@opengeni/runtime 0.6.1 → 0.7.0

package/dist/index.js

@@ -10,21 +10,43 @@ import {
   DISPLAY_STACK_TIMEOUT_MS,
   DisplayStackError,
   DisplayStackUnsupportedError,
+  FAULT_FIELD_WHAT_HAPPENED,
+  FAULT_FIELD_WHAT_PRESERVED,
+  FAULT_FIELD_WHAT_TO_TRY,
+  FAULT_FIELD_WHICH_LAYER,
   MockAgentResponder,
+  NEVER_SENT_DETAIL_KEY,
   NatsControlRpc,
+  NatsOpStreamTransport,
+  OP_STREAM_ACK_INTERVAL_MS,
+  OP_STREAM_DEFAULT_WINDOW_BYTES,
+  OP_STREAM_RECONNECT_HOLD_MS,
+  OP_STREAM_SILENCE_TIMEOUT_MS,
+  OpStreamUnavailableError,
   PROVIDER_REGISTRY,
+  REPOSITORY_DISCOVERY_LIMIT,
   RecordingError,
   RecordingUnavailableError,
   RoutingSandboxSession,
   RoutingUnsupportedError,
   SELFHOSTED_DEFAULT_TIMEOUT_MS,
+  SELFHOSTED_DRAINING_MAX_RETRIES,
+  SELFHOSTED_EXEC_DRAINING_MAX_RETRIES,
+  SELFHOSTED_IDEMPOTENT_READONLY_OPS,
+  SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES,
+  SELFHOSTED_NEVER_SENT_MAX_RETRIES,
   SELFHOSTED_RECONNECT_WINDOW_MS,
   SELFHOSTED_RELAY_STREAM_PATH,
+  SELFHOSTED_RETRY_BACKOFF_BASE_MS,
+  SELFHOSTED_RETRY_BACKOFF_CAP_MS,
+  SELFHOSTED_RETRY_BACKOFF_FACTOR,
+  SELFHOSTED_TIMEOUT_MAX_RETRIES,
   STREAM_PORT,
   STREAM_TOKEN_DEFAULT_TTL_SECONDS,
   SandboxChannelAService,
   SandboxConfigError,
   SandboxProviderUnavailableError,
+  SandboxResumeStateUnavailableError,
   SelfhostedControlError,
   SelfhostedSandboxClient,
   SelfhostedSession,
@@ -47,17 +69,23 @@ import {
   contentTypeForCodec,
   createSandboxClient,
   createSandboxClientForBackend,
+  decideSelfhostedRetry,
   decodeModalSnapshotId,
+  defaultSelfhostedRetryClock,
   deletePriorPersistedSnapshot,
   deleteRecordingArtifacts,
   deserializeSandboxSessionStateEnvelope,
   desktopCapableBackend,
+  drainingExhaustedError,
+  drainingMessage,
   ensureDisplayStack,
   ensureModalRegistryImage,
   ensureTerminalServer,
   establishSandboxSessionFromEnvelope,
+  execDeadlineHint,
   exposeStreamPort,
   extForCodec,
+  inspectRecordingArtifact,
   isExecSessionLostBanner,
   isProviderSandboxNotFoundError,
   isSelfhostedProviderNotFoundError,
@@ -68,26 +96,35 @@ import {
   modalSandboxAttributionTags,
   negotiateCapabilities,
   negotiateSelfhostedCapabilities,
+  nextDurableOpId,
   offlineAgentError,
   offlineControlResponse,
+  opAckSubject,
+  opFrameSubject,
   parseExecBannerSessionId,
   parseExposedPorts,
   parseNumstatZ,
   parsePorcelainV2,
   parseUnifiedPatch,
-  readRecordingBytes,
+  payloadTooLargeMessage,
   readWorkspaceArchiveFromEnvelopeSessionState,
   recordingStorageKey,
+  renderSelfhostedFault,
   restoredSandboxSessionStateFromEntry,
+  runWithToolCallCorrelation,
   sandboxStateEntryFromRunState,
+  sanitizeOpIdToken,
   selectBackend,
+  selfhostedFaultClass,
   selfhostedLiveness,
+  selfhostedRetryBackoffMs,
   serializeEstablishedSandboxEnvelope,
   setSelfhostedApplyDiff,
   startRecording,
   stopRecording,
   stripExecBanner,
   subjectFor,
+  swapTargetEstablishability,
   sweepModalOrphanSandboxes,
   tagModalSandbox,
   tearDownDisplayStack,
@@ -95,12 +132,24 @@ import {
   terminateModalSandboxById,
   timeoutAgentError,
   timeoutControlResponse,
+  uploadRecordingArtifact,
   verifyStreamToken
-} from "./chunk-DYBF7ZEB.js";
+} from "./chunk-RYDCVTMW.js";
 
 // src/index.ts
-import { AGENT_INSTRUCTIONS_CORE_PLACEHOLDER, collectSandboxEnvironment as collectSandboxEnvironment2, contextInputBudgetTokens, contextServerCompactThreshold, firstPartyMcpBaseUrl, resolveContextCompactionMode, resolveModelProvider, sandboxLifecycleHookIds } from "@opengeni/config";
-import { CAPABILITY_DESCRIPTORS as CAPABILITY_DESCRIPTORS2, isClearedRunStateBlob, prefixedMcpToolName as sharedPrefixedMcpToolName, signDelegatedAccessToken } from "@opengeni/contracts";
+import {
+  AGENT_INSTRUCTIONS_CORE_PLACEHOLDER,
+  collectSandboxEnvironment as collectSandboxEnvironment2,
+  firstPartyMcpBaseUrl,
+  resolveModelProvider,
+  sandboxLifecycleHookIds
+} from "@opengeni/config";
+import {
+  CAPABILITY_DESCRIPTORS as CAPABILITY_DESCRIPTORS2,
+  isClearedRunStateBlob,
+  prefixedMcpToolName as sharedPrefixedMcpToolName,
+  signDelegatedAccessToken
+} from "@opengeni/contracts";
 import {
   Agent,
   AgentsError,
@@ -121,15 +170,11 @@ import {
   webSearchTool,
   applyDiff
 } from "@openai/agents";
-import {
-  localDirLazySkillSource
-} from "@openai/agents/sandbox/local";
+import { localDirLazySkillSource } from "@openai/agents/sandbox/local";
 import {
   Manifest,
   SandboxAgent,
-  StaticCompactionPolicy,
   azureBlobMount,
-  compaction,
   dir,
   file,
   filesystem,
@@ -142,7 +187,14 @@ import {
 } from "@openai/agents/sandbox";
 import { ModalCloudBucketMountStrategy } from "@openai/agents-extensions/sandbox/modal";
 import OpenAI from "openai";
-import { CODEX_APPS_MCP_SERVER_ID, CODEX_MODEL_ID_PREFIX, CODEX_ORIGINATOR, codexAppsSanitizingFetch, codexRequestStorage, codexSubscriptionFetch } from "@opengeni/codex";
+import {
+  CODEX_APPS_MCP_SERVER_ID,
+  CODEX_MODEL_ID_PREFIX,
+  CODEX_ORIGINATOR,
+  codexAppsSanitizingFetch,
+  codexRequestStorage,
+  codexSubscriptionFetch
+} from "@opengeni/codex";
 import { cpSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync } from "fs";
 import { dirname, isAbsolute, join, posix as posixPath, relative } from "path";
 import { fileURLToPath } from "url";
@@ -195,6 +247,68 @@ function callIdOf(item) {
   }
   return void 0;
 }
+function viewImagePathOf(item) {
+  if (!item || typeof item !== "object") {
+    return void 0;
+  }
+  const record = item;
+  if (record.type !== "function_call" || record.name !== "view_image" || typeof record.arguments !== "string") {
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(record.arguments);
+    return typeof parsed.path === "string" && parsed.path.length > 0 ? parsed.path : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function elideSupersededViewImagePairs(items) {
+  if (items.length === 0) {
+    return [];
+  }
+  const callIndexById = /* @__PURE__ */ new Map();
+  const resultIndexById = /* @__PURE__ */ new Map();
+  items.forEach((item, index) => {
+    const callId = callIdOf(item);
+    if (!callId) {
+      return;
+    }
+    if (itemType(item) === "function_call") {
+      callIndexById.set(callId, index);
+    } else if (itemType(item) === "function_call_result" || itemType(item) === "function_call_output") {
+      resultIndexById.set(callId, index);
+    }
+  });
+  const pairedByPath = /* @__PURE__ */ new Map();
+  for (const [callId, callIndex] of callIndexById) {
+    const path = viewImagePathOf(items[callIndex]);
+    const resultIndex = resultIndexById.get(callId);
+    if (!path || resultIndex === void 0 || resultIndex <= callIndex) {
+      continue;
+    }
+    const pairs = pairedByPath.get(path) ?? [];
+    pairs.push({ callIndex, resultIndex });
+    pairedByPath.set(path, pairs);
+  }
+  const dropped = /* @__PURE__ */ new Set();
+  for (const pairs of pairedByPath.values()) {
+    if (pairs.length < 2) {
+      continue;
+    }
+    pairs.sort((left, right) => left.callIndex - right.callIndex);
+    for (const pair of pairs.slice(0, -1)) {
+      dropped.add(pair.callIndex);
+      dropped.add(pair.resultIndex);
+      for (let index = pair.callIndex - 1; index >= 0; index -= 1) {
+        if (itemType(items[index]) !== "reasoning") {
+          break;
+        }
+        dropped.add(index);
+      }
+    }
+  }
+  return dropped.size === 0 ? items.slice() : items.filter((_item, index) => !dropped.has(index));
+}
 function sanitizeHistoryItemsForModel(items) {
   if (items.length === 0) {
     return [];
@@ -265,9 +379,24 @@ function sanitizeHistoryItemsForModel(items) {
     }
   }
   if (dropped.size === 0) {
-    return items.slice();
+    return items.map(stripInternalResumeMarker);
+  }
+  return items.filter((_item, index) => !dropped.has(index)).map(stripInternalResumeMarker);
+}
+var INTERNAL_RESUME_MESSAGE_MARKER = "opengeni_internal_resume";
+function stripInternalResumeMarker(item) {
+  const providerData = item.providerData;
+  if (!providerData || typeof providerData !== "object" || !(INTERNAL_RESUME_MESSAGE_MARKER in providerData)) {
+    return item;
+  }
+  const { [INTERNAL_RESUME_MESSAGE_MARKER]: _dropped, ...rest } = providerData;
+  const next = { ...item };
+  if (Object.keys(rest).length > 0) {
+    next.providerData = rest;
+  } else {
+    delete next.providerData;
   }
-  return items.filter((_item, index) => !dropped.has(index));
+  return next;
 }
 function stripReasoningEncryptedContent(item) {
   const type = itemType(item);
@@ -519,109 +648,6 @@ function computerCallNormalizingFetch(base) {
   };
 }
 
-// src/screenshot-omitted-card.ts
-var SCREENSHOT_OMITTED_IMAGE_DATA_URL = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAgwAAAC0CAYAAAD4gHQ+AAAG2klEQVR42u3dMXLbMBCGUR/ChQuPT5KD+c5q1Ki2b+CMRlji38UrXpWYoUkA/AoM8vb17/sHAOAvbx4CACAYAADBAAAIBgBAMAAAggEAEAwAgGAAABAMAIBgAAAEAwAgGAAAwQAACAYAQDAAAIIBAEAwAACCAQAQDACAYAAABAMAIBgAAMEAAAiGco/77SVXXz/9fqvv/9nrvzoedr/ftPvfPX7S14fV7+fZn582f0+7vggQDIJBMAgGwSAYXF8wCAbBIBgEg2AQDK4vGASDYBAMgkEwCAbXFwznBUP1C0q/fvUHK+35rF7QT3+/u38+fX149YOyejxb/9yfYBAMgkEwCAbBYP1zf4JBMAgGwSAYBINgEAyiQDAIBsEgGASDYBAMgkEwCIbc51P954JBMCSPP+ufYBAMJoxgEAyCQTBY/9yfYBAMgkEwCAbBIBgEA4JBMAgGwSAYBINgEAyzDm5K39SXdtDU7utXL8jdD86yIAqGk4Oh28FcCAbBIBgEg2AQDIJBMAgGwSAYBINgEAyCQTAIBsEgGASDYBAMgkEwzA+GaZsGLShrP9DT3p9gsOlUMNj0KBgEgwVFMAgGwWB+uz/BIBgEg2DwwRIM5rdgQDAIBsHggyUYBINgEAyCIeWDaEHpfbCUD5ZgEAyCAcEgGCwoPliCQTAIBsEgGASDCSsYBINgEAyCQTAIBhNWMAgGwWB+C4a5//nU6oM7qv+9qxe06vs/7fmkLTjV47/7gtjt/VbPr9MPbtq9PiAYBINgEAyCQTAIBhEgGASDYBAMgkEwCAbBIBgEg2AQDIJBMAgGwWDTIwAgGAAAwQAACAYAQDAAAAgGAEAwAACCAQAQDACAYAAABAMAIBgAAMEAACAYAADBAAAIBgBAMAAAggEAEAwAgGAAAASDhwAACAYAQDAAAIIBAEgIho/3z59Kj/ttqdX/XvX9P3v9bs8//frV47v786/+farH/+7xOW38GP/Wt78IBsEgGASDYBAMgkEwCAbBIBgEg2AQDIJBMAgGwSAYBINgEAyCQTBMDIa061dPqN0Tdvfzm35/xn/tB331398dkNPGT/f5nRZU6e9PMAgGwWD8CwbBIBgEg2AQDIJBMAgGwSAYBINgEAyCQTAIBsEgGASDYBAMgkEwnDz+q/9cMAgGwSAYBINgEAyCQTAIBsEgGASDYBAMgkEwCAbBIBgsmIJBMBj/gkEwCIazg8HBGrMnbLeDs04f/+kHB63+c+NHMCSNH8EgGASDYBAMgkEwCAbBIBhMWMEgGASDYBAMgkEwmLCCQTAIBsEgGASDTY9pm6pseuy9aXT687Gp2KZHwWDTo2AQDIJBMAgGwSAYBINgEAyCwYIvGASD9UcwCAbBIBgEg2AQDIJBMAiGvgPGpqO995e+aa3b8xEMxo9gEAyCQTAIBsEgGASDYBAMgkEwCAbBIBgEg/VHMAgGwSAYBINgEAyCQTA4uGndwS/dFrS0g6fSru8/n/JBT5pf09bP064//WBAwWBBEwyCQTAIBuuDYBAMgsGCIBgEg2CwPggGwSAYTFjBIBgEg2AQDIIBAJhIMAAAggEAEAwAgGAAAAQDACAYAADBAAAIBgAAwQAACAYAQDAAAIIBABAMAIBgAAAEAwAgGAAABAMAIBgAAMEAAAgGAEAwAACCAQAQDACAYFjvcb8ttfrfS3sh3Z7Pq8/zfz9/9fjxfme936uvb/wjGASDD4pg8H4Fg/GPYBAMgkEweL+CQTCAYBAMPiiCQTAIBh89em96rJ5w1T+/+/dPW/DTrt99fKd/0E+f36evXwgGweCDIhi8X8Fg/QLBIBgEg/crGKxfIBgEg2AQDIJBMIBgEAyCQTCkPP/d4yNtfl89ngUDgkEwCAbBIBgEg2BAMAgGwSAYBINgEAwIBsHggyIYBINgEAwIBsGQdLDP7oOz0g+uEQyCYef4SX//IBgEg2AQDIJBMIBgEAyCQTAIBsEgGBAMgkEwCAbBIBgEA4JBMHTaZGXTo2BYGag2Pdr0iGAQDIJBMAgGwSAYEAyCQTAIBsEgGAQDgkEwCAbBIBgEg2AAwSAYrno+1R8gwTArCP3nU1m/X/omYgSDYBAMgkEwCAbBgGAQDIJBMAgGwSAYEAwmnGAQDIJBMAgGBEO3BbX7wT7VBzd1XxCnHeS0+6Au4yf74DLBgGAQDIJBMAgGwSAYEAyCQTAIBsEgGAQDgkEwCAbBIBiMH8GAYAAAEAwAgGAAAAQDACAYAADBAAAIBgBAMAAAggEAQDAAAIIBABAMAIBgAAAEAwAgGAAAwQAACAYAAMEAAAgGAEAwAACCAQAQDACAYAAABAMAcLxffBoP915amCIAAAAASUVORK5CYII=";
-
-// src/image-history.ts
-var SCREENSHOT_OMITTED_PLACEHOLDER = "[screenshot omitted: an older desktop frame \u2014 the full image remains in the session event log]";
-var DATA_IMAGE_BASE64_PATTERN = /data:image\/[a-z0-9.+-]+;base64,[a-z0-9+/=_-]+/i;
-function elideStaleScreenshotImages(items, options = {}) {
-  const keepLast = Math.max(0, Math.floor(options.keepLast ?? 3));
-  const placeholder = options.placeholder ?? SCREENSHOT_OMITTED_PLACEHOLDER;
-  const occurrences = [];
-  for (let i = 0; i < items.length; i += 1) {
-    collectItemImageOccurrences(items[i], [i], placeholder, occurrences);
-  }
-  const elidedCount = Math.max(0, occurrences.length - keepLast);
-  if (elidedCount === 0) {
-    return { items: items.slice(), imageCount: occurrences.length, elidedCount: 0 };
-  }
-  const cloned = structuredClone(items);
-  for (const occurrence of occurrences.slice(0, elidedCount)) {
-    setPath(cloned, occurrence.path, occurrence.replacement);
-  }
-  return { items: cloned, imageCount: occurrences.length, elidedCount };
-}
-function collectItemImageOccurrences(item, path, placeholder, out) {
-  if (!isRecord(item)) {
-    return;
-  }
-  if (item.type === "message" && (item.role === "user" || item.role === "system")) {
-    return;
-  }
-  if (item.type === "computer_call_result" || item.type === "computer_call_output") {
-    collectComputerOutputImages(item, path, out);
-    return;
-  }
-  if (item.type === "function_call_result" || item.type === "function_call_output") {
-    collectToolResultImages(item.output, [...path, "output"], placeholder, out);
-  }
-}
-function collectComputerOutputImages(item, path, out) {
-  const output = item.output;
-  if (!isRecord(output) || output.type !== "computer_screenshot") {
-    return;
-  }
-  for (const key of ["data", "image_url", "imageUrl"]) {
-    if (isImageDataUrl(output[key])) {
-      out.push({ path: [...path, "output", key], replacement: SCREENSHOT_OMITTED_IMAGE_DATA_URL });
-      return;
-    }
-  }
-}
-function collectToolResultImages(value, path, placeholder, out) {
-  if (typeof value === "string") {
-    if (isImageDataUrl(value)) {
-      out.push({ path, replacement: placeholder });
-    }
-    return;
-  }
-  if (Array.isArray(value)) {
-    for (let i = 0; i < value.length; i += 1) {
-      collectToolResultImages(value[i], [...path, i], placeholder, out);
-    }
-    return;
-  }
-  if (!isRecord(value)) {
-    return;
-  }
-  if (value.type === "input_image") {
-    for (const key of ["image", "imageUrl", "image_url"]) {
-      if (isImageDataUrl(value[key])) {
-        out.push({ path, replacement: { type: "input_text", text: placeholder } });
-        return;
-      }
-    }
-  }
-  for (const key of ["content", "text", "output"]) {
-    if (key in value) {
-      collectToolResultImages(value[key], [...path, key], placeholder, out);
-    }
-  }
-}
-function isImageDataUrl(value) {
-  return typeof value === "string" && DATA_IMAGE_BASE64_PATTERN.test(value);
-}
-function isRecord(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-function setPath(root, path, value) {
-  if (path.length === 0) {
-    return;
-  }
-  let cursor = root;
-  for (let i = 0; i < path.length - 1; i += 1) {
-    const segment = path[i];
-    cursor = Array.isArray(cursor) ? cursor[segment] : cursor[segment];
-  }
-  const last = path[path.length - 1];
-  if (Array.isArray(cursor)) {
-    cursor[last] = value;
-  } else {
-    cursor[last] = value;
-  }
-}
-
 // src/codex-tool-search.ts
 import { toolSearchTool } from "@openai/agents";
 var CODEX_APPS_TOOL_PREFIX = "codex_apps__";
@@ -746,7 +772,10 @@ ${sources.map((s) => `- ${s}`).join("\n")}`;
 var SEARCH_TOOL_PARAMETERS = {
   type: "object",
   properties: {
-    query: { type: "string", description: "Plain-language description of the capability you need." },
+    query: {
+      type: "string",
+      description: "Plain-language description of the capability you need."
