc5MdUh3LzhveC9b77y/hVTAcTUoJfOajs+1+Em/zrv+Nz09dJ52Pf8OjQ7zImpYkzm/U16/3ovXOb2D1wr81XN59c+DiCmiqliqqFMTDXse37FVDFVTBVTxVTvBTFVTBVT7eMAiKliqpgqphr2Pb9iqpgqpoqpYqqYKqaKqWKqmAqAmGooE1PFVDFVTBVTxVQxVUwVU8VUMVVMFVPFVADEVEOZmCqmiqliqpgqpjrMialiqpgqpoqp5isxFQAx1V+r9Nd1h1zn9EO959fza98QU7vF1NX/YCWmmje8F9xf89WMf5yyjwMgphq6Db9iqufX8+vQLKaKqWKqecN7wXtBTBVTvX8BEFMNZQ43Yqqh0fPrkCGmiqliqpjqveC9IKaKqd6/AIiphjJDnpgq2lhXDs1iqsOcmCqmei94L4ipYqr1DICYKsY43Iipoo115dAspjrMiakO4d4L3gtiqphqPYupAGKqYcHQ7Tpv/77+2qzn1yFDTBVT+60rMdV7wXtBTJ1wndNn4PT79uQfCwEQUw1lhl8xVUz1/Do0i6liqpgqpnoveC/Y18RUMVVMBRBTDWUON2KqmGpdOTSLqWKqmOp96b3gvSCmiqnev2IqgJhqKHO4cTgUU60rh2YxVZSzrsRU7wXvBTFVTBVTxVQAMdWwYOgWU8VU68qhWUwVU60rMdV7wXvB/TVfialiKoCYalj4kPQhb8d3O3Wdk77vtMN6xevc5SCd/kxXXFed9ytzxBV1nTvH1M7P77RrL6aarzqdy5L2CDEVQEwVU8VUMVVMFVM902KqmCqmiqliqpgqpoqpYqqYCiCmiqliqjghpoqpnmkxVUwVU8VU84aYKqaar8RUMRVATBVTxVRxQkwVUwULMVVMFVPFVPOGmCqmmq/EVDEVQEwVU8VUMVVMNeyLqWKq/cocIabam8RUMVVMdS4TUwHEVAAAAAAAxFQAAAAAADEVAAAAAEBMBQAAAAAQUwEAAAAAxFQAAAAAADEVAAAAAEBMBQAAAAAQUwEAAAAAEFMBAAAAAMRUAAAAAAAxFQAAAABATAUAAAAAEFMBAAAAAMRUAAAAAAAxFQAAAAAAMRUAAAAAQEwFAAAAABBTAQAAAADEVAAAAAAAMRUAAAAAQEwFAAAAABBTAQAAAADEVBcBAAAAAEBMBQAAAAAQUwEAAAAAxFQAAAAAADEVAAAAAEBMBQAAAAAQUwEAAAAAxNQPeL/uj/vp567+Hknfd8fvkrRwXeea177zd1u9hqbd31Pvhc7vo1P399R67vIOOLWeDcWX5zdsvuo8TzqnXN4LBX6XinOstdZn3ugyX1U8LyCmiqmGI9dZTBVTxVTDkZhq2BdTxVQx1XvB/RVTxVRrTUx1XkBMNaSIqa6zmCqmiqmGI4cqw76YKqaKqc4pYqr3gphqrYmpzgueSzHVkCLyialiqpgqphqOxFSHZjFVTBVTnVPEVO8F731nCDFVTBVTxVRDisgnpoqpBiExVUwVUx1kxFQxVUwVU8VU7wUxVUwVU8VUMVVMbTGs+nkOQa7zzOuXdLjxffO/77TrbD37vuaIfdHB3Gke6rRfmeu8B60rn+u8kDlvIKb6eR4W19n1Myz4voZQ99f39X4TU60X5xTRy3vBujJPWldiqrlOTPXzPCyus+tnWPB9DaFiqvXs/SamWi/mIdHLdfZ9xVTrSkz1nhZTxU9DrcOm62foNhwZQsVU19n+LKaaO81Dopf3gu8rplpXrrOYKqaKlYZa68r1E1MN3YYjMdV1tj+LqWKqeUj0Mtf5vtaVOdZ5QUwVUw0phlpDlGFBTDUsGI7EVNdZTB3/Hjz131kv5iHRy3W2rsRU62rOdfZciqnip6HWunL9xFTDkeFITHWd7c9iqrnTPCR6eS/4vmKqOdZ1FlPFVLHSUGtduX5iqqHbcCSmus72ZzFVTDUP2a/Mdd6D1pXPdV4QU8VUQ4qh1hBlWBBTDQu+r5hqPYup5ggx1Txkv3LfvAetK5/rORJTxVRDip/nZec6i6mGBd/XdXZ/fV9zhJhqvYip7pv3gnVljvUciamMj6mrpT+kp77btJdd5+uc/hylf98ufzVy9TXo8n2nXWeHyLv1ujIUi6liav9zyrR9Y9r+PG2u67LWpp0XfK6YKqYaUkQ+MVVMFVMNR2KqmCqmiqkimpgqpoqpYqp5Q0x1XvAcialiqiFFTDX8us5iqpgqpjrciKliqpgqpjqkianmWDFVtBFTPUdiKmKqmCqmus5iqpgqpjrciKliqgFbTBVTxVRzrAgkpoqpniMxFTFVTBVTXWcxVUw1dDvciKliqpgqpoqpziliqggkpoqpniMx1awnpvp5zf9K4bTv4a/bux/ik+tc5TqLqTW/b/rhq/McUfEfQ8TU3ucK9+1u/XxYV9ap52jmecE/nIupYqqoJFaKqWKqodt1FlOtZzFVTDXHmodELxHIuhJTxVTnBTFVTBU/RSXfw+/nfhi6XWcx1XUWU8VUMVVMFb1EIO9BzBvOZWKqmGpIEZXEVL+f72voFlPFVNdZTBVTxVQx1X4lpnoPCi3mDc+RmCqmGlJEJTHV72fd+1yxTUwVUx1uxFQxVZQTU0Uq84aYKqZ6jsRUxFRDqJjq97PuvbTFJ9fZ/R30fXf8zuaI3odSUU5M7X7fuvzVdetKTPUcOS+Is2Kqnyfyuc6eSy9PQ7frLKb6vmKqmOp9bh4SvUQg60pM9Rw5L4ipYqqYKiqJlWKqmGrodp3FVOtZTPUeNMdaB6KXCGRdialiqvOCmCqmip+iku/h93M/vLRdZzHVdRZTRTQx1ToQvcRU+xXmDecyMVVMNaSISmKq38/39bliqhjjOoup5ggxVZSzX4mp3oMii3nDcySmiqmGlAWb3Go7PrfiS8d1FlM7vTxPref0l3bS8zvtOtufPb8Tw9q059c9d07pNNs6D1pXFeb29N/Fc2SuE1PFVA+9mOo6i6liqpjqOoupYqqYKqaKqc4pYqqYal2JqdaVuU5MFVM99CKf6yymiqliquFITBVTxVQxVUx1ThG9nAetKzHVunJeEFPFVC9Pkc919lyKqV7ahiMxVUwVU8VUMdU8JHq5zr6vmCqmOi+IqWKqIUXkE1MdHsRUL23DkZgqpoqp3oNiqnUgeompopeYKqaKqWKqmAoAAAAAIKYCAAAAAIipAAAAAACIqQAAAAAAYioAAAAAgJgKAAAAACCmAgAAAACIqQAAAAAAYioAAAAAgJgKAAAAACCmuhAAAAAAAGIqAAAAAICYCgAAAAAgpgIAAAAAiKkAAAAAAGIqAAAAAICYCgAAAAAgpgIAAAAAIKYCAAAAAIipAAAAAABiKgAAAACAmAoAAAAAIKYCAAAAAIipAAAAAABiKgAAAAAAYioAAAAAgJgKAAAAACCmAgAAAACIqQAAAAAAYioAAAAAgJj6L96ve6lTv0v6jdxxrZKu8+p11eWep1/7iuu54r386fc9dZ09vzWf31P3t+Jz1Pn5nbZPps+2nfemitcgfc6Ztm8AgJgqpoqpYoyYKhKIqZ5fMVVMtU+KqWKqmCqmAoCYKqaKqWKqmCoSiKmeXzFVTBVFxFR7k5gqpgKAmCqmiqliqhgjpoqpnl8xVUwVU8VUMVVMFVMBQEwVU8VUMdWBR0wVU8VUMVVMFVPFVDFVTBVTHbABEFMLRz6HjD1DXvp17jLknfoenl//aFLh/np+7Ruuc6+YZY6Yd/3sV/lzu3AKAGKqmCqmijGeX4dcMdXza98QU+2TApLnV0z1LACAmCqmiqkOh55f68Ch2fNr3xBTxVTvD8+vmCqmAoCYKsaIqSKaKGIdiKmeX/uG6yymen94fsVUMRUAxFQxRkx1CHLIsA7EVHHC54qpYqo5QkwVU8VUABBTxZiA63zqv3MIEkV2DfGdh30x1X2zb4ipVd7n9kn7lZiaN497TwOAmCqmiqliqpgqptqfPb/2DddZPDFHeH7FVPsBAIipYqqY6hAkpjoAiKnum88VU8VUc4SYKqaKqQAgpoqpYqpDkCgipoqp4oTPFWPEVDHV9bNfiakAIKaKqWKqQ5AoIqaKqQ5pIp8YI6baJ10/MVVMBQAxVUwVU8XU4Hu+46/Drub+Zj0fO+5v0hqa9vymf7ek/ari54one75H5/0qfT2nf9+KkVQ4BQAxVUwVU8VUMVVMFVM9v2KqmCqmiqliqpgqpgKAmCqmiqlim5gqpoqpYqqY6nPFVDFVTBVTxVQAEFPFVDFVTBVT3V8xVUwVJ8RUMVVMFVPFVDEVAMRUMVVMFVPFVDFVTBVTxVQxVUwVU8VUMVVMBQAxVUwtfnjYMQyKqVfr+O7++ivV/kpw/+fXe7rP5077hwq/n/dCp++bFHEBQEw1pIipYqoY4/6KqWKq59f+IqaKqX4/MVVM9Z4GADFVTBVTDYNiqpgqpnp+7S9iqpjq9/NeEFO9pwFATBVtxFSxTUwVUx2aPb9iqpgqpoqp3gtiqpgKAGKqmCqmim1ih/srpiKmiqliqlhpbvd9xVQAEFMd0lxnsU1MdX/FVM+lOHH0fyviXmKq309MHTA/J+2xnf9RBwAx1ZBi+BXbxBj3V0wVUz2/YqqYKqb6/exXYqqYCgBiquFXbBNj3F8xVUz1/IqpYqqY6vcTU8VUMRUAxFQx1XU2lLm/YqpDs+dXTBVTxVS/n/eC+VlMBQAxVUx1ncU291dMFVM9v2KqmGo/FVPNk+ZnMRUA2sfUJ079LiLLXfI6dz4c7rjOYqrnfNdhLuld4T14b/lr0V3WVdLnTot8Fe+veePyHPk/QYipAIipYqrIIqaKqWKqmCqmiqliqpgqpoqpYqrPFVMBEFMdIsVUMdXhRkz1nIup3oNiqpgqpoqpYqqYKqYCgJgqpoqpYqqYKqaKqd6DYqqYKqaKqWKqmCqmAoCYKqaKqWKqmCqmiqliqpgqpoqpYqqYKmqKqQBQKaYCAAAAAIipAAAAAABiKgAAAAAAYioAAAAAgJgKAAAAACCmAgAAAACIqQAAAAAAYioAAAAAgJgKAAAAACCmAgAAAACIqQAAAAAAiKkAAAAAAGIqAAAAAICYCgAAAAAgpgIAAAAAiKkAAAAAAGIqAAAAAICYCgAAAACAmAoAAAAAIKYCAAAAAIipAAAAAABiKgAAAACAmAoAAAAAIKYCAAAAAIipAAAAAACIqQAAAAAAYioAAAAAgJgKAAAAACCmAgAAAACIqQAAAAAAYuo/vV/3x6V/7o4beepzT+lyf9PXc9L9PfXzpu1XXdZQ+nPU+TonPUfT9ufO19m8Yd6oujfZN7Kuc8W1VnF+dp3z92fzZP51tp6z17iYKqbaSB1uxFQxVUwVU8VUMVVMNW+YN8RUMVXkE1PFVPOkmGreEFPFVDHV4UZMFVMNZWKqmCqmiqnmDfOGmCqmiqliqvhknhRTzRtiqpgqpjrciKliqpgqphp+7c9iqnnDvCGmiqliqpgqPpknxVQxVUwVU8VUhxuHGzFVTBVTDb/2ZzHVvGHeEFPFVDFVTBWfxFQx1XoeFVOnbf5i6iXKbdps3Lc+17nL53Ye1Fxn69m+8Zl/nPLesp7dN+cj+3Pm9/V/vngWgdxf82SF++sfdcRUhxsx1eHGfTN0i3z2DcOvfUNMtW+YN+z39mff17whprq/nl8xVUwVNcVUhxuHG0O3fde+Yfi1b4ip9g3zhvtmfxZTxTYx1f31/IqpYqphQUw1JDvcGLrFVOvP8GvfEFO9t8wb7pvzkf1ZbBNT3V/Pr5gqphoWxFTryuHGdTYsWH+GX/uG6yymWs/um/OR/VlMFVPdX/uV9SymOtT7XEOyw42XmH1DTHWdDb/2De8t84b75v1hPQfet87Pfvq6OvXfmSftV9apmOrhE1MNyQ43hm77rn3D8GvfEFPtG+YN9835SEwVU8VU86T9SkwVUw0LYqp15XDjOhv2rT/Dr31DTPXesp7dN+cj+7OYKqaKVPYrMVVMNSyIqdaVw43rbFgQUw2/hl8x1XvLenbfnI/sz2KqmCpS2a/EVDHVod7nGpIdbrzE7BtiqutsPds3vLfMG+6b94f1LKY6L4hU5kkxVUxtvRk+IaYakj+xrlb/lb3V69nh5jq2b3T+XOvP8Lvrczvvz+nX2bxh3jBv1Njvp805nd9H/vH73D4pUmXtz13mus7rWUwVU8VUQ7LDjZgqpoqpYqqYKhKIqeYN84aY6lwmpoqpIpWYKqaKqYZQMdXhxuHG4UZMFVPFVDFVTBVTzRvmDTFVTBVTxVQxVUwVU61TMVVMdbhxuHG4ccgQUx2uxVQxVUw1b5g3xFQxVUwVU8VUMVVMtU7FVC9tMdXhxuFGTBVTHa7FVDFVTDVvmDfs9+YcMVVMFVPFVDHVOhVTRU0x1V/X9dd1/dXr3/4qt31DTPXXou0b9g33zX3Lv372SevKe/8zkc/+kv/X7a1nMVU88blesg437puYav05BDm8mjfsG+YN981+b5+0rsQ2MVVMFVPFVMOMl7Yh2eHGfXPIsP4cgrwHRQL7hnnDfbPf2yetK8+vmOr+iqliqpjqpS2mOty4b6KD9ecQJKaKBPYN+4b7Zr8351hXYqqYKqaKqWKqmCpqiqkON+6b6GD92TfEVDHVvmHfcN/s92KqmCqmiqnmSTFVTBVTvTzFVMOMw42YWuavZFp/DkFiqnnDvmHecN/s9/ZJ68p7v8/nur93yRlpWhQWU8VUMdUw4/6KqaKI9Wf4tT+LqfYN84b7JqZ6H4mp4pP9RUwVU8VU8URMta4cbuwHooj1Z/g1dIup9g3r2X0TU+2T1pX3vpgqplpXYqp4IqZ6yTrc2A/EVOvP8CummjfsG+YN981+b5+0rrz3xVQxVUwVU710fK4h2eHGfXPIEEUMFQ6v3vv2DfOGecN+b5+0rsQ20cv9FVPF1EEPy2o+10v25CY37f7u+G6nrmnSvmE43/M97MV91nPS/mzfMG+YN/L2ps7nhYpR0z5p3+0UU82TvedJMVVMFVPFVIcbhxsx1bAvpoqpYqqYat8wb4ipYqqYKk6IqWKqeVJMFVPFVDHVS9bhRkwVUw3nYqrhV0y1b5g3xFQxVUwVJ8RUMdU8KaaKqWKqmOol63AjpoqphnMx1fArpto3zBtiqpgqpooT9l0x1TwpptqvxFQxVUx1uBFTHaoM52Kq4VdMtW+YN8RUMVVMFVPtu2KqedK6sl+Vi6kAAAAAAMnEVAAAAAAAMRUAAAAAQEwFAAAAABBTAQAAAADEVAAAAAAAMRUAAAAAQEwFAAAAABBTAQAAAAAQUwEAAAAAxFQAAAAAADEVAAAAAEBMBQAAAAAQUwEAAAAAxFQAAAAAADEVAAAAAAAxFQAAAABATAUAAAAAEFMBAAAAAMRUAAAAAAAxFQAAAABATAUAAAAAEFMBAAAAAMRUFwIAAAAAQEwFAAAAABBTAQAAAADEVAAAAAAAMRUAAAAAQEwFAAAAABBTAQAAAADE1B3er3uppM/t8t1Ofd8nn7t6TSY9qNPWVZdrYE+87Bth195+1fu9v2M9ey9creerpPdg57kOABBTxVSHSDHVM+PQLAiIqWKqdSWm2sPEVDEVABBTHbTEVDFVnHBo9t3EVDHVuhJTvRfEVDEVAEBMFVPFVDFVTBVTxVQx1X4lpoqpYqqYCgAgpoqpYqqYKqaKqdaVmGq/ElPFVDFVTHXwAwDKxNRTw0yXzz0VCSpe56Qh3rry/J68zl3+UWLHz9uxb0w71NuvsqLmjmehcxwzH+SvZ/suACCm+lzRS0y1rjy/YqqYKqaKqWKqmCqmiqkAgJgqxjhEiqnWledXTBVTxVT7lZhqnhRTxVQAQEw1/DpEiqnWledXTBVTxVT7lZgqpoqpYioAIKYafh0ixVRxwvMrpoqpYqr9SkwVUz1vYioAIKaKIg6RTa9zl9hhXXl+xdS86yKm2q+sUzFVTLXvAgBiqijiECmmOixZV2KqQ71Dvf3KOhVTzQfWMwCAmOpQJaaKqdaVmCqmOtR7jsRUMVVMtZ4BAMRUhyrXWUy1rlxn8cSh3n5l37AfiKnWs5gKAIipYozoJaZaV66zmOpQL6aKqWKqmGrfte8CAK1j6teDv9hZ8a94Pvluq7/vtM+dFlPd33l/lTv9OjvUr99fdvzVdfuV92DV+LnjOid9rn1XTAUAxFQx1SFSTHV/xVQx1aFeTPUeFFPFVPuumAoAiKliqkOkmGpdialiqkO9mOo9KKaKqWKqmAoAiKliqsOcQ6Q4IaaKqQ71Yqr9yntQTBVTxVQAQEwVUx0iHSLFCTFVTHWoF1PtV96DYqqYKqYCAETE1C9/1ddfuT34uV3ihHXlr3KLnzX2jS7PpX3j8vxap+Jn4PNRca4DAMRUMVX0ElOtK4dcMVVMFVPtG55f69R9E1MBADFVTBW9xFQx1boSU8VUMdW+IaZap2KqmAoAIKY6VImpYqp1Jab6eWKq51dMtU7FVDEVAEBMdahyGBFTrSsx1aFeTBWp7M9iqpgqpjr4AQBiavGYmvS/dRjpfeizruYdIh3q+9xfkWreP+553qxT+2TdfzwDAMRUMVX0chgRU60rMdXPE1PFVDHVOhVTxVQxFQAQUx2qHEbEVOtKTHWoF1M9v/Zn69T8Yp8UUwEAMdWhyuHVoc+6ElMd6kUCkcr+7L3qPWOfFFMBADFVTHV4deizrsRUMUYkEKm898VU7xn7pJgKALSLqT8dSHYMLjt+l6Qh9NT37Xyduxz60u9v0l5y6jMq3t9T97LzYb3ioT4pUk1775s3vHu8B8VUAEBMFVPFVDFVTBVTxVQxVUy1rswb3j3eg2IqACCmiqkON2KqmCqmiqliqpgqpoqpYqqYKqYCAGKqmOpwI6aKqWKqmGrfEFPFVDFVTBVTxVQAQEwVUx1uRBEx1YFWTBVTxVQxVUwVU8VUMRUAEFMBAAAAABBTAQAAAADEVAAAAAAAMRUAAAAAQEwFAAAAABBTAQAAAADEVAAAAAAAMRUAAAAAADEVAAAAAEBMBQAAAAAQUwEAAAAAxFQAAAAAADEVAAAAAEBMBQAAAAAQUwEAAAAAxFQAAAAAAMRUAAAAAAAxFQAAAABATAUAAAAAEFMBAAAAAMRUAAAAAAAxFQAAAABATAUAAAAAQEwFAAAAAPh//gZFPTu5uGIZdgAAAABJRU5ErkJggg==";
 
 // src/history-sanitizer.ts
-var RESULT_TYPE_BY_CALL_TYPE = {
+var TOOL_CALL_RESULT_TYPE_BY_CALL_TYPE = {
   function_call: "function_call_result",
   computer_call: "computer_call_result",
   shell_call: "shell_call_output",
@@ -163,6 +163,7 @@ var RESULT_TYPE_BY_CALL_TYPE = {
   // additionally ride providerData (see callIdOf).
