@opengeni/runtime 0.7.0 → 0.11.0

package/src/index.ts

@@ -12,16 +12,28 @@ import {
   sandboxLifecycleHookIds,
 } from "@opengeni/config";
 import {
+  approvalIdentifier,
   CAPABILITY_DESCRIPTORS,
+  assertUniqueResourceMountPaths,
+  gitCredentialBindingIdForRepository,
+  gitCredentialProviderForRepository,
   isClearedRunStateBlob,
+  normalizeRepositorySubpath,
+  normalizeResourceMountPath,
   prefixedMcpToolName as sharedPrefixedMcpToolName,
+  resourceMountPath,
+  sessionEventMediaPreview,
+  sessionEventMediaPreviewFromDataUrl,
   signDelegatedAccessToken,
+  RequestHumanInputToolInput,
   type GitCredentialProvider,
+  type HumanInputResponse,
   type McpServerConnectionRef,
   type Permission,
   type ReasoningEffort,
   type ResourceRef,
   type SessionEventType,
+  type SessionEventMediaPreview,
   type ToolAuthNeededPayload,
   type ToolRef,
 } from "@opengeni/contracts";
@@ -52,6 +64,7 @@ import {
   setDefaultOpenAIKey,
   setOpenAIResponsesTransport,
   setTracingDisabled,
+  tool as agentTool,
   // Hosted web_search tool factory. Re-exported from @openai/agents-openai via
   // `export * from '@openai/agents-openai'` in @openai/agents' index (0.11.6);
   // it returns a { type: 'hosted_tool', providerData: { type: 'web_search' } }
@@ -104,11 +117,13 @@ import {
   CODEX_APPS_MCP_SERVER_ID,
   CODEX_MODEL_ID_PREFIX,
   CODEX_ORIGINATOR,
+  boundModelToolOutputItems,
   codexAppsSanitizingFetch,
   codexRequestStorage,
   codexSubscriptionFetch,
 } from "@opengeni/codex";
 import { cpSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { dirname, isAbsolute, join, posix as posixPath, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -121,22 +136,52 @@ import {
 import { installCodexToolSearch } from "./codex-tool-search";
 import {
   CompactionNeededError,
+  CompactionProviderResponseError,
+  EmptyCompactionSummaryError,
   SUMMARY_BUFFER_TOKENS,
   compactionThresholdTokens,
-  estimateTokens,
+  estimateCompleteModelInput,
+  estimateSerializedValueTokens,
+  hasModelGeneratedItem,
   renderCompactionPromptInputForChat,
+  type CompleteModelInputFootprint,
+  type ProviderContextTokenSignal,
 } from "./context-compaction";
 import {
   createSandboxClient,
   desktopCapableBackend,
   restoredSandboxSessionStateFromEntry,
   setSelfhostedApplyDiff,
+  toolspaceTokenFileFromEnvironment,
+  withToolspaceTokenClient,
+  withToolspaceTokenSession,
+  withRunCredentialsClient,
+  withRunCredentialsSession,
+  type RunCredentialSessionReady,
 } from "./sandbox";
 import { runWithToolCallCorrelation } from "./sandbox/op-correlation";
+import {
+  createTurnToolCancellationController,
+  TurnSandboxCommandCancelledError,
+  wrapCapabilityToolsForTurnCancellation,
+  type TurnSandboxCommandArgs,
+  type TurnSandboxCommandSession,
+  type TurnToolCancellationFence,
+} from "./sandbox/turn-tool-cancellation";
 import { computerUse, type ComputerToolMode } from "./sandbox-computer";
 import type { RuntimeMetricsHooks } from "./metrics";
+export {
+  getSkillLibraryEntry,
+  isSkillLibraryEntryId,
+  listSkillLibraryEntries,
+  loadSkillLibrarySkill,
+  type SkillLibraryEntry,
+  type SkillLibraryFile,
+  type SkillLibrarySkill,
+} from "./skill-library";
 
 export type { RuntimeMetricsHooks } from "./metrics";
+export type { TurnToolCancellationFence } from "./sandbox/turn-tool-cancellation";
 
 // P4.3 computer-use surface (the agent's :0 driver). Re-exported from the barrel
 // so callers (the worker, live proofs) reach SandboxComputer/ComputerUseCapability
@@ -188,17 +233,25 @@ export { OpenAIChatCompletionsModel, OpenAIResponsesModel } from "@openai/agents
 
 export {
   CompactionNeededError,
+  CompactionProviderResponseError,
+  EmptyCompactionSummaryError,
   buildCompactionPromptInput,
   buildCompactionReplacementHistory,
+  compactionReplacementFingerprint,
   compactionThresholdTokens,
   clampCompactionThresholdRatio,
   decideCompaction,
   buildSummaryItem,
   findCompactionNeededError,
   isCompactionSummary,
+  latestCompactionReplacementFingerprint,
+  prepareCompactionPromptInput,
   isUserMessage,
   estimateTokens,
   estimateItemTokens,
+  estimateCompleteModelInput,
+  estimateSerializedValueTokens,
+  hasModelGeneratedItem,
   renderCompactionPromptInputForChat,
   COMPACTION_SUMMARY_MARKER,
   COMPACTION_PROMPT,
@@ -211,7 +264,11 @@ export {
   isEphemeralInternalContext,
   USER_MESSAGE_TRUNCATION_MARKER,
 } from "./context-compaction";
-export type { CompactionDecision, CompactionItem } from "./context-compaction";
+export type {
+  CompactionDecision,
+  CompactionItem,
+  PreparedCompactionPromptInput,
+} from "./context-compaction";
 export { modelCallUsageTelemetry } from "./usage-telemetry";
 export type { ModelCallUsageTelemetry } from "./usage-telemetry";
 
@@ -249,14 +306,21 @@ export type ResolveConnectionCredentialInput = {
 };
 
 export type ResolveConnectionCredentialResult =
-  | { status: "ok"; headers: Record<string, string>; connectionId: string; expiresAt?: Date | null }
+  | {
+      status: "ok";
+      headers: Record<string, string>;
+      connectionId: string;
+      expiresAt?: Date | null;
+    }
   | {
       status: "auth_needed";
       reason: ToolAuthNeededPayload["reason"];
       providerDomain: string;
+      provider?: string;
       connectionId?: string;
       scopes?: string[];
       resource?: string;
+      selectedResources?: McpServerConnectionRef["selectedResources"];
       authorizationUrl?: string;
     };
 
@@ -311,6 +375,11 @@ export type AgentSegmentInput =
       approvalId: string;
       decision: "approve" | "reject";
       message?: string;
+    }
+  | {
+      kind: "human_input";
+      serializedRunState: string;
+      toolCallId: string;
     };
 
 export type PreparedAgentInput = {
@@ -318,6 +387,13 @@ export type PreparedAgentInput = {
   sandboxSessionState?: SandboxSessionState;
 };
 
+export const HUMAN_INPUT_TOOL_NAME = "request_human_input";
+
+export type SerializedHumanInputInterruption = {
+  toolCallId: string;
+  input: ReturnType<typeof RequestHumanInputToolInput.parse>;
+};
+
 export type SandboxFileDownload = {
   fileId: string;
   mountPath: string;
@@ -376,6 +452,7 @@ export type OpenGeniRuntime = {
     options?: RunAgentStreamOptions,
   ) => Promise<Awaited<ReturnