@opengeni/runtime 0.7.0 → 0.11.0

package/dist/index.d.ts

@@ -3,15 +3,211 @@ import { Tool, Computer, AgentInputItem, Model, MCPServer, ModelProvider, Agent,
 export { MaxTurnsExceededError, OpenAIChatCompletionsModel, OpenAIResponsesModel } from '@openai/agents';
 import { Settings, ResolvedModelProvider, ConfiguredModel, ModelProviderApi } from '@opengeni/config';
 export { collectSandboxEnvironment, parseExposedPorts } from '@opengeni/config';
-import { ReasoningEffort, GitCredentialProvider, SessionEventType, ResourceRef, ToolRef, Permission, McpServerConnectionRef, ToolAuthNeededPayload } from '@opengeni/contracts';
+import { HumanInputResponse, ReasoningEffort, GitCredentialProvider, SessionEventType, ResourceRef, ToolRef, Permission, McpServerConnectionRef, ToolAuthNeededPayload, RequestHumanInputToolInput } from '@opengeni/contracts';
 export { CAPABILITY_DESCRIPTORS, CapabilityDescriptor, DESKTOP_STREAM_PORT, StreamTokenPayload, StreamTokenPayload as StreamTokenPayloadType, TERMINAL_STREAM_PORT } from '@opengeni/contracts';
 import { SandboxSessionLike, Capability, SandboxSessionState, Manifest, Capabilities, LocalDirLazySkillSource, SandboxClient } from '@openai/agents/sandbox';
 import OpenAI from 'openai';
-import { R as RuntimeMetricsHooks } from './index-DIiiwQY2.js';
-export { A as ActiveBackendResolverDeps, a as ActiveBackendUnresolvableError, b as ActivePointer, B as BackendUnresolvableCode, C as ChannelAConflictError, c as ChannelAEmitter, d as ChannelAExecArgs, e as ChannelAExecResult, f as ChannelANotFoundError, g as ChannelASession, h as ChannelAUnsupportedError, i as ChannelAValidationError, j as ControlRpc, D as DEFAULT_DESKTOP_GEOMETRY, k as DISPLAY_STACK_TIMEOUT_MS, l as DesktopGeometry, m as DisplayStackError, n as DisplayStackUnsupportedError, E as EnsureDisplayStackOptions, o as EnsureDisplayStackResult, p as EnsureTerminalServerOptions, q as EnsureTerminalServerResult, r as EstablishedSandboxSession, s as ExposeStreamPortInput, t as ExposeStreamPortResult, u as ExposedPortEndpoint, F as FAULT_FIELD_WHAT_HAPPENED, v as FAULT_FIELD_WHAT_PRESERVED, w as FAULT_FIELD_WHAT_TO_TRY, x as FAULT_FIELD_WHICH_LAYER, L as LiveModalSandboxLeaseAttribution, M as MintStreamTokenInput, y as MockAgentResponder, z as MockAgentResponderOptions, G as MockExecHandler, H as ModalModuleLoader, I as ModalOrphanSweepResult, J as ModalSandboxAttribution, N as NEVER_SENT_DETAIL_KEY, K as NatsControlRpc, O as NatsOpStreamConnection, P as NatsOpStreamTransport, Q as NatsRequestConnection, S as NegotiationContext, T as NumstatEntry, U as OP_STREAM_ACK_INTERVAL_MS, V as OP_STREAM_DEFAULT_WINDOW_BYTES, W as OP_STREAM_RECONNECT_HOLD_MS, X as OP_STREAM_SILENCE_TIMEOUT_MS, Y as OpStreamExecOutcome, Z as OpStreamJournal, _ as OpStreamSubscription, $ as OpStreamTransport, a0 as OpStreamUnavailableError, a1 as PROVIDER_REGISTRY, a2 as ProviderConstructionContext, a3 as ProviderRegistration, a4 as REPOSITORY_DISCOVERY_LIMIT, a5 as RecordingArtifactMetadata, a6 as RecordingCodec, a7 as RecordingContentType, a8 as RecordingError, a9 as RecordingProcess, aa as RecordingUnavailableError, ab as RepositoryDiscoveryDegradedReason, ac as RepositoryDiscoveryResult, ad as ResolvedActiveBackend, ae as RoutableBackendSession, af as RoutableSandbox, ag as RoutingSandboxSession, ah as RoutingSandboxSessionDeps, ai as RoutingTransitionEvent, aj as RoutingUnsupportedError, ak as SELFHOSTED_DEFAULT_TIMEOUT_MS, al as SELFHOSTED_DRAINING_MAX_RETRIES, am as SELFHOSTED_EXEC_DRAINING_MAX_RETRIES, an as SELFHOSTED_IDEMPOTENT_READONLY_OPS, ao as SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES, ap as SELFHOSTED_NEVER_SENT_MAX_RETRIES, aq as SELFHOSTED_RECONNECT_WINDOW_MS, ar as SELFHOSTED_RELAY_STREAM_PATH, as as SELFHOSTED_RETRY_BACKOFF_BASE_MS, at as SELFHOSTED_RETRY_BACKOFF_CAP_MS, au as SELFHOSTED_RETRY_BACKOFF_FACTOR, av as SELFHOSTED_TIMEOUT_MAX_RETRIES, aw as STREAM_PORT, ax as STREAM_TOKEN_DEFAULT_TTL_SECONDS, ay as SandboxChannelAService, az as SandboxChannelAServiceOptions, aA as SandboxConfigError, aB as SandboxCreatedCallback, aC as SandboxProviderUnavailableError, aD as SandboxResumeStateUnavailableError, aE as SelfhostedApplyDiff, aF as SelfhostedControlError, aG as SelfhostedEditor, aH as SelfhostedEnrollment, aI as SelfhostedExecArgs, aJ as SelfhostedExecResult, aK as SelfhostedImageOutput, aL as SelfhostedLivenessState, aM as SelfhostedNegotiationInput, aN as SelfhostedOpObservation, aO as SelfhostedOpObserver, aP as SelfhostedOpStreamDeps, aQ as SelfhostedRelayConfig, aR as SelfhostedRetryClock, aS as SelfhostedRetryDecision, aT as SelfhostedSandboxClient, aU as SelfhostedSession, aV as SelfhostedSessionBuild, aW as SelfhostedSessionDeps, aX as SelfhostedSessionState, aY as SelfhostedUnavailableReason, aZ as StartRecordingInput, a_ as StreamPortUnavailableError, a$ as SwapTargetEstablishability, b0 as TERMINAL_SERVER_TIMEOUT_MS, b1 as TerminalServerError, b2 as TerminalServerUnsupportedError, b3 as agentErrorToControlError, b4 as assertDescriptorRegistryInvariants, b5 as assertProviderRegistryInvariants, b6 as assertSafeRelPath, b7 as backendSupportsOs, b8 as buildDisplayStackScript, b9 as buildSelfhostedBackendSession, ba as buildStreamUrl, bb as buildTerminalServerScript, bc as contentTypeForCodec, bd as createSandboxClient, be as createSandboxClientForBackend, bf as decideSelfhostedRetry, bg as decodeModalSnapshotId, bh as defaultSelfhostedRetryClock, bi as deletePriorPersistedSnapshot, bj as deleteRecordingArtifacts, bk as deserializeSandboxSessionStateEnvelope, bl as desktopCapableBackend, bm as drainingExhaustedError, bn as drainingMessage, bo as ensureDisplayStack, bp as ensureModalRegistryImage, bq as ensureTerminalServer, br as establishSandboxSessionFromEnvelope, bs as execDeadlineHint, bt as exposeStreamPort, bu as extForCodec, bv as inspectRecordingArtifact, bw as isExecSessionLostBanner, bx as isProviderSandboxNotFoundError, by as isSelfhostedProviderNotFoundError, bz as isWorkspaceEscapeError, bA as makeActiveBackendResolver, bB as mintStreamToken, bC as modalSandboxAttributionEnvironment, bD as modalSandboxAttributionTags, bE as negotiateCapabilities, bF as negotiateSelfhostedCapabilities, bG as nextDurableOpId, bH as offlineAgentError, bI as offlineControlResponse, bJ as opAckSubject, bK as opFrameSubject, bL as parseExecBannerSessionId, bM as parseNumstatZ, bN as parsePorcelainV2, bO as parseUnifiedPatch, bP as payloadTooLargeMessage, bQ as readWorkspaceArchiveFromEnvelopeSessionState, bR as recordingStorageKey, bS as renderSelfhostedFault, bT as restoredSandboxSessionStateFromEntry, bU as runWithToolCallCorrelation, bV as sandboxStateEntryFromRunState, bW as sanitizeOpIdToken, bX as selectBackend, bY as selfhostedFaultClass, bZ as selfhostedLiveness, b_ as selfhostedRetryBackoffMs, b$ as serializeEstablishedSandboxEnvelope, c0 as setSelfhostedApplyDiff, c1 as startRecording, c2 as stopRecording, c3 as stripExecBanner, c4 as subjectFor, c5 as swapTargetEstablishability, c6 as sweepModalOrphanSandboxes, c7 as tagModalSandbox, c8 as tearDownDisplayStack, c9 as tearDownTerminalServer, ca as terminateModalSandboxById, cb as timeoutAgentError, cc as timeoutControlResponse, cd as uploadRecordingArtifact, ce as verifyStreamToken } from './index-DIiiwQY2.js';
+import { R as RunCredentialSessionReady, a as RuntimeMetricsHooks } from './index-D6yi-JcU.js';
+export { A as ActiveBackendResolverDeps, b as ActiveBackendUnresolvableError, c as ActivePointer, B as BackendUnresolvableCode, C as ChannelAConflictError, d as ChannelAEmitter, e as ChannelAExecArgs, f as ChannelAExecResult, g as ChannelANotFoundError, h as ChannelASession, i as ChannelAUnavailableError, j as ChannelAUnsupportedError, k as ChannelAValidationError, l as ControlRpc, D as DEFAULT_DESKTOP_GEOMETRY, m as DISPLAY_STACK_TIMEOUT_MS, n as DesktopGeometry, o as DisplayStackError, p as DisplayStackUnsupportedError, E as EnsureDisplayStackOptions, q as EnsureDisplayStackResult, r as EnsureTerminalServerOptions, s as EnsureTerminalServerResult, t as EstablishedSandboxSession, u as ExposeStreamPortInput, v as ExposeStreamPortResult, w as ExposedPortEndpoint, F as FAULT_FIELD_WHAT_HAPPENED, x as FAULT_FIELD_WHAT_PRESERVED, y as FAULT_FIELD_WHAT_TO_TRY, z as FAULT_FIELD_WHICH_LAYER, L as LiveModalSandboxLeaseAttribution, M as MaterializeRunCredentialsOptions, G as MintStreamTokenInput, H as MockAgentResponder, I as MockAgentResponderOptions, J as MockExecHandler, K as ModalModuleLoader, N as ModalOrphanSweepResult, O as ModalSandboxAttribution, P as NEVER_SENT_DETAIL_KEY, Q as NatsControlRpc, S as NatsOpStreamConnection, T as NatsOpStreamTransport, U as NatsRequestConnection, V as NegotiationContext, W as NormalizedRunCredentialMaterial, X as NumstatEntry, Y as OP_STREAM_ACK_INTERVAL_MS, Z as OP_STREAM_DEFAULT_WINDOW_BYTES, _ as OP_STREAM_RECONNECT_HOLD_MS, $ as OP_STREAM_SILENCE_TIMEOUT_MS, a0 as OpStreamExecOutcome, a1 as OpStreamJournal, a2 as OpStreamSubscription, a3 as OpStreamTransport, a4 as OpStreamUnavailableError, a5 as PROVIDER_REGISTRY, a6 as ProviderConstructionContext, a7 as ProviderRegistration, a8 as REPOSITORY_DISCOVERY_LIMIT, a9 as RecordingArtifactMetadata, aa as RecordingCodec, ab as RecordingContentType, ac as RecordingError, ad as RecordingProcess, ae as RecordingUnavailableError, af as RepositoryDiscoveryDegradedReason, ag as RepositoryDiscoveryResult, ah as ResolvedActiveBackend, ai as RoutableBackendSession, aj as RoutableSandbox, ak as RoutingSandboxSession, al as RoutingSandboxSessionDeps, am as RoutingTransitionEvent, an as RoutingUnsupportedError, ao as RunCredentialCommandRunner, ap as RunCredentialCommandSession, aq as RunCredentialExpectedScope, ar as RunCredentialValidationError, as as SELFHOSTED_DEFAULT_TIMEOUT_MS, at as SELFHOSTED_DRAINING_MAX_RETRIES, au as SELFHOSTED_EXEC_DRAINING_MAX_RETRIES, av as SELFHOSTED_IDEMPOTENT_READONLY_OPS, aw as SELFHOSTED_INFRASTRUCTURE_FAULT_CLASSES, ax as SELFHOSTED_NEVER_SENT_MAX_RETRIES, ay as SELFHOSTED_RECONNECT_WINDOW_MS, az as SELFHOSTED_RELAY_STREAM_PATH, aA as SELFHOSTED_RETRY_BACKOFF_BASE_MS, aB as SELFHOSTED_RETRY_BACKOFF_CAP_MS, aC as SELFHOSTED_RETRY_BACKOFF_FACTOR, aD as SELFHOSTED_TIMEOUT_MAX_RETRIES, aE as STREAM_PORT, aF as STREAM_TOKEN_DEFAULT_TTL_SECONDS, aG as SandboxChannelAService, aH as SandboxChannelAServiceOptions, aI as SandboxConfigError, aJ as SandboxCreatedCallback, aK as SandboxProviderUnavailableError, aL as SandboxResumeStateUnavailableError, aM as SelfhostedApplyDiff, aN as SelfhostedControlError, aO as SelfhostedEditor, aP as SelfhostedEnrollment, aQ as SelfhostedExecArgs, aR as SelfhostedExecResult, aS as SelfhostedImageOutput, aT as SelfhostedLivenessState, aU as SelfhostedNegotiationInput, aV as SelfhostedOpObservation, aW as SelfhostedOpObserver, aX as SelfhostedOpStreamDeps, aY as SelfhostedRelayConfig, aZ as SelfhostedRetryClock, a_ as SelfhostedRetryDecision, a$ as SelfhostedSandboxClient, b0 as SelfhostedSession, b1 as SelfhostedSessionBuild, b2 as SelfhostedSessionDeps, b3 as SelfhostedSessionState, b4 as SelfhostedUnavailableReason, b5 as StartRecordingInput, b6 as StreamPortUnavailableError, b7 as SwapTargetEstablishability, b8 as TERMINAL_SERVER_TIMEOUT_MS, b9 as TerminalServerError, ba as TerminalServerUnsupportedError, bb as ToolspaceTokenPathError, bc as agentErrorToControlError, bd as assertDescriptorRegistryInvariants, be as assertProviderRegistryInvariants, bf as assertSafeRelPath, bg as backendSupportsOs, bh as buildDisplayStackScript, bi as buildSelfhostedBackendSession, bj as buildStreamUrl, bk as buildTerminalServerScript, bl as clearRunCredentials, bm as clearRunCredentialsForAttempt, bn as contentTypeForCodec, bo as createSandboxClient, bp as createSandboxClientForBackend, bq as decideSelfhostedRetry, br as decodeModalSnapshotId, bs as defaultSelfhostedRetryClock, bt as deletePriorPersistedSnapshot, bu as deleteRecordingArtifacts, bv as deserializeSandboxSessionStateEnvelope, bw as desktopCapableBackend, bx as drainingExhaustedError, by as drainingMessage, bz as ensureDisplayStack, bA as ensureModalRegistryImage, bB as ensureTerminalServer, bC as establishSandboxSessionFromEnvelope, bD as execDeadlineHint, bE as exposeStreamPort, bF as extForCodec, bG as inspectRecordingArtifact, bH as isExecSessionLostBanner, bI as isProviderSandboxNotFoundError, bJ as isSelfhostedProviderNotFoundError, bK as makeActiveBackendResolver, bL as materializeRunCredentials, bM as mintStreamToken, bN as modalSandboxAttributionEnvironment, bO as modalSandboxAttributionTags, bP as negotiateCapabilities, bQ as negotiateSelfhostedCapabilities, bR as nextDurableOpId, bS as normalizeRunCredentialsResolution, bT as offlineAgentError, bU as offlineControlResponse, bV as opAckSubject, bW as opFrameSubject, bX as parseExecBannerExitCode, bY as parseExecBannerSessionId, bZ as parseNumstatZ, b_ as parsePorcelainV2, b$ as parseUnifiedPatch, c0 as payloadTooLargeMessage, c1 as readWorkspaceArchiveFromEnvelopeSessionState, c2 as recordingStorageKey, c3 as renderSelfhostedFault, c4 as restoredSandboxSessionStateFromEntry, c5 as runCredentialPointerFile, c6 as runCredentialRoot, c7 as runWithToolCallCorrelation, c8 as sandboxStateEntryFromRunState, c9 as sanitizeOpIdToken, ca as selectBackend, cb as selfhostedFaultClass, cc as selfhostedLiveness, cd as selfhostedRetryBackoffMs, ce as serializeEstablishedSandboxEnvelope, cf as setSelfhostedApplyDiff, cg as startRecording, ch as stopRecording, ci as stripExecBanner, cj as subjectFor, ck as swapTargetEstablishability, cl as sweepModalOrphanSandboxes, cm as tagModalSandbox, cn as tearDownDisplayStack, co as tearDownTerminalServer, cp as terminateModalSandboxById, cq as timeoutAgentError, cr as timeoutControlResponse, cs as toolspaceTokenFileForSession, ct as toolspaceTokenFileFromEnvironment, cu as uploadRecordingArtifact, cv as verifyStreamToken, cw as withRunCredentialEnvironment, cx as withRunCredentialsClient, cy as withRunCredentialsSession, cz as withToolspaceTokenClient, cA as withToolspaceTokenEnvironment, cB as withToolspaceTokenSession } from './index-D6yi-JcU.js';
+export { SkillLibraryEntry, SkillLibraryFile, SkillLibrarySkill, getSkillLibraryEntry, isSkillLibraryEntryId, listSkillLibraryEntries, loadSkillLibrarySkill } from './skill-library.js';
 import 'modal';
 import '@opengeni/agent-proto';
 
+/**
+ * Portable conversation context compaction, following Codex CLI's local path.