   tool_search_call: "tool_search_output"
 };
+var RESULT_TYPE_BY_CALL_TYPE = TOOL_CALL_RESULT_TYPE_BY_CALL_TYPE;
 var RESULT_TYPES = new Set(Object.values(RESULT_TYPE_BY_CALL_TYPE));
 function itemType(item) {
   if (!item || typeof item !== "object") {
@@ -795,7 +796,10 @@ function installCodexToolSearch(agent, connectorNamespaces = NO_NAMESPACES) {
 var COMPACTION_SUMMARY_MARKER = "opengeni_context_summary";
 var SUMMARY_BUFFER_TOKENS = 2e4;
 var COMPACT_USER_MESSAGE_MAX_TOKENS = 2e4;
-var CLIENT_COMPACTION_TRIGGER_FRACTION = 0.9;
+var DEFAULT_COMPACTION_THRESHOLD_RATIO = 0.6;
+var MIN_COMPACTION_THRESHOLD_RATIO = 0.3;
+var MAX_COMPACTION_THRESHOLD_RATIO = 0.9;
+var COMPACTION_FALLBACK_TARGET_RATIO = 0.5;
 var COMPACTION_PROMPT = [
   "You are performing a CONTEXT CHECKPOINT COMPACTION. Create a handoff summary for another LLM that will resume the task.",
   "",
@@ -809,12 +813,7 @@ var COMPACTION_PROMPT = [
 ].join("\n");
 var SUMMARY_PREFIX = "Another language model started to solve this problem and produced a summary of its thinking process. You also have access to the state of the tools that were used by that language model. Use this to build on the work that has already been done and avoid duplicating work. Here is the summary produced by the other language model, use the information in this summary to assist with your own analysis:";
 var USER_MESSAGE_TRUNCATION_MARKER = "\n[... middle truncated for context compaction ...]\n";
-var RESULT_TYPE_BY_CALL_TYPE2 = {
-  function_call: "function_call_result",
-  computer_call: "computer_call_result",
-  shell_call: "shell_call_output",
-  apply_patch_call: "apply_patch_call_output"
-};
+var RESULT_TYPE_BY_CALL_TYPE2 = TOOL_CALL_RESULT_TYPE_BY_CALL_TYPE;
 var RESULT_TYPES2 = new Set(Object.values(RESULT_TYPE_BY_CALL_TYPE2));
 function itemType2(item) {
   if (!item || typeof item !== "object") {
@@ -852,12 +851,12 @@ function estimateTokens(items) {
   }
   return total;
 }
+function clampCompactionThresholdRatio(value) {
+  const numeric = typeof value === "number" && Number.isFinite(value) ? value : DEFAULT_COMPACTION_THRESHOLD_RATIO;
+  return Math.min(MAX_COMPACTION_THRESHOLD_RATIO, Math.max(MIN_COMPACTION_THRESHOLD_RATIO, numeric));
+}
 function clientCompactionThresholdTokens(input) {
-  const available = Math.max(
-    0,
-    input.contextWindowTokens - input.contextReservedOutputTokens - SUMMARY_BUFFER_TOKENS
-  );
-  return Math.floor(available * CLIENT_COMPACTION_TRIGGER_FRACTION);
+  return Math.floor(Math.max(0, input.contextWindowTokens) * clampCompactionThresholdRatio(input.contextCompactionThresholdRatio));
 }
 function decideClientCompaction(input) {
   const thresholdTokens = clientCompactionThresholdTokens(input);
@@ -959,6 +958,58 @@ function buildCompactionReplacementHistory(items, summaryBody) {
   history.push(buildSummaryItem(summaryBody));
   return history;
 }
+function buildDeterministicFallbackCompactionHistory(input) {
+  const sourceTokens = Math.max(1, estimateTokens(input.items));
+  const requestedTarget = typeof input.targetTokens === "number" && input.targetTokens > 0 ? Math.floor(input.targetTokens) : Math.floor(sourceTokens * COMPACTION_FALLBACK_TARGET_RATIO);
+  const targetTokens = Math.max(1, Math.min(requestedTarget, Math.max(1, sourceTokens - 1)));
+  const summaryItem = buildSummaryItem([
+    "Non-LLM context compaction fallback.",
+    input.cause ? `Summarizer failure: ${input.cause}` : "Summarizer failure: unavailable.",
+    "Older assistant, tool, reasoning, and image history was dropped deterministically.",
+    "Retained context above is limited to initial instructions and the most recent user messages that fit the fallback budget; oversized retained messages may be middle-truncated."
+  ].join("\n"));
+  const summaryTokens = estimateItemTokens(summaryItem);
+  let remaining = Math.max(0, targetTokens - summaryTokens);
+  const retainedInstructions = [];
+  for (const item of input.items) {
+    if (!isInitialInstructionMessage(item)) {
+      if (isUserMessage(item)) {
+        break;
+      }
+      continue;
+    }
+    if (remaining <= 0) {
+      break;
+    }
+    const capped = compactMessageToEstimatedItemBudget(item, Math.min(2e3, remaining));
+    if (!capped) {
+      continue;
+    }
+    const tokens = estimateItemTokens(capped);
+    if (tokens <= remaining) {
+      retainedInstructions.push(capped);
+      remaining -= tokens;
+    }
+  }
+  const retainedUsers = [];
+  for (let index = input.items.length - 1; index >= 0 && remaining > 0; index -= 1) {
+    const item = input.items[index];
+    if (!isUserMessage(item) || isCompactionSummary(item)) {
+      continue;
+    }
+    const capped = compactMessageToEstimatedItemBudget(item, Math.min(COMPACT_USER_MESSAGE_MAX_TOKENS, remaining));
+    if (!capped) {
+      continue;
+    }
+    const tokens = estimateItemTokens(capped);
+    if (tokens <= remaining) {
+      retainedUsers.push(capped);
+      remaining -= tokens;
+    }
+  }
+  retainedUsers.reverse();
+  return [...retainedInstructions, ...retainedUsers, summaryItem];
+}
 function buildSummaryItem(summaryBody) {
   const trimmed = summaryBody.trim();
   return {
@@ -970,15 +1021,38 @@ ${trimmed}`,
   };
 }
 function compactUserMessage(item) {
+  return compactMessageToTokenBudget(item, COMPACT_USER_MESSAGE_MAX_TOKENS);
+}
+function compactMessageToTokenBudget(item, maxTokens) {
   const text = messageText(item);
   const next = { ...item };
-  if (estimatedTextTokens(text) > COMPACT_USER_MESSAGE_MAX_TOKENS) {
-    next.content = truncateMiddleByEstimatedTokens(text, COMPACT_USER_MESSAGE_MAX_TOKENS);
+  if (estimatedTextTokens(text) > maxTokens) {
+    next.content = truncateMiddleByEstimatedTokens(text, maxTokens);
     return next;
   }
   next.content = contentWithoutImages(item);
   return next;
 }
+function compactMessageToEstimatedItemBudget(item, maxItemTokens) {
+  if (maxItemTokens <= 0) {
+    return null;
+  }
+  const overheadTokens = estimateItemTokens({ ...item, content: "" });
+  let contentBudget = Math.max(0, maxItemTokens - overheadTokens);
+  for (let attempt = 0; attempt < 6; attempt += 1) {
+    const capped = compactMessageToTokenBudget(item, contentBudget);
+    const estimated = estimateItemTokens(capped);
+    if (estimated <= maxItemTokens) {
+      return capped;
+    }
+    const overage = estimated - maxItemTokens;
+    if (contentBudget <= 0) {
+      break;
+    }
+    contentBudget = Math.max(0, contentBudget - Math.max(1, overage));
+  }
+  return null;
+}
 function estimatedTextTokens(text) {
   return Math.ceil(text.length / 4);
 }
@@ -1029,8 +1103,29 @@ function messageText(item) {
   }
   return "";
 }
-function renderCompactionPromptInputForChat(input) {
-  return input.map(renderItem).join("\n");
+function isInitialInstructionMessage(item) {
+  const type = itemType2(item);
+  const role = itemRole(item);
+  return type === "message" && (role === "system" || role === "developer");
+}
+function renderCompactionPromptInputForChat(input, options = {}) {
+  const rendered = input.map(renderItem);
+  if (typeof options.maxEstimatedTokens !== "number" || options.maxEstimatedTokens <= 0) {
+    return rendered.join("\n");
+  }
+  const maxChars = Math.max(1, Math.floor(options.maxEstimatedTokens * 4));
+  const last = rendered.at(-1);
+  const prefix = rendered.slice(0, -1);
+  let kept = prefix.slice();
+  while (kept.length > 0 && transcriptLength([...kept, last].filter((line) => line !== void 0)) > maxChars) {
+    kept.shift();
+  }
+  const lines = [...kept, last].filter((line) => line !== void 0);
+  const joined = lines.join("\n");
+  if (joined.length <= maxChars) {
+    return joined;
+  }
+  return truncateMiddleByChars(joined, maxChars);
 }
 function renderItem(item) {
   const type = itemType2(item) ?? "unknown";
@@ -1076,6 +1171,24 @@ function truncateForTranscript(text, max) {
   }
   return `${text.slice(0, max)}... (${text.length - max} more chars)`;
 }
+function transcriptLength(lines) {
+  if (lines.length === 0) {
+    return 0;
+  }
+  return lines.reduce((sum, line) => sum + line.length, 0) + Math.max(0, lines.length - 1);
+}
+function truncateMiddleByChars(text, maxChars) {
+  if (text.length <= maxChars) {
+    return text;
+  }
+  if (maxChars <= USER_MESSAGE_TRUNCATION_MARKER.length) {
+    return USER_MESSAGE_TRUNCATION_MARKER.slice(0, maxChars);
+  }
+  const keepChars = maxChars - USER_MESSAGE_TRUNCATION_MARKER.length;
+  const headChars = Math.ceil(keepChars / 2);
+  const tailChars = Math.floor(keepChars / 2);
+  return `${text.slice(0, headChars)}${USER_MESSAGE_TRUNCATION_MARKER}${text.slice(text.length - tailChars)}`;
+}
 
 // src/sandbox-computer.ts
 import { computerTool, tool } from "@openai/agents";
@@ -1939,12 +2052,16 @@ async function summarizeForCompaction(settings, input, options = {}) {
   const api = options.api ?? "responses";
   const model = options.model ?? settings.openaiModel;
   const maxTokens = options.maxOutputTokens ?? SUMMARY_BUFFER_TOKENS;
+  const transcript = renderCompactionPromptInputForChat(
+    input,
+    typeof options.maxTranscriptTokens === "number" && options.maxTranscriptTokens > 0 ? { maxEstimatedTokens: options.maxTranscriptTokens } : {}
+  );
   try {
     if (api === "chat") {
       const completion = await client.chat.completions.create({
         model,
         max_tokens: maxTokens,
-        messages: [{ role: "user", content: renderCompactionPromptInputForChat(input) }]
+        messages: [{ role: "user", content: transcript }]
       });
       const text2 = completion.choices?.[0]?.message?.content;
       const trimmed2 = typeof text2 === "string" ? text2.trim() : "";
@@ -1957,13 +2074,13 @@ async function summarizeForCompaction(settings, input, options = {}) {
       // built-in path (api "responses"), so gate it on the built-in provider.