+    },
     limit: { type: "number", description: "Maximum number of tools to return (default 8)." }
   },
   required: ["query"],
@@ -759,10 +788,28 @@ function codexToolSearchExecutor(args) {
   return bm25RankTools(deferred, query, limit);
 }
 var NO_NAMESPACES = /* @__PURE__ */ new Set();
-function buildCodexToolSearchTool(connectorNamespaces = NO_NAMESPACES) {
+function hasConnectorSources(connectorNamespaces) {
+  for (const namespace of connectorNamespaces) {
+    if (typeof namespace === "string" && namespace.length > 0) {
+      return true;
+    }
+  }
+  return false;
+}
+function resolveSearchToolDescription(connectorNamespaces, freeze) {
+  if (freeze?.value != null) {
+    return freeze.value;
+  }
+  const rendered = renderSearchToolDescription(connectorNamespaces);
+  if (freeze && hasConnectorSources(connectorNamespaces)) {
+    freeze.value = rendered;
+  }
+  return rendered;
+}
+function buildCodexToolSearchToolFromDescription(description) {
   return toolSearchTool({
     execution: "client",
-    description: renderSearchToolDescription(connectorNamespaces),
+    description,
     parameters: SEARCH_TOOL_PARAMETERS,
     execute: codexToolSearchExecutor
   });
@@ -771,7 +818,7 @@ function isToolSearchTool(tool2) {
   const t = tool2;
   return !!t && (t.name === "tool_search" || t.providerData?.type === "tool_search");
 }
-function applyCodexToolSearch(tools, connectorNamespaces = NO_NAMESPACES) {
+function applyCodexToolSearch(tools, connectorNamespaces = NO_NAMESPACES, descriptionFreeze) {
   for (const tool2 of tools) {
     if (isCodexAppsFunctionTool(tool2) && tool2.deferLoading !== true) {
       tool2.deferLoading = true;
@@ -780,16 +827,24 @@ function applyCodexToolSearch(tools, connectorNamespaces = NO_NAMESPACES) {
   if (tools.some(isToolSearchTool)) {
     return tools;
   }
-  return [...tools, buildCodexToolSearchTool(connectorNamespaces)];
+  const description = resolveSearchToolDescription(connectorNamespaces, descriptionFreeze);
+  return [...tools, buildCodexToolSearchToolFromDescription(description)];
 }
 function installCodexToolSearch(agent, connectorNamespaces = NO_NAMESPACES) {
+  installCodexToolSearchWithFreeze(agent, connectorNamespaces, { value: null });
+}
+function installCodexToolSearchWithFreeze(agent, connectorNamespaces, descriptionFreeze) {
   const originalGetAllTools = agent.getAllTools.bind(agent);
-  agent.getAllTools = (async (runContext) => applyCodexToolSearch(await originalGetAllTools(runContext), connectorNamespaces));
+  agent.getAllTools = async (runContext) => applyCodexToolSearch(
+    await originalGetAllTools(runContext),
+    connectorNamespaces,
+    descriptionFreeze
+  );
   const originalClone = agent.clone?.bind(agent);
   if (originalClone) {
     const cloneWithToolSearch = (config) => {
       const cloned = originalClone(config);
-      installCodexToolSearch(cloned, connectorNamespaces);
+      installCodexToolSearchWithFreeze(cloned, connectorNamespaces, descriptionFreeze);
       return cloned;
     };
     agent.clone = cloneWithToolSearch;
@@ -800,10 +855,9 @@ function installCodexToolSearch(agent, connectorNamespaces = NO_NAMESPACES) {
 var COMPACTION_SUMMARY_MARKER = "opengeni_context_summary";
 var SUMMARY_BUFFER_TOKENS = 2e4;
 var COMPACT_USER_MESSAGE_MAX_TOKENS = 2e4;
-var DEFAULT_COMPACTION_THRESHOLD_RATIO = 0.6;
+var DEFAULT_COMPACTION_THRESHOLD_RATIO = 0.9;
 var MIN_COMPACTION_THRESHOLD_RATIO = 0.3;
 var MAX_COMPACTION_THRESHOLD_RATIO = 0.9;
-var COMPACTION_FALLBACK_TARGET_RATIO = 0.5;
 var COMPACTION_PROMPT = [
   "You are performing a CONTEXT CHECKPOINT COMPACTION. Create a handoff summary for another LLM that will resume the task.",
   "",
@@ -839,6 +893,9 @@ function isUserMessage(item) {
 function isCompactionSummary(item) {
   return isUserMessage(item) && item[COMPACTION_SUMMARY_MARKER] === true;
 }
+function isEphemeralInternalContext(item) {
+  return itemType2(item) === "message" && itemRole(item) === "system";
+}
 function estimateItemTokens(item) {
   let text;
   try {
@@ -857,13 +914,21 @@ function estimateTokens(items) {
 }
 function clampCompactionThresholdRatio(value) {
   const numeric = typeof value === "number" && Number.isFinite(value) ? value : DEFAULT_COMPACTION_THRESHOLD_RATIO;
-  return Math.min(MAX_COMPACTION_THRESHOLD_RATIO, Math.max(MIN_COMPACTION_THRESHOLD_RATIO, numeric));
+  return Math.min(
+    MAX_COMPACTION_THRESHOLD_RATIO,
+    Math.max(MIN_COMPACTION_THRESHOLD_RATIO, numeric)
+  );
 }
-function clientCompactionThresholdTokens(input) {
-  return Math.floor(Math.max(0, input.contextWindowTokens) * clampCompactionThresholdRatio(input.contextCompactionThresholdRatio));
+function compactionThresholdTokens(input) {
+  const window = Math.max(0, input.contextWindowTokens);
+  const codexMaximum = Math.floor(window * MAX_COMPACTION_THRESHOLD_RATIO);
+  if (typeof input.contextAutoCompactThresholdTokens === "number" && Number.isFinite(input.contextAutoCompactThresholdTokens) && input.contextAutoCompactThresholdTokens > 0) {
+    return Math.min(Math.floor(input.contextAutoCompactThresholdTokens), codexMaximum);
+  }
+  return Math.floor(window * clampCompactionThresholdRatio(input.contextCompactionThresholdRatio));
 }
-function decideClientCompaction(input) {
-  const thresholdTokens = clientCompactionThresholdTokens(input);
+function decideCompaction(input) {
+  const thresholdTokens = compactionThresholdTokens(input);
   const recorded = typeof input.lastInputTokens === "number" && input.lastInputTokens > 0 ? input.lastInputTokens : 0;
   const signalTokens = recorded > 0 ? recorded : estimateTokens(input.items);
   if (input.items.length === 0) {
@@ -872,7 +937,7 @@ function decideClientCompaction(input) {
   if (input.force) {
     return { shouldCompact: true, reason: "force", signalTokens, thresholdTokens };
   }
-  if (signalTokens > thresholdTokens) {
+  if (signalTokens >= thresholdTokens) {
     return { shouldCompact: true, reason: "above_threshold", signalTokens, thresholdTokens };
   }
   return { shouldCompact: false, reason: "below_threshold", signalTokens, thresholdTokens };
@@ -881,14 +946,17 @@ var CompactionNeededError = class extends Error {
   signalTokens;
   thresholdTokens;
   signalSource;
+  trigger;
   constructor(input) {
+    const trigger = input.trigger ?? "threshold";
     super(
-      `Context compaction needed: signal ${input.signalTokens} tokens exceeded threshold ${input.thresholdTokens}`
+      trigger === "operator" ? "Context compaction requested by the operator" : `Context compaction needed: signal ${input.signalTokens} tokens exceeded threshold ${input.thresholdTokens}`
     );
     this.name = "CompactionNeededError";
     this.signalTokens = input.signalTokens;
     this.thresholdTokens = input.thresholdTokens;
     this.signalSource = input.signalSource;
+    this.trigger = trigger;
   }
 };
 function findCompactionNeededError(error, seen = /* @__PURE__ */ new WeakSet()) {
@@ -905,42 +973,6 @@ function findCompactionNeededError(error, seen = /* @__PURE__ */ new WeakSet())
   const record = error;
   return findCompactionNeededError(record.cause, seen) ?? findCompactionNeededError(record.error, seen);
 }
-function findKeepBoundary(items, keepRecentTokens) {
-  const boundaries = [];
-  for (let i = 0; i < items.length; i += 1) {
-    if (isUserMessage(items[i])) {
-      boundaries.push(i);
-    }
-  }
-  if (boundaries.length === 0) {
-    return 0;
-  }
-  for (let b = 0; b < boundaries.length; b += 1) {
-    const boundary = boundaries[b];
-    if (estimateTokens(items.slice(boundary)) <= keepRecentTokens) {
-      return boundary;
-    }
-  }
-  return boundaries[boundaries.length - 1];
-}
-function enforceInputBudget(items, maxTokens, trailingTokens = 0) {
-  const total = estimateTokens(items) + Math.max(0, trailingTokens);
-  if (items.length === 0 || total <= maxTokens) {
-    return { items: items.slice(), trimmed: false, droppedCount: 0, estimatedTokens: total };
-  }
-  const historyBudget = Math.max(0, maxTokens - Math.max(0, trailingTokens));
-  const boundary = findKeepBoundary(items, historyBudget);
-  if (boundary <= 0) {
-    return { items: items.slice(), trimmed: false, droppedCount: 0, estimatedTokens: total };
-  }
-  const kept = items.slice(boundary);
-  return {
-    items: kept,
-    trimmed: true,
-    droppedCount: boundary,
-    estimatedTokens: estimateTokens(kept) + Math.max(0, trailingTokens)
-  };
-}
 function buildCompactionPromptInput(items) {
   return [
     ...items,
@@ -952,70 +984,27 @@ function buildCompactionPromptInput(items) {
   ];
 }
 function buildCompactionReplacementHistory(items, summaryBody) {
-  const history = [];
-  for (const item of items) {
+  const retainedReversed = [];
+  let remaining = COMPACT_USER_MESSAGE_MAX_TOKENS;
+  for (let index = items.length - 1; index >= 0 && remaining > 0; index -= 1) {
+    const item = items[index];
     if (!isUserMessage(item) || isCompactionSummary(item)) {
       continue;
     }
-    history.push(compactUserMessage(item));
-  }
-  history.push(buildSummaryItem(summaryBody));
-  return history;
-}
-function buildDeterministicFallbackCompactionHistory(input) {
-  const sourceTokens = Math.max(1, estimateTokens(input.items));
-  const requestedTarget = typeof input.targetTokens === "number" && input.targetTokens > 0 ? Math.floor(input.targetTokens) : Math.floor(sourceTokens * COMPACTION_FALLBACK_TARGET_RATIO);
-  const targetTokens = Math.max(1, Math.min(requestedTarget, Math.max(1, sourceTokens - 1)));
-  const summaryItem = buildSummaryItem([
-    "Non-LLM context compaction fallback.",
-    input.cause ? `Summarizer failure: ${input.cause}` : "Summarizer failure: unavailable.",
-    "Older assistant, tool, reasoning, and image history was dropped deterministically.",
-    "Retained context above is limited to initial instructions and the most recent user messages that fit the fallback budget; oversized retained messages may be middle-truncated."
-  ].join("\n"));
-  const summaryTokens = estimateItemTokens(summaryItem);
-  let remaining = Math.max(0, targetTokens - summaryTokens);
-  const retainedInstructions = [];
-  for (const item of input.items) {
-    if (!isInitialInstructionMessage(item)) {
-      if (isUserMessage(item)) {
-        break;
-      }
-      continue;
-    }
-    if (remaining <= 0) {
+    const textTokens = estimatedTextTokens(messageText(item));
+    retainedReversed.push(compactMessageToTokenBudget(item, remaining));
+    if (textTokens > remaining) {
+      remaining = 0;
       break;
     }
-    const capped = compactMessageToEstimatedItemBudget(item, Math.min(2e3, remaining));
-    if (!capped) {
-      continue;
-    }
-    const tokens = estimateItemTokens(capped);
-    if (tokens <= remaining) {
-      retainedInstructions.push(capped);
-      remaining -= tokens;
-    }
-  }
-  const retainedUsers = [];
-  for (let index = input.items.length - 1; index >= 0 && remaining > 0; index -= 1) {
-    const item = input.items[index];
-    if (!isUserMessage(item) || isCompactionSummary(item)) {
-      continue;
-    }
-    const capped = compactMessageToEstimatedItemBudget(item, Math.min(COMPACT_USER_MESSAGE_MAX_TOKENS, remaining));
-    if (!capped) {
-      continue;
-    }
-    const tokens = estimateItemTokens(capped);
-    if (tokens <= remaining) {
-      retainedUsers.push(capped);
-      remaining -= tokens;
-    }
+    remaining -= textTokens;
   }
-  retainedUsers.reverse();
-  return [...retainedInstructions, ...retainedUsers, summaryItem];
+  const history = retainedReversed.reverse();
+  history.push(buildSummaryItem(summaryBody));
+  return history;
 }
 function buildSummaryItem(summaryBody) {
-  const trimmed = summaryBody.trim();
+  const trimmed = summaryBody.trim() || "(no summary available)";
   return {
     type: "message",
     role: "user",
@@ -1024,9 +1013,6 @@ ${trimmed}`,
     [COMPACTION_SUMMARY_MARKER]: true
   };
 }
-function compactUserMessage(item) {
-  return compactMessageToTokenBudget(item, COMPACT_USER_MESSAGE_MAX_TOKENS);
-}
 function compactMessageToTokenBudget(item, maxTokens) {
   const text = messageText(item);
   const next = { ...item };
@@ -1037,26 +1023,6 @@ function compactMessageToTokenBudget(item, maxTokens) {
   next.content = contentWithoutImages(item);
   return next;
 }
-function compactMessageToEstimatedItemBudget(item, maxItemTokens) {
-  if (maxItemTokens <= 0) {
-    return null;
-  }
-  const overheadTokens = estimateItemTokens({ ...item, content: "" });
-  let contentBudget = Math.max(0, maxItemTokens - overheadTokens);
-  for (let attempt = 0; attempt < 6; attempt += 1) {
-    const capped = compactMessageToTokenBudget(item, contentBudget);
-    const estimated = estimateItemTokens(capped);
-    if (estimated <= maxItemTokens) {
-      return capped;
-    }
-    const overage = estimated - maxItemTokens;
-    if (contentBudget <= 0) {
-      break;
-    }
-    contentBudget = Math.max(0, contentBudget - Math.max(1, overage));
-  }
-  return null;
-}
 function estimatedTextTokens(text) {
   return Math.ceil(text.length / 4);
 }
@@ -1107,46 +1073,25 @@ function messageText(item) {
   }
   return "";
 }
-function isInitialInstructionMessage(item) {
-  const type = itemType2(item);
-  const role = itemRole(item);
-  return type === "message" && (role === "system" || role === "developer");
-}
-function renderCompactionPromptInputForChat(input, options = {}) {
-  const rendered = input.map(renderItem);
-  if (typeof options.maxEstimatedTokens !== "number" || options.maxEstimatedTokens <= 0) {
-    return rendered.join("\n");
-  }
-  const maxChars = Math.max(1, Math.floor(options.maxEstimatedTokens * 4));
-  const last = rendered.at(-1);
-  const prefix = rendered.slice(0, -1);
-  let kept = prefix.slice();
-  while (kept.length > 0 && transcriptLength([...kept, last].filter((line) => line !== void 0)) > maxChars) {
-    kept.shift();
-  }
-  const lines = [...kept, last].filter((line) => line !== void 0);
-  const joined = lines.join("\n");
-  if (joined.length <= maxChars) {
-    return joined;
-  }
-  return truncateMiddleByChars(joined, maxChars);
+function renderCompactionPromptInputForChat(input) {
+  return input.map(renderItem).join("\n");
 }
 function renderItem(item) {
   const type = itemType2(item) ?? "unknown";
   if (type === "message") {
     const role = itemRole(item) ?? "assistant";
-    return `[${role}] ${truncateForTranscript(messageText(item), 4e3)}`;
+    return `[${role}] ${messageText(item)}`;
   }
   if (type === "reasoning") {
     return "[reasoning] (omitted)";
   }
   if (RESULT_TYPES2.has(type)) {
-    return `[tool_result] ${truncateForTranscript(resultText(item), 2e3)}`;
+    return `[tool_result] ${resultText(item)}`;
   }
   if (RESULT_TYPE_BY_CALL_TYPE2[type]) {
-    return `[tool_call ${type}] ${truncateForTranscript(callText(item), 1e3)}`;
+    return `[tool_call ${type}] ${callText(item)}`;
   }
-  return `[${type}] ${truncateForTranscript(safeStringify(item), 1e3)}`;
+  return `[${type}] ${safeStringify(item)}`;
 }
 function resultText(item) {
   const output = item.output;
@@ -1169,35 +1114,15 @@ function safeStringify(value) {
     return String(value);
   }
 }
-function truncateForTranscript(text, max) {
-  if (text.length <= max) {
-    return text;
-  }
-  return `${text.slice(0, max)}... (${text.length - max} more chars)`;
-}
-function transcriptLength(lines) {
-  if (lines.length === 0) {
-    return 0;
-  }
-  return lines.reduce((sum, line) => sum + line.length, 0) + Math.max(0, lines.length - 1);
-}
-function truncateMiddleByChars(text, maxChars) {
-  if (text.length <= maxChars) {
-    return text;
-  }
-  if (maxChars <= USER_MESSAGE_TRUNCATION_MARKER.length) {
-    return USER_MESSAGE_TRUNCATION_MARKER.slice(0, maxChars);
-  }
-  const keepChars = maxChars - USER_MESSAGE_TRUNCATION_MARKER.length;
-  const headChars = Math.ceil(keepChars / 2);
-  const tailChars = Math.floor(keepChars / 2);
-  return `${text.slice(0, headChars)}${USER_MESSAGE_TRUNCATION_MARKER}${text.slice(text.length - tailChars)}`;
-}
 
 // src/sandbox-computer.ts
 import { computerTool, tool } from "@openai/agents";
 import { Capability } from "@openai/agents/sandbox";
-import { KeyAction, PointerAction, PointerButton } from "@opengeni/agent-proto";
+import {
+  KeyAction,
+  PointerAction,
+  PointerButton
+} from "@opengeni/agent-proto";
 function requireBoundSession(capabilityType, session) {
   if (!session) {
     throw new ComputerUnavailableError(`capability "${capabilityType}" used before bind(session)`);
@@ -1245,7 +1170,13 @@ function toKeysym(k) {
   if (/^f([1-9]|1[0-2])$/.test(low)) return low.toUpperCase();
   return low.length === 1 ? low : k;
 }
-var BUTTON_NUM = { left: 1, wheel: 2, right: 3, back: 8, forward: 9 };
+var BUTTON_NUM = {
+  left: 1,
+  wheel: 2,
+  right: 3,
+  back: 8,
+  forward: 9
+};
 var ComputerUnavailableError = class extends Error {
   constructor(message) {
     super(message);
@@ -1273,9 +1204,6 @@ ${stderr}` : ""}`);
     this.stderr = stderr;
     this.name = "ComputerActionError";
   }
-  cmd;
-  exitCode;
-  stderr;
 };
 var SandboxComputer = class {
   environment = "ubuntu";
@@ -1288,6 +1216,9 @@ var SandboxComputer = class {
   tmp;
   screenshotWarmupBudgetMs;
   screenshotRetryDelayMs;
+  prepare;
+  prepared = false;
+  preparation = null;
   constructor(session, opts = {}) {
     this.session = session;
     this.display = opts.display ?? DEFAULT_DISPLAY;
@@ -1300,15 +1231,34 @@ var SandboxComputer = class {
     this.tmp = opts.screenshotTmpDir ?? "/tmp";
     this.screenshotWarmupBudgetMs = opts.screenshotWarmupBudgetMs ?? SCREENSHOT_WARMUP_BUDGET_MS;
     this.screenshotRetryDelayMs = opts.screenshotRetryDelayMs ?? SCREENSHOT_RETRY_DELAY_MS;
+    this.prepare = opts.prepare;
   }
   /** Rebind to a freshly resumed-by-id session after a box rollover / re-establish. */
   rebind(session) {
     this.session = session;
+    this.prepared = false;
+    this.preparation = null;
+  }
+  async prepareOnce() {
+    if (this.prepared) return;
+    if (!this.prepare) {
+      this.prepared = true;
+      return;
+    }
+    this.preparation ??= this.prepare(this.session);
+    try {
+      await this.preparation;
+      this.prepared = true;
+    } catch (error) {
+      this.preparation = null;
+      throw error;
+    }
   }
   // The single command primitive. Dual-paths exec/execCommand (F1), then uses the
   // established string-aware parsers (F2/F3): exitCode from the preamble, and
   // "still running" → a retriable failure. Returns the command OUTPUT body.
   async x(cmd) {
+    await this.prepareOnce();
     const args = {
       cmd: `DISPLAY=${this.display} ${cmd}`,
       ...this.runAs ? { runAs: this.runAs } : {},
@@ -1356,7 +1306,9 @@ var SandboxComputer = class {
         await this.x(`scrot --pointer --overwrite ${f}`);
         const bytes = await this.readScreenshotBytes(f);
         if (bytes.length === 0) {
-          throw new ComputerUnavailableError("scrot produced an empty screenshot (display not up?)");
+          throw new ComputerUnavailableError(
+            "scrot produced an empty screenshot (display not up?)"
+          );
         }
         return Buffer.from(bytes).toString("base64");
       } catch (error) {
@@ -1365,7 +1317,9 @@ var SandboxComputer = class {
           throw error;
         }
       } finally {
-        await this.x(`rm -f ${f}`).catch(() => void 0);
+        if (this.prepared) {
+          await this.x(`rm -f ${f}`).catch(() => void 0);
+        }
       }
       if (Date.now() + this.screenshotRetryDelayMs >= deadline) {
         break;
@@ -1408,7 +1362,9 @@ var SandboxComputer = class {
     if (typeof this.session.execCommand === "function") {
       return stripExecBanner(await this.session.execCommand(args));
     }
-    throw new ComputerUnavailableError("session cannot run commands (no exec/execCommand) \u2014 screenshots unavailable");
+    throw new ComputerUnavailableError(
+      "session cannot run commands (no exec/execCommand) \u2014 screenshots unavailable"
+    );
   }
   // Read the screenshot PNG bytes off the box. A SINGLE `base64 <file>` over Modal's
   // exec silently returns "" once the base64 exceeds the exec-stdout buffer cap (a full
@@ -1545,7 +1501,10 @@ var NativeDesktopComputer = class {
   }
   async pointer(x, y, action, button) {
     const n = this.toNative(x, y);
-    await this.session.desktopInput({ $case: "pointer", pointer: { x: n.x, y: n.y, action, button } });
+    await this.session.desktopInput({
+      $case: "pointer",
+      pointer: { x: n.x, y: n.y, action, button }
+    });
   }
   async screenshot() {
     let lastError;
@@ -1559,7 +1518,9 @@ var NativeDesktopComputer = class {
       try {
         const { png, width, height, nativeWidth, nativeHeight } = await this.session.screenshot();
         if (png.length === 0) {
-          throw new ComputerUnavailableError("native desktop screenshot returned an empty frame (display not up?)");
+          throw new ComputerUnavailableError(
+            "native desktop screenshot returned an empty frame (display not up?)"
+          );
         }
         this.lastEncoded = [width, height];
         this.lastNative = [nativeWidth || width, nativeHeight || height];
@@ -1573,44 +1534,82 @@ var NativeDesktopComputer = class {
       }
     }
     const reason = lastError instanceof Error ? lastError.message : String(lastError);
-    console.warn(`[NativeDesktopComputer] screenshot failed after ${attempt} attempt(s): ${reason}`);
+    console.warn(
+      `[NativeDesktopComputer] screenshot failed after ${attempt} attempt(s): ${reason}`
+    );
     if (lastError instanceof Error) {
       throw lastError;
     }
-    throw new ComputerUnavailableError("native desktop screenshot returned an empty frame (display not up?)");
+    throw new ComputerUnavailableError(
+      "native desktop screenshot returned an empty frame (display not up?)"