+ *
+ * The checkpoint model sees the current active history plus one fixed
+ * checkpoint prompt, then the active history is rebuilt from the newest real
+ * user messages within one cumulative 20k-token budget plus one summary.
+ * Assistant messages, tool calls/results, reasoning, and images are removed
+ * from the active model-facing history; the database audit rows remain.
+ */
+type CompactionItem = Record<string, unknown>;
+/**
+ * Marker stored on the synthetic summary item so the UI can render it and the
+ * next rebuild can exclude old summaries from the retained user-message set.
+ */
+declare const COMPACTION_SUMMARY_MARKER = "opengeni_context_summary";
+declare const SUMMARY_BUFFER_TOKENS = 20000;
+declare const COMPACT_USER_MESSAGE_MAX_TOKENS = 20000;
+declare const DEFAULT_COMPACTION_THRESHOLD_RATIO = 0.9;
+declare const MIN_COMPACTION_THRESHOLD_RATIO = 0.3;
+declare const MAX_COMPACTION_THRESHOLD_RATIO = 0.9;
+declare const COMPACTION_PROMPT: string;
+declare const SUMMARY_PREFIX = "Another language model started to solve this problem and produced a summary of its thinking process. You also have access to the state of the tools that were used by that language model. Use this to build on the work that has already been done and avoid duplicating work. Here is the summary produced by the other language model, use the information in this summary to assist with your own analysis:";
+declare const USER_MESSAGE_TRUNCATION_MARKER = "\n[... middle truncated for context compaction ...]\n";
+/** A user-authored `message` item is the only legal turn boundary. */
+declare function isUserMessage(item: unknown): boolean;
+/** True for our synthetic compaction summary item. */
+declare function isCompactionSummary(item: unknown): boolean;
+/** Platform-authored system context exists for one inference and is never persisted. */
+declare function isEphemeralInternalContext(item: unknown): boolean;
+/** Serialized-item estimate for pre-call accounting and retained user budgets. */
+declare function estimateItemTokens(item: CompactionItem): number;
+declare function estimateTokens(items: readonly CompactionItem[]): number;
+declare function estimateSerializedValueTokens(value: unknown): number;
+type CompleteModelInputFootprint = {
+    input: readonly CompactionItem[];
+    instructionsTokens: number;
+    toolSchemaTokens: number;
+};
+type ProviderContextTokenSignal = {
+    /** Monotonic within one sampled run; advances after every model response. */
+    revision: number;
+    /** Provider total tokens after that response (input + generated output). */
+    totalTokens: number;
+};
+type CompleteModelInputEstimate = {
+    tokens: number;
+    source: "complete_estimate" | "provider_plus_local";
+    inputTokens: number;
+    instructionsTokens: number;
+    toolSchemaTokens: number;
+    appendedAfterModelTokens: number;
+};
+/**
+ * Match Codex history accounting: after one provider response, start from its
+ * authoritative TOTAL token count and add only local items placed after the
+ * newest model-generated item. System instructions and tool schemas are
+ * compared with the exact request footprint that produced the provider count;
+ * positive growth is added. Without a bound anchor, estimate the entire
+ * outgoing request rather than trusting stale usage from an earlier turn.
+ */
+declare function estimateCompleteModelInput(input: {
+    current: CompleteModelInputFootprint;
+    provider?: ProviderContextTokenSignal | null;
+    providerRequestFootprint?: CompleteModelInputFootprint | null;
+}): CompleteModelInputEstimate;
+declare function hasModelGeneratedItem(items: readonly CompactionItem[]): boolean;
+declare function clampCompactionThresholdRatio(value: number | undefined | null): number;
+declare function compactionThresholdTokens(input: {
+    contextWindowTokens: number;
+    contextReservedOutputTokens: number;
+    contextAutoCompactThresholdTokens?: number | null | undefined;
+    contextCompactionThresholdRatio?: number | null | undefined;
+}): number;
+type CompactionDecision = {
+    shouldCompact: boolean;
+    reason: "force" | "above_threshold" | "below_threshold" | "no_history";
+    signalTokens: number;
+    thresholdTokens: number;
+};
+declare function decideCompaction(input: {
+    items: readonly CompactionItem[];
+    lastInputTokens?: number | null;
+    contextWindowTokens: number;
+    contextReservedOutputTokens: number;
+    contextAutoCompactThresholdTokens?: number | null | undefined;
+    contextCompactionThresholdRatio?: number | null | undefined;
+    force?: boolean;
+}): CompactionDecision;
+declare class CompactionNeededError extends Error {
+    readonly signalTokens: number;
+    readonly thresholdTokens: number;
+    readonly signalSource: "provider" | "estimate";
+    readonly trigger: "threshold" | "operator";
+    constructor(input: {
+        signalTokens: number;
+        thresholdTokens: number;
+        signalSource: "provider" | "estimate";
+        trigger?: "threshold" | "operator";
+    });
+}
+declare class EmptyCompactionSummaryError extends Error {
+    readonly diagnostics: Record<string, unknown>;
+    constructor(diagnostics?: Record<string, unknown>);
+}
+/**
+ * The checkpoint model request ended in a provider/transport failure rather
+ * than a successful response with an empty assistant message. Diagnostics are
+ * deliberately bounded and content-free so this error can be persisted on a
+ * turn without copying provider messages or conversation input into events.
+ */
+declare class CompactionProviderResponseError extends Error {
+    readonly diagnostics: Record<string, unknown>;
+    readonly status?: number;
+    readonly code?: string;
+    readonly type?: string;
+    readonly cause?: unknown;
+    constructor(diagnostics?: Record<string, unknown>, cause?: unknown);
+}
+declare function findCompactionNeededError(error: unknown, seen?: WeakSet<object>): CompactionNeededError | null;
+/**
+ * The exact checkpoint input shape: current active history followed by Codex's
+ * checkpoint prompt as a synthesized user message.