       ...settings.openaiProvider === "azure" ? {} : { store: false },
       max_output_tokens: maxTokens,
-      input
+      input: transcript
     });
     const text = extractResponseOutputText(response);
     const trimmed = text.trim();
     return trimmed.length > 0 ? trimmed : null;
   } catch (error) {
-    console.error("context compaction summarize failed (compaction skipped this turn)", error);
+    console.error("context compaction summarize failed", error);
     return null;
   }
 }
@@ -2033,13 +2150,22 @@ function appendSessionInstructions(composed, sessionInstructions) {
   const trimmed = sessionInstructions?.trim();
   return trimmed ? `${composed} ${trimmed}` : composed;
 }
+function appendToolspaceInstructions(composed, toolspaceAvailable) {
+  return toolspaceAvailable ? `${composed} ${TOOLSPACE_PROGRAMMATIC_DIRECTIVE}` : composed;
+}
 function appendGenesisTitleDirective(instructions, genesisTitleHint) {
   return genesisTitleHint ? `${instructions} ${GENESIS_TITLE_DIRECTIVE}` : instructions;
 }
 var agentFileDownloads = /* @__PURE__ */ new WeakMap();
 var agentRepositoryCloneHooks = /* @__PURE__ */ new WeakMap();
 var agentGitTokenSeed = /* @__PURE__ */ new WeakMap();
+var agentToolspaceTokenSeed = /* @__PURE__ */ new WeakMap();
 var agentActiveSandboxBackend = /* @__PURE__ */ new WeakMap();
+function mcpToolErrorOutput(error) {
+  const details = error instanceof Error ? error.message : String(error);
+  return { isError: true, content: [{ type: "text", text: `An error occurred while running the tool. Please try again. Error: ${details}` }] };
+}
+var mcpToolErrorFunction = ({ error }) => mcpToolErrorOutput(error);
 function buildOpenGeniAgent(settings, resources, options = {}) {
   const compactionMode = options.compactionMode ?? resolveContextCompactionMode(settings);
   const hostedWebSearch = options.hostedWebSearch ?? settings.webSearchEnabled;
@@ -2060,14 +2186,21 @@ function buildOpenGeniAgent(settings, resources, options = {}) {
     // Persona composition order (all one system-level instructions string):
     //   1. workspace instructionsTemplate (or deployment default) with the
     //      non-bypassable CORE substituted at {{core}} — composeAgentInstructions,
-    //   2. + the per-session persona instructions (session-specific, LAST so it
-    //      refines the workspace persona),
-    //   3. + the one-shot genesis title directive (genesis turn only).
-    // With no session instructions and no genesis hint this is byte-identical to
-    // the historical composed instructions.
+    //   2. + the generic programmatic-tool-calling (toolspace) directive, ONLY
+    //      when a toolspace token was minted for this turn (feature enabled + a
+    //      per-turn seed — the mint gate, which includes selfhosted turns since
+    //      they now receive the token too) — appendToolspaceInstructions,
+    //   3. + the per-session persona instructions (session-specific, so it
+    //      refines both the workspace persona and the substrate note),
+    //   4. + the one-shot genesis title directive (genesis turn only).
+    // With no toolspace token, no session instructions, and no genesis hint this
+    // is byte-identical to the historical composed instructions.
     instructions: appendGenesisTitleDirective(
       appendSessionInstructions(
-        composeAgentInstructions(options.instructionsTemplate ?? settings.agentInstructionsTemplate, options.workspaceEnvironment),
+        appendToolspaceInstructions(
+          composeAgentInstructions(options.instructionsTemplate ?? settings.agentInstructionsTemplate, options.workspaceEnvironment),
+          settings.toolspaceEnabled && Boolean(options.toolspaceTokenSeed)
+        ),
         options.sessionInstructions
       ),
       options.genesisTitleHint
@@ -2098,11 +2231,19 @@ function buildOpenGeniAgent(settings, resources, options = {}) {
     // `new SandboxAgent({ ...baseConfig, ... })` path via the shared baseConfig
     // spread; the SDK concatenates these with MCP and sandbox capability tools.
     ...hostedTools.length ? { tools: hostedTools } : {},
-    ...options.mcpServers?.length ? { mcpServers: options.mcpServers } : {}
+    ...options.mcpServers?.length ? { mcpServers: options.mcpServers } : {},
+    // Surface FAILED MCP tool calls as `{ isError: true }` tool output (see
+    // mcpToolErrorFunction / mcpToolErrorOutput) instead of the SDK's default
+    // flat error string, so a thrown MCP failure (protocol error, auth, timeout,
+    // tool-not-found) settles the timeline tool to "failed" rather than rendering
+    // as success. Applies to every MCP server on this agent (session, first-party,
+    // capability, codex_apps) since none set a server-level errorFunction.