+    );
   }
   async click(x, y, button) {
     this.guardWrite();
-    await this.pointer(x, y, PointerAction.POINTER_ACTION_CLICK, POINTER_BUTTON[button] ?? PointerButton.POINTER_BUTTON_LEFT);
+    await this.pointer(
+      x,
+      y,
+      PointerAction.POINTER_ACTION_CLICK,
+      POINTER_BUTTON[button] ?? PointerButton.POINTER_BUTTON_LEFT
+    );
   }
   async doubleClick(x, y) {
     this.guardWrite();
-    await this.pointer(x, y, PointerAction.POINTER_ACTION_DOUBLE_CLICK, PointerButton.POINTER_BUTTON_LEFT);
+    await this.pointer(
+      x,
+      y,
+      PointerAction.POINTER_ACTION_DOUBLE_CLICK,
+      PointerButton.POINTER_BUTTON_LEFT
+    );
   }
   async move(x, y) {
     this.guardWrite();
-    await this.pointer(x, y, PointerAction.POINTER_ACTION_MOVE, PointerButton.POINTER_BUTTON_UNSPECIFIED);
+    await this.pointer(
+      x,
+      y,
+      PointerAction.POINTER_ACTION_MOVE,
+      PointerButton.POINTER_BUTTON_UNSPECIFIED
+    );
   }
   async scroll(x, y, sx, sy) {
     this.guardWrite();
     const n = this.toNative(x, y);
-    await this.session.desktopInput({ $case: "scroll", scroll: { x: n.x, y: n.y, deltaX: sx, deltaY: sy } });
+    await this.session.desktopInput({
+      $case: "scroll",
+      scroll: { x: n.x, y: n.y, deltaX: sx, deltaY: sy }
+    });
   }
   async type(text) {
     this.guardWrite();
-    await this.session.desktopInput({ $case: "key", key: { key: text, isText: true, action: KeyAction.KEY_ACTION_PRESS } });
+    await this.session.desktopInput({
+      $case: "key",
+      key: { key: text, isText: true, action: KeyAction.KEY_ACTION_PRESS }
+    });
   }
   async keypress(keys) {
     this.guardWrite();
-    await this.session.desktopInput({ $case: "key", key: { key: keys.join("+"), isText: false, action: KeyAction.KEY_ACTION_PRESS } });
+    await this.session.desktopInput({
+      $case: "key",
+      key: { key: keys.join("+"), isText: false, action: KeyAction.KEY_ACTION_PRESS }
+    });
   }
   async drag(path) {
     this.guardWrite();
     if (path.length === 0) return;
     const [sx, sy] = path[0];
-    await this.pointer(sx, sy, PointerAction.POINTER_ACTION_DOWN, PointerButton.POINTER_BUTTON_LEFT);
+    await this.pointer(
+      sx,
+      sy,
+      PointerAction.POINTER_ACTION_DOWN,
+      PointerButton.POINTER_BUTTON_LEFT
+    );
     for (const [px, py] of path.slice(1)) {
-      await this.pointer(px, py, PointerAction.POINTER_ACTION_MOVE, PointerButton.POINTER_BUTTON_LEFT);
+      await this.pointer(
+        px,
+        py,
+        PointerAction.POINTER_ACTION_MOVE,
+        PointerButton.POINTER_BUTTON_LEFT
+      );
     }
     const [ex, ey] = path[path.length - 1];
     await this.pointer(ex, ey, PointerAction.POINTER_ACTION_UP, PointerButton.POINTER_BUTTON_LEFT);
@@ -1624,14 +1623,20 @@ function isNativeDesktopSession(session) {
   return typeof s.desktopInput === "function" && typeof s.screenshot === "function";
 }
 function sniffScreenshotMediaType(bytes) {
-  if (bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71) return "image/png";
+  if (bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71)
+    return "image/png";
   if (bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return "image/jpeg";
-  if (bytes[0] === 71 && bytes[1] === 73 && bytes[2] === 70 && bytes[3] === 56) return "image/gif";
-  if (bytes[0] === 82 && bytes[1] === 73 && bytes[2] === 70 && bytes[3] === 70 && bytes[8] === 87 && bytes[9] === 69 && bytes[10] === 66 && bytes[11] === 80) return "image/webp";
+  if (bytes[0] === 71 && bytes[1] === 73 && bytes[2] === 70 && bytes[3] === 56)
+    return "image/gif";
+  if (bytes[0] === 82 && bytes[1] === 73 && bytes[2] === 70 && bytes[3] === 70 && bytes[8] === 87 && bytes[9] === 69 && bytes[10] === 66 && bytes[11] === 80)
+    return "image/webp";
   return "image/png";
 }
 function imageOutputFromScreenshotBytes(bytes) {
-  return { type: "image", image: { data: Uint8Array.from(bytes), mediaType: sniffScreenshotMediaType(bytes) } };
+  return {
+    type: "image",
+    image: { data: Uint8Array.from(bytes), mediaType: sniffScreenshotMediaType(bytes) }
+  };
 }
 function renderImageForTextTransport(output) {
   if (typeof output === "string") return output;
@@ -1646,8 +1651,14 @@ function supportsStructuredToolOutputTransport(modelInstance) {
 }
 var COMPUTER_READ_ONLY_MESSAGE = "computer-use is read-only for this session \u2014 click, double_click, move, scroll, type, keypress, and drag are disabled. Call computer_screenshot to observe the desktop.";
 var COORD_PROPS = {
-  x: { type: "integer", description: "X coordinate in the pixels of the most recent computer_screenshot" },
-  y: { type: "integer", description: "Y coordinate in the pixels of the most recent computer_screenshot" }
+  x: {
+    type: "integer",
+    description: "X coordinate in the pixels of the most recent computer_screenshot"
+  },
+  y: {
+    type: "integer",
+    description: "Y coordinate in the pixels of the most recent computer_screenshot"
+  }
 };
 function objectSchema(properties, required) {
   return { type: "object", properties, required, additionalProperties: false };
@@ -1681,14 +1692,24 @@ function computerFunctionTools(computer, readOnly, needsApproval, imageFunctionR
       name: "computer_click",
       description: "Click the mouse at (x, y). `button` is one of left|right|wheel|back|forward (default left). Take a computer_screenshot first to find coordinates.",
       parameters: objectSchema(
-        { ...COORD_PROPS, button: { type: "string", enum: ["left", "right", "wheel", "back", "forward"], description: "Mouse button; defaults to left" } },
+        {
+          ...COORD_PROPS,
+          button: {
+            type: "string",
+            enum: ["left", "right", "wheel", "back", "forward"],
+            description: "Mouse button; defaults to left"
+          }
+        },
         ["x", "y"]
       ),
       strict: false,
       ...approval,
       execute: async (input) => {
         const { x, y, button } = input;
-        return write(`clicked ${button ?? "left"} at (${x}, ${y})`, () => computer.click(x, y, button ?? "left"));
+        return write(
+          `clicked ${button ?? "left"} at (${x}, ${y})`,
+          () => computer.click(x, y, button ?? "left")
+        );
       }
     }),
     tool({
@@ -1719,8 +1740,14 @@ function computerFunctionTools(computer, readOnly, needsApproval, imageFunctionR
       parameters: objectSchema(
         {
           ...COORD_PROPS,
-          scroll_x: { type: "integer", description: "Horizontal scroll amount in pixels (positive = right)" },
-          scroll_y: { type: "integer", description: "Vertical scroll amount in pixels (positive = down)" }
+          scroll_x: {
+            type: "integer",
+            description: "Horizontal scroll amount in pixels (positive = right)"
+          },
+          scroll_y: {
+            type: "integer",
+            description: "Vertical scroll amount in pixels (positive = down)"
+          }
         },
         ["x", "y", "scroll_x", "scroll_y"]
       ),
@@ -1728,13 +1755,19 @@ function computerFunctionTools(computer, readOnly, needsApproval, imageFunctionR
       ...approval,
       execute: async (input) => {
         const { x, y, scroll_x, scroll_y } = input;
-        return write(`scrolled (${scroll_x}, ${scroll_y}) at (${x}, ${y})`, () => computer.scroll(x, y, scroll_x, scroll_y));
+        return write(
+          `scrolled (${scroll_x}, ${scroll_y}) at (${x}, ${y})`,
+          () => computer.scroll(x, y, scroll_x, scroll_y)
+        );
       }
     }),
     tool({
       name: "computer_type",
       description: "Type a literal text string at the current keyboard focus. Click the target field first.",
-      parameters: objectSchema({ text: { type: "string", description: "The literal text to type" } }, ["text"]),
+      parameters: objectSchema(
+        { text: { type: "string", description: "The literal text to type" } },
+        ["text"]
+      ),
       strict: false,
       ...approval,
       execute: async (input) => {
@@ -1746,7 +1779,13 @@ function computerFunctionTools(computer, readOnly, needsApproval, imageFunctionR
       name: "computer_keypress",
       description: 'Press a key or chord. `keys` is an ordered list pressed together, e.g. ["ctrl","c"] or ["Enter"]. Use key names (ctrl, alt, shift, cmd, enter, tab, esc, arrows\u2026), not characters.',
       parameters: objectSchema(
-        { keys: { type: "array", items: { type: "string" }, description: "Keys pressed together as a chord" } },
+        {
+          keys: {
+            type: "array",
+            items: { type: "string" },
+            description: "Keys pressed together as a chord"
+          }
+        },
         ["keys"]
       ),
       strict: false,
@@ -1792,7 +1831,6 @@ var ComputerUseCapability = class extends Capability {
     super();
     this.args = args;
   }
-  args;
   type = "computer-use";
   tools() {
     const session = requireBoundSession("computer-use", this._session);
@@ -1804,22 +1842,45 @@ var ComputerUseCapability = class extends Capability {
       ...this.args.readOnly !== void 0 ? { readOnly: this.args.readOnly } : {},
       ...this.args.display ? { display: this.args.display } : {},
       // The SDK base exposes the bound runAs as a protected field.
-      ...typeof this._runAs === "string" ? { runAs: this._runAs } : {}
+      ...typeof this._runAs === "string" ? { runAs: this._runAs } : {},
+      // Crucially lazy: tool registration does no provider work. The first
+      // click/type/screenshot boots the display, then lets the worker start
+      // any computer-use-only recording. One SandboxComputer instance caches
+      // this for the rest of the turn.
+      prepare: async (preparedSession) => {
+        await ensureDisplayStack(preparedSession);
+        await this.args.onReady?.(preparedSession);
+      }
     });
     switch (this.args.toolMode) {
       case "hosted":
         return [this.hostedComputerTool(computer)];
       case "function-image":
-        return computerFunctionTools(computer, this.args.readOnly ?? false, this.args.needsApproval, true);
+        return computerFunctionTools(
+          computer,
+          this.args.readOnly ?? false,
+          this.args.needsApproval,
+          true
+        );
       case "function-text":
-        return computerFunctionTools(computer, this.args.readOnly ?? false, this.args.needsApproval, false);
+        return computerFunctionTools(
+          computer,
+          this.args.readOnly ?? false,
+          this.args.needsApproval,
+          false
+        );
       case void 0:
         break;
     }
     if (supportsStructuredToolOutputTransport(this._modelInstance)) {
       return [this.hostedComputerTool(computer)];
     }
-    return computerFunctionTools(computer, this.args.readOnly ?? false, this.args.needsApproval, this.args.imageFunctionResults ?? false);
+    return computerFunctionTools(
+      computer,
+      this.args.readOnly ?? false,
+      this.args.needsApproval,
+      this.args.imageFunctionResults ?? false
+    );
   }
   /** The single HOSTED `computer_use_preview` tool bound to `computer` — identical
    *  construction for the explicit "hosted" mode and the legacy structured-sniff path. */
@@ -1833,8 +1894,52 @@ var ComputerUseCapability = class extends Capability {
 
 // src/index.ts
 import { OpenAIChatCompletionsModel as OpenAIChatCompletionsModel2, OpenAIResponsesModel as OpenAIResponsesModel2 } from "@openai/agents";
+
+// src/usage-telemetry.ts
+function modelCallUsageTelemetry(usage) {
+  return {
+    inputTokens: finiteNumberOrNull(usage?.inputTokens),
+    outputTokens: finiteNumberOrNull(usage?.outputTokens),
+    cachedTokens: usage ? firstPositiveDetailNumber(usage.inputTokensDetails, [
+      "cached_tokens",
+      "cachedInputTokens",
+      "cached_input_tokens"
+    ]) : null,
+    reasoningTokens: usage ? firstPositiveDetailNumber(usage.outputTokensDetails, [
+      "reasoning_tokens",
+      "reasoningTokens",
+      "reasoning_output_tokens"
+    ]) : null
+  };
+}
+function firstPositiveDetailNumber(details, keys) {
+  if (!details) {
+    return null;
+  }
+  const entries = Array.isArray(details) ? details : [details];
+  let sawZero = false;
+  for (const entry of entries) {
+    for (const key of keys) {
+      const value = finiteNumberOrNull(entry[key]);
+      if (value !== null && value > 0) {
+        return value;
+      }
+      if (value === 0) {
+        sawZero = true;
+      }
+    }
+  }
+  return sawZero ? 0 : null;
+}
+function finiteNumberOrNull(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+
+// src/index.ts
 import { MaxTurnsExceededError as MaxTurnsExceededError2 } from "@openai/agents";
-setSelfhostedApplyDiff(applyDiff);
+setSelfhostedApplyDiff(
+  applyDiff
+);
 ensureReadableStreamFrom();
 var SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS = 12e4;
 function ensureReadableStreamFrom() {
@@ -1902,7 +2007,7 @@ function buildOpenAIClientFromSettings(settings, providerId = settings.openaiPro
       defaultQuery: azureOpenAIDefaultQuery(settings, baseURL),
       defaultHeaders: settings.azureOpenaiAdToken && !settings.azureOpenaiApiKey ? { Authorization: `Bearer ${settings.azureOpenaiAdToken}` } : void 0,
       // Rewrite every outbound /responses computer_call to the ACTIONS-ONLY shape
-      // the GA Azure computer tool (gpt-5.5) accepts. This is the lowest reachable
+      // the GA Azure computer tool accepts. This is the lowest reachable
       // seam — below the SDK responses converter, which always re-synthesizes BOTH
       // `action` and `actions` (rejected 400 "exactly one of action or actions").
       // See computerCallNormalizingFetch / rewriteComputerCallsToActionsOnly.
@@ -1922,19 +2027,35 @@ function buildProviderClient(provider, settings) {
   if (cached) {
     return cached;
   }
-  const client = provider.builtin ? buildOpenAIClientFromSettings(settings, provider.id) : provider.kind === "codex-subscription" ? new OpenAI({
-    apiKey: provider.apiKey ?? "codex-subscription",
-    ...provider.baseUrl ? { baseURL: provider.baseUrl } : {},
-    maxRetries: settings.openaiMaxRetries,
-    fetch: codexSubscriptionFetch(instrumentedModelFetch(provider.id, globalThis.fetch))
-  }) : new OpenAI({
-    ...provider.apiKey ? { apiKey: provider.apiKey } : {},
-    ...provider.baseUrl ? { baseURL: provider.baseUrl } : {},
-    maxRetries: settings.openaiMaxRetries,
-    ...provider.defaultQuery ? { defaultQuery: provider.defaultQuery } : {},
-    ...provider.defaultHeaders ? { defaultHeaders: provider.defaultHeaders } : {},
-    fetch: instrumentedModelFetch(provider.id, globalThis.fetch)
-  });
+  const client = provider.builtin ? buildOpenAIClientFromSettings(settings, provider.id) : provider.kind === "codex-subscription" ? (
+    // Codex subscription: the static apiKey is a placeholder — the real per-request
+    // bearer + ChatGPT-Account-ID, the /responses->/codex/responses rewrite, and the
+    // body normalization are all injected by codexSubscriptionFetch, which reads the
+    // per-workspace token from codexRequestStorage (AsyncLocalStorage) at call time.
+    // The provider id is constant ("codex-subscription"), so one cached client serves
+    // every workspace without baking a token into it.
+    new OpenAI({
+      apiKey: provider.apiKey ?? "codex-subscription",
+      ...provider.baseUrl ? { baseURL: provider.baseUrl } : {},
+      // Codex transport owns exactly one explicit 401 refresh/retry. Blind
+      // SDK retries on network/5xx/partial streams can replay provider work
+      // or external tool side effects without a durable checkpoint.
+      maxRetries: 0,
+      fetch: codexSubscriptionFetch(instrumentedModelFetch(provider.id, globalThis.fetch))
+    })
+  ) : (
+    // ResolvedModelProvider.apiKey is already the resolved key (configuredProviders
+    // ran resolveProviderApiKey at config time, collapsing apiKey/apiKeyEnv), so it
+    // is passed straight through here rather than re-resolved.
+    new OpenAI({
+      ...provider.apiKey ? { apiKey: provider.apiKey } : {},
+      ...provider.baseUrl ? { baseURL: provider.baseUrl } : {},
+      maxRetries: settings.openaiMaxRetries,
+      ...provider.defaultQuery ? { defaultQuery: provider.defaultQuery } : {},
+      ...provider.defaultHeaders ? { defaultHeaders: provider.defaultHeaders } : {},
+      fetch: instrumentedModelFetch(provider.id, globalThis.fetch)
+    })
+  );
   providerClientCache.set(provider.id, client);
   return client;
 }
@@ -1958,11 +2079,13 @@ var MultiProviderModelProvider = class {
   constructor(settings) {
     this.settings = settings;
   }
-  settings;
   fallback;
   async getModel(modelName) {
     if (modelName) {
-      const resolved = resolveTurnModel(settingsForRunScopedModelResolution(this.settings, modelName), modelName);
+      const resolved = resolveTurnModel(
+        settingsForRunScopedModelResolution(this.settings, modelName),
+        modelName
+      );
       if (resolved) {
         if (modelName.startsWith(CODEX_MODEL_ID_PREFIX) && resolved.provider.kind !== "codex-subscription") {
           throw new CodexSubscriptionUnavailableError(modelName);
@@ -1999,6 +2122,14 @@ var CodexSubscriptionUnavailableError = class extends Error {
     this.name = "CodexSubscriptionUnavailableError";
   }
 };
+var WorkspaceModelPolicyBlockedError = class extends Error {
+  constructor(modelName, providerId, reason) {
+    super(
+      reason === "provider" ? `Model "${modelName}" is not available in this workspace: its provider ("${providerId}") is not in the workspace's allowed providers. Pick an allowed model, or ask a workspace admin to change the workspace model policy.` : `Model "${modelName}" is not in this workspace's allowed models. Pick an allowed model, or ask a workspace admin to change the workspace model policy.`
+    );
+    this.name = "WorkspaceModelPolicyBlockedError";
+  }
+};
 function configureOpenAI(settings) {
   setOpenAIResponsesTransport(settings.openaiResponsesTransport);
   setTracingDisabled(settings.disableOpenaiTracing || !settings.observabilityOtlpEndpoint);
@@ -2017,7 +2148,7 @@ function configureOpenAI(settings) {
   setDefaultModelProvider(router);
 }
 function instrumentedModelFetch(provider, inner) {
-  return (async (input, init) => {
+  return async (input, init) => {
     if (!isModelCallFetch(input)) {
       return await inner(input, init);
     }
@@ -2030,7 +2161,7 @@ function instrumentedModelFetch(provider, inner) {
       recordModelCallMetric(provider, "failed", started);
       throw error;
     }
-  });
+  };
 }
 function isModelCallFetch(input) {
   const rawUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
@@ -2056,37 +2187,43 @@ async function summarizeForCompaction(settings, input, options = {}) {
   const api = options.api ?? "responses";
   const model = options.model ?? settings.openaiModel;
   const maxTokens = options.maxOutputTokens ?? SUMMARY_BUFFER_TOKENS;
-  const transcript = renderCompactionPromptInputForChat(
-    input,
-    typeof options.maxTranscriptTokens === "number" && options.maxTranscriptTokens > 0 ? { maxEstimatedTokens: options.maxTranscriptTokens } : {}
-  );
-  try {
-    if (api === "chat") {
-      const completion = await client.chat.completions.create({
-        model,
-        max_tokens: maxTokens,
-        messages: [{ role: "user", content: transcript }]
-      });
-      const text2 = completion.choices?.[0]?.message?.content;
-      const trimmed2 = typeof text2 === "string" ? text2.trim() : "";
-      return trimmed2.length > 0 ? trimmed2 : null;
-    }
-    const response = await client.responses.create({
+  if (api === "chat") {
+    const transcript = renderCompactionPromptInputForChat(input);
+    const completion = await client.chat.completions.create({
       model,
-      // store:false is the OpenAI-platform-only storeless precondition; Azure
-      // rejects it. The summarizer's resolved client is OpenAI/Azure on the
-      // built-in path (api "responses"), so gate it on the built-in provider.
-      ...settings.openaiProvider === "azure" ? {} : { store: false },
-      max_output_tokens: maxTokens,
-      input: transcript
+      max_tokens: maxTokens,
+      messages: [{ role: "user", content: transcript }],
+      ...options.promptCacheKey ? { prompt_cache_key: options.promptCacheKey } : {}
     });
-    const text = extractResponseOutputText(response);
-    const trimmed = text.trim();
-    return trimmed.length > 0 ? trimmed : null;
-  } catch (error) {
-    console.error("context compaction summarize failed", error);
-    return null;
+    const usage2 = modelResponseUsageFromResponse(completion);
+    if (usage2) {
+      await options.onUsage?.(usage2);
+    }
+    const text = completion.choices?.[0]?.message?.content;
+    return typeof text === "string" ? text.trim() : "";
+  }
+  const request = {
+    systemInstructions: options.systemInstructions ?? "",
+    input,
+    modelSettings: {
+      maxTokens,
+      // Azure rejects store:false; the Codex subscription transport enforces
+      // it independently. The OpenAI platform path remains explicitly storeless.
+      ...settings.openaiProvider === "azure" ? {} : { store: false },
+      ...options.promptCacheKey ? { providerData: { prompt_cache_key: options.promptCacheKey } } : {}
+    },
+    tools: [],
+    toolsExplicitlyProvided: true,
+    outputType: "text",
+    handoffs: [],
+    tracing: false
+  };
+  const response = await new CompactionResponsesModel(client, model).fetchResponse(request);
+  const usage = modelResponseUsageFromResponse(response);
+  if (usage) {
+    await options.onUsage?.(usage);
   }
+  return extractResponseOutputText(response).trim();
 }
 function extractResponseOutputText(response) {
   if (!response || typeof response !== "object") {
@@ -2123,6 +2260,19 @@ function extractResponseOutputText(response) {
   }
   return parts.join("");
 }
+var CompactionResponsesModel = class extends OpenAIResponsesModel {
+  fetchResponse(request) {
+    return this._fetchResponse(request, false);
+  }
+};
+function rigInstructions(rig) {
+  return [
+    `This session runs on rig "${rig.name}" (active version v${rig.version}) \u2014 a shared, versioned sandbox machine definition for your workspace.`,
+    "Your sandbox is an EPHEMERAL FORK of that rig: you have root and may install anything freely, but everything you change here is junk that dies with the box and never reaches the rig or other sessions.",
+    "For a DURABLE, team-wide change (tooling every future session on this rig should have), propose it with rig_propose_change, passing the EXACT command that already worked in this box \u2014 never assume an unverified change propagates.",
+    "If tooling you expect is missing, consult rig_get to see the rig's current setup and checks before reinstalling."
+  ];
+}
 function workspaceEnvironmentInstructions(environment) {
   const lines = [
     `A workspace environment named "${environment.name}" is attached to this session; its variables are exported in the sandbox shell environment.`
@@ -2137,14 +2287,17 @@ function workspaceEnvironmentInstructions(environment) {
   }
   return lines;
 }
-function coreInstructions(workspaceEnvironment) {
+function coreInstructions(workspaceEnvironment, rig) {
   return [
     "If the session has a goal, you own it: keep working until you call opengeni__goal_complete with concrete evidence or opengeni__goal_pause with a rationale; revise it with opengeni__goal_update; create one with opengeni__goal_set when given a long-running objective.",
-    ...workspaceEnvironment ? workspaceEnvironmentInstructions(workspaceEnvironment) : []
+    ...workspaceEnvironment ? workspaceEnvironmentInstructions(workspaceEnvironment) : [],
+    // Rig doctrine (M3): data-conditional, inside the non-bypassable CORE so a
+    // white-label persona template can never drop it. Absent for rig-less sessions.