+ */
+declare function buildCompactionPromptInput(items: readonly CompactionItem[]): CompactionItem[];
+type PreparedCompactionPromptInput = {
+    input: CompactionItem[];
+    estimatedInputTokens: number;
+    rewrittenToolOutputs: number;
+    droppedHistoryItems: number;
+};
+/**
+ * Fit the explicit checkpoint request without mutating canonical history.
+ *
+ * Codex first replaces oversized tool outputs in its temporary remote-
+ * compaction input. OpenGeni does the same oldest-first, preserving the most
+ * recent tool detail for the plaintext summary. If that is still insufficient,
+ * whole oldest user-delimited work units are removed and the remaining suffix
+ * is protocol-sanitized so no call/result/reasoning fragment is orphaned.
+ * The raw active history is still the source for the eventual replacement and
+ * remains unchanged if the provider call fails.
+ */
+declare function prepareCompactionPromptInput(items: readonly CompactionItem[], maxInputTokens: number): PreparedCompactionPromptInput;
+/**
+ * Build the active history after compaction:
+ * the newest real user messages that fit one cumulative 20k-token budget
+ * (prior summaries excluded, images removed) plus one marked summary item.
+ */
+declare function buildCompactionReplacementHistory(items: readonly CompactionItem[], summaryBody: string): CompactionItem[];
+declare function compactionReplacementFingerprint(items: readonly CompactionItem[]): string;
+/** Fingerprint the latest durable replacement prefix in active history. */
+declare function latestCompactionReplacementFingerprint(items: readonly CompactionItem[]): string | null;
+/**
+ * Build the synthetic summary item (a plain user message) appended to the
+ * rebuilt active history.
+ */
+declare function buildSummaryItem(summaryBody: string): CompactionItem;
+declare function renderCompactionPromptInputForChat(input: readonly CompactionItem[]): string;
+
+type CommandCancellationSession = {
+    cancelExecCommand?(opId: string): Promise<boolean>;
+    supportsPty?(): boolean;
+};
+type TurnSandboxCommandArgs = {
+    cmd: string;
+    workdir?: string;
+    shell?: string;
+    login?: boolean;
+    tty?: boolean;
+    yieldTimeMs?: number;
+    maxOutputTokens?: number;
+    runAs?: string;
+};
+type TurnSandboxCommandSession = CommandCancellationSession & {
+    exec?(args: TurnSandboxCommandArgs): Promise<unknown>;
+    execCommand?(args: TurnSandboxCommandArgs): Promise<string>;
+    writeStdin?(args: {
+        sessionId: number;
+        chars?: string;
+        yieldTimeMs?: number;
+        maxOutputTokens?: number;
+    }): Promise<string>;
+};
+/**
+ * The worker may publish an attempt-quiesced receipt only after this fence
+ * resolves. `cancel()` prevents new turn-owned sandbox calls, actively stops
+ * shell processes, and `waitForQuiescence()` drains every capability call that
+ * was already in flight. Cleanup/telemetry outside the sandbox capability set
+ * remains independently attempt-fenced.
+ */
+type TurnToolCancellationFence = {
+    cancel(reason?: unknown): void;
+    waitForQuiescence(): Promise<void>;
+    runSandboxCommand(session: TurnSandboxCommandSession, args: TurnSandboxCommandArgs): Promise<unknown>;
+};
+
 type ComputerButton = "left" | "right" | "wheel" | "back" | "forward";
 type SandboxComputerOptions = {
     display?: string;
@@ -222,7 +418,7 @@ declare function elideSupersededViewImagePairs<T extends HistoryItem>(items: rea
  * types exist with that id, the call appearing before the result. Calls and
  * results that satisfy that survive untouched.
  */
-declare function sanitizeHistoryItemsForModel<T extends HistoryItem>(items: readonly T[]): T[];
+declare function sanitizeHistoryItemsForModel<T extends HistoryItem>(items: readonly T[], toolOutputTruncationTokens?: number): T[];
 /**
  * Drop the account/org-bound `reasoning.encrypted_content` blob from a single
  * history item, preserving everything else (the visible chain-of-thought text in
@@ -312,94 +508,6 @@ declare function stripReasoningIdentityFromSerializedRunState(serialized: string
  */
 declare function neutralizeToolSearchItemsInSerializedRunState(serialized: string): string;
 
-/**
- * Portable conversation context compaction, following Codex CLI's local path.
- *
- * The checkpoint model sees the current active history plus one fixed
- * checkpoint prompt, then the active history is rebuilt from the newest real
- * user messages within one cumulative 20k-token budget plus one summary.
- * Assistant messages, tool calls/results, reasoning, and images are removed
- * from the active model-facing history; the database audit rows remain.
- */
-type CompactionItem = Record<string, unknown>;
-/**
- * Marker stored on the synthetic summary item so the UI can render it and the
- * next rebuild can exclude old summaries from the retained user-message set.
- */
-declare const COMPACTION_SUMMARY_MARKER = "opengeni_context_summary";
-declare const SUMMARY_BUFFER_TOKENS = 20000;
-declare const COMPACT_USER_MESSAGE_MAX_TOKENS = 20000;
-declare const DEFAULT_COMPACTION_THRESHOLD_RATIO = 0.9;
-declare const MIN_COMPACTION_THRESHOLD_RATIO = 0.3;
-declare const MAX_COMPACTION_THRESHOLD_RATIO = 0.9;
-declare const COMPACTION_PROMPT: string;
-declare const SUMMARY_PREFIX = "Another language model started to solve this problem and produced a summary of its thinking process. You also have access to the state of the tools that were used by that language model. Use this to build on the work that has already been done and avoid duplicating work. Here is the summary produced by the other language model, use the information in this summary to assist with your own analysis:";
-declare const USER_MESSAGE_TRUNCATION_MARKER = "\n[... middle truncated for context compaction ...]\n";
-/** A user-authored `message` item is the only legal turn boundary. */
-declare function isUserMessage(item: unknown): boolean;
-/** True for our synthetic compaction summary item. */
-declare function isCompactionSummary(item: unknown): boolean;
-/** Platform-authored system context exists for one inference and is never persisted. */
-declare function isEphemeralInternalContext(item: unknown): boolean;
-/**
- * Rough token estimate for an item: char/4 over its serialized text. Used for
- * the pre-first-call signal and the retained user-message budget.
- */
-declare function estimateItemTokens(item: CompactionItem): number;
-declare function estimateTokens(items: readonly CompactionItem[]): number;
-declare function clampCompactionThresholdRatio(value: number | undefined | null): number;
-declare function compactionThresholdTokens(input: {
-    contextWindowTokens: number;
-    contextReservedOutputTokens: number;
-    contextAutoCompactThresholdTokens?: number | null | undefined;
-    contextCompactionThresholdRatio?: number | null | undefined;
-}): number;
-type CompactionDecision = {
-    shouldCompact: boolean;
-    reason: "force" | "above_threshold" | "below_threshold" | "no_history";
-    signalTokens: number;
-    thresholdTokens: number;
-};
-declare function decideCompaction(input: {
-    items: readonly CompactionItem[];
-    lastInputTokens?: number | null;
-    contextWindowTokens: number;
-    contextReservedOutputTokens: number;
-    contextAutoCompactThresholdTokens?: number | null | undefined;
-    contextCompactionThresholdRatio?: number | null | undefined;
-    force?: boolean;
-}): CompactionDecision;
-declare class CompactionNeededError extends Error {
-    readonly signalTokens: number;
-    readonly thresholdTokens: number;
-    readonly signalSource: "provider" | "estimate";
-    readonly trigger: "threshold" | "operator";
-    constructor(input: {
-        signalTokens: number;
-        thresholdTokens: number;
-        signalSource: "provider" | "estimate";
-        trigger?: "threshold" | "operator";
-    });
-}
-declare function findCompactionNeededError(error: unknown, seen?: WeakSet<object>): CompactionNeededError | null;
-/**
- * The exact checkpoint input shape: current active history followed by Codex's
- * checkpoint prompt as a synthesized user message.