+    mcpConfig: { errorFunction: mcpToolErrorFunction }
   };
   if (settings.sandboxBackend === "none") {
     const agent2 = new Agent(baseConfig);
     maybeInstallCodexToolSearch(agent2, settings, options);
+    applyMcpApprovalPolicy(agent2, settings);
     return agent2;
   }
   const runAs = sandboxRunAs(settings);
@@ -2125,7 +2266,11 @@ function buildOpenGeniAgent(settings, resources, options = {}) {
   if (options.gitTokenSeed) {
     agentGitTokenSeed.set(agent, options.gitTokenSeed);
   }
+  if (options.toolspaceTokenSeed) {
+    agentToolspaceTokenSeed.set(agent, options.toolspaceTokenSeed);
+  }
   maybeInstallCodexToolSearch(agent, settings, options);
+  applyMcpApprovalPolicy(agent, settings);
   return agent;
 }
 function maybeInstallCodexToolSearch(agent, settings, options) {
@@ -2136,6 +2281,41 @@ function maybeInstallCodexToolSearch(agent, settings, options) {
     );
   }
 }
+function mcpToolRequiresApproval(policy, unprefixedName) {
+  return policy === true || Array.isArray(policy) && policy.includes(unprefixedName);
+}
+function installMcpApprovalPolicy(agent, policies) {
+  const listMcpTools = agent.getMcpTools.bind(agent);
+  agent.getMcpTools = async (runContext) => {
+    const tools = await listMcpTools(runContext);
+    return tools.map((tool2) => {
+      if (tool2.type !== "function") {
+        return tool2;
+      }
+      const policy = policies.find((entry) => tool2.name.startsWith(entry.prefix));
+      if (!policy) {
+        return tool2;
+      }
+      const unprefixed = tool2.name.slice(policy.prefix.length);
+      return mcpToolRequiresApproval(policy.requireApproval, unprefixed) ? { ...tool2, needsApproval: async () => true } : tool2;
+    });
+  };
+  const originalClone = agent.clone?.bind(agent);
+  if (originalClone) {
+    agent.clone = (config) => {
+      const cloned = originalClone(config);
+      installMcpApprovalPolicy(cloned, policies);
+      return cloned;
+    };
+  }
+}
+function applyMcpApprovalPolicy(agent, settings) {
+  const policies = settings.mcpServers.filter((server) => server.requireApproval === true || Array.isArray(server.requireApproval) && server.requireApproval.length > 0).map((server) => ({ prefix: prefixedMcpToolName(server.id, ""), requireApproval: server.requireApproval })).sort((a, b) => b.prefix.length - a.prefix.length);
+  if (policies.length === 0) {
+    return;
+  }
+  installMcpApprovalPolicy(agent, policies);
+}
 function neutralizeStructuredToolTransport(capability) {
   const forceFunctionTransport = function() {
     this._modelInstance = void 0;
@@ -2185,6 +2365,8 @@ async function prepareAgentTools(settings, tools, options = {}) {
       throw new Error(`Unknown MCP server id: ${tool2.id}`);
     }
     const url = firstPartyMcpServerUrlForRun(settings, config, options.workspaceId) ?? config.url;
+    const baseFetch = isCodexAppsMcpServer(config) ? codexAppsSanitizingFetch(globalThis.fetch, codexConnectorNamespaces) : globalThis.fetch;
+    const fetchImpl = config.connectionRef ? connectionBrokerFetch(baseFetch, config, options) : baseFetch;
     const server = new PrefixedMcpServer(new MCPServerStreamableHttp({
       url,
       name: config.name ?? config.id,
@@ -2193,7 +2375,7 @@ async function prepareAgentTools(settings, tools, options = {}) {
       // MCP SDK's strict Tool schema rejects (fails the turn during tools/list);
       // sanitize the response on the wire before validation. The namespace Set
       // also captures each tool's original connector namespace (P4 Part B.1).
-      ...isCodexAppsMcpServer(config) ? { fetch: codexAppsSanitizingFetch(globalThis.fetch, codexConnectorNamespaces) } : {},
+      ...fetchImpl !== globalThis.fetch ? { fetch: fetchImpl } : {},
       ...await mcpServerRequestInit(settings, config, options),
       ...config.timeoutMs ? {
         timeout: config.timeoutMs,
@@ -2201,7 +2383,7 @@ async function prepareAgentTools(settings, tools, options = {}) {
       } : {}
     }), config.id, config.allowedTools);
     const optional = tool2.optional === true;
-    return { server, bestEffort: isCodexAppsMcpServer(config) || optional, optional };
+    return { server, bestEffort: isCodexAppsMcpServer(config) || optional || !!config.connectionRef, optional };
   }));
   const requiredServers = servers.filter((entry) => !entry.bestEffort).map((entry) => entry.server);
   const bestEffortServers = servers.filter((entry) => entry.bestEffort).map((entry) => entry.server);
@@ -2239,6 +2421,190 @@ async function prepareAgentTools(settings, tools, options = {}) {
     codexConnectorNamespaces
   };
 }
+function connectionBrokerFetch(baseFetch, config, options) {
+  const connectionRef = config.connectionRef;
+  if (!connectionRef) {
+    return baseFetch;
+  }
+  return async (input, init) => {
+    const request = await mcpRequestInfo(input, init);
+    const first = await resolveConnectionForRequest(options, config.id, connectionRef, request.toolName, false);
+    if (first.status === "auth_needed") {
+      return await authNeededFetchResponse(options, config.id, request, first, connectionRef);
+    }
+    const response = await baseFetch(fetchInputForAttempt(input), withConnectionHeaders(input, init, first.headers));
+    if (response.status === 401) {
+      const refreshed = await resolveConnectionForRequest(options, config.id, connectionRef, request.toolName, true);
+      if (refreshed.status === "auth_needed") {
+        return await authNeededFetchResponse(options, config.id, request, refreshed, connectionRef);
+      }
+      const retry = await baseFetch(fetchInputForAttempt(input), withConnectionHeaders(input, init, refreshed.headers));
+      if (retry.status === 403) {
+        const auth = insufficientScopeAuth(retry.headers, connectionRef, refreshed.connectionId);
+        return auth ? await authNeededFetchResponse(options, config.id, request, auth, connectionRef) : retry;
+      }
+      if (retry.status === 401) {
+        return await authNeededFetchResponse(options, config.id, request, {
+          status: "auth_needed",
+          reason: "expired",
+          providerDomain: connectionRef.providerDomain,
+          connectionId: refreshed.connectionId,
+          ...connectionRef.scopes ? { scopes: connectionRef.scopes } : {},
+          ...connectionRef.resource ? { resource: connectionRef.resource } : {}
+        }, connectionRef);
+      }
+      return retry;
+    }
+    if (response.status === 403) {
+      const auth = insufficientScopeAuth(response.headers, connectionRef, first.connectionId);
+      return auth ? await authNeededFetchResponse(options, config.id, request, auth, connectionRef) : response;
+    }
+    return response;
+  };
+}
+async function resolveConnectionForRequest(options, serverId, connectionRef, toolName, forceRefresh) {
+  if (!options.workspaceId || !options.resolveCredential) {
+    return {
+      status: "auth_needed",
+      reason: "missing_connection",
+      providerDomain: connectionRef.providerDomain,
+      ...connectionRef.connectionId ? { connectionId: connectionRef.connectionId } : {},
+      ...connectionRef.scopes ? { scopes: connectionRef.scopes } : {},
+      ...connectionRef.resource ? { resource: connectionRef.resource } : {}
+    };
+  }
+  const request = {
+    workspaceId: options.workspaceId,
+    serverId,
+    connectionRef,
+    forceRefresh,
+    ...toolName ? { toolName } : {},
+    ...options.subjectId ? { subjectId: options.subjectId } : {}
+  };