+    ...rig ? rigInstructions(rig) : []
   ];
 }
-function composeAgentInstructions(template, workspaceEnvironment) {
-  const core = coreInstructions(workspaceEnvironment).join(" ");
+function composeAgentInstructions(template, workspaceEnvironment, rig) {
+  const core = coreInstructions(workspaceEnvironment, rig).join(" ");
   if (template.includes(AGENT_INSTRUCTIONS_CORE_PLACEHOLDER)) {
     return template.split(AGENT_INSTRUCTIONS_CORE_PLACEHOLDER).join(core);
   }
@@ -2154,27 +2307,52 @@ function appendSessionInstructions(composed, sessionInstructions) {
   const trimmed = sessionInstructions?.trim();
   return trimmed ? `${composed} ${trimmed}` : composed;
 }
-function appendToolspaceInstructions(composed, toolspaceAvailable) {
-  return toolspaceAvailable ? `${composed} ${TOOLSPACE_PROGRAMMATIC_DIRECTIVE}` : composed;
+function appendPersistentSessionSettings(composed, settings) {
+  if (!settings) {
+    return composed;
+  }
+  const childState = settings.childNotificationsMode ? `; spawned-worker completion notifications are ${settings.childNotificationsMode}` : "";
+  const persistentTools = settings.childNotificationsMode ? "opengeni__set_session_title or opengeni__set_child_notifications_mode" : "opengeni__set_session_title";
+  return `${composed} Persistent session settings already in effect: the display title is ${settings.titleIsSet ? "set" : "not set"}${childState}. These settings persist across turns, continuations, and interruptions. Do not call ${persistentTools} merely to reassert an unchanged value; call them only when the current value actually needs to change.`;
+}
+function appendWorkspaceMemory(composed, workspaceMemory) {
+  const trimmed = workspaceMemory?.trim();
+  return trimmed ? `${composed} ${trimmed}` : composed;
+}
+function appendToolspaceInstructions(composed, toolspaceAvailable) {
+  return toolspaceAvailable ? `${composed} ${TOOLSPACE_PROGRAMMATIC_DIRECTIVE}` : composed;
 }
 function appendGenesisTitleDirective(instructions, genesisTitleHint) {
   return genesisTitleHint ? `${instructions} ${GENESIS_TITLE_DIRECTIVE}` : instructions;
 }
 var agentFileDownloads = /* @__PURE__ */ new WeakMap();
 var agentRepositoryCloneHooks = /* @__PURE__ */ new WeakMap();
-var agentGitTokenSeed = /* @__PURE__ */ new WeakMap();
+var agentGitTokenSeeds = /* @__PURE__ */ new WeakMap();
 var agentToolspaceTokenSeed = /* @__PURE__ */ new WeakMap();
+var agentsNeedingGenesisTitleDirective = /* @__PURE__ */ new WeakSet();
 var agentActiveSandboxBackend = /* @__PURE__ */ new WeakMap();
+var agentRigSetup = /* @__PURE__ */ new WeakMap();
+var agentRigCredentialHooks = /* @__PURE__ */ new WeakMap();
 function mcpToolErrorOutput(error) {
   const details = error instanceof Error ? error.message : String(error);
-  return { isError: true, content: [{ type: "text", text: `An error occurred while running the tool. Please try again. Error: ${details}` }] };
+  return {
+    isError: true,
+    content: [
+      {
+        type: "text",
+        text: `An error occurred while running the tool. Please try again. Error: ${details}`
+      }
+    ]
+  };
 }
 var mcpToolErrorFunction = ({ error }) => mcpToolErrorOutput(error);
 function buildOpenGeniAgent(settings, resources, options = {}) {
-  const compactionMode = options.compactionMode ?? resolveContextCompactionMode(settings);
   const hostedWebSearch = options.hostedWebSearch ?? settings.webSearchEnabled;
   const encryptedReasoning = options.encryptedReasoning ?? settings.openaiReasoningEncryptedContent;
-  const contextWindowTokens = options.contextWindowTokens ?? settings.contextWindowTokens;
+  const providerData = {
+    ...encryptedReasoning ? { include: ["reasoning.encrypted_content"] } : {},
+    ...options.promptCacheKey ? { prompt_cache_key: options.promptCacheKey } : {}
+  };
   const hostedTools = hostedWebSearch ? [webSearchTool()] : [];
   const baseConfig = {
     name: "OpenGeni Agent",
@@ -2194,32 +2372,36 @@ function buildOpenGeniAgent(settings, resources, options = {}) {
     //      when a toolspace token was minted for this turn (feature enabled + a
     //      per-turn seed — the mint gate, which includes selfhosted turns since
     //      they now receive the token too) — appendToolspaceInstructions,
-    //   3. + the per-session persona instructions (session-specific, so it
+    //   3. + workspace memory working set, ONLY when the workspace setting is on
+    //      and the worker resolved a nonblank block — appendWorkspaceMemory,
+    //   4. + the per-session persona instructions (session-specific, so it
     //      refines both the workspace persona and the substrate note),
-    //   4. + the one-shot genesis title directive (genesis turn only).
-    // With no toolspace token, no session instructions, and no genesis hint this
-    // is byte-identical to the historical composed instructions.
-    instructions: appendGenesisTitleDirective(
+    //   5. + durable session-setting state (title present + child notification
+    //      mode), when supplied by the worker,
+    // The genesis title directive is deliberately NOT part of this persistent
+    // string. runAgentStream injects it into the first model call only.
+    instructions: appendPersistentSessionSettings(
       appendSessionInstructions(
-        appendToolspaceInstructions(
-          composeAgentInstructions(options.instructionsTemplate ?? settings.agentInstructionsTemplate, options.workspaceEnvironment),
-          settings.toolspaceEnabled && Boolean(options.toolspaceTokenSeed)
+        appendWorkspaceMemory(
+          appendToolspaceInstructions(
+            composeAgentInstructions(
+              options.instructionsTemplate ?? settings.agentInstructionsTemplate,
+              options.workspaceEnvironment,
+              options.rig
+            ),
+            settings.toolspaceEnabled && Boolean(options.toolspaceTokenSeed)
+          ),
+          options.workspaceMemory
         ),
         options.sessionInstructions
       ),
-      options.genesisTitleHint
+      options.persistentSessionSettings
     ),
     modelSettings: {
-      reasoning: { effort: options.reasoningEffort ?? settings.openaiReasoningEffort, summary: "detailed" },
-      // Server-side compaction (OpenAI platform) requires store=false: the
-      // server emits an opaque ENCRYPTED 'compaction' item that round-trips in
-      // the request rather than being anchored to a stored response. OpenGeni
-      // already runs storeless (provider item ids stripped, encrypted reasoning
-      // round-tripped), so this is consistent with the existing design and
-      // only set where the server compaction capability is attached. Gated on
-      // the RESOLVED compaction mode (registry providers resolve to "client",
-      // so they never carry store:false).
-      ...compactionMode === "server" ? { store: false } : {},
+      reasoning: {
+        effort: options.reasoningEffort ?? settings.openaiReasoningEffort,
+        summary: "detailed"
+      },
       // Round-trip the encrypted reasoning payload with every call so chains
       // of thought survive without provider-side response storage (which is
       // what stripped provider item ids opt us out of — see
@@ -2228,7 +2410,7 @@ function buildOpenGeniAgent(settings, resources, options = {}) {
       // function tools, which contribute none. Gated on the resolved
       // encryptedReasoning flag: the chat wire API has no encrypted_content
       // field, so registry "chat" providers turn it off.
-      ...encryptedReasoning ? { providerData: { include: ["reasoning.encrypted_content"] } } : {}
+      ...Object.keys(providerData).length > 0 ? { providerData } : {}
     },
     // Explicit hosted tools (web_search when enabled). Threaded into BOTH the
     // `new Agent(baseConfig)` path (sandboxBackend === "none") and the
@@ -2246,6 +2428,9 @@ function buildOpenGeniAgent(settings, resources, options = {}) {
   };
   if (settings.sandboxBackend === "none") {
     const agent2 = new Agent(baseConfig);
+    if (options.genesisTitleHint) {
+      agentsNeedingGenesisTitleDirective.add(agent2);
+    }
     maybeInstallCodexToolSearch(agent2, settings, options);
     applyMcpApprovalPolicy(agent2, settings);
     return agent2;
@@ -2253,26 +2438,51 @@ function buildOpenGeniAgent(settings, resources, options = {}) {
   const runAs = sandboxRunAs(settings);
   const agent = new SandboxAgent({
     ...baseConfig,
-    defaultManifest: buildManifest(settings, resources, options.sandboxEnvironment, options.fileResourceDownloads),
+    defaultManifest: buildManifest(
+      settings,
+      resources,
+      options.sandboxEnvironment,
+      options.fileResourceDownloads
+    ),
     ...runAs ? { runAs } : {},
     capabilities: buildAgentCapabilities(settings, options.packSkills ?? [], {
-      compactionMode,
-      contextWindowTokens,
       ...options.structuredToolTransport !== void 0 ? { structuredToolTransport: options.structuredToolTransport } : {},
-      ...options.computerToolMode !== void 0 ? { computerToolMode: options.computerToolMode } : {}
+      ...options.computerToolMode !== void 0 ? { computerToolMode: options.computerToolMode } : {},
+      ...options.onComputerUseReady ? { onComputerUseReady: options.onComputerUseReady } : {}
     })
   });
-  agentFileDownloads.set(agent, normalizeSandboxFileDownloads(options.fileResourceDownloads ?? []).filter((download) => !download.content));
-  agentRepositoryCloneHooks.set(agent, sandboxRepositoryCloneHooks(settings, resources, options.activeSandboxBackend));
+  if (options.genesisTitleHint) {
+    agentsNeedingGenesisTitleDirective.add(agent);
+  }
+  agentFileDownloads.set(
+    agent,
+    normalizeSandboxFileDownloads(options.fileResourceDownloads ?? []).filter(
+      (download) => !download.content
+    )
+  );
+  agentRepositoryCloneHooks.set(
+    agent,
+    sandboxRepositoryCloneHooks(settings, resources, options.activeSandboxBackend)
+  );
   if (options.activeSandboxBackend) {
     agentActiveSandboxBackend.set(agent, options.activeSandboxBackend);
   }
-  if (options.gitTokenSeed) {
-    agentGitTokenSeed.set(agent, options.gitTokenSeed);
+  const gitTokenSeeds = {
+    ...options.gitTokenSeeds ?? {},
+    ...options.gitTokenSeed ? { github: options.gitTokenSeed } : {}
+  };
+  if (Object.keys(gitTokenSeeds).length > 0) {
+    agentGitTokenSeeds.set(agent, gitTokenSeeds);
   }
   if (options.toolspaceTokenSeed) {
     agentToolspaceTokenSeed.set(agent, options.toolspaceTokenSeed);
   }
+  if (options.rigSetup) {
+    agentRigSetup.set(agent, options.rigSetup);
+  }
+  if (options.rigCredentialHookIds && options.rigCredentialHookIds.length > 0) {
+    agentRigCredentialHooks.set(agent, sandboxLifecycleHooksForIds(options.rigCredentialHookIds));
+  }
   maybeInstallCodexToolSearch(agent, settings, options);
   applyMcpApprovalPolicy(agent, settings);
   return agent;
@@ -2314,7 +2524,12 @@ function installMcpApprovalPolicy(agent, policies) {
   }
 }
 function applyMcpApprovalPolicy(agent, settings) {
-  const policies = settings.mcpServers.filter((server) => server.requireApproval === true || Array.isArray(server.requireApproval) && server.requireApproval.length > 0).map((server) => ({ prefix: prefixedMcpToolName(server.id, ""), requireApproval: server.requireApproval })).sort((a, b) => b.prefix.length - a.prefix.length);
+  const policies = settings.mcpServers.filter(
+    (server) => server.requireApproval === true || Array.isArray(server.requireApproval) && server.requireApproval.length > 0
+  ).map((server) => ({
+    prefix: prefixedMcpToolName(server.id, ""),
+    requireApproval: server.requireApproval
+  })).sort((a, b) => b.prefix.length - a.prefix.length);
   if (policies.length === 0) {
     return;
   }
@@ -2327,24 +2542,67 @@ function neutralizeStructuredToolTransport(capability) {
   };
   capability.bindModel = forceFunctionTransport;
 }
+function withExecOpCorrelation(tools) {
+  return tools.map((capabilityTool) => {
+    if (capabilityTool.type !== "function" || capabilityTool.name !== "exec_command") {
+      return capabilityTool;
+    }
+    const invoke = capabilityTool.invoke;
+    return {
+      ...capabilityTool,
+      invoke: (runContext, input, details) => {
+        const callId = details?.toolCall?.callId;
+        if (!callId) {
+          return invoke(runContext, input, details);
+        }
+        return runWithToolCallCorrelation(callId, () => invoke(runContext, input, details));
+      }
+    };
+  });
+}
+function withStructuredViewImageFunctionResults(tools) {
+  return tools.map((capabilityTool) => {
+    if (capabilityTool.type !== "function" || capabilityTool.name !== "view_image") {
+      return capabilityTool;
+    }
+    const invoke = capabilityTool.invoke;
+    return {
+      ...capabilityTool,
+      invoke: async (runContext, input, details) => {
+        const output = await invoke(runContext, input, details);
+        const dataUrl = typeof output === "string" ? output : output && typeof output === "object" && typeof output.text === "string" ? output.text : null;
+        return dataUrl?.startsWith("data:image/") ? { type: "image", image: { url: dataUrl } } : output;
+      }
+    };
+  });
+}
 function buildAgentCapabilities(settings, packSkills, options = {}) {
-  const mode = options.compactionMode ?? resolveContextCompactionMode(settings);
-  const contextWindowTokens = options.contextWindowTokens ?? settings.contextWindowTokens;
-  const filesystemCapability = filesystem();
+  const filesystemCapability = filesystem({
+    ...options.structuredToolTransport === false ? { configureTools: withStructuredViewImageFunctionResults } : {}
+  });
   if (options.structuredToolTransport === false) {
     neutralizeStructuredToolTransport(filesystemCapability);
   }
-  const caps = [filesystemCapability, shell()];
-  if (mode === "server") {
-    caps.push(compaction({ policy: new StaticCompactionPolicy(contextServerCompactThreshold({ ...settings, contextWindowTokens })) }));
-  }
+  const caps = [
+    filesystemCapability,
+    shell({ configureTools: withExecOpCorrelation })
+  ];
   caps.push(skills({ lazyFrom: lazySkillSourceWithPackSkills(packSkills) }));
   if (settings.computerUseEnabled && settings.sandboxDesktopEnabled && desktopCapableBackend(settings.sandboxBackend)) {
     const explicitMode = options.computerToolMode;
     const computerCapability = computerUse({
       dimensions: [settings.streamResolutionWidth, settings.streamResolutionHeight],
       readOnly: settings.computerUseReadOnly,
-      ...explicitMode ? { toolMode: explicitMode } : options.structuredToolTransport === false ? { imageFunctionResults: true } : {}
+      ...options.onComputerUseReady ? { onReady: options.onComputerUseReady } : {},
+      ...explicitMode ? { toolMode: explicitMode } : (
+        // Legacy (no explicit mode): on the codex path the function tools deliver
+        // screenshots as a real image the model can see. The ChatGPT/Codex backend
+        // rejects HOSTED tool types but DOES accept `input_image` content items inside a
+        // `function_call_output` (proven by openai/codex codex-rs, whose view_image tool
+        // ships exactly that shape) — so a structured image tool result is seen, where a
+        // text data-URL would be unreadable.
+        options.structuredToolTransport === false ? { imageFunctionResults: true } : {}
+      )
     });
     if (!explicitMode && options.structuredToolTransport === false) {
       neutralizeStructuredToolTransport(computerCapability);
@@ -2363,32 +2621,44 @@ async function prepareAgentTools(settings, tools, options = {}) {
     }, codexConnectorNamespaces };
   }
   const registry = new Map(settings.mcpServers.map((server) => [server.id, server]));
-  const servers = await Promise.all(tools.map(async (tool2) => {
-    const config = registry.get(tool2.id);
-    if (!config) {
-      throw new Error(`Unknown MCP server id: ${tool2.id}`);
-    }
-    const url = firstPartyMcpServerUrlForRun(settings, config, options.workspaceId) ?? config.url;
-    const baseFetch = isCodexAppsMcpServer(config) ? codexAppsSanitizingFetch(globalThis.fetch, codexConnectorNamespaces) : globalThis.fetch;
-    const fetchImpl = config.connectionRef ? connectionBrokerFetch(baseFetch, config, options) : baseFetch;
-    const server = new PrefixedMcpServer(new MCPServerStreamableHttp({
-      url,
-      name: config.name ?? config.id,
-      cacheToolsList: config.cacheToolsList,
-      // codex_apps returns connector tools with empty `outputSchema: {}` that the
-      // MCP SDK's strict Tool schema rejects (fails the turn during tools/list);
-      // sanitize the response on the wire before validation. The namespace Set
-      // also captures each tool's original connector namespace (P4 Part B.1).
-      ...fetchImpl !== globalThis.fetch ? { fetch: fetchImpl } : {},
-      ...await mcpServerRequestInit(settings, config, options),
-      ...config.timeoutMs ? {
-        timeout: config.timeoutMs,
-        clientSessionTimeoutSeconds: Math.ceil(config.timeoutMs / 1e3)
-      } : {}
-    }), config.id, config.allowedTools);
-    const optional = tool2.optional === true;
-    return { server, bestEffort: isCodexAppsMcpServer(config) || optional || !!config.connectionRef, optional };
-  }));
+  const servers = await Promise.all(
+    tools.map(async (tool2) => {
+      const config = registry.get(tool2.id);
+      if (!config) {
+        throw new Error(`Unknown MCP server id: ${tool2.id}`);
+      }
+      const url = firstPartyMcpServerUrlForRun(settings, config, options.workspaceId) ?? config.url;
+      const baseFetch = isCodexAppsMcpServer(config) ? codexAppsSanitizingFetch(globalThis.fetch, codexConnectorNamespaces) : globalThis.fetch;
+      const fetchImpl = config.connectionRef ? connectionBrokerFetch(baseFetch, config, options) : isFirstPartyMcpServer(settings, config) ? firstPartyAuthFetch(baseFetch, settings, options) : baseFetch;
+      const optional = tool2.optional === true;
+      const bestEffort = isCodexAppsMcpServer(config) || optional || !!config.connectionRef;
+      const server = new PrefixedMcpServer(
+        new MCPServerStreamableHttp({
+          url,
+          name: config.name ?? config.id,
+          cacheToolsList: config.cacheToolsList,
+          // codex_apps returns connector tools with empty `outputSchema: {}` that the
+          // MCP SDK's strict Tool schema rejects (fails the turn during tools/list);
+          // sanitize the response on the wire before validation. The namespace Set
+          // also captures each tool's original connector namespace (P4 Part B.1).