- */
-declare function buildCompactionPromptInput(items: readonly CompactionItem[]): CompactionItem[];
-/**
- * Build the active history after compaction:
- * the newest real user messages that fit one cumulative 20k-token budget
- * (prior summaries excluded, images removed) plus one marked summary item.
- */
-declare function buildCompactionReplacementHistory(items: readonly CompactionItem[], summaryBody: string): CompactionItem[];
-/**
- * Build the synthetic summary item (a plain user message) appended to the
- * rebuilt active history.
- */
-declare function buildSummaryItem(summaryBody: string): CompactionItem;
-declare function renderCompactionPromptInputForChat(input: readonly CompactionItem[]): string;
-
 type UsageDetails = Record<string, unknown> | Array<Record<string, unknown>>;
 type ModelCallUsageTelemetry = {
     inputTokens: number | null;
@@ -445,9 +553,11 @@ type ResolveConnectionCredentialResult = {
     status: "auth_needed";
     reason: ToolAuthNeededPayload["reason"];
     providerDomain: string;
+    provider?: string;
     connectionId?: string;
     scopes?: string[];
     resource?: string;
+    selectedResources?: McpServerConnectionRef["selectedResources"];
     authorizationUrl?: string;
 };
 declare function ensureReadableStreamFrom(): void;
@@ -465,11 +575,20 @@ type AgentSegmentInput = {
     approvalId: string;
     decision: "approve" | "reject";
     message?: string;
+} | {
+    kind: "human_input";
+    serializedRunState: string;
+    toolCallId: string;
 };
 type PreparedAgentInput = {
     input: string | AgentInputItem[] | RunState<any, any>;
     sandboxSessionState?: SandboxSessionState;
 };
+declare const HUMAN_INPUT_TOOL_NAME = "request_human_input";
+type SerializedHumanInputInterruption = {
+    toolCallId: string;
+    input: ReturnType<typeof RequestHumanInputToolInput.parse>;
+};
 type SandboxFileDownload = {
     fileId: string;
     mountPath: string;
@@ -499,6 +618,7 @@ type OpenGeniRuntime = {
     prepareInput: (agent: Agent<any, any>, input: AgentSegmentInput, options?: PrepareInputOptions) => Promise<PreparedAgentInput>;
     runStream: (agent: Agent<any, any>, input: PreparedAgentInput, settings: Settings, options?: RunAgentStreamOptions) => Promise<Awaited<ReturnType<typeof runAgentStream>>>;
     serializeApprovals: (interruptions: unknown[]) => unknown[];
+    serializeHumanInputRequests?: (interruptions: unknown[]) => SerializedHumanInputInterruption[];
 };
 type ProductionRuntimeOverrides = {
     model?: Model;
@@ -615,6 +735,10 @@ declare function summarizeForCompaction(settings: Settings, input: Array<Record<
     systemInstructions?: string;
     onUsage?: (usage: ModelResponseUsage) => void | Promise<void>;
 }): Promise<string>;
+/** Bounded provider diagnostics: identifiers and classifications, never messages or model data. */
+declare function compactionProviderFailureDiagnostics(error: unknown): Record<string, unknown>;
+/** Bounded, content-free diagnostics for a semantically empty checkpoint. */
+declare function compactionResponseDiagnostics(response: unknown, extractedText?: string): Record<string, unknown>;
 /**
  * Pull the assistant text out of a Responses API result, shape-tolerant. Only
  * `role === "assistant"` message items contribute: a provider whose Responses
@@ -625,9 +749,39 @@ declare function summarizeForCompaction(settings: Settings, input: Array<Record<
  */
 declare function extractResponseOutputText(response: unknown): string;
 type GitTokenSeeds = Partial<Record<GitCredentialProvider, string>>;
+type GitCredentialBindingSeed = {
+    credentialBindingId: string;
+    provider: GitCredentialProvider;
+    token: string;
+    expiresAt?: string;
+    /** Total active bindings for this provider, used to suppress unsafe aliases. */
+    providerBindingCount?: number;
+};
 type GitCredentialTokenWriterSession = SandboxSessionLike;
+type ToolspaceTokenWriterSession = SandboxSessionLike;
+type EffectiveSkillSelection = Readonly<{
+    id: string;
+    name: string;
+    source: "bundled" | "library" | "pack";
+    version: string | null;
+    contentSha256: string | null;
+    reason: string;
+}>;
+/**
+ * Read-only, secret-free skill provenance for an already-built agent. This is
+ * intentionally separate from the model instructions and sandbox manifest so
+ * effective configuration inspection cannot accidentally expose credentials or
+ * turn skill activation into an authorization change.
+ */
+declare function effectiveSkillSelectionsForAgent(agent: object): readonly EffectiveSkillSelection[];
 type BuildAgentOptions = {
     model?: Model;
+    /** Settled response for the one internal human-input interruption resumed by this run. */
+    humanInputResponse?: {
+        requestId: string;
+        toolCallId: string;
+        response: HumanInputResponse;
+    };
     reasoningEffort?: ReasoningEffort;
     hostedWebSearch?: boolean;
     encryptedReasoning?: boolean;
@@ -653,12 +807,29 @@ type BuildAgentOptions = {
     rigCredentialHookIds?: string[];
     gitTokenSeed?: string;
     gitTokenSeeds?: GitTokenSeeds;
+    gitCredentialBindings?: GitCredentialBindingSeed[];
     toolspaceTokenSeed?: string;
+    toolspaceTokenSessionId?: string;
     genesisTitleHint?: boolean;
     persistentSessionSettings?: PersistentSessionSettings;
     instructionsTemplate?: string;
     sessionInstructions?: string;
+    turnInstructions?: string;
     packSkills?: PackSkill[];
+    skillLibrarySkills?: PackSkill[];
+    skillLibrarySelections?: EffectiveSkillSelection[];
+    /**
+     * Internal per-attempt cancellation boundary. The worker supplies Temporal's
+     * signal so an in-flight shell process is interrupted immediately instead of
+     * holding Steer/Pause behind its requested yield or natural exit.
+     */
+    turnCancellationSignal?: AbortSignal;
+    /**
+     * Receives the physical sandbox-tool fence at agent construction time. A
+     * cancelled/fenced worker attempt must await it before publishing its durable
+     * attempt-quiesced receipt.
+     */
+    onToolCancellationFence?: (fence: TurnToolCancellationFence) => void;
 };
 type PackSkillFile = {
     path: string;
@@ -684,7 +855,6 @@ type WorkspaceEnvironmentContext = {
 };
 type PersistentSessionSettings = {
     titleIsSet: boolean;
-    childNotificationsMode?: "digest" | "passive";
 };
 /**
  * The rig a session rides (M3): its name + the active version pinned onto the
@@ -728,6 +898,8 @@ declare function composeAgentInstructions(template: string, workspaceEnvironment
  * is a no-op that returns the composed string byte-for-byte.
  */
 declare function appendSessionInstructions(composed: string, sessionInstructions?: string): string;
+/** Append system instructions that apply to this exact turn only. */
+declare function appendTurnInstructions(composed: string, turnInstructions?: string): string;
 /**
  * Append the durable session metadata the model otherwise cannot observe.