+  try {
+    return await options.resolveCredential(request);
+  } catch {
+    return {
+      status: "auth_needed",
+      reason: "refresh_failed",
+      providerDomain: connectionRef.providerDomain,
+      ...connectionRef.connectionId ? { connectionId: connectionRef.connectionId } : {},
+      ...connectionRef.scopes ? { scopes: connectionRef.scopes } : {},
+      ...connectionRef.resource ? { resource: connectionRef.resource } : {}
+    };
+  }
+}
+function insufficientScopeAuth(headers, connectionRef, connectionId) {
+  const challenge = parseWwwAuthenticate(headers.get("www-authenticate"));
+  if (challenge.error !== "insufficient_scope") {
+    return null;
+  }
+  return {
+    status: "auth_needed",
+    reason: "insufficient_scope",
+    providerDomain: connectionRef.providerDomain,
+    connectionId,
+    ...challenge.scope?.length ? { scopes: challenge.scope } : connectionRef.scopes ? { scopes: connectionRef.scopes } : {},
+    ...challenge.resource ? { resource: challenge.resource } : connectionRef.resource ? { resource: connectionRef.resource } : {}
+  };
+}
+async function authNeededFetchResponse(options, serverId, request, auth, connectionRef) {
+  const connectionId = auth.connectionId ?? connectionRef.connectionId;
+  await publishAuthNeeded(options, {
+    serverId,
+    toolName: request.toolName ?? null,
+    providerDomain: auth.providerDomain,
+    reason: auth.reason,
+    ...connectionId ? { connectionId } : {},
+    ...auth.scopes ? { scopes: auth.scopes } : connectionRef.scopes ? { scopes: connectionRef.scopes } : {},
+    ...auth.resource ? { resource: auth.resource } : connectionRef.resource ? { resource: connectionRef.resource } : {},
+    ...auth.authorizationUrl ? { authorizationUrl: auth.authorizationUrl } : {},
+    ...options.subjectId ? { subjectId: options.subjectId } : {}
+  });
+  if (request.method === "tools/call") {
+    return mcpToolAuthNeededResponse(request.id);
+  }
+  return new Response("Authentication required for MCP server connection", { status: 401 });
+}
+async function publishAuthNeeded(options, payload) {
+  try {
+    await options.onAuthNeeded?.(payload);
+  } catch {
+  }
+}
+async function mcpRequestInfo(input, init) {
+  const body = typeof init?.body === "string" ? init.body : input instanceof Request && (init?.method ?? input.method).toUpperCase() === "POST" ? await input.clone().text().catch(() => "") : "";
+  if (!body) {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(body);
+    const method = typeof parsed.method === "string" ? parsed.method : void 0;
+    const id = typeof parsed.id === "string" || typeof parsed.id === "number" || parsed.id === null ? parsed.id : void 0;
+    const toolName = method === "tools/call" && typeof parsed.params?.name === "string" ? parsed.params.name : void 0;
+    return {
+      ...method ? { method } : {},
+      ...id !== void 0 ? { id } : {},
+      ...toolName ? { toolName } : {}
+    };
+  } catch {
+    return {};
+  }
+}
+function withConnectionHeaders(input, init, authHeaders) {
+  const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : void 0));
+  for (const [name, value] of Object.entries(authHeaders)) {
+    headers.set(name, value);
+  }
+  return { ...init, headers };
+}
+function fetchInputForAttempt(input) {
+  return input instanceof Request ? input.clone() : input;
+}
+function parseWwwAuthenticate(header) {
+  if (!header) {
+    return {};
+  }
+  const bearerIndex = header.toLowerCase().indexOf("bearer");
+  if (bearerIndex < 0) {
+    return {};
+  }
+  const paramsText = header.slice(bearerIndex + "bearer".length);
+  const params = {};
+  const re = /([a-zA-Z_][a-zA-Z0-9_-]*)\s*=\s*("(?:[^"\\]|\\.)*"|[^,\s]+)/g;
+  let match;
+  while ((match = re.exec(paramsText)) !== null) {
+    const raw = match[2];
+    params[match[1].toLowerCase()] = raw.startsWith('"') ? raw.slice(1, -1).replace(/\\"/g, '"') : raw;
+  }
+  return {
+    ...params.error ? { error: params.error } : {},
+    ...params.scope ? { scope: params.scope.split(/\s+/).filter(Boolean) } : {},
+    ...params.resource ? { resource: params.resource } : {}
+  };
+}
+var MCP_AUTH_NEEDED_ERROR_CODE = -32001;
+var MCP_AUTH_NEEDED_MESSAGE = "Authentication required - a connection link was posted to the session.";
+function mcpToolAuthNeededResponse(id) {
+  return new Response(JSON.stringify({
+    jsonrpc: "2.0",
+    id: id ?? null,
+    error: {
+      code: MCP_AUTH_NEEDED_ERROR_CODE,
+      message: MCP_AUTH_NEEDED_MESSAGE
+    }
+  }), {
+    status: 200,
+    headers: { "content-type": "application/json" }
+  });
+}
+function isAuthNeededMcpError(error) {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+  const code = error.code;
+  return code === MCP_AUTH_NEEDED_ERROR_CODE || error.message.includes(MCP_AUTH_NEEDED_MESSAGE);
+}
 async function mcpServerRequestInit(settings, config, options) {
   if (isCodexAppsMcpServer(config)) {
     return await codexAppsMcpRequestInit(settings);
@@ -2382,7 +2748,7 @@ function normalizeUrl(raw) {
   }
 }
 function prefixedMcpToolName(registryId, toolName) {
-  return `${registryId}__${toolName}`;
+  return sharedPrefixedMcpToolName(registryId, toolName);
 }
 var PrefixedMcpServer = class {
   constructor(inner, registryId, allowedTools) {
@@ -2412,7 +2778,14 @@ var PrefixedMcpServer = class {
     if (!this.isAllowed(unprefixed)) {
       throw new Error(`MCP tool ${unprefixed} is not allowed for server ${this.name}`);
     }
-    return await this.inner.callTool(unprefixed, args, meta);
+    try {
+      return await this.inner.callTool(unprefixed, args, meta);
+    } catch (error) {
+      if (isAuthNeededMcpError(error)) {
+        return { isError: true, content: [{ type: "text", text: MCP_AUTH_NEEDED_MESSAGE }] };
+      }
+      throw error;
+    }
   }
   invalidateToolsCache() {
     return this.inner.invalidateToolsCache();
@@ -2531,6 +2904,7 @@ async function prepareRunInput(agent, input, options = {}) {
   return { input: state };
 }
 var GENESIS_TITLE_DIRECTIVE = "This is the first turn of a new session. Before responding to the user, call the opengeni__set_session_title tool with a concise 3-7 word title that summarizes what this session is about, then address the user's request normally.";
+var TOOLSPACE_PROGRAMMATIC_DIRECTIVE = "Every tool on your MCP surface is also callable programmatically from the sandbox shell, so scripts can invoke tools without a model round trip per call. Run `ogtool list` to see the available tools and their input schemas (from tools/list), then `ogtool call <tool-name> '<json-args>'`; equivalently, POST MCP JSON-RPC to $OPENGENI_TOOLSPACE_URL with the bearer token read from $OPENGENI_TOOLSPACE_TOKEN_FILE. Prefer programmatic calls for loops, polling, and bulk filtering: their results stay in the sandbox and do not consume your context window. Tools that require human approval must still be invoked normally \u2014 called programmatically they return a typed error.";
 var stripProviderItemIdsFilter = ({ modelData }) => ({
   ...modelData,
   input: modelData.input.map((item) => {
@@ -2623,15 +2997,18 @@ async function runAgentStream(agent, input, settings, overrides = {}) {
       ...runAs2 ? { runAs: runAs2 } : {}
     }) : ownedClient;
     const ownedGitTokenSeed = gitTokenSeedForAgent(agent);
+    const ownedToolspaceTokenSeed = toolspaceTokenSeedForAgent(agent);
     const ownedHooks = [
       ...sandboxLifecycleHooksForIds(sandboxLifecycleHookIds(settings)),