+          ...fetchImpl !== globalThis.fetch ? { fetch: fetchImpl } : {},
+          ...await mcpServerRequestInit(settings, config),
+          ...config.timeoutMs ? {
+            timeout: config.timeoutMs,
+            clientSessionTimeoutSeconds: Math.ceil(config.timeoutMs / 1e3)
+          } : {}
+        }),
+        config.id,
+        config.allowedTools,
+        bestEffort
+      );
+      return {
+        server,
+        bestEffort,
+        optional
+      };
+    })
+  );
   const requiredServers = servers.filter((entry) => !entry.bestEffort).map((entry) => entry.server);
   const bestEffortServers = servers.filter((entry) => entry.bestEffort).map((entry) => entry.server);
   const optionalServerNames = new Set(
@@ -2432,30 +2702,54 @@ function connectionBrokerFetch(baseFetch, config, options) {
   }
   return async (input, init) => {
     const request = await mcpRequestInfo(input, init);
-    const first = await resolveConnectionForRequest(options, config.id, connectionRef, request.toolName, false);
+    const first = await resolveConnectionForRequest(
+      options,
+      config.id,
+      connectionRef,
+      request.toolName,
+      false
+    );
     if (first.status === "auth_needed") {
       return await authNeededFetchResponse(options, config.id, request, first, connectionRef);
     }
-    const response = await baseFetch(fetchInputForAttempt(input), withConnectionHeaders(input, init, first.headers));
+    const response = await baseFetch(
+      fetchInputForAttempt(input),
+      withConnectionHeaders(input, init, first.headers)
+    );
     if (response.status === 401) {
-      const refreshed = await resolveConnectionForRequest(options, config.id, connectionRef, request.toolName, true);
+      const refreshed = await resolveConnectionForRequest(
+        options,
+        config.id,
+        connectionRef,
+        request.toolName,
+        true
+      );
       if (refreshed.status === "auth_needed") {
         return await authNeededFetchResponse(options, config.id, request, refreshed, connectionRef);
       }
-      const retry = await baseFetch(fetchInputForAttempt(input), withConnectionHeaders(input, init, refreshed.headers));
+      const retry = await baseFetch(
+        fetchInputForAttempt(input),
+        withConnectionHeaders(input, init, refreshed.headers)
+      );
       if (retry.status === 403) {
         const auth = insufficientScopeAuth(retry.headers, connectionRef, refreshed.connectionId);
         return auth ? await authNeededFetchResponse(options, config.id, request, auth, connectionRef) : retry;
       }
       if (retry.status === 401) {
-        return await authNeededFetchResponse(options, config.id, request, {
-          status: "auth_needed",
-          reason: "expired",
-          providerDomain: connectionRef.providerDomain,
-          connectionId: refreshed.connectionId,
-          ...connectionRef.scopes ? { scopes: connectionRef.scopes } : {},
-          ...connectionRef.resource ? { resource: connectionRef.resource } : {}
-        }, connectionRef);
+        return await authNeededFetchResponse(
+          options,
+          config.id,
+          request,
+          {
+            status: "auth_needed",
+            reason: "expired",
+            providerDomain: connectionRef.providerDomain,
+            connectionId: refreshed.connectionId,
+            ...connectionRef.scopes ? { scopes: connectionRef.scopes } : {},
+            ...connectionRef.resource ? { resource: connectionRef.resource } : {}
+          },
+          connectionRef
+        );
       }
       return retry;
     }
@@ -2556,7 +2850,9 @@ async function mcpRequestInfo(input, init) {
   }
 }
 function withConnectionHeaders(input, init, authHeaders) {
-  const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : void 0));
+  const headers = new Headers(
+    init?.headers ?? (input instanceof Request ? input.headers : void 0)
+  );
   for (const [name, value] of Object.entries(authHeaders)) {
     headers.set(name, value);
   }
@@ -2590,17 +2886,20 @@ function parseWwwAuthenticate(header) {
 var MCP_AUTH_NEEDED_ERROR_CODE = -32001;
 var MCP_AUTH_NEEDED_MESSAGE = "Authentication required - a connection link was posted to the session.";
 function mcpToolAuthNeededResponse(id) {
-  return new Response(JSON.stringify({
-    jsonrpc: "2.0",
-    id: id ?? null,
-    error: {
-      code: MCP_AUTH_NEEDED_ERROR_CODE,
-      message: MCP_AUTH_NEEDED_MESSAGE
-    }
-  }), {
-    status: 200,
-    headers: { "content-type": "application/json" }
-  });
+  return new Response(
+    JSON.stringify({
+      jsonrpc: "2.0",
+      id: id ?? null,
+      error: {
+        code: MCP_AUTH_NEEDED_ERROR_CODE,
+        message: MCP_AUTH_NEEDED_MESSAGE
+      }
+    }),
+    {
+      status: 200,
+      headers: { "content-type": "application/json" }
+    }
+  );
 }
 function isAuthNeededMcpError(error) {
   if (!(error instanceof Error)) {
@@ -2609,19 +2908,35 @@ function isAuthNeededMcpError(error) {
   const code = error.code;
   return code === MCP_AUTH_NEEDED_ERROR_CODE || error.message.includes(MCP_AUTH_NEEDED_MESSAGE);
 }
-async function mcpServerRequestInit(settings, config, options) {
+function mcpToolUnavailableMessage(reason) {
+  return `This tool is unavailable for the rest of this turn (${reason}). Do not retry it \u2014 continue without it or use another approach.`;
+}
+function safeMcpErrorFields(error) {
+  const errorClass = error instanceof Error ? error.constructor.name : typeof error;
+  const raw = error?.code;
+  const status = typeof raw === "number" ? raw : void 0;
+  if (status === void 0) {
+    const altRaw = error?.status;
+    return typeof altRaw === "number" ? { errorClass, status: altRaw } : { errorClass };
+  }
+  return { errorClass, status };
+}
+function mcpErrorReason(fields) {
+  return fields.status === void 0 ? fields.errorClass : `${fields.errorClass} ${fields.status}`;
+}
+async function mcpServerRequestInit(settings, config) {
   if (isCodexAppsMcpServer(config)) {
     return await codexAppsMcpRequestInit(settings);
   }
   if (isFirstPartyMcpServer(settings, config)) {
-    return await firstPartyMcpRequestInit(settings, config, options);
+    return await firstPartyMcpRequestInit(settings, config);
   }
   if (config.headers && Object.keys(config.headers).length > 0) {
     return { requestInit: { headers: { ...config.headers } } };
   }
   return {};
 }
-async function firstPartyMcpRequestInit(settings, config, options) {
+async function firstPartyMcpRequestInit(settings, config) {
   if (!isFirstPartyMcpServer(settings, config)) {
     return {};
   }
@@ -2629,17 +2944,6 @@ async function firstPartyMcpRequestInit(settings, config, options) {
   if (settings.authRequired && settings.accessKey) {
     headers["x-opengeni-access-key"] = settings.accessKey;
   }
-  if (settings.delegationSecret && options.accountId && options.workspaceId) {
-    headers.authorization = `Bearer ${await signDelegatedAccessToken(settings.delegationSecret, {
-      accountId: options.accountId,
-      workspaceId: options.workspaceId,
-      subjectId: options.subjectId ?? "worker:first-party-mcp",
-      ...options.subjectLabel ? { subjectLabel: options.subjectLabel } : {},
-      permissions: options.firstPartyPermissions ?? firstPartyMcpPermissions,
-      ...options.sessionId ? { sessionId: options.sessionId } : {},
-      exp: Math.floor(Date.now() / 1e3) + 60 * 60
-    })}`;
-  }
   if (Object.keys(headers).length === 0) {
     return {};
   }
@@ -2649,6 +2953,33 @@ async function firstPartyMcpRequestInit(settings, config, options) {
     }
   };
 }
+async function signFirstPartyDelegatedBearer(settings, options) {
+  if (!settings.delegationSecret || !options.accountId || !options.workspaceId) {
+    return null;
+  }
+  return await signDelegatedAccessToken(settings.delegationSecret, {
+    accountId: options.accountId,
+    workspaceId: options.workspaceId,
+    subjectId: options.subjectId ?? "worker:first-party-mcp",
+    ...options.subjectLabel ? { subjectLabel: options.subjectLabel } : {},
+    permissions: options.firstPartyPermissions ?? firstPartyMcpPermissions,
+    ...options.sessionId ? { sessionId: options.sessionId } : {},
+    ...options.turnId ? { turnId: options.turnId } : {},
+    exp: Math.floor(Date.now() / 1e3) + 60 * 60
+  });
+}
+function firstPartyAuthFetch(baseFetch, settings, options) {
+  return async (input, init) => {
+    const bearer = await signFirstPartyDelegatedBearer(settings, options);
+    if (!bearer) {
+      return await baseFetch(input, init);
+    }
+    return await baseFetch(
+      fetchInputForAttempt(input),
+      withConnectionHeaders(input, init, { authorization: `Bearer ${bearer}` })
+    );
+  };
+}
 async function codexAppsMcpRequestInit(settings) {
   const ctx = codexRequestStorage.getStore();
   if (!ctx) {
@@ -2688,8 +3019,9 @@ var firstPartyMcpPermissions = [
   "sessions:read",
   "sessions:create",
   "sessions:control",
-  "environments:use",
-  "environments:manage",
+  "variable-sets:use",
+  "variable-sets:manage",
+  "rigs:use",
   "github:use"
 ];
 function isCodexAppsMcpServer(config) {
@@ -2718,7 +3050,11 @@ function firstPartyMcpServerUrlForRun(settings, config, workspaceId) {
   if (!isFirstPartyMcpServer(settings, config)) {
     return null;
   }
-  const rawBase = settings.opengeniMcpUrl?.includes("{workspaceId}") ? settings.opengeniMcpUrl.replaceAll("{workspaceId}", workspaceId) : settings.opengeniMcpUrl ? scopedMcpUrlFromConfiguredBase(settings.opengeniMcpUrl, workspaceId) : firstPartyMcpBaseUrl(settings).replaceAll("{workspaceId}", workspaceId);
+  const rawBase = settings.opengeniMcpUrl?.includes("{workspaceId}") ? settings.opengeniMcpUrl.replaceAll("{workspaceId}", workspaceId) : settings.opengeniMcpUrl ? scopedMcpUrlFromConfiguredBase(settings.opengeniMcpUrl, workspaceId) : (
+    // unset → the shared loopback default (a `{workspaceId}` template owned by
+    // @opengeni/config's firstPartyMcpBaseUrl), scoped to this run's workspace.
+    firstPartyMcpBaseUrl(settings).replaceAll("{workspaceId}", workspaceId)
+  );
   const url = new URL(rawBase);
   if (config.id === "docs") {
     url.pathname = `${url.pathname.replace(/\/+$/, "")}/docs`;
@@ -2755,18 +3091,24 @@ function prefixedMcpToolName(registryId, toolName) {
   return sharedPrefixedMcpToolName(registryId, toolName);
 }
 var PrefixedMcpServer = class {
-  constructor(inner, registryId, allowedTools) {
+  constructor(inner, registryId, allowedTools, bestEffort = false) {
     this.inner = inner;
     this.name = registryId;
     this.prefix = prefixedMcpToolName(registryId, "");
     this.cacheToolsList = inner.cacheToolsList;
     this.allowedTools = allowedTools ? new Set(allowedTools) : void 0;
+    this.bestEffort = bestEffort;
   }
-  inner;
   cacheToolsList;
   name;
   prefix;
   allowedTools;
+  // Best-effort servers (optional refs, connectionRef-backed capability MCPs,
+  // codex_apps) must never fail a turn: a tools/list throw degrades to zero
+  // tools instead of propagating. Deduplicate the warn so one degraded server
+  // doesn't spam the log when the SDK re-lists across model turns.
+  bestEffort;
+  loggedListToolsFailure = false;
   connect() {
     return this.inner.connect();
   }
@@ -2774,7 +3116,24 @@ var PrefixedMcpServer = class {
     return this.inner.close();
   }
   async listTools() {
-    const tools = await this.inner.listTools();
+    let tools;
+    try {
+      tools = await this.inner.listTools();
+    } catch (error) {
+      if (!this.bestEffort) {
+        throw error;
+      }
+      if (!this.loggedListToolsFailure) {
+        this.loggedListToolsFailure = true;
+        console.warn(
+          "[mcp] best-effort server tools/list failed; its tools are unavailable this turn",
+          // Safe surface only (class + numeric status), never the raw error
+          // message/response body — a broker 401/403 body can echo request detail.
+          { serverId: this.name, ...safeMcpErrorFields(error) }
+        );
+      }
+      return [];
+    }
     return tools.filter((tool2) => this.isAllowed(tool2.name)).map((tool2) => ({ ...tool2, name: prefixedMcpToolName(this.name, tool2.name) }));
   }
   async callTool(toolName, args, meta) {
@@ -2788,6 +3147,17 @@ var PrefixedMcpServer = class {
       if (isAuthNeededMcpError(error)) {
         return { isError: true, content: [{ type: "text", text: MCP_AUTH_NEEDED_MESSAGE }] };
       }
+      if (this.bestEffort) {
+        const fields = safeMcpErrorFields(error);
+        console.warn(
+          "[mcp] best-effort server tool call failed; returning an unavailable result for this turn",
+          { serverId: this.name, toolName: unprefixed, ...fields }
+        );
+        return {
+          isError: true,
+          content: [{ type: "text", text: mcpToolUnavailableMessage(mcpErrorReason(fields)) }]
+        };
+      }
       throw error;
     }
   }
@@ -2825,74 +3195,45 @@ var PrefixedMcpServer = class {
     return toolName.slice(this.prefix.length);
   }
 };
-function guardAssembledInput(history, trailing, inputBudgetTokens) {
-  if (typeof inputBudgetTokens !== "number" || inputBudgetTokens <= 0) {
-    return [...history, trailing];
-  }
-  const trailingTokens = estimateItemTokens(trailing);
-  const guarded = enforceInputBudget(
-    history,
-    inputBudgetTokens,
-    trailingTokens
-  );
-  if (guarded.trimmed) {
-    console.warn(
-      `read-path budget guard trimmed ${guarded.droppedCount} oldest history item(s) to fit input budget (${inputBudgetTokens} tokens); the over-budget input was NOT sent`
-    );
-  }
-  return [...guarded.items, trailing];
-}
 async function prepareRunInput(agent, input, options = {}) {
   if (input.kind === "message") {
-    if (input.historyItems && input.historyItems.length > 0) {
-      const sandboxSessionState2 = input.sandboxEnvelope ? await restoredSandboxSessionStateFromEntry(input.sandboxEnvelope, options.sandboxClient) : void 0;
-      const sanitizedHistory2 = sanitizeHistoryItemsForModel(
-        input.historyItems
-      );
-      return {
-        // Read-path budget guard: even after the orphan sanitizer, an assembled
-        // input can exceed the model window (pre-turn compaction is best-effort
-        // and can no-op). Trim the oldest history at a clean turn boundary so an
-        // over-budget request is never sent. No-op when no budget is supplied.
-        input: guardAssembledInput(
-          sanitizedHistory2,
-          {
-            type: "message",
-            role: "user",
-            content: input.text
-          },
-          options.inputBudgetTokens
-        ),
-        ...sandboxSessionState2 ? { sandboxSessionState: sandboxSessionState2 } : {}
-      };
+    const trailingMessages = [];
+    if (input.internalContext?.trim()) {
+      trailingMessages.push({
+        type: "message",
+        role: "system",
+        content: input.internalContext
+      });
     }
-    if (!input.serializedRunState || isClearedRunStateBlob(input.serializedRunState)) {
-      return { input: input.text };
+    if (input.text?.trim()) {
+      trailingMessages.push({
+        type: "message",
+        role: "user",
+        content: input.text
+      });
+    }
+    if (trailingMessages.length === 0 && (input.historyItems === void 0 || input.historyItems === null || input.historyItems.length === 0)) {
+      throw new Error("Message input requires a user prompt or internal context");
     }
-    const state2 = await RunState.fromString(agent, input.serializedRunState);
-    const sandboxSessionState = await restoredSandboxSessionState(state2, options.sandboxClient);
     const sanitizedHistory = sanitizeHistoryItemsForModel(
-      state2.history
+      input.historyItems ?? []
     );
+    const sandboxSessionState = input.sandboxEnvelope ? await restoredSandboxSessionStateFromEntry(input.sandboxEnvelope, options.sandboxClient) : void 0;
+    const assembled = [...sanitizedHistory, ...trailingMessages];
+    if (assembled.length === 0) {
+      throw new Error("Message input requires durable history or internal context");
+    }
     return {
-      // Read-path budget guard (see the items path above): keep an over-budget
-      // resumed history off the wire by trimming the oldest turns when a budget
-      // is supplied.
-      input: guardAssembledInput(
-        sanitizedHistory,
-        {
-          type: "message",
-          role: "user",
-          content: input.text
-        },
-        options.inputBudgetTokens
-      ),
-      ...sandboxSessionState ? { sandboxSessionState } : {},
-      serializedRunStateForSandbox: input.serializedRunState
+      // Preserve the SDK's simple first-message form without creating a second
+      // history path: this is merely the zero-history representation.
+      input: sanitizedHistory.length === 0 && !input.internalContext?.trim() && input.text?.trim() ? input.text : assembled,
+      ...sandboxSessionState ? { sandboxSessionState } : {}
     };
   }
   if (isClearedRunStateBlob(input.serializedRunState)) {
-    throw new Error("Cannot resume an approval: the session context was cleared, so the awaiting run state no longer exists.");
+    throw new Error(
+      "Cannot resume an approval: the session context was cleared, so the awaiting run state no longer exists."
+    );
   }
   const state = await RunState.fromString(agent, input.serializedRunState);
   const interruptions = state.getInterruptions();
@@ -2908,6 +3249,26 @@ async function prepareRunInput(agent, input, options = {}) {
   return { input: state };
 }
 var GENESIS_TITLE_DIRECTIVE = "This is the first turn of a new session. Before responding to the user, call the opengeni__set_session_title tool with a concise 3-7 word title that summarizes what this session is about, then address the user's request normally.";
+function oneShotGenesisTitleInputFilter() {
+  let pending = true;
+  return ({ modelData }) => {
+    if (!pending) {
+      return modelData;
+    }
+    pending = false;
+    return {
+      ...modelData,
+      instructions: modelData.instructions ? `${modelData.instructions} ${GENESIS_TITLE_DIRECTIVE}` : GENESIS_TITLE_DIRECTIVE
+    };
+  };
+}
+function takeGenesisTitleInputFilter(agent) {
+  if (!agentsNeedingGenesisTitleDirective.has(agent)) {
+    return void 0;
+  }
+  agentsNeedingGenesisTitleDirective.delete(agent);
+  return oneShotGenesisTitleInputFilter();
+}
 var TOOLSPACE_PROGRAMMATIC_DIRECTIVE = "Every tool on your MCP surface is also callable programmatically from the sandbox shell, so scripts can invoke tools without a model round trip per call. Run `ogtool list` to see the available tools and their input schemas (from tools/list), then `ogtool call <tool-name> '<json-args>'`; equivalently, POST MCP JSON-RPC to $OPENGENI_TOOLSPACE_URL with the bearer token read from $OPENGENI_TOOLSPACE_TOKEN_FILE. Prefer programmatic calls for loops, polling, and bulk filtering: their results stay in the sandbox and do not consume your context window. Tools that require human approval must still be invoked normally \u2014 called programmatically they return a typed error.";
 var stripProviderItemIdsFilter = ({ modelData }) => ({
   ...modelData,
@@ -2925,38 +3286,32 @@ var normalizeComputerCallsFilter = ({ modelData }) => ({
     modelData.input
   )
 });
+var elideSupersededViewImagesFilter = ({ modelData }) => ({
+  ...modelData,
+  input: elideSupersededViewImagePairs(
+    modelData.input
+  )
+});
 function contextRobustnessFilterForSettings(settings, options = {}) {
-  const inputBudgetTokens = modelCallBudgetTokens(settings);
-  const clientCompactionMode = resolveContextCompactionMode(settings) === "client";
-  const compactionThresholdTokens = clientCompactionThresholdTokens(settings);
-  return ({ modelData }) => {
-    const images = elideStaleScreenshotImages(modelData.input);
-    if (images.elidedCount > 0) {
-      console.warn(
-        `per-call image history policy elided ${images.elidedCount} older screenshot image(s), keeping the last ${Math.min(3, images.imageCount)} full image(s)`
-      );
-    }
-    let input = images.items;
-    if (inputBudgetTokens !== void 0) {
-      const guarded = enforceInputBudget(
-        input,
-        inputBudgetTokens
-      );
-      if (guarded.trimmed) {
-        console.warn(
-          `per-call budget guard trimmed ${guarded.droppedCount} oldest history item(s) to fit input budget (${inputBudgetTokens} tokens); the over-budget model call was NOT sent`
-        );
-        input = guarded.items;
-      }
-    }
-    if (clientCompactionMode && options.throwOnCompactionNeeded) {
+  const thresholdTokens = compactionThresholdTokens(settings);
+  return async ({ modelData }) => {
+    const input = modelData.input;
+    if (options.throwOnCompactionNeeded) {
       const reported = options.contextCompactionSignalTokens?.();
       const hasReported = typeof reported === "number" && reported > 0;
       const signalTokens = hasReported ? reported : estimateTokens(input);
-      if (signalTokens > compactionThresholdTokens) {
+      if (await options.contextCompactionRequested?.()) {
+        throw new CompactionNeededError({
+          signalTokens,
+          thresholdTokens,
+          signalSource: hasReported ? "provider" : "estimate",
+          trigger: "operator"
+        });
+      }
+      if (signalTokens >= thresholdTokens) {
         throw new CompactionNeededError({
           signalTokens,
-          thresholdTokens: compactionThresholdTokens,
+          thresholdTokens,
           signalSource: hasReported ? "provider" : "estimate"
         });
       }
@@ -2964,13 +3319,6 @@ function contextRobustnessFilterForSettings(settings, options = {}) {
     return { ...modelData, input };
   };
 }
-function modelCallBudgetTokens(settings) {
-  if (resolveContextCompactionMode(settings) !== "client") {
-    return void 0;
-  }
-  const budget = contextInputBudgetTokens(settings);
-  return budget > 0 ? budget : void 0;
-}
 function composeCallModelInputFilters(filters) {
   return async (args) => {
     let modelData = args.modelData;
@@ -2981,7 +3329,10 @@ function composeCallModelInputFilters(filters) {
   };
 }
 function callModelInputFilterForSettings(settings, options = {}) {
-  const filters = [normalizeComputerCallsFilter];
+  const filters = [
+    normalizeComputerCallsFilter,
+    elideSupersededViewImagesFilter
+  ];
   if (settings.openaiProviderItemIds === "strip") {
     filters.push(stripProviderItemIdsFilter);
   }
@@ -2991,54 +3342,63 @@ function callModelInputFilterForSettings(settings, options = {}) {
 async function runAgentStream(agent, input, settings, overrides = {}) {
   const prepared = typeof input === "string" || input instanceof RunState ? { input } : input;
   const environment = overrides.sandboxEnvironment ?? collectSandboxEnvironment2(settings);
+  const genesisTitleInputFilter = takeGenesisTitleInputFilter(agent);
   if (overrides.ownedSandbox) {
     const { client: ownedClient, session, sessionState } = overrides.ownedSandbox;
     const setupSession = overrides.ownedSandbox.setupSession ?? session;
+    if (!overrides.ownedSandbox.deferredSetup) {
+      await runOwnedSandboxSetup(agent, session, setupSession, {
+        settings,
+        environment,
+        preparedInput: prepared,
+        ...overrides.ownedSandbox.fileDownloadsMaterialized ? { fileDownloadsMaterialized: true } : {},
+        ...overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {}
+      });
+      await overrides.onGitCredentialSessionReady?.(setupSession);
+    }
     const runAs2 = sandboxRunAs(settings);
     const fileDownloads2 = sandboxFileDownloadsForAgent(agent);
     const resourceClient2 = fileDownloads2.length > 0 ? withSandboxFileDownloads(ownedClient, fileDownloads2, {
       ...overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {},
       ...runAs2 ? { runAs: runAs2 } : {}
     }) : ownedClient;
-    const ownedGitTokenSeed = gitTokenSeedForAgent(agent);
+    const ownedGitTokenSeeds = gitTokenSeedsForAgent(agent);
     const ownedToolspaceTokenSeed = toolspaceTokenSeedForAgent(agent);
+    const ownedRigSetup = rigSetupDescriptorForAgent(agent);
     const ownedHooks = [
-      ...sandboxLifecycleHooksForIds(sandboxLifecycleHookIds(settings)),
+      // M3: rig setup runs FIRST so any tooling it installs is present for the
+      // credential / repository-clone hooks below. The rig's credential hooks are
+      // unioned into the deployment preparation-profile hooks (deduped by id).
+      ...sandboxRigSetupHooksForAgent(agent),
+      ...unionCredentialHooks(
+        sandboxLifecycleHooksForIds(sandboxLifecycleHookIds(settings)),
+        rigCredentialHooksForAgent(agent)
+      ),
       ...sandboxToolspaceTokenHooksForAgent(agent),
-      ...sandboxRepositoryCloneHooksForAgent(agent)
+      ...sandboxRepositoryCloneHooksForAgent(agent),
+      ...gitCredentialSessionRegistrationHooks(overrides.onGitCredentialSessionReady)
     ];
     const ownedHookContext = {
       environment,
       ...overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {},
       ...runAs2 ? { runAs: runAs2 } : {},
-      ...ownedGitTokenSeed ? { gitTokenSeed: ownedGitTokenSeed } : {},
-      ...ownedToolspaceTokenSeed ? { toolspaceTokenSeed: ownedToolspaceTokenSeed } : {}
+      ...ownedGitTokenSeeds ? { gitTokenSeeds: ownedGitTokenSeeds } : {},
+      ...ownedToolspaceTokenSeed ? { toolspaceTokenSeed: ownedToolspaceTokenSeed } : {},
+      ...ownedRigSetup ? { rigSetup: ownedRigSetup } : {}
     };
-    if (agentActiveSandboxBackend.get(agent) !== "selfhosted") {
-      await runBeforeAgentStartHooks(setupSession, ownedHooks, ownedHookContext);
-      if (fileDownloads2.length > 0) {
-        await materializeSandboxFileDownloads(setupSession, fileDownloads2, {
-          ...overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {},
-          ...runAs2 ? { runAs: runAs2 } : {}
-        });
-      }
-    } else {
-      const toolspaceHooks = sandboxToolspaceTokenHooksForAgent(agent);
-      if (toolspaceHooks.length > 0) {
-        await runBeforeAgentStartHooks(setupSession, toolspaceHooks, ownedHookContext);
-      }
-    }
     const decoratedClient = withSandboxLifecycleHooks(resourceClient2, ownedHooks, ownedHookContext);
     const ownedFilter = composeCallModelInputFilters(
       [
         callModelInputFilterForSettings(settings, {
-          throwOnCompactionNeeded: Boolean(overrides.contextCompactionSignalTokens),
-          ...overrides.contextCompactionSignalTokens ? { contextCompactionSignalTokens: overrides.contextCompactionSignalTokens } : {}
+          throwOnCompactionNeeded: Boolean(
+            overrides.contextCompactionSignalTokens || overrides.contextCompactionRequested
+          ),
+          ...overrides.contextCompactionSignalTokens ? { contextCompactionSignalTokens: overrides.contextCompactionSignalTokens } : {},
+          ...overrides.contextCompactionRequested ? { contextCompactionRequested: overrides.contextCompactionRequested } : {}
         }),
+        genesisTitleInputFilter,
         overrides.callModelInputFilter
-      ].filter(
-        (f) => Boolean(f)
-      )
+      ].filter((f) => Boolean(f))
     );
     const ownedRunOptions = {
       stream: true,
@@ -3053,44 +3413,66 @@ async function runAgentStream(agent, input, settings, overrides = {}) {
     return await runScopedRunner(settings).run(agent, prepared.input, ownedRunOptions);
   }
   const rawClient = overrides.sandboxClient ?? createSandboxClient(settings, environment);
-  const refreshedClient = rawClient ? withManifestRefreshOnResume(rawClient, agent.defaultManifest) : void 0;
+  const refreshedClient = rawClient ? withManifestRefreshOnResume(
+    rawClient,
+    agent.defaultManifest,
+    {
+      ...overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {}
+    }
+  ) : void 0;
   const runAs = sandboxRunAs(settings);
   const fileDownloads = sandboxFileDownloadsForAgent(agent);
   const resourceClient = refreshedClient && fileDownloads.length > 0 ? withSandboxFileDownloads(refreshedClient, fileDownloads, {
     ...overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {},
     ...runAs ? { runAs } : {}
   }) : refreshedClient;
-  const gitTokenSeed = gitTokenSeedForAgent(agent);
+  const gitTokenSeeds = gitTokenSeedsForAgent(agent);
   const toolspaceTokenSeed = toolspaceTokenSeedForAgent(agent);
-  const client = resourceClient ? withSandboxLifecycleHooks(resourceClient, [
-    ...sandboxLifecycleHooksForIds(sandboxLifecycleHookIds(settings)),
-    ...sandboxToolspaceTokenHooksForAgent(agent),
-    ...sandboxRepositoryCloneHooksForAgent(agent)
-  ], {
-    environment,
-    ...overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {},
-    ...runAs ? { runAs } : {},
-    ...gitTokenSeed ? { gitTokenSeed } : {},
-    ...toolspaceTokenSeed ? { toolspaceTokenSeed } : {}
-  }) : void 0;
-  const sandboxSessionState = prepared.sandboxSessionState ?? (prepared.serializedRunStateForSandbox && client ? await restoredSandboxSessionState(await RunState.fromString(agent, prepared.serializedRunStateForSandbox), client) : void 0);
+  const legacyRigSetup = rigSetupDescriptorForAgent(agent);
+  const client = resourceClient ? withSandboxLifecycleHooks(
+    resourceClient,
+    [
+      // M3: same rig-setup-first ordering + credential-hook union as the owned
+      // path (this legacy create/resume decoration path is byte-for-byte today
+      // for a rig-less turn — the rig hooks are empty then).