  * This is deliberately declarative and excludes the title text: the title is
@@ -809,9 +981,12 @@ declare function buildOpenGeniAgent(settings: Settings, resources: ResourceRef[]
  */
 declare function withStructuredViewImageFunctionResults(tools: Tool<unknown>[]): Tool<unknown>[];
 declare function buildAgentCapabilities(settings: Settings, packSkills: PackSkill[], options?: {
+    skillLibrarySkills?: PackSkill[];
     structuredToolTransport?: boolean;
     computerToolMode?: ComputerToolMode;
     onComputerUseReady?: (session: SandboxSessionLike) => Promise<void>;
+    turnCancellationSignal?: AbortSignal;
+    onToolCancellationFence?: (fence: TurnToolCancellationFence) => void;
 }): ReturnType<typeof Capabilities.default>;
 declare function sandboxRunAs(_settings: Settings): string | undefined;
 type PreparedAgentTools = {
@@ -824,6 +999,8 @@ type PrepareToolsOptions = {
     workspaceId?: string;
     sessionId?: string;
     turnId?: string;
+    attemptId?: string;
+    executionGeneration?: number;
     subjectId?: string;
     subjectLabel?: string;
     firstPartyPermissions?: Permission[];
@@ -837,12 +1014,17 @@ type PrepareInputOptions = {
 };
 declare function prepareRunInput(agent: Agent<any, any>, input: AgentSegmentInput, options?: PrepareInputOptions): Promise<PreparedAgentInput>;
 type RunAgentStreamOptions = {
+    /** Abort the provider/tool loop when the owning activity is cancelled. */
+    signal?: AbortSignal;
     sandboxClient?: unknown;
     sandboxEnvironment?: Record<string, string>;
     onRuntimeEvent?: (event: NormalizedRuntimeEvent) => Promise<void> | void;
-    contextCompactionSignalTokens?: () => number | null | undefined;
+    contextCompactionSignal?: () => ProviderContextTokenSignal | null | undefined;
     contextCompactionRequested?: () => boolean | Promise<boolean>;
     onGitCredentialSessionReady?: (session: GitCredentialTokenWriterSession) => Promise<void> | void;
+    onToolspaceTokenSessionReady?: (session: ToolspaceTokenWriterSession) => Promise<void> | void;
+    runCredentialSessionId?: string;
+    onRunCredentialSessionReady?: RunCredentialSessionReady;
     ownedSandbox?: {
         client: unknown;
         session: unknown;
@@ -851,10 +1033,17 @@ type RunAgentStreamOptions = {
         fileDownloadsMaterialized?: boolean;
         deferredSetup?: boolean;
     };
+    /**
+     * The attempt's authoritative physical sandbox-operation fence. Platform
+     * lifecycle commands use its command runner too, so Steer/Pause can interrupt
+     * repository clone, rig setup, file materialization, and credential seeding
+     * before the attempt-quiesced receipt opens queue admission.
+     */
+    turnToolCancellationFence?: TurnToolCancellationFence;
     callModelInputFilter?: CallModelInputFilter;
 };
 type ContextRobustnessFilterOptions = {
-    contextCompactionSignalTokens?: () => number | null | undefined;
+    contextCompactionSignal?: () => ProviderContextTokenSignal | null | undefined;
     contextCompactionRequested?: () => boolean | Promise<boolean>;
     throwOnCompactionNeeded?: boolean;
 };
@@ -867,7 +1056,7 @@ declare const GENESIS_TITLE_DIRECTIVE = "This is the first turn of a new session
  * fails: a retry/recovery must continue the task, not restart setup.
  */
 declare function oneShotGenesisTitleInputFilter(): CallModelInputFilter;
-declare const TOOLSPACE_PROGRAMMATIC_DIRECTIVE = "Every tool on your MCP surface is also callable programmatically from the sandbox shell, so scripts can invoke tools without a model round trip per call. Run `ogtool list` to see the available tools and their input schemas (from tools/list), then `ogtool call <tool-name> '<json-args>'`; equivalently, POST MCP JSON-RPC to $OPENGENI_TOOLSPACE_URL with the bearer token read from $OPENGENI_TOOLSPACE_TOKEN_FILE. Prefer programmatic calls for loops, polling, and bulk filtering: their results stay in the sandbox and do not consume your context window. Tools that require human approval must still be invoked normally \u2014 called programmatically they return a typed error.";
+declare const TOOLSPACE_PROGRAMMATIC_DIRECTIVE = "Every tool on your MCP surface is also callable programmatically from the sandbox shell, so scripts can invoke tools without a model round trip per call. If `ogtool` is installed, run `ogtool list` to see the available tools and their input schemas (from tools/list), then `ogtool call <tool-name> '<json-args>'`. If it is absent and both npm and $OPENGENI_OGTOOL_PACKAGE_SPEC are available, run the exact deployment-pinned package with `npm exec --yes --package=\"$OPENGENI_OGTOOL_PACKAGE_SPEC\" -- ogtool ...`; never guess a version or install `latest`. Otherwise POST MCP JSON-RPC directly to $OPENGENI_TOOLSPACE_URL with the bearer token read from $OPENGENI_TOOLSPACE_TOKEN_FILE. Prefer programmatic calls for loops, polling, and bulk filtering: their results stay in the sandbox and do not consume your context window. Tools that require human approval must still be invoked normally \u2014 called programmatically they return a typed error.";
 /**
  * callModelInputFilter that removes provider-assigned item ids (rs_/msg_/fc_…)
  * from every input item immediately before each model call. Responses-API
@@ -903,6 +1092,12 @@ declare const normalizeComputerCallsFilter: CallModelInputFilter;
  * information and can otherwise balloon every following model request.
  */
 declare const elideSupersededViewImagesFilter: CallModelInputFilter;
+/**
+ * Canonical Codex-style tool-result bound at the final model-input seam. The
+ * identical pure normalizer also runs before conversation rows are persisted,
+ * so this is a live-turn defense rather than a request-only alternate history.
+ */
+declare function boundModelToolOutputsFilterForSettings(settings: Settings): CallModelInputFilter;
 declare function contextRobustnessFilterForSettings(settings: Settings, options?: ContextRobustnessFilterOptions): CallModelInputFilter;
 /**
  * The model-input filter applied before every model call. The computer_call
@@ -985,25 +1180,19 @@ declare function runOwnedSandboxSetup(agent: Agent<any, any>, session: SandboxSe
     onRuntimeEvent?: SandboxLifecycleHookContext["onRuntimeEvent"];
     gitTokenSeedsOverride?: GitTokenSeeds;
     gitTokenSeedOverride?: string;
+    gitCredentialBindingsOverride?: GitCredentialBindingSeed[];
+    toolspaceTokenSeedOverride?: string;
+    commandRunner?: SandboxLifecycleCommandRunner;
 }): Promise<void>;
-declare function withSandboxFileDownloads(client: SandboxClient, downloads: SandboxFileDownload[], context?: Pick<SandboxLifecycleHookContext, "onRuntimeEvent" | "runAs">): SandboxClient;
-declare function materializeSandboxFileDownloads(session: SandboxSessionLike, downloads: SandboxFileDownload[], context?: Pick<SandboxLifecycleHookContext, "onRuntimeEvent" | "runAs">): Promise<SandboxFileDownloadMaterializationResult>;
+declare function withSandboxFileDownloads(client: SandboxClient, downloads: SandboxFileDownload[], context?: Pick<SandboxLifecycleHookContext, "onRuntimeEvent" | "runAs" | "commandRunner">): SandboxClient;
+declare function materializeSandboxFileDownloads(session: SandboxSessionLike, downloads: SandboxFileDownload[], context?: Pick<SandboxLifecycleHookContext, "onRuntimeEvent" | "runAs" | "commandRunner">): Promise<SandboxFileDownloadMaterializationResult>;
 declare function sandboxFileDownloadFailureNote(failures: SandboxFileDownloadFailure[]): string;
 declare function sandboxFileDownloadsForAgent(agent: unknown): SandboxFileDownload[];
 /**
- * Compact a tool-call output for the `agent.toolCall.output` SESSION EVENT so it
- * never carries a raw binary payload. The codex-path `computer_screenshot` function
- * tool returns a structured `{type:'image', image:{data: Uint8Array, mediaType}}`;
- * captured verbatim its `Uint8Array` JSON-serializes as an object-of-numbers (~12.7MB
- * per screenshot in session_events — ~10x the base64 form). This mirrors the desktop
- * screenshot to the SAME compact `data:<mediaType>;base64,…` STRING the HOSTED
- * `computer_call` event already carries (agents-core sets its output to that data-URL),
- * so both computer-use transports emit one representation. The full data-URL is kept
- * (not truncated) because the web timeline RENDERS the screenshot from this event
- * payload — packages/react/src/timeline/tool-renderers.tsx ComputerCallRenderer
- * (`out.startsWith("data:image")` → <ScreenshotFigure src={out}/>) and ViewImageRenderer.
- * Non-image outputs (text strings, MCP `{isError,content}` objects, hosted computer_call
- * data-URL strings) pass through unchanged.
+ * Normalize a tool-call output for the lossy `agent.toolCall.output` audit event.