+      ...sandboxToolspaceTokenHooksForAgent(agent),
       ...sandboxRepositoryCloneHooksForAgent(agent)
     ];
     const ownedHookContext = {
       environment,
       ...overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {},
       ...runAs2 ? { runAs: runAs2 } : {},
-      ...ownedGitTokenSeed ? { gitTokenSeed: ownedGitTokenSeed } : {}
+      ...ownedGitTokenSeed ? { gitTokenSeed: ownedGitTokenSeed } : {},
+      ...ownedToolspaceTokenSeed ? { toolspaceTokenSeed: ownedToolspaceTokenSeed } : {}
     };
     if (agentActiveSandboxBackend.get(agent) !== "selfhosted") {
       await runBeforeAgentStartHooks(setupSession, ownedHooks, ownedHookContext);
@@ -2641,6 +3018,11 @@ async function runAgentStream(agent, input, settings, overrides = {}) {
           ...runAs2 ? { runAs: runAs2 } : {}
         });
       }
+    } else {
+      const toolspaceHooks = sandboxToolspaceTokenHooksForAgent(agent);
+      if (toolspaceHooks.length > 0) {
+        await runBeforeAgentStartHooks(setupSession, toolspaceHooks, ownedHookContext);
+      }
     }
     const decoratedClient = withSandboxLifecycleHooks(resourceClient2, ownedHooks, ownedHookContext);
     const ownedFilter = composeCallModelInputFilters(
@@ -2675,14 +3057,17 @@ async function runAgentStream(agent, input, settings, overrides = {}) {
     ...runAs ? { runAs } : {}
   }) : refreshedClient;
   const gitTokenSeed = gitTokenSeedForAgent(agent);
+  const toolspaceTokenSeed = toolspaceTokenSeedForAgent(agent);
   const client = resourceClient ? withSandboxLifecycleHooks(resourceClient, [
     ...sandboxLifecycleHooksForIds(sandboxLifecycleHookIds(settings)),
+    ...sandboxToolspaceTokenHooksForAgent(agent),
     ...sandboxRepositoryCloneHooksForAgent(agent)
   ], {
     environment,
     ...overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {},
     ...runAs ? { runAs } : {},
-    ...gitTokenSeed ? { gitTokenSeed } : {}
+    ...gitTokenSeed ? { gitTokenSeed } : {},
+    ...toolspaceTokenSeed ? { toolspaceTokenSeed } : {}
   }) : void 0;
   const sandboxSessionState = prepared.sandboxSessionState ?? (prepared.serializedRunStateForSandbox && client ? await restoredSandboxSessionState(await RunState.fromString(agent, prepared.serializedRunStateForSandbox), client) : void 0);
   const callModelInputFilter = composeCallModelInputFilters(
@@ -3356,6 +3741,16 @@ function sandboxRepositoryCloneHooksForAgent(agent) {
 function gitTokenSeedForAgent(agent) {
   return agentGitTokenSeed.get(agent);
 }
+function toolspaceTokenSeedForAgent(agent) {
+  return agentToolspaceTokenSeed.get(agent);
+}
+function sandboxToolspaceTokenHooksForAgent(agent) {
+  return toolspaceTokenSeedForAgent(agent) ? [{
+    id: "toolspace-token",
+    phase: "beforeAgentStart",
+    run: runToolspaceTokenSeedHook
+  }] : [];
+}
 function sandboxRepositoryCloneHooks(settings, resources, activeSandboxBackend = settings.sandboxBackend) {
   const repositories = resources.filter((resource) => resource.kind === "repository" && repositoryUsesSandboxClone(settings, resource, activeSandboxBackend));
   if (repositories.length === 0) {
@@ -3526,6 +3921,49 @@ function repositoryCloneCommand(resources) {
   }
   return commands.join("\n");
 }
+function toolspaceTokenSeedCommand() {
+  return [
+    "set -eu",
+    'export HOME="${HOME:-/workspace}"',
+    'if [ -n "${OPENGENI_TOOLSPACE_TOKEN_SEED:-}" ]; then',
+    '  seed_umask="$(umask)"',
+    "  umask 077",
+    '  token_file="${OPENGENI_TOOLSPACE_TOKEN_FILE:-$HOME/.opengeni/toolspace-token}"',
+    '  mkdir -p "$(dirname "$token_file")"',
+    `  printf '%s' "$OPENGENI_TOOLSPACE_TOKEN_SEED" > "$token_file.tmp.$$"`,
+    '  mv -f "$token_file.tmp.$$" "$token_file"',
+    '  umask "$seed_umask"',
+    "fi"
+  ].join("\n");
+}
+async function runToolspaceTokenSeedHook(session, context) {
+  if (!context.toolspaceTokenSeed) {
+    return;
+  }
+  const command = `export OPENGENI_TOOLSPACE_TOKEN_SEED=${shellQuote(context.toolspaceTokenSeed)}
+${toolspaceTokenSeedCommand()}`;
+  if (session.exec) {
+    const result = await session.exec({
+      cmd: command,
+      workdir: "/workspace",
+      ...context.runAs ? { runAs: context.runAs } : {},
+      yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
+      maxOutputTokens: 4e3
+    });
+    assertSandboxCommandSucceeded(result, "Toolspace token seed hook");
+  } else if (session.execCommand) {
+    const result = await session.execCommand({
+      cmd: command,
+      workdir: "/workspace",
+      ...context.runAs ? { runAs: context.runAs } : {},
+      yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
+      maxOutputTokens: 4e3
+    });
+    assertSandboxCommandSucceeded(result, "Toolspace token seed hook");
+  } else {
+    throw new Error("Sandbox session does not support command execution");
+  }
+}
 async function runRepositoryCloneHook(session, resources, context = { environment: {} }) {
   const payload = { name: "repository-clone", repositoryCount: resources.length };
   await context.onRuntimeEvent?.({ type: "sandbox.operation.started", payload });
@@ -3874,7 +4312,6 @@ function approvalIdentifier(item) {
 export {
   ActiveBackendUnresolvableError,
   CAPABILITY_DESCRIPTORS,
-  CLIENT_COMPACTION_TRIGGER_FRACTION,
   COMPACTION_PROMPT,
   COMPACTION_SUMMARY_MARKER,
   COMPACT_USER_MESSAGE_MAX_TOKENS,
@@ -3888,12 +4325,15 @@ export {
   ComputerReadOnlyError,
   ComputerUnavailableError,
   ComputerUseCapability,
+  DEFAULT_COMPACTION_THRESHOLD_RATIO,
   DEFAULT_DESKTOP_GEOMETRY,
   DESKTOP_STREAM_PORT,
   DISPLAY_STACK_TIMEOUT_MS,
   DisplayStackError,
   DisplayStackUnsupportedError,
   GENESIS_TITLE_DIRECTIVE,
+  MAX_COMPACTION_THRESHOLD_RATIO,
+  MIN_COMPACTION_THRESHOLD_RATIO,
   MaxTurnsExceededError2 as MaxTurnsExceededError,
   MockAgentResponder,
   MultiProviderModelProvider,
@@ -3924,6 +4364,7 @@ export {
   StreamTokenPayload,
   TERMINAL_SERVER_TIMEOUT_MS,
   TERMINAL_STREAM_PORT,
+  TOOLSPACE_PROGRAMMATIC_DIRECTIVE,
   TerminalServerError,
   TerminalServerUnsupportedError,
   USER_MESSAGE_TRUNCATION_MARKER,
@@ -3931,6 +4372,7 @@ export {
   agentsErrorRunState,
   appendGenesisTitleDirective,
   appendSessionInstructions,
+  appendToolspaceInstructions,
   applyMissingManifestEntries,
   assertDescriptorRegistryInvariants,
   assertProviderRegistryInvariants,
@@ -3941,6 +4383,7 @@ export {
   buildAgentCapabilities,
   buildCompactionPromptInput,
   buildCompactionReplacementHistory,
+  buildDeterministicFallbackCompactionHistory,
   buildDisplayStackScript,
   buildManifest,
   buildModelInstance,
@@ -3952,6 +4395,7 @@ export {
   buildSummaryItem,
   buildTerminalServerScript,
   callModelInputFilterForSettings,
+  clampCompactionThresholdRatio,
   clientCompactionThresholdTokens,
   collectSandboxEnvironment,
   composeAgentInstructions,
@@ -3993,6 +4437,7 @@ export {
   makeActiveBackendResolver,
   materializeSandboxFileDownloads,
   maxTurnsExceededRunState,
+  mcpToolErrorOutput,
   mintStreamToken,
   modalSandboxAttributionEnvironment,
   modalSandboxAttributionTags,
@@ -4025,6 +4470,7 @@ export {
   runAzureCliLoginHook,
   runBeforeAgentStartHooks,
   runRepositoryCloneHook,
+  runToolspaceTokenSeedHook,
   sandboxCommandExitCode,
   sandboxCommandOutput,
   sandboxCommandStillRunning,
@@ -4053,6 +4499,7 @@ export {
   terminateModalSandboxById,
   timeoutAgentError,
   timeoutControlResponse,
+  toolspaceTokenSeedCommand,
   verifyStreamToken,
   withManifestRefreshOnResume,
   withSandboxFileDownloads,