+      ...sandboxRigSetupHooksForAgent(agent),
+      ...unionCredentialHooks(
+        sandboxLifecycleHooksForIds(sandboxLifecycleHookIds(settings)),
+        rigCredentialHooksForAgent(agent)
+      ),
+      ...sandboxToolspaceTokenHooksForAgent(agent),
+      ...sandboxRepositoryCloneHooksForAgent(agent),
+      ...gitCredentialSessionRegistrationHooks(overrides.onGitCredentialSessionReady)
+    ],
+    {
+      environment,
+      ...overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {},
+      ...runAs ? { runAs } : {},
+      ...gitTokenSeeds ? { gitTokenSeeds } : {},
+      ...toolspaceTokenSeed ? { toolspaceTokenSeed } : {},
+      ...legacyRigSetup ? { rigSetup: legacyRigSetup } : {}
+    }
+  ) : void 0;
+  const sandboxSessionState = prepared.sandboxSessionState;
   const callModelInputFilter = composeCallModelInputFilters(
     [
       callModelInputFilterForSettings(settings, {
-        throwOnCompactionNeeded: Boolean(overrides.contextCompactionSignalTokens),
-        ...overrides.contextCompactionSignalTokens ? { contextCompactionSignalTokens: overrides.contextCompactionSignalTokens } : {}
+        throwOnCompactionNeeded: Boolean(
+          overrides.contextCompactionSignalTokens || overrides.contextCompactionRequested
+        ),
+        ...overrides.contextCompactionSignalTokens ? { contextCompactionSignalTokens: overrides.contextCompactionSignalTokens } : {},
+        ...overrides.contextCompactionRequested ? { contextCompactionRequested: overrides.contextCompactionRequested } : {}
       }),
+      genesisTitleInputFilter,
       overrides.callModelInputFilter
-    ].filter(
-      (f) => Boolean(f)
-    )
+    ].filter((f) => Boolean(f))
   );
   const runOptions = {
     stream: true,
     maxTurns: settings.agentMaxModelCallsPerTurn,
     // Built-in per-call guard chain: normalize computer calls, optionally strip
-    // provider ids, elide stale screenshots in every mode, and trim to the input
-    // budget on the client-compaction path. This runs for turn-start replay AND
+    // provider ids, trim to the input budget on the client-compaction path, and
+    // raise the proactive compaction signal. This runs for turn-start replay AND
     // every mid-turn follow-up.
     callModelInputFilter
   };
@@ -3102,6 +3484,22 @@ async function runAgentStream(agent, input, settings, overrides = {}) {
   }
   return await runScopedRunner(settings).run(agent, prepared.input, runOptions);
 }
+function appendSandboxFileDownloadFailureNote(input, failures) {
+  const note = sandboxFileDownloadFailureNote(failures);
+  if (!note) {
+    return;
+  }
+  if (typeof input.input === "string") {
+    input.input = [input.input, "", note].join("\n");
+    return;
+  }
+  if (Array.isArray(input.input)) {
+    input.input = [
+      ...input.input,
+      { type: "message", role: "user", content: note }
+    ];
+  }
+}
 function runScopedRunner(settings) {
   return new Runner({ modelProvider: new MultiProviderModelProvider(settings) });
 }
@@ -3125,7 +3523,7 @@ function agentsErrorRunState(error) {
     return null;
   }
 }
-function withManifestRefreshOnResume(client, targetManifest) {
+function withManifestRefreshOnResume(client, targetManifest, context = {}) {
   if (!targetManifest || !client.resume) {
     return client;
   }
@@ -3135,17 +3533,25 @@ function withManifestRefreshOnResume(client, targetManifest) {
     ...client.create ? { create: async (...args) => await client.create(...args) } : {},
     resume: async (state) => {
       const session = await client.resume(state);
-      await applyMissingManifestEntries(session, targetManifest);
+      await applyMissingManifestEntries(session, targetManifest, context);
       return session;
     },
     ...client.delete ? { delete: async (state) => await client.delete(state) } : {},
-    ...client.serializeSessionState ? { serializeSessionState: async (state, options) => await client.serializeSessionState(state, options) } : {},
-    ...client.canPersistOwnedSessionState ? { canPersistOwnedSessionState: async (state) => await client.canPersistOwnedSessionState(state) } : {},
-    ...client.canReusePreservedOwnedSession ? { canReusePreservedOwnedSession: async (state) => await client.canReusePreservedOwnedSession(state) } : {},
-    ...client.deserializeSessionState ? { deserializeSessionState: async (state) => await client.deserializeSessionState(state) } : {}
+    ...client.serializeSessionState ? {
+      serializeSessionState: async (state, options) => await client.serializeSessionState(state, options)
+    } : {},
+    ...client.canPersistOwnedSessionState ? {
+      canPersistOwnedSessionState: async (state) => await client.canPersistOwnedSessionState(state)
+    } : {},
+    ...client.canReusePreservedOwnedSession ? {
+      canReusePreservedOwnedSession: async (state) => await client.canReusePreservedOwnedSession(state)
+    } : {},
+    ...client.deserializeSessionState ? {
+      deserializeSessionState: async (state) => await client.deserializeSessionState(state)
+    } : {}
   };
 }
-async function applyMissingManifestEntries(session, targetManifest) {
+async function applyMissingManifestEntries(session, targetManifest, context = {}) {
   const currentManifestValue = session.state?.manifest;
   const currentManifest = currentManifestValue ? ensureManifest(currentManifestValue) : void 0;
   const target = ensureManifest(targetManifest);
@@ -3153,13 +3559,18 @@ async function applyMissingManifestEntries(session, targetManifest) {
     if (Object.keys(target.entries).length === 0) {
       return;
     }
-    throw new Error("Resumed sandbox session cannot apply new manifest entries because current manifest state is unavailable");
+    throw new Error(
+      "Resumed sandbox session cannot apply new manifest entries because current manifest state is unavailable"
+    );
   }
+  await reportManifestEnvironmentDrift(currentManifest, target, context);
   if (!session.applyManifest && !session.materializeEntry) {
     if (Object.keys(target.entries).length === 0) {
       return;
     }
-    throw new Error("Resumed sandbox session cannot apply new manifest entries because it does not support applyManifest() or materializeEntry()");
+    throw new Error(
+      "Resumed sandbox session cannot apply new manifest entries because it does not support applyManifest() or materializeEntry()"
+    );
   }
   if (Object.keys(target.entries).length === 0) {
     return;
@@ -3180,7 +3591,9 @@ async function applyMissingManifestEntries(session, targetManifest) {
   }
   const environmentChanged = stableJson(currentManifest.environment) !== stableJson(target.environment);
   if (environmentChanged && !session.applyManifest) {
-    throw new Error("Resumed sandbox session cannot refresh manifest environment because it does not support applyManifest()");
+    throw new Error(
+      "Resumed sandbox session cannot refresh manifest environment because it does not support applyManifest()"
+    );
   }
   if (Object.keys(entries).length === 0 && !environmentChanged) {
     return;
@@ -3209,6 +3622,114 @@ async function applyMissingManifestEntries(session, targetManifest) {
     ...extraPathGrants.length ? { extraPathGrants } : {}
   });
 }
+function manifestEnvironmentDrift(current, target) {
+  const currentEnv = current.environment ?? {};
+  const targetEnv = target.environment ?? {};
+  const added = [];
+  const removed = [];
+  const changed = [];
+  for (const key of Object.keys(targetEnv)) {
+    if (!(key in currentEnv)) {
+      added.push(key);
+    } else if (stableJson(currentEnv[key]) !== stableJson(targetEnv[key])) {
+      changed.push(key);
+    }
+  }
+  for (const key of Object.keys(currentEnv)) {
+    if (!(key in targetEnv)) {
+      removed.push(key);
+    }
+  }
+  if (added.length === 0 && removed.length === 0 && changed.length === 0) {
+    return null;
+  }
+  return { added: added.sort(), removed: removed.sort(), changed: changed.sort() };
+}
+async function reportManifestEnvironmentDrift(current, target, context) {
+  const drift = manifestEnvironmentDrift(current, target);
+  if (!drift) {
+    return null;
+  }
+  try {
+    await context.onRuntimeEvent?.({ type: "sandbox.env.drift", payload: drift });
+  } catch {
+  }
+  return drift;
+}
+async function pinProvidedSessionManifestEnvironment(agent, session, context = {}) {
+  const holder = agent;
+  const currentManifestValue = session.state?.manifest;
+  if (!holder.defaultManifest || !currentManifestValue) {
+    return;
+  }
+  const current = ensureManifest(currentManifestValue);
+  const target = ensureManifest(holder.defaultManifest);
+  const drift = await reportManifestEnvironmentDrift(current, target, context);
+  if (!drift) {
+    return;
+  }
+  holder.defaultManifest = new Manifest({
+    ...target.root ? { root: target.root } : {},
+    entries: target.entries,
+    environment: current.environment,
+    ...target.extraPathGrants?.length ? { extraPathGrants: target.extraPathGrants } : {}
+  });
+}
+async function runOwnedSandboxSetup(agent, session, setupSession, opts) {
+  const { settings, environment } = opts;
+  await pinProvidedSessionManifestEnvironment(agent, session, {
+    ...opts.onRuntimeEvent ? { onRuntimeEvent: opts.onRuntimeEvent } : {}
+  });
+  const runAs = sandboxRunAs(settings);
+  const fileDownloads = sandboxFileDownloadsForAgent(agent);
+  const ownedGitTokenSeeds = {
+    ...gitTokenSeedsForAgent(agent) ?? {},
+    ...opts.gitTokenSeedOverride ? { github: opts.gitTokenSeedOverride } : {},
+    ...opts.gitTokenSeedsOverride ?? {}
+  };
+  const ownedToolspaceTokenSeed = toolspaceTokenSeedForAgent(agent);
+  const ownedRigSetup = rigSetupDescriptorForAgent(agent);
+  const ownedHooks = [
+    // M3: rig setup runs FIRST so any tooling it installs is present for the
+    // credential / repository-clone hooks below; the rig's credential hooks are
+    // unioned into the deployment preparation-profile hooks (deduped by id).
+    // This is the LIVE owned-path execution (the provided session skips the
+    // client create/resume decoration), so the rig hooks MUST be here or a
+    // rig-bound turn would start without ever running the frozen setup script.
+    ...sandboxRigSetupHooksForAgent(agent),
+    ...unionCredentialHooks(
+      sandboxLifecycleHooksForIds(sandboxLifecycleHookIds(settings)),
+      rigCredentialHooksForAgent(agent)
+    ),
+    ...sandboxToolspaceTokenHooksForAgent(agent),
+    ...sandboxRepositoryCloneHooksForAgent(agent)
+  ];
+  const ownedHookContext = {
+    environment,
+    ...opts.onRuntimeEvent ? { onRuntimeEvent: opts.onRuntimeEvent } : {},
+    ...runAs ? { runAs } : {},
+    ...Object.keys(ownedGitTokenSeeds).length > 0 ? { gitTokenSeeds: ownedGitTokenSeeds } : {},
+    ...ownedToolspaceTokenSeed ? { toolspaceTokenSeed: ownedToolspaceTokenSeed } : {},
+    ...ownedRigSetup ? { rigSetup: ownedRigSetup } : {}
+  };
+  if (agentActiveSandboxBackend.get(agent) !== "selfhosted") {
+    await runBeforeAgentStartHooks(setupSession, ownedHooks, ownedHookContext);
+    if (fileDownloads.length > 0 && !opts.fileDownloadsMaterialized) {
+      const materialized = await materializeSandboxFileDownloads(setupSession, fileDownloads, {
+        ...opts.onRuntimeEvent ? { onRuntimeEvent: opts.onRuntimeEvent } : {},
+        ...runAs ? { runAs } : {}
+      });
+      if (opts.preparedInput) {
+        appendSandboxFileDownloadFailureNote(opts.preparedInput, materialized.failures);
+      }
+    }
+  } else {
+    const toolspaceHooks = sandboxToolspaceTokenHooksForAgent(agent);
+    if (toolspaceHooks.length > 0) {
+      await runBeforeAgentStartHooks(setupSession, toolspaceHooks, ownedHookContext);
+    }
+  }
+}
 function mergePathGrants(current, target) {
   const merged = /* @__PURE__ */ new Map();
   for (const grant of [...current ?? [], ...target ?? []]) {
@@ -3232,23 +3753,33 @@ function withSandboxFileDownloads(client, downloads, context = {}) {
   return {
     backendId: client.backendId,
     ...client.supportsDefaultOptions !== void 0 ? { supportsDefaultOptions: client.supportsDefaultOptions } : {},
-    ...client.create ? { create: async (...args) => await wrapSession(await client.create(...args)) } : {},
-    ...client.resume ? { resume: async (state) => await wrapSession(await client.resume(state)) } : {},
+    ...client.create ? {
+      create: async (...args) => await wrapSession(await client.create(...args))
+    } : {},
+    ...client.resume ? {
+      resume: async (state) => await wrapSession(await client.resume(state))
+    } : {},
     ...client.delete ? { delete: async (state) => await client.delete(state) } : {},
-    ...client.serializeSessionState ? { serializeSessionState: async (state, options) => await client.serializeSessionState(state, options) } : {},
-    ...client.canPersistOwnedSessionState ? { canPersistOwnedSessionState: async (state) => await client.canPersistOwnedSessionState(state) } : {},
-    ...client.canReusePreservedOwnedSession ? { canReusePreservedOwnedSession: async (state) => await client.canReusePreservedOwnedSession(state) } : {},
-    ...client.deserializeSessionState ? { deserializeSessionState: async (state) => await client.deserializeSessionState(state) } : {}
+    ...client.serializeSessionState ? {
+      serializeSessionState: async (state, options) => await client.serializeSessionState(state, options)
+    } : {},
+    ...client.canPersistOwnedSessionState ? {
+      canPersistOwnedSessionState: async (state) => await client.canPersistOwnedSessionState(state)
+    } : {},
+    ...client.canReusePreservedOwnedSession ? {
+      canReusePreservedOwnedSession: async (state) => await client.canReusePreservedOwnedSession(state)
+    } : {},
+    ...client.deserializeSessionState ? {
+      deserializeSessionState: async (state) => await client.deserializeSessionState(state)
+    } : {}
   };
 }
 async function materializeSandboxFileDownloads(session, downloads, context = {}) {
   const normalizedDownloads = normalizeSandboxFileDownloads(downloads);
   if (normalizedDownloads.length === 0) {
-    return;
-  }
-  if (!session.exec && !session.execCommand) {
-    throw new Error("Sandbox file download materialization requires command execution support");
+    return { failures: [] };
   }
+  const failures = [];
   for (const download of normalizedDownloads) {
     const targetPath = sandboxDownloadTargetPath(download);
     const payload = {
@@ -3257,9 +3788,30 @@ async function materializeSandboxFileDownloads(session, downloads, context = {})
       sizeBytes: download.sizeBytes ?? null,
       expiresAt: download.expiresAt ? new Date(download.expiresAt).toISOString() : null
     };
-    await context.onRuntimeEvent?.({ type: "sandbox.operation.started", payload: { name: "file-resource-download", ...payload } });
+    await context.onRuntimeEvent?.({
+      type: "sandbox.operation.started",
+      payload: { name: "file-resource-download", ...payload }
+    });
+    if (!session.exec && !session.execCommand) {
+      const failure = sandboxFileDownloadFailure(
+        download,
+        targetPath,
+        "Sandbox file download materialization requires command execution support"
+      );
+      failures.push(failure);
+      await context.onRuntimeEvent?.({
+        type: "sandbox.operation.failed",
+        payload: {
+          name: "file-resource-download",
+          ...payload,
+          error: failure.reason
+        }
+      });
+      continue;
+    }
+    let result;
     try {
-      const result = session.exec ? await session.exec({
+      result = session.exec ? await session.exec({
         cmd: sandboxFileDownloadCommand(download, targetPath),
         workdir: "/workspace",
         ...context.runAs ? { runAs: context.runAs } : {},
@@ -3273,19 +3825,48 @@ async function materializeSandboxFileDownloads(session, downloads, context = {})
         maxOutputTokens: 2e4
       });
       assertSandboxCommandSucceeded(result, `Sandbox file resource download ${download.fileId}`);
-      await context.onRuntimeEvent?.({ type: "sandbox.operation.completed", payload: { name: "file-resource-download", ...payload } });
+      await context.onRuntimeEvent?.({
+        type: "sandbox.operation.completed",
+        payload: { name: "file-resource-download", ...payload }
+      });
     } catch (error) {
+      const failure = sandboxFileDownloadFailure(download, targetPath, error, result);
+      failures.push(failure);
       await context.onRuntimeEvent?.({
         type: "sandbox.operation.failed",
         payload: {
           name: "file-resource-download",
           ...payload,
-          error: error instanceof Error ? error.message : String(error)
+          error: failure.reason,
+          ...failure.exitCode !== void 0 ? { exitCode: failure.exitCode } : {},
+          ...failure.output ? { output: failure.output } : {}
         }
       });
-      throw error;
     }
   }
+  return { failures };
+}
+function sandboxFileDownloadFailure(download, targetPath, error, result) {
+  const exitCode = sandboxCommandExitCode(result);
+  const output = sandboxCommandOutput(result);
+  return {
+    fileId: download.fileId,
+    filename: download.filename,
+    path: targetPath,
+    reason: error instanceof Error ? error.message : String(error),
+    ...exitCode !== null ? { exitCode } : {},
+    ...output ? { output } : {}
+  };
+}
+function sandboxFileDownloadFailureNote(failures) {
+  if (failures.length === 0) {
+    return "";
+  }
+  return [
+    "The following attached files could not be loaded into the sandbox and are unavailable this turn:",
+    ...failures.map((failure) => `- ${failure.filename} (${failure.reason})`),
+    "Continue without them or tell the user."
+  ].join("\n");
 }
 function sandboxFileDownloadsForAgent(agent) {
   return typeof agent === "object" && agent !== null ? [...agentFileDownloads.get(agent) ?? []] : [];
@@ -3360,6 +3941,9 @@ function normalizeSdkEvent(event) {
       out.push({ type: "agent.message.delta", payload: { text: data.delta } });
       return out;
     }
+    if (data?.type === "response_done") {
+      return out;
+    }
   }
   if (isOpenAIResponsesRawModelStreamEvent(event)) {
     const raw = event.data?.event;
@@ -3418,7 +4002,10 @@ function normalizeSdkEvent(event) {
       type: "agent.toolCall.output",
       payload: {
         id: raw.call_id ?? raw.callId ?? item.id ?? null,
-        output: { type: "text", text: disclosed.length > 0 ? `Disclosed tools: ${disclosed.join(", ")}` : "No matching tools found." }
+        output: {
+          type: "text",
+          text: disclosed.length > 0 ? `Disclosed tools: ${disclosed.join(", ")}` : "No matching tools found."
+        }
       }
     });
   } else if (item.type === "message_output_item") {
@@ -3431,6 +4018,9 @@ function normalizeSdkEvent(event) {
 }
 function modelResponseUsageFromSdkEvent(event) {
   const response = modelResponseFromSdkEvent(event);
+  return modelResponseUsageFromResponse(response);
+}
+function modelResponseUsageFromResponse(response) {
   const usage = usageFromResponse(response);
   if (!usage) {
     return null;
@@ -3461,25 +4051,51 @@ function usageFromResponse(response) {
   if (!raw || typeof raw !== "object") {
     return null;
   }
+  const record = raw;
   const usage = {
-    ...numberProp(raw, "inputTokens", "inputTokens", "input_tokens"),
-    ...numberProp(raw, "outputTokens", "outputTokens", "output_tokens"),
-    ...numberProp(raw, "totalTokens", "totalTokens", "total_tokens"),
-    ...inputTokenDetailsProp(raw)
+    ...numberProp(
+      record,
+      "inputTokens",
+      "inputTokens",
+      "input_tokens",
+      "promptTokens",
+      "prompt_tokens"
+    ),
+    ...numberProp(
+      record,
+      "outputTokens",
+      "outputTokens",
+      "output_tokens",
+      "completionTokens",
+      "completion_tokens"
+    ),
+    ...numberProp(record, "totalTokens", "totalTokens", "total_tokens"),
+    ...inputTokenDetailsProp(record),
+    ...outputTokenDetailsProp(record)
   };
   return Object.keys(usage).length > 0 ? usage : null;
 }
-function numberProp(raw, outputKey, camel, snake) {
-  const value = raw[camel] ?? raw[snake];
+function numberProp(raw, outputKey, ...keys) {
+  const value = keys.map((key) => raw[key]).find((candidate) => candidate !== void 0);
   return typeof value === "number" && Number.isFinite(value) ? { [outputKey]: value } : {};
 }
 function inputTokenDetailsProp(raw) {
-  const details = raw.inputTokensDetails ?? raw.input_tokens_details;
+  const details = raw.inputTokensDetails ?? raw.input_tokens_details ?? raw.promptTokensDetails ?? raw.prompt_tokens_details;
   if (!details || typeof details !== "object") {
     return {};
   }
   return { inputTokensDetails: details };
 }
+function outputTokenDetailsProp(raw) {
+  const details = raw.outputTokensDetails ?? raw.output_tokens_details;
+  const normalized = details ?? raw.completionTokensDetails ?? raw.completion_tokens_details;
+  if (!normalized || typeof normalized !== "object") {
+    return {};
+  }
+  return {
+    outputTokensDetails: normalized
+  };
+}
 function serializeApprovals(interruptions) {
   return interruptions.map((item) => {
     if (typeof item?.toJSON === "function") {
@@ -3495,7 +4111,12 @@ function serializeApprovals(interruptions) {
 }
 function buildManifest(settings, resources, environment = collectSandboxEnvironment2(settings), fileResourceDownloads = []) {
   const entries = {};
-  const downloadsByFileId = new Map(normalizeSandboxFileDownloads(fileResourceDownloads).map((download) => [download.fileId, download]));
+  const downloadsByFileId = new Map(
+    normalizeSandboxFileDownloads(fileResourceDownloads).map((download) => [
+      download.fileId,
+      download
+    ])
+  );
   for (const resource of resources) {
     if (resource.kind === "repository") {
       const url = new URL(resource.uri);
@@ -3528,7 +4149,9 @@ function buildManifest(settings, resources, environment = collectSandboxEnvironm
 }
 function sandboxDownloadDirectory(download, mountPath) {
   if (download.mountPath !== mountPath) {
-    throw new Error(`File download materialization path mismatch for ${download.fileId}: expected ${mountPath}, got ${download.mountPath}`);
+    throw new Error(
+      `File download materialization path mismatch for ${download.fileId}: expected ${mountPath}, got ${download.mountPath}`
+    );
   }
   assertSafeSandboxFilename(download.filename, download.fileId);
   if (download.content) {
@@ -3544,7 +4167,9 @@ function objectStorageFileMount(settings, prefix) {
   const nativeBucketMount = CAPABILITY_DESCRIPTORS2[settings.sandboxBackend].nativeBucketMount;
   if (settings.objectStorageBackend === "azure-blob") {
     if (nativeBucketMount) {
-      throw new Error("Modal sandbox Azure Blob file resources require pre-signed download materialization because the current OpenAI Agents SDK Modal client does not support Azure Blob mount entries.");
+      throw new Error(
+        "Modal sandbox Azure Blob file resources require pre-signed download materialization because the current OpenAI Agents SDK Modal client does not support Azure Blob mount entries."