+ * Inline image bytes/data URLs become a compact `media_preview` with exact byte
+ * length where knowable and `fullOutputAvailable:false`. The model-facing output
+ * is not changed here, and mixed arrays retain their non-image text/error facts.
  */
 declare function normalizeToolOutputForEvent(output: unknown): unknown;
 declare function normalizeSdkEvent(event: RunStreamEvent): NormalizedRuntimeEvent[];
@@ -1011,16 +1200,21 @@ declare function modelResponseUsageFromSdkEvent(event: RunStreamEvent): ModelRes
 /** Normalize usage from either a Responses or Chat Completions result. */
 declare function modelResponseUsageFromResponse(response: unknown): ModelResponseUsage | null;
 declare function serializeApprovals(interruptions: unknown[]): unknown[];
+declare function serializeHumanInputRequests(interruptions: unknown[]): SerializedHumanInputInterruption[];
 declare function buildManifest(settings: Settings, resources: ResourceRef[], environment?: Record<string, string>, fileResourceDownloads?: SandboxFileDownload[]): Manifest;
 type SandboxLifecycleHookPhase = "beforeAgentStart";
+type SandboxLifecycleCommandRunner = (session: TurnSandboxCommandSession, args: TurnSandboxCommandArgs) => Promise<unknown>;
 type SandboxLifecycleHookContext = {
     environment: Record<string, string>;
     onRuntimeEvent?: (event: NormalizedRuntimeEvent) => Promise<void> | void;
     runAs?: string;
     gitTokenSeed?: string;
     gitTokenSeeds?: GitTokenSeeds;
+    gitCredentialBindings?: GitCredentialBindingSeed[];
     toolspaceTokenSeed?: string;
+    toolspaceTokenFile?: string;
     rigSetup?: RigSetupDescriptor;
+    commandRunner?: SandboxLifecycleCommandRunner;
 };
 type RigSetupDescriptor = {
     rigId: string;
@@ -1070,6 +1264,7 @@ declare function withSandboxLifecycleHooks(client: SandboxClient, hooks: Sandbox
 declare function repositoryUsesSandboxClone(settings: Settings, resource: Extract<ResourceRef, {
     kind: "repository";
 }>, activeSandboxBackend?: Settings["sandboxBackend"]): boolean;
+declare function gitCredentialBindingHash(credentialBindingId: string): string;
 /**
  * Build the off-manifest command used to atomically replace provider token files.
  *
@@ -1079,14 +1274,29 @@ declare function repositoryUsesSandboxClone(settings: Settings, resource: Extrac
  * manifest environment or rebuilding the sandbox.
  */
 declare function gitProviderTokenRefreshCommand(seeds: GitTokenSeeds): string;
+declare function gitCredentialBindingTokenRefreshCommand(bindings: GitCredentialBindingSeed[]): string;
 declare function refreshGitProviderTokenFiles(session: GitCredentialTokenWriterSession, seeds: GitTokenSeeds, options?: {
     runAs?: string;
+    commandRunner?: SandboxLifecycleCommandRunner;
+}): Promise<void>;
+declare function refreshGitCredentialBindingTokenFiles(session: GitCredentialTokenWriterSession, bindings: GitCredentialBindingSeed[], options?: {
+    runAs?: string;
+    commandRunner?: SandboxLifecycleCommandRunner;
 }): Promise<void>;
 declare function repositoryCloneCommand(resources: Extract<ResourceRef, {
     kind: "repository";
-}>[]): string;
-declare function toolspaceTokenSeedCommand(): string;
+}>[], bindings?: GitCredentialBindingSeed[]): string;
+declare function toolspaceTokenSeedCommand(options?: {
+    tokenFile?: string;
+    legacyTokenFile?: string;
+}): string;
 declare function runToolspaceTokenSeedHook(session: SandboxSessionLike, context: SandboxLifecycleHookContext): Promise<void>;
+declare function refreshToolspaceTokenFile(session: ToolspaceTokenWriterSession, token: string, options?: {
+    runAs?: string;
+    commandRunner?: SandboxLifecycleCommandRunner;
+    tokenFile?: string;
+    legacyTokenFile?: string;
+}): Promise<void>;
 /**
  * The rig-setup command (M3). One idempotent bash program:
  *   1. `mkdir -p /var/opengeni` and, if the per-version marker already exists,
@@ -1124,14 +1334,15 @@ declare function sandboxCommandStillRunning(result: unknown): boolean;
 declare function runAzureCliLoginHook(session: SandboxSessionLike, context?: SandboxLifecycleHookContext): Promise<void>;
 declare function azureOpenAIDefaultQuery(settings: Pick<Settings, "azureOpenaiApiVersion">, baseURL: string): Record<string, string> | undefined;
 /**
- * The skill source fed to the SDK Skills capability. Without pack skills this
- * is the plain bundled local-dir source, byte-for-byte the pre-pack behavior.
- * With pack skills it becomes a single in-memory dir source combining bundled
- * skill directories (as local_dir entries the SDK materializes lazily) with
- * pack skill directories built from manifest-carried file content — one skill
- * index, one `## Skills` instruction section, lazy `load_skill` for all of
- * them. A pack skill shadows a bundled skill with the same directory name.
+ * The skill source fed to the SDK Skills capability. Without pack or curated
+ * skills this is the plain bundled local-dir source, byte-for-byte the
+ * pre-pack behavior. With either selected source it becomes a single
+ * in-memory dir source combining bundled skill directories (as local_dir
+ * entries the SDK materializes lazily) with selected in-memory skill
+ * directories — one skill index, one `## Skills` instruction section, lazy
+ * `load_skill` for all of them. A pack skill shadows a bundled or curated
+ * skill with the same directory name, case-insensitively.
  */
-declare function lazySkillSourceWithPackSkills(packSkills: PackSkill[]): LocalDirLazySkillSource;
+declare function lazySkillSourceWithPackSkills(packSkills: PackSkill[], skillLibrarySkills?: PackSkill[]): LocalDirLazySkillSource;
 
-export { type AgentSegmentInput, type BuildAgentOptions, COMPACTION_PROMPT, COMPACTION_SUMMARY_MARKER, COMPACT_USER_MESSAGE_MAX_TOKENS, CodexSubscriptionUnavailableError, type CompactionDecision, type CompactionItem, CompactionNeededError, ComputerActionError, ComputerReadOnlyError, type ComputerToolMode, ComputerUnavailableError, type ComputerUseArgs, ComputerUseCapability, type ContextRobustnessFilterOptions, DEFAULT_COMPACTION_THRESHOLD_RATIO, GENESIS_TITLE_DIRECTIVE, type GitCredentialTokenWriterSession, type GitTokenSeeds, type HistoryItem, MAX_COMPACTION_THRESHOLD_RATIO, MIN_COMPACTION_THRESHOLD_RATIO, type ModelCallUsageTelemetry, type ModelResponseUsage, MultiProviderModelProvider, type NormalizedRuntimeEvent, type OpenGeniRuntime, type PackSkill, type PackSkillFile, type PersistentSessionSettings, type PrepareInputOptions, type PrepareToolsOptions, type PreparedAgentInput, type PreparedAgentTools, type ProductionRuntimeOverrides, type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult, type RigInstructionsContext, type RigSetupDescriptor, type RunAgentStreamOptions, RuntimeMetricsHooks, SUMMARY_BUFFER_TOKENS, SUMMARY_PREFIX, SandboxComputer, type SandboxComputerOptions, type SandboxFileDownload, type SandboxFileDownloadFailure, type SandboxFileDownloadMaterializationResult, type SandboxLifecycleHook, type SandboxLifecycleHookContext, type SandboxLifecycleHookPhase, TOOLSPACE_PROGRAMMATIC_DIRECTIVE, USER_MESSAGE_TRUNCATION_MARKER, type WorkspaceEnvironmentContext, WorkspaceModelPolicyBlockedError, agentsErrorRunState, appendGenesisTitleDirective, appendPersistentSessionSettings, appendSessionInstructions, appendToolspaceInstructions, appendWorkspaceMemory, applyMissingManifestEntries, azureCliLoginCommand, azureOpenAIDefaultQuery, buildAgentCapabilities, buildCompactionPromptInput, buildCompactionReplacementHistory, buildManifest, buildModelInstance, buildOpenAIClientFromSettings, buildOpenGeniAgent, buildProviderClient, buildSummaryItem, callModelInputFilterForSettings, clampCompactionThresholdRatio, compactionThresholdTokens, composeAgentInstructions, computerUse, configureOpenAI, configureRuntimeMetricsHooks, contextRobustnessFilterForSettings, coreInstructions, createProductionAgentRuntime, decideCompaction, elideSupersededViewImagePairs, elideSupersededViewImagesFilter, ensureReadableStreamFrom, estimateItemTokens, estimateTokens, extractResponseOutputText, findCompactionNeededError, gitProviderTokenRefreshCommand, isCompactionSummary, isEphemeralInternalContext, isUserMessage, lazySkillSourceWithPackSkills, manifestEnvironmentDrift, materializeSandboxFileDownloads, maxTurnsExceededRunState, mcpToolErrorOutput, modelCallUsageTelemetry, modelResponseUsageFromResponse, modelResponseUsageFromSdkEvent, neutralizeToolSearchItemsInSerializedRunState, normalizeComputerCallsFilter, normalizeSdkEvent, normalizeToolOutputForEvent, oneShotGenesisTitleInputFilter, pinProvidedSessionManifestEnvironment, prefixedMcpToolName, prepareAgentTools, prepareRunInput, refreshGitProviderTokenFiles, renderCompactionPromptInputForChat, repositoryCloneCommand, repositoryUsesSandboxClone, resolveTurnModel, rigInstructions, rigSetupScriptCommand, runAgentStream, runAzureCliLoginHook, runBeforeAgentStartHooks, runOwnedSandboxSetup, runRepositoryCloneHook, runRigSetupHook, runToolspaceTokenSeedHook, sandboxCommandExitCode, sandboxCommandOutput, sandboxCommandStillRunning, sandboxFileDownloadFailureNote, sandboxFileDownloadsForAgent, sandboxLifecycleHooksForIds, sandboxRunAs, sanitizeHistoryItemsForModel, serializeApprovals, stripProviderItemIdsFilter, stripReasoningEncryptedContent, stripReasoningIdentityFromSerializedRunState, summarizeForCompaction, toolspaceTokenSeedCommand, withManifestRefreshOnResume, withSandboxFileDownloads, withSandboxLifecycleHooks, withStructuredViewImageFunctionResults, workspaceEnvironmentInstructions };
+export { type AgentSegmentInput, type BuildAgentOptions, COMPACTION_PROMPT, COMPACTION_SUMMARY_MARKER, COMPACT_USER_MESSAGE_MAX_TOKENS, CodexSubscriptionUnavailableError, type CompactionDecision, type CompactionItem, CompactionNeededError, CompactionProviderResponseError, ComputerActionError, ComputerReadOnlyError, type ComputerToolMode, ComputerUnavailableError, type ComputerUseArgs, ComputerUseCapability, type ContextRobustnessFilterOptions, DEFAULT_COMPACTION_THRESHOLD_RATIO, type EffectiveSkillSelection, EmptyCompactionSummaryError, GENESIS_TITLE_DIRECTIVE, type GitCredentialBindingSeed, type GitCredentialTokenWriterSession, type GitTokenSeeds, HUMAN_INPUT_TOOL_NAME, type HistoryItem, MAX_COMPACTION_THRESHOLD_RATIO, MIN_COMPACTION_THRESHOLD_RATIO, type ModelCallUsageTelemetry, type ModelResponseUsage, MultiProviderModelProvider, type NormalizedRuntimeEvent, type OpenGeniRuntime, type PackSkill, type PackSkillFile, type PersistentSessionSettings, type PrepareInputOptions, type PrepareToolsOptions, type PreparedAgentInput, type PreparedAgentTools, type PreparedCompactionPromptInput, type ProductionRuntimeOverrides, type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult, type RigInstructionsContext, type RigSetupDescriptor, type RunAgentStreamOptions, RunCredentialSessionReady, RuntimeMetricsHooks, SUMMARY_BUFFER_TOKENS, SUMMARY_PREFIX, SandboxComputer, type SandboxComputerOptions, type SandboxFileDownload, type SandboxFileDownloadFailure, type SandboxFileDownloadMaterializationResult, type SandboxLifecycleCommandRunner, type SandboxLifecycleHook, type SandboxLifecycleHookContext, type SandboxLifecycleHookPhase, type SerializedHumanInputInterruption, TOOLSPACE_PROGRAMMATIC_DIRECTIVE, type ToolspaceTokenWriterSession, type TurnToolCancellationFence, USER_MESSAGE_TRUNCATION_MARKER, type WorkspaceEnvironmentContext, WorkspaceModelPolicyBlockedError, agentsErrorRunState, appendGenesisTitleDirective, appendPersistentSessionSettings, appendSessionInstructions, appendToolspaceInstructions, appendTurnInstructions, appendWorkspaceMemory, applyMissingManifestEntries, azureCliLoginCommand, azureOpenAIDefaultQuery, boundModelToolOutputsFilterForSettings, buildAgentCapabilities, buildCompactionPromptInput, buildCompactionReplacementHistory, buildManifest, buildModelInstance, buildOpenAIClientFromSettings, buildOpenGeniAgent, buildProviderClient, buildSummaryItem, callModelInputFilterForSettings, clampCompactionThresholdRatio, compactionProviderFailureDiagnostics, compactionReplacementFingerprint, compactionResponseDiagnostics, compactionThresholdTokens, composeAgentInstructions, computerUse, configureOpenAI, configureRuntimeMetricsHooks, contextRobustnessFilterForSettings, coreInstructions, createProductionAgentRuntime, decideCompaction, effectiveSkillSelectionsForAgent, elideSupersededViewImagePairs, elideSupersededViewImagesFilter, ensureReadableStreamFrom, estimateCompleteModelInput, estimateItemTokens, estimateSerializedValueTokens, estimateTokens, extractResponseOutputText, findCompactionNeededError, gitCredentialBindingHash, gitCredentialBindingTokenRefreshCommand, gitProviderTokenRefreshCommand, hasModelGeneratedItem, isCompactionSummary, isEphemeralInternalContext, isUserMessage, latestCompactionReplacementFingerprint, lazySkillSourceWithPackSkills, manifestEnvironmentDrift, materializeSandboxFileDownloads, maxTurnsExceededRunState, mcpToolErrorOutput, modelCallUsageTelemetry, modelResponseUsageFromResponse, modelResponseUsageFromSdkEvent, neutralizeToolSearchItemsInSerializedRunState, normalizeComputerCallsFilter, normalizeSdkEvent, normalizeToolOutputForEvent, oneShotGenesisTitleInputFilter, pinProvidedSessionManifestEnvironment, prefixedMcpToolName, prepareAgentTools, prepareCompactionPromptInput, prepareRunInput, refreshGitCredentialBindingTokenFiles, refreshGitProviderTokenFiles, refreshToolspaceTokenFile, renderCompactionPromptInputForChat, repositoryCloneCommand, repositoryUsesSandboxClone, resolveTurnModel, rigInstructions, rigSetupScriptCommand, runAgentStream, runAzureCliLoginHook, runBeforeAgentStartHooks, runOwnedSandboxSetup, runRepositoryCloneHook, runRigSetupHook, runToolspaceTokenSeedHook, sandboxCommandExitCode, sandboxCommandOutput, sandboxCommandStillRunning, sandboxFileDownloadFailureNote, sandboxFileDownloadsForAgent, sandboxLifecycleHooksForIds, sandboxRunAs, sanitizeHistoryItemsForModel, serializeApprovals, serializeHumanInputRequests, stripProviderItemIdsFilter, stripReasoningEncryptedContent, stripReasoningIdentityFromSerializedRunState, summarizeForCompaction, toolspaceTokenSeedCommand, withManifestRefreshOnResume, withSandboxFileDownloads, withSandboxLifecycleHooks, withStructuredViewImageFunctionResults, workspaceEnvironmentInstructions };