+      );
     }
     const config2 = azureBlobMountConfig(settings);
     return azureBlobMount({
@@ -3558,7 +4183,9 @@ function objectStorageFileMount(settings, prefix) {
     });
   }
   if (settings.objectStorageBackend === "aws-s3" || settings.objectStorageBackend === "gcs") {
-    throw new Error(`${settings.objectStorageBackend} file resources require pre-signed download materialization`);
+    throw new Error(
+      `${settings.objectStorageBackend} file resources require pre-signed download materialization`
+    );
   }
   const config = s3CompatibleMountConfig(settings);
   return s3Mount({
@@ -3594,7 +4221,10 @@ function azureBlobMountConfig(settings) {
   if (!accountName || !accountKey) {
     throw new Error("File resources require Azure Blob account name and account key");
   }
-  const endpointUrl = azureBlobManifestEndpoint(settings.objectStorageAzureEndpoint ?? parsed.BlobEndpoint, accountName);
+  const endpointUrl = azureBlobManifestEndpoint(
+    settings.objectStorageAzureEndpoint ?? parsed.BlobEndpoint,
+    accountName
+  );
   return {
     container: settings.objectStorageBucket,
     accountName,
@@ -3611,10 +4241,12 @@ function azureBlobManifestEndpoint(endpoint, accountName) {
   return normalized === standardAccountEndpoint ? void 0 : normalized;
 }
 function parseAzureConnectionString(value) {
-  return Object.fromEntries(value.split(";").map((part) => part.trim()).filter(Boolean).map((part) => {
-    const index = part.indexOf("=");
-    return index === -1 ? [part, ""] : [part.slice(0, index), part.slice(index + 1)];
-  }));
+  return Object.fromEntries(
+    value.split(";").map((part) => part.trim()).filter(Boolean).map((part) => {
+      const index = part.indexOf("=");
+      return index === -1 ? [part, ""] : [part.slice(0, index), part.slice(index + 1)];
+    })
+  );
 }
 function normalizeManifestPath(path) {
   const normalized = path.replace(/^\/+|\/+$/g, "");
@@ -3628,7 +4260,9 @@ function normalizeSandboxFileDownloads(downloads) {
     const mountPath = normalizeManifestPath(download.mountPath);
     assertSafeSandboxFilename(download.filename, download.fileId);
     if (!download.content && !download.url?.trim()) {
-      throw new Error(`File download materialization requires content or a URL for ${download.fileId}`);
+      throw new Error(
+        `File download materialization requires content or a URL for ${download.fileId}`
+      );
     }
     return {
       ...download,
@@ -3651,7 +4285,7 @@ function sandboxFileDownloadCommand(download, targetPath) {
   const targetDir = posixPath.dirname(targetPath);
   const tmpPath = `${targetPath}.opengeni-download-$$`;
   return [
-    "set -euo pipefail",
+    "set -eu",
     `mkdir -p -- ${shellQuote(targetDir)}`,
     `if [ ! -f ${shellQuote(targetPath)} ]; then`,
     `  tmp=${shellQuote(tmpPath)}`,
@@ -3667,25 +4301,6 @@ function sandboxFileDownloadCommand(download, targetPath) {
 function shellQuote(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
-async function restoredSandboxSessionState(state, client) {
-  if (!client) {
-    return void 0;
-  }
-  const sandboxState = state._sandbox;
-  const entry = sandboxState?.sessionsByAgent?.[sandboxState.currentAgentKey] ?? (sandboxState?.currentAgentKey && sandboxState?.sessionState ? {
-    backendId: sandboxState.backendId,
-    currentAgentKey: sandboxState.currentAgentKey,
-    currentAgentName: sandboxState.currentAgentName,
-    sessionState: sandboxState.sessionState
-  } : void 0);
-  if (!entry) {
-    return void 0;
-  }
-  if (client.backendId !== entry.backendId) {
-    throw new Error("RunState sandbox backend does not match the configured sandbox client");
-  }
-  return await deserializeSandboxSessionStateEnvelope(client, entry.sessionState);
-}
 var builtInSandboxLifecycleHooks = {
   "azure-cli-login": {
     id: "azure-cli-login",
@@ -3704,7 +4319,9 @@ function sandboxLifecycleHooksForIds(ids) {
   });
 }
 function applicableBeforeAgentStartHooks(hooks, context) {
-  return hooks.filter((hook) => hook.phase === "beforeAgentStart" && (hook.shouldRun?.(context) ?? true));
+  return hooks.filter(
+    (hook) => hook.phase === "beforeAgentStart" && (hook.shouldRun?.(context) ?? true)
+  );
 }
 async function runBeforeAgentStartHooks(session, hooks, context) {
   for (const hook of applicableBeforeAgentStartHooks(hooks, context)) {
@@ -3729,102 +4346,328 @@ function withSandboxLifecycleHooks(client, hooks, context) {
   const wrapped = {
     backendId: client.backendId,
     ...client.supportsDefaultOptions !== void 0 ? { supportsDefaultOptions: client.supportsDefaultOptions } : {},
-    ...client.create ? { create: async (...args) => await wrapSession(await client.create(...args)) } : {},
-    ...client.resume ? { resume: async (state) => await wrapSession(await client.resume(state)) } : {},
+    ...client.create ? {
+      create: async (...args) => await wrapSession(await client.create(...args))
+    } : {},
+    ...client.resume ? {
+      resume: async (state) => await wrapSession(await client.resume(state))
+    } : {},
     ...client.delete ? { delete: async (state) => await client.delete(state) } : {},
-    ...client.serializeSessionState ? { serializeSessionState: async (state, options) => await client.serializeSessionState(state, options) } : {},
-    ...client.canPersistOwnedSessionState ? { canPersistOwnedSessionState: async (state) => await client.canPersistOwnedSessionState(state) } : {},
-    ...client.canReusePreservedOwnedSession ? { canReusePreservedOwnedSession: async (state) => await client.canReusePreservedOwnedSession(state) } : {},
-    ...client.deserializeSessionState ? { deserializeSessionState: async (state) => await client.deserializeSessionState(state) } : {}
+    ...client.serializeSessionState ? {
+      serializeSessionState: async (state, options) => await client.serializeSessionState(state, options)
+    } : {},
+    ...client.canPersistOwnedSessionState ? {
+      canPersistOwnedSessionState: async (state) => await client.canPersistOwnedSessionState(state)
+    } : {},
+    ...client.canReusePreservedOwnedSession ? {
+      canReusePreservedOwnedSession: async (state) => await client.canReusePreservedOwnedSession(state)
+    } : {},
+    ...client.deserializeSessionState ? {
+      deserializeSessionState: async (state) => await client.deserializeSessionState(state)
+    } : {}
   };
   return wrapped;
 }
 function sandboxRepositoryCloneHooksForAgent(agent) {
   return agentRepositoryCloneHooks.get(agent) ?? [];
 }
-function gitTokenSeedForAgent(agent) {
-  return agentGitTokenSeed.get(agent);
+function gitTokenSeedsForAgent(agent) {
+  return agentGitTokenSeeds.get(agent);
 }
 function toolspaceTokenSeedForAgent(agent) {
   return agentToolspaceTokenSeed.get(agent);
 }
 function sandboxToolspaceTokenHooksForAgent(agent) {
-  return toolspaceTokenSeedForAgent(agent) ? [{
-    id: "toolspace-token",
-    phase: "beforeAgentStart",
-    run: runToolspaceTokenSeedHook
-  }] : [];
+  return toolspaceTokenSeedForAgent(agent) ? [
+    {
+      id: "toolspace-token",
+      phase: "beforeAgentStart",
+      run: runToolspaceTokenSeedHook
+    }
+  ] : [];
+}
+function sandboxRigSetupHooksForAgent(agent) {
+  return agentRigSetup.get(agent) ? [
+    {
+      id: "rig-setup",
+      phase: "beforeAgentStart",
+      run: runRigSetupHook
+    }
+  ] : [];
+}
+function rigSetupDescriptorForAgent(agent) {
+  return agentRigSetup.get(agent);
+}
+function rigCredentialHooksForAgent(agent) {
+  return agentRigCredentialHooks.get(agent) ?? [];
+}
+function unionCredentialHooks(deploymentHooks, rigHooks) {
+  if (rigHooks.length === 0) {
+    return deploymentHooks;
+  }
+  const seen = new Set(deploymentHooks.map((hook) => hook.id));
+  return [...deploymentHooks, ...rigHooks.filter((hook) => !seen.has(hook.id))];
+}
+function gitCredentialSessionRegistrationHooks(callback) {
+  return callback ? [
+    {
+      id: "git-credential-renewal-registration",
+      phase: "beforeAgentStart",
+      run: async (session) => {
+        await callback(session);
+      }
+    }
+  ] : [];
 }
 function sandboxRepositoryCloneHooks(settings, resources, activeSandboxBackend = settings.sandboxBackend) {
-  const repositories = resources.filter((resource) => resource.kind === "repository" && repositoryUsesSandboxClone(settings, resource, activeSandboxBackend));
+  const repositories = resources.filter(
+    (resource) => resource.kind === "repository" && repositoryUsesSandboxClone(settings, resource, activeSandboxBackend)
+  );
   if (repositories.length === 0) {
     return [];
   }
-  return [{
-    id: "repository-clone",
-    phase: "beforeAgentStart",
-    run: async (session, context) => {
-      await runRepositoryCloneHook(session, repositories, context);
+  return [
+    {
+      id: "repository-clone",
+      phase: "beforeAgentStart",
+      run: async (session, context) => {
+        await runRepositoryCloneHook(session, repositories, context);
+      }
     }
-  }];
+  ];
 }
 function repositoryUsesSandboxClone(settings, resource, activeSandboxBackend = settings.sandboxBackend) {
   if (activeSandboxBackend === "selfhosted") {
     return false;
   }
-  return settings.sandboxBackend === "modal" || Boolean(resource.githubInstallationId && resource.githubRepositoryId);
+  return settings.sandboxBackend === "modal" || Boolean(resource.githubInstallationId && resource.githubRepositoryId) || Boolean(resource.provider);
 }
-function repositoryCloneCommand(resources) {
-  const commands = [
-    "set -eu",
-    'export HOME="${HOME:-/workspace}"',
-    'export GIT_TERMINAL_PROMPT="${GIT_TERMINAL_PROMPT:-0}"',
-    // TOKEN-BROKER (B1/B2): seed the run-scoped GitHub token into the STABLE token FILE
-    // AND provision the git-askpass helper into the box AT SETUP (runtime) BEFORE any
-    // clone runs, so GIT_ASKPASS points at a per-box, user-writable script that reads
-    // that file for the fetch below. Provisioning the askpass here (rather than relying
-    // on a baked image script at /usr/local/bin/opengeni-git-askpass) removes the
-    // image-rebuild rollout gate: the askpass is correct on ANY box image, including
-    // pre-existing warm boxes on their next turn's clone hook, and no product image has
-    // to carry it. The seed rides the per-exec env (OPENGENI_GIT_TOKEN_SEED) — NEVER the
-    // box/agent manifest (validateNoEnvironmentDelta must not see a rotating value), so
-    // this whole block is a no-op when the seed is absent (e.g. the selfhosted path,
-    // which uses its own git creds). The token file lives at $OPENGENI_GIT_TOKEN_FILE
-    // (stable, from the shared base) with a $HOME/.opengeni/git-token fallback.
-    // $GIT_ASKPASS is on the box manifest env (set by
-    // sandboxEnvironmentForRun to $HOME/.opengeni/askpass), so it is available to this
-    // exec; the askpass script we write is byte-identical to docker/opengeni-git-askpass
-    // and is written via a QUOTED heredoc (<<'ASKPASS_EOF') so NOTHING inside it expands
-    // ($1, $HOME, ${OPENGENI_GIT_TOKEN_FILE:-...}, and the literal \n in printf all land
-    // verbatim), then chmod 0755 so git can exec it.
-    //
-    // ATOMIC REWRITE: this block now re-runs at the start of EVERY turn on a warm box
-    // that other turn holders may be actively using — an in-flight `git fetch` from a
-    // concurrent turn can invoke the askpass (which cats the token file) at any moment.
-    // Both files are therefore written to a pid-suffixed temp under umask 077 and
-    // renamed into place: rename is atomic, concurrent readers keep the old inode, and
-    // the token is never observable world-readable (no post-hoc chmod window).
-    'if [ -n "${OPENGENI_GIT_TOKEN_SEED:-}" ]; then',
-    '  seed_umask="$(umask)"',
-    "  umask 077",
-    '  git_token_file="${OPENGENI_GIT_TOKEN_FILE:-$HOME/.opengeni/git-token}"',
-    '  mkdir -p "$(dirname "$git_token_file")"',
-    `  printf '%s' "$OPENGENI_GIT_TOKEN_SEED" > "$git_token_file.tmp.$$"`,
-    '  mv -f "$git_token_file.tmp.$$" "$git_token_file"',
-    '  git_askpass="${GIT_ASKPASS:-$HOME/.opengeni/askpass}"',
-    '  mkdir -p "$(dirname "$git_askpass")"',
-    `  cat > "$git_askpass.tmp.$$" <<'ASKPASS_EOF'`,
+var GIT_CREDENTIAL_PROVIDERS = [
+  "github",
+  "gitlab",
+  "azure_devops"
+];
+function gitProviderSeedEnv(provider) {
+  return `OPENGENI_GIT_${provider.toUpperCase()}_TOKEN_SEED`;
+}
+function gitTokenSeedExportPrefix(seeds) {
+  const lines = [];
+  for (const provider of GIT_CREDENTIAL_PROVIDERS) {
+    const token = seeds[provider];
+    if (!token) {
+      continue;
+    }
+    lines.push(`export ${gitProviderSeedEnv(provider)}=${shellQuote(token)}`);
+    if (provider === "github") {
+      lines.push(`export OPENGENI_GIT_TOKEN_SEED=${shellQuote(token)}`);
+    }
+  }
+  return lines.join("\n");
+}
+function repositoryCredentialProvider(resource) {
+  return resource.provider ?? "github";
+}
+function gitAskpassHostProviderCaseLines(resources) {
+  const hosts = /* @__PURE__ */ new Map();
+  for (const resource of resources) {
+    try {
+      const hostname = new URL(resource.uri).hostname.toLowerCase();
+      if (!hostname) {
+        continue;
+      }
+      hosts.set(hostname, repositoryCredentialProvider(resource));
+    } catch {
+    }
+  }
+  return [...hosts.entries()].sort(([a], [b]) => a.localeCompare(b)).map(
+    ([hostname, provider]) => `    ${shellQuote(hostname)}) printf '%s\\n' ${provider}; return 0 ;;`
+  );
+}
+function gitCredentialTokenWriterCommandLines() {
+  return [
+    // TOKEN-BROKER (B1/B2): seed run-scoped provider tokens into stable files and
+    // atomically replace each provider file. Token VALUES are supplied only by
+    // the per-exec command prefix
+    // (OPENGENI_GIT_*_TOKEN_SEED), never by the box/agent manifest. Helper paths
+    // are stable manifest values from @opengeni/config.
+    "git_provider_token_file() {",
+    '  provider="$1"',
+    '  case "$provider" in',
+    `    github) printf '%s\\n' "\${OPENGENI_GIT_TOKEN_FILE:-$HOME/.opengeni/git-token}" ;;`,
+    `    *) printf '%s\\n' "\${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/$provider-token" ;;`,
+    "  esac",
+    "}",
+    "write_git_provider_token() {",
+    '  provider="$1"',
+    '  token="$2"',
+    '  [ -n "$token" ] || return 0',
+    '  token_file="$(git_provider_token_file "$provider")"',
+    '  mkdir -p "$(dirname "$token_file")"',
+    `  printf '%s' "$token" > "$token_file.tmp.$$"`,
+    '  mv -f "$token_file.tmp.$$" "$token_file"',
+    '  if [ "$provider" = github ]; then',
+    '    credential_dir="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}"',
+    '    mkdir -p "$credential_dir"',
+    `    printf '%s' "$token" > "$credential_dir/github-token.tmp.$$"`,
+    '    mv -f "$credential_dir/github-token.tmp.$$" "$credential_dir/github-token"',
+    "  fi",
+    "}",
+    'seed_umask="$(umask)"',
+    "umask 077",
+    'write_git_provider_token github "${OPENGENI_GIT_GITHUB_TOKEN_SEED:-${OPENGENI_GIT_TOKEN_SEED:-}}"',
+    'write_git_provider_token gitlab "${OPENGENI_GIT_GITLAB_TOKEN_SEED:-}"',
+    'write_git_provider_token azure_devops "${OPENGENI_GIT_AZURE_DEVOPS_TOKEN_SEED:-}"',
+    'umask "$seed_umask"'
+  ];
+}
+function gitCredentialHelperCommandLines(resources = []) {
+  const hostProviderCases = gitAskpassHostProviderCaseLines(resources);
+  return [
+    ...gitCredentialTokenWriterCommandLines(),
+    // Provision git/provider-CLI helpers at SETUP (runtime) before any clone
+    // runs. Renewal updates only token files and deliberately leaves these
+    // repository-specific host mappings intact.
+    'git_askpass="${GIT_ASKPASS:-$HOME/.opengeni/askpass}"',
+    'mkdir -p "$(dirname "$git_askpass")"',
+    `cat > "$git_askpass.tmp.$$" <<'ASKPASS_EOF'`,
     "#!/usr/bin/env sh",
+    "prompt_host() {",
+    `  prompt_lower="$(printf '%s\\n' "$1" | tr '[:upper:]' '[:lower:]')"`,
+    '  case "$prompt_lower" in',
+    "    *://*) ;;",
+    "    *) printf '\\n'; return 0 ;;",
+    "  esac",
+    '  rest="${prompt_lower#*://}"',
+    '  rest="${rest#*@}"',
+    '  host="${rest%%/*}"',
+    '  host="${host%%:*}"',
+    `  host="$(printf '%s\\n' "$host" | tr -d "'")"`,
+    `  printf '%s\\n' "$host"`,
+    "}",
+    "provider_for_prompt() {",
+    '  host="$(prompt_host "$1")"',
+    '  case "$host" in',
+    ...hostProviderCases.length > 0 ? hostProviderCases : ['    "") : ;;'],
+    "  esac",
+    `  case "$(printf '%s\\n' "$1" | tr '[:upper:]' '[:lower:]')" in`,
+    "    *github.com*|*githubusercontent.com*) printf '%s\\n' github ;;",
+    "    *gitlab*) printf '%s\\n' gitlab ;;",
+    "    *dev.azure.com*|*.visualstudio.com*) printf '%s\\n' azure_devops ;;",
+    "    *) printf '%s\\n' github ;;",
+    "  esac",
+    "}",
+    "token_file_for_provider() {",
+    '  case "$1" in',
+    `    github) printf '%s\\n' "\${OPENGENI_GIT_TOKEN_FILE:-$HOME/.opengeni/git-token}" ;;`,
+    `    *) printf '%s\\n' "\${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/$1-token" ;;`,
+    "  esac",
+    "}",
+    "username_for_provider() {",
+    '  case "$1" in',
+    `    github) printf '%s\\n' "x-access-token" ;;`,
+    `    gitlab) printf '%s\\n' "oauth2" ;;`,
+    `    azure_devops) printf '%s\\n' "opengeni" ;;`,
+    "    *) printf '\\n' ;;",
+    "  esac",
+    "}",
+    'provider="$(provider_for_prompt "$1")"',
     'case "$1" in',
-    `  *Username*) printf '%s\\n' "x-access-token" ;;`,
-    `  *Password*) cat "\${OPENGENI_GIT_TOKEN_FILE:-$HOME/.opengeni/git-token}" 2>/dev/null || printf '\\n' ;;`,
+    '  *Username*) username_for_provider "$provider" ;;',
+    `  *Password*) cat "$(token_file_for_provider "$provider")" 2>/dev/null || printf '\\n' ;;`,
     "  *) printf '\\n' ;;",
     "esac",
     "ASKPASS_EOF",
-    '  chmod 0755 "$git_askpass.tmp.$$"',
-    '  mv -f "$git_askpass.tmp.$$" "$git_askpass"',
-    '  umask "$seed_umask"',
+    'chmod 0755 "$git_askpass.tmp.$$"',
+    'mv -f "$git_askpass.tmp.$$" "$git_askpass"',
+    'wrapper_dir="${OPENGENI_GIT_CLI_WRAPPER_DIR:-$HOME/.opengeni/bin}"',
+    'mkdir -p "$wrapper_dir"',
+    "for opengeni_git_cli_tool in gh glab az; do",
+    '  wrapper="$wrapper_dir/$opengeni_git_cli_tool"',
+    `  cat > "$wrapper.tmp.$$" <<'CLI_WRAPPER_EOF'`,
+    "#!/usr/bin/env sh",
+    "set -eu",
+    'tool="${0##*/}"',
+    'case "$tool" in',
+    "  gh) provider=github; token_env=GH_TOKEN ;;",
+    "  glab) provider=gitlab; token_env=GITLAB_TOKEN ;;",
+    "  az) provider=azure_devops; token_env=AZURE_DEVOPS_EXT_PAT ;;",
+    "  *) provider=; token_env= ;;",
+    "esac",
+    'if [ -n "$provider" ]; then',
+    '  case "$provider" in',
+    '    github) token_file="${OPENGENI_GIT_TOKEN_FILE:-$HOME/.opengeni/git-token}" ;;',
+    '    *) token_file="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/$provider-token" ;;',
+    "  esac",
+    '  if [ -f "$token_file" ]; then',
+    '    token="$(cat "$token_file" 2>/dev/null || true)"',
+    '    if [ -n "$token" ]; then',
+    '      case "$token_env" in',
+    '        GH_TOKEN) export GH_TOKEN="$token" ;;',
+    '        GITLAB_TOKEN) export GITLAB_TOKEN="$token" ;;',
+    '        AZURE_DEVOPS_EXT_PAT) export AZURE_DEVOPS_EXT_PAT="$token" ;;',
+    "      esac",
+    "    fi",
+    "  fi",
     "fi",
+    `self_real="$(readlink -f "$0" 2>/dev/null || printf '%s\\n' "$0")"`,
+    'old_ifs="$IFS"',
+    "IFS=:",
+    "for dir in $PATH; do",
+    '  [ -n "$dir" ] || dir=.',
+    '  candidate="$dir/$tool"',
+    '  [ -x "$candidate" ] || continue',
+    `  candidate_real="$(readlink -f "$candidate" 2>/dev/null || printf '%s\\n' "$candidate")"`,
+    '  [ "$candidate_real" = "$self_real" ] && continue',
+    '  IFS="$old_ifs"',
+    '  exec "$candidate" "$@"',
+    "done",
+    'IFS="$old_ifs"',
+    `printf '%s\\n' "$tool: real command not found on PATH" >&2`,
+    "exit 127",
+    "CLI_WRAPPER_EOF",
+    '  chmod 0755 "$wrapper.tmp.$$"',
+    '  mv -f "$wrapper.tmp.$$" "$wrapper"',
+    "done"
+  ];
+}
+function gitProviderTokenRefreshCommand(seeds) {
+  const seedPrefix = gitTokenSeedExportPrefix(seeds);
+  if (!seedPrefix) {
+    return "";
+  }
+  return [
+    seedPrefix,
+    "set -eu",
+    'export HOME="${HOME:-/workspace}"',
+    ...gitCredentialTokenWriterCommandLines()
+  ].join("\n");
+}
+async function refreshGitProviderTokenFiles(session, seeds, options = {}) {
+  const command = gitProviderTokenRefreshCommand(seeds);
+  if (!command) {
+    return;
+  }
+  const args = {
+    cmd: command,
+    workdir: "/workspace",
+    ...options.runAs ? { runAs: options.runAs } : {},
+    yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
+    maxOutputTokens: 4e3
+  };
+  if (session.exec) {
+    assertSandboxCommandSucceeded(await session.exec(args), "Git credential refresh");
+  } else if (session.execCommand) {
+    assertSandboxCommandSucceeded(await session.execCommand(args), "Git credential refresh");
+  } else {
+    throw new Error("Sandbox session does not support command execution");
+  }
+}
+function repositoryCloneCommand(resources) {
+  const commands = [
+    "set -eu",
+    'export HOME="${HOME:-/workspace}"',
+    'export GIT_TERMINAL_PROMPT="${GIT_TERMINAL_PROMPT:-0}"',
+    ...gitCredentialHelperCommandLines(resources),
     "ensure_git() {",
     "  if command -v git >/dev/null 2>&1; then",
     "    return 0",
@@ -3915,13 +4758,15 @@ function repositoryCloneCommand(resources) {
     const url = new URL(resource.uri);
     const repo = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
     const mountPath = normalizeManifestPath(resource.mountPath ?? `repos/${repo}`);
-    commands.push([
-      "clone_repository",
-      shellQuote(posixPath.join("/workspace", mountPath)),
-      shellQuote(resource.uri),
-      shellQuote(resource.ref),
-      shellQuote(resource.subpath ? normalizeManifestPath(resource.subpath) : "")
-    ].join(" "));
+    commands.push(
+      [
+        "clone_repository",
+        shellQuote(posixPath.join("/workspace", mountPath)),
+        shellQuote(resource.uri),
+        shellQuote(resource.ref),
+        shellQuote(resource.subpath ? normalizeManifestPath(resource.subpath) : "")
+      ].join(" ")
+    );
   }
   return commands.join("\n");
 }
@@ -3968,11 +4813,124 @@ ${toolspaceTokenSeedCommand()}`;
     throw new Error("Sandbox session does not support command execution");
   }
 }
+var RIG_SETUP_OUTPUT_TAIL_LIMIT = 4e3;
+var RIG_SETUP_SKIPPED_SENTINEL = "__OPENGENI_RIG_SETUP_SKIPPED__";
+function rigSetupScriptCommand(script, versionId, timeoutMs = 6e5, markerRoot = "/var/opengeni") {
+  const timeoutSecs = Math.max(1, Math.ceil(timeoutMs / 1e3));
+  const lockWaitSecs = timeoutSecs + 6;
+  const marker = `${markerRoot.replace(/\/+$/, "")}/rig-setup-${versionId}.done`;
+  return [
+    "set -u",
+    `mkdir -p ${shellQuote(markerRoot)}`,
+    `__OG_RIG_MARKER=${shellQuote(marker)}`,
+    '__OG_RIG_LOCK="$__OG_RIG_MARKER.lock"',
+    `__OG_RIG_TIMEOUT_SECS=${timeoutSecs}`,
+    `__OG_RIG_LOCK_WAIT_SECS=${lockWaitSecs}`,
+    `if [ -f "$__OG_RIG_MARKER" ]; then printf '%s\\n' ${shellQuote(RIG_SETUP_SKIPPED_SENTINEL)}; exit 0; fi`,
+    "while :; do",
+    '  if mkdir "$__OG_RIG_LOCK" 2>/dev/null; then',
+    `    trap 'rm -rf "$__OG_RIG_LOCK"' EXIT`,
+    `    if [ -f "$__OG_RIG_MARKER" ]; then printf '%s\\n' ${shellQuote(RIG_SETUP_SKIPPED_SENTINEL)}; exit 0; fi`,
+    '__OG_RIG_SCRIPT="$(mktemp)"',
+    `cat > "$__OG_RIG_SCRIPT" <<'__OPENGENI_RIG_SETUP_SCRIPT_EOF__'`,
+    script,
+    "__OPENGENI_RIG_SETUP_SCRIPT_EOF__",
+    '    timeout -k 5s "${__OG_RIG_TIMEOUT_SECS}s" bash "$__OG_RIG_SCRIPT"',
+    "__OG_RIG_RC=$?",
+    '    rm -f "$__OG_RIG_SCRIPT"',
+    '    if [ "$__OG_RIG_RC" -eq 0 ]; then touch "$__OG_RIG_MARKER"; fi',
+    '    exit "$__OG_RIG_RC"',
+    "  fi",
+    "  __OG_RIG_WAITED=0",
+    '  while [ "$__OG_RIG_WAITED" -lt "$__OG_RIG_LOCK_WAIT_SECS" ]; do',
+    `    if [ -f "$__OG_RIG_MARKER" ]; then printf '%s\\n' ${shellQuote(RIG_SETUP_SKIPPED_SENTINEL)}; exit 0; fi`,
+    '    if [ ! -d "$__OG_RIG_LOCK" ]; then break; fi',
+    "    sleep 1",
+    "    __OG_RIG_WAITED=$((__OG_RIG_WAITED + 1))",
+    "  done",
+    `  if [ -f "$__OG_RIG_MARKER" ]; then printf '%s\\n' ${shellQuote(RIG_SETUP_SKIPPED_SENTINEL)}; exit 0; fi`,
+    '  if [ ! -d "$__OG_RIG_LOCK" ]; then continue; fi',
+    '  rmdir "$__OG_RIG_LOCK" 2>/dev/null || true',
+    "done"
+  ].join("\n");
+}
+async function runRigSetupHook(session, context = { environment: {} }) {
+  const rigSetup = context.rigSetup;
+  if (!rigSetup) {
+    return;
+  }
+  const payload = {
+    rigId: rigSetup.rigId,
+    versionId: rigSetup.versionId,
+    rigName: rigSetup.rigName
+  };
+  await context.onRuntimeEvent?.({ type: "rig.setup.started", payload });
+  const command = rigSetupScriptCommand(rigSetup.script, rigSetup.versionId, rigSetup.timeoutMs);
+  const execArgs = {
+    cmd: command,
+    workdir: "/workspace",
+    ...context.runAs ? { runAs: context.runAs } : {},
+    // The in-box coreutils timeout is the hard deadline; the SDK yield waits a
+    // little longer so it observes timeout's non-zero exit instead of a live
+    // still-running process.
+    yieldTimeMs: rigSetup.timeoutMs + 7e3,
+    maxOutputTokens: 2e4
+  };
+  let result;
+  try {
+    if (session.exec) {
+      result = await session.exec(execArgs);
+    } else if (session.execCommand) {
+      result = await session.execCommand(execArgs);
+    } else {
+      throw new Error("Sandbox session does not support command execution");
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    await context.onRuntimeEvent?.({
+      type: "rig.setup.failed",
+      payload: { ...payload, error: message.slice(-RIG_SETUP_OUTPUT_TAIL_LIMIT) }
+    });
+    throw new Error(
+      `Rig setup failed for rig "${rigSetup.rigName}" (version ${rigSetup.versionId}): ${message}`,
+      { cause: error }
+    );
+  }
+  const output = sandboxCommandOutput(result);
+  if (output.includes(RIG_SETUP_SKIPPED_SENTINEL)) {
+    await context.onRuntimeEvent?.({ type: "rig.setup.skipped", payload });
+    return;
+  }
+  const stillRunning = sandboxCommandStillRunning(result);
+  const exitCode = sandboxCommandExitCode(result);
+  if (stillRunning || exitCode === null || exitCode !== 0) {
+    const tail = output.length > RIG_SETUP_OUTPUT_TAIL_LIMIT ? output.slice(-RIG_SETUP_OUTPUT_TAIL_LIMIT) : output;
+    const reason = stillRunning ? `did not finish within the rig setup timeout (${rigSetup.timeoutMs}ms)` : exitCode === null ? "did not report an exit code" : `exited with code ${exitCode}`;
+    const failure = new Error(
+      `Rig setup failed for rig "${rigSetup.rigName}" (version ${rigSetup.versionId}): the setup script ${reason}${tail ? `:
+${tail}` : ""}`
+    );
+    await context.onRuntimeEvent?.({
+      type: "rig.setup.failed",
+      payload: { ...payload, error: failure.message.slice(-RIG_SETUP_OUTPUT_TAIL_LIMIT) }
+    });
+    throw failure;
+  }
+  await context.onRuntimeEvent?.({
+    type: "rig.setup.completed",
+    payload: { ...payload, skipped: false }
+  });
+}
 async function runRepositoryCloneHook(session, resources, context = { environment: {} }) {
   const payload = { name: "repository-clone", repositoryCount: resources.length };
   await context.onRuntimeEvent?.({ type: "sandbox.operation.started", payload });
   try {
-    const command = context.gitTokenSeed ? `export OPENGENI_GIT_TOKEN_SEED=${shellQuote(context.gitTokenSeed)}
+    const gitTokenSeeds = {
+      ...context.gitTokenSeeds ?? {},
+      ...context.gitTokenSeed ? { github: context.gitTokenSeed } : {}
+    };
+    const seedPrefix = gitTokenSeedExportPrefix(gitTokenSeeds);
+    const command = seedPrefix ? `${seedPrefix}
 ${repositoryCloneCommand(resources)}` : repositoryCloneCommand(resources);
     if (session.exec) {
       const result = await session.exec({
@@ -4043,6 +5001,10 @@ function sandboxCommandExitCode(result) {
   return null;
 }
 function sandboxCommandOutput(result) {
+  if (typeof result === "string") {
+    const outputIndex = result.indexOf("Output:");
+    return outputIndex >= 0 ? result.slice(outputIndex + "Output:".length).trim() : result.trim();
+  }
   if (!result || typeof result !== "object") {
     return "";
   }
@@ -4052,12 +5014,17 @@ function sandboxCommandOutput(result) {
 function assertSandboxCommandSucceeded(result, operation) {
   const output = sandboxCommandOutput(result);
   if (sandboxCommandStillRunning(result)) {
-    throw new Error(`${operation} did not finish before the lifecycle command timeout${output ? `:
-${output}` : ""}`);
+    throw new Error(
+      `${operation} did not finish before the lifecycle command timeout${output ? `:
+${output}` : ""}`
+    );
   }
   const exitCode = sandboxCommandExitCode(result);
   if (exitCode !== null && exitCode !== 0) {
-    throw new Error(output || `${operation} failed with exit code ${exitCode}`);
+    throw new Error(
+      `${operation} failed with exit code ${exitCode}${output ? `:
+${output}` : ""}`
+    );
   }
   if (exitCode === null) {
     throw new Error(output || `${operation} did not return a command exit code`);
@@ -4142,7 +5109,10 @@ function bundledSkillsDir() {
     return packaged;
   }
   if (!stagedBundledSkillsDir) {
-    stagedBundledSkillsDir = stageBundledSkills(packaged, join(process.cwd(), ".opengeni", "bundled_hashicorp_terraform_skills"));
+    stagedBundledSkillsDir = stageBundledSkills(
+      packaged,
+      join(process.cwd(), ".opengeni", "bundled_hashicorp_terraform_skills")
+    );
   }
   return stagedBundledSkillsDir;
 }
@@ -4187,12 +5157,18 @@ function lazySkillSourceWithPackSkills(packSkills) {
     packNameKeys.add(skill.name.toLowerCase());
     packNames.add(skill.name);
     children[skill.name] = packSkillDirEntry(skill);
-    packIndex.push({ name: skill.name, description: packSkillDescription(skill), path: skill.name });
+    packIndex.push({
+      name: skill.name,
+      description: packSkillDescription(skill),
+      path: skill.name
+    });
   }
   return {
     source: dir({ children }),
     getIndex: (manifest, skillsPath) => [
-      ...(bundled.getIndex?.(manifest, skillsPath) ?? []).filter((entry) => !packNames.has(entry.path ?? entry.name)),
+      ...(bundled.getIndex?.(manifest, skillsPath) ?? []).filter(
+        (entry) => !packNames.has(entry.path ?? entry.name)
+      ),
       ...packIndex
     ]
   };
@@ -4306,7 +5282,9 @@ function sortJson(value) {
     return value.map(sortJson);
   }
   if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, nested]) => [key, sortJson(nested)]));
+    return Object.fromEntries(
+      Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, nested]) => [key, sortJson(nested)])
+    );
   }
   return value;
 }
@@ -4335,25 +5313,44 @@ export {
   DISPLAY_STACK_TIMEOUT_MS,
   DisplayStackError,
   DisplayStackUnsupportedError,
+  FAULT_FIELD_WHAT_HAPPENED,
+  FAULT_FIELD_WHAT_PRESERVED,
+  FAULT_FIELD_WHAT_TO_TRY,
+  FAULT_FIELD_WHICH_LAYER,
   GENESIS_TITLE_DIRECTIVE,
   MAX_COMPACTION_THRESHOLD_RATIO,
   MIN_COMPACTION_THRESHOLD_RATIO,
   MaxTurnsExceededError2 as MaxTurnsExceededError,
   MockAgentResponder,
   MultiProviderModelProvider,
+  NEVER_SENT_DETAIL_KEY,
   NatsControlRpc,
+  NatsOpStreamTransport,
+  OP_STREAM_ACK_INTERVAL_MS,
+  OP_STREAM_DEFAULT_WINDOW_BYTES,
+  OP_STREAM_RECONNECT_HOLD_MS,
+  OP_STREAM_SILENCE_TIMEOUT_MS,
+  OpStreamUnavailableError,
   OpenAIChatCompletionsModel2 as OpenAIChatCompletionsModel,
   OpenAIResponsesModel2 as OpenAIResponsesModel,
   PROVIDER_REGISTRY,
+  REPOSITORY_DISCOVERY_LIMIT,
   RecordingError,
   RecordingUnavailableError,
   RoutingSandboxSession,
   RoutingUnsupportedError,
-  SCREENSHOT_OMITTED_IMAGE_DATA_URL,
-  SCREENSHOT_OMITTED_PLACEHOLDER,
   SELFHOSTED_DEFAULT_TIMEOUT_MS,
+  SELFHOSTED_DRAINING_MAX_RETRIES,
+  SELFHOSTED_EXEC_DRAINING_MAX_RETRIES,
+  SELFHOSTED_IDEMPOTENT_READONLY_OPS,
+  SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES,
+  SELFHOSTED_NEVER_SENT_MAX_RETRIES,
   SELFHOSTED_RECONNECT_WINDOW_MS,
   SELFHOSTED_RELAY_STREAM_PATH,
+  SELFHOSTED_RETRY_BACKOFF_BASE_MS,
+  SELFHOSTED_RETRY_BACKOFF_CAP_MS,
+  SELFHOSTED_RETRY_BACKOFF_FACTOR,
+  SELFHOSTED_TIMEOUT_MAX_RETRIES,
   STREAM_PORT,
   STREAM_TOKEN_DEFAULT_TTL_SECONDS,
   SUMMARY_BUFFER_TOKENS,
@@ -4362,6 +5359,7 @@ export {
   SandboxComputer,
   SandboxConfigError,
   SandboxProviderUnavailableError,
+  SandboxResumeStateUnavailableError,
   SelfhostedControlError,
   SelfhostedSandboxClient,
   SelfhostedSession,
@@ -4373,11 +5371,14 @@ export {
   TerminalServerError,
   TerminalServerUnsupportedError,
   USER_MESSAGE_TRUNCATION_MARKER,
+  WorkspaceModelPolicyBlockedError,
   agentErrorToControlError,
   agentsErrorRunState,
   appendGenesisTitleDirective,
+  appendPersistentSessionSettings,
   appendSessionInstructions,
   appendToolspaceInstructions,
+  appendWorkspaceMemory,
   applyMissingManifestEntries,
   assertDescriptorRegistryInvariants,
   assertProviderRegistryInvariants,
@@ -4388,7 +5389,6 @@ export {
   buildAgentCapabilities,
   buildCompactionPromptInput,
   buildCompactionReplacementHistory,
-  buildDeterministicFallbackCompactionHistory,
   buildDisplayStackScript,
   buildManifest,
   buildModelInstance,
@@ -4401,8 +5401,8 @@ export {
   buildTerminalServerScript,
   callModelInputFilterForSettings,
   clampCompactionThresholdRatio,
-  clientCompactionThresholdTokens,
   collectSandboxEnvironment,
+  compactionThresholdTokens,
   composeAgentInstructions,
   computerUse,
   configureOpenAI,
@@ -4413,14 +5413,18 @@ export {
   createProductionAgentRuntime,
   createSandboxClient,
   createSandboxClientForBackend,
-  decideClientCompaction,
+  decideCompaction,
+  decideSelfhostedRetry,
   decodeModalSnapshotId,
+  defaultSelfhostedRetryClock,
   deletePriorPersistedSnapshot,
   deleteRecordingArtifacts,
   deserializeSandboxSessionStateEnvelope,
   desktopCapableBackend,
-  elideStaleScreenshotImages,
-  enforceInputBudget,
+  drainingExhaustedError,
+  drainingMessage,
+  elideSupersededViewImagePairs,
+  elideSupersededViewImagesFilter,
   ensureDisplayStack,
   ensureModalRegistryImage,
   ensureReadableStreamFrom,
@@ -4428,12 +5432,15 @@ export {
   establishSandboxSessionFromEnvelope,
   estimateItemTokens,
   estimateTokens,
+  execDeadlineHint,
   exposeStreamPort,
   extForCodec,
   extractResponseOutputText,
   findCompactionNeededError,
-  findKeepBoundary,
+  gitProviderTokenRefreshCommand,
+  inspectRecordingArtifact,
   isCompactionSummary,
+  isEphemeralInternalContext,
   isExecSessionLostBanner,
   isProviderSandboxNotFoundError,
   isSelfhostedProviderNotFoundError,
@@ -4441,52 +5448,71 @@ export {
   isWorkspaceEscapeError,
   lazySkillSourceWithPackSkills,
   makeActiveBackendResolver,
+  manifestEnvironmentDrift,
   materializeSandboxFileDownloads,
   maxTurnsExceededRunState,
   mcpToolErrorOutput,
   mintStreamToken,
   modalSandboxAttributionEnvironment,
   modalSandboxAttributionTags,
+  modelCallUsageTelemetry,
+  modelResponseUsageFromResponse,
   modelResponseUsageFromSdkEvent,
   negotiateCapabilities,
   negotiateSelfhostedCapabilities,
   neutralizeToolSearchItemsInSerializedRunState,
+  nextDurableOpId,
   normalizeComputerCallsFilter,
   normalizeSdkEvent,
   normalizeToolOutputForEvent,
   offlineAgentError,
   offlineControlResponse,
+  oneShotGenesisTitleInputFilter,
+  opAckSubject,
+  opFrameSubject,
   parseExecBannerSessionId,
   parseExposedPorts,
   parseNumstatZ,
   parsePorcelainV2,
   parseUnifiedPatch,
+  payloadTooLargeMessage,
+  pinProvidedSessionManifestEnvironment,
   prefixedMcpToolName,
   prepareAgentTools,
   prepareRunInput,
-  readRecordingBytes,
   readWorkspaceArchiveFromEnvelopeSessionState,
   recordingStorageKey,
+  refreshGitProviderTokenFiles,
   renderCompactionPromptInputForChat,
+  renderSelfhostedFault,
   repositoryCloneCommand,
   repositoryUsesSandboxClone,
   resolveTurnModel,
   restoredSandboxSessionStateFromEntry,
+  rigInstructions,
+  rigSetupScriptCommand,
   runAgentStream,
   runAzureCliLoginHook,
   runBeforeAgentStartHooks,
+  runOwnedSandboxSetup,
   runRepositoryCloneHook,
+  runRigSetupHook,
   runToolspaceTokenSeedHook,
+  runWithToolCallCorrelation,
   sandboxCommandExitCode,
   sandboxCommandOutput,
   sandboxCommandStillRunning,
+  sandboxFileDownloadFailureNote,
   sandboxFileDownloadsForAgent,
   sandboxLifecycleHooksForIds,
   sandboxRunAs,
   sandboxStateEntryFromRunState,
   sanitizeHistoryItemsForModel,
+  sanitizeOpIdToken,
   selectBackend,
+  selfhostedFaultClass,
   selfhostedLiveness,
+  selfhostedRetryBackoffMs,
   serializeApprovals,
   serializeEstablishedSandboxEnvelope,
   setSelfhostedApplyDiff,
@@ -4498,6 +5524,7 @@ export {
   stripReasoningIdentityFromSerializedRunState,
   subjectFor,
   summarizeForCompaction,
+  swapTargetEstablishability,
   sweepModalOrphanSandboxes,
   tagModalSandbox,
   tearDownDisplayStack,
@@ -4506,10 +5533,12 @@ export {
   timeoutAgentError,
   timeoutControlResponse,
   toolspaceTokenSeedCommand,
+  uploadRecordingArtifact,
   verifyStreamToken,
   withManifestRefreshOnResume,
   withSandboxFileDownloads,
   withSandboxLifecycleHooks,
+  withStructuredViewImageFunctionResults,
   workspaceEnvironmentInstructions
 };
 //# sourceMappingURL=index.js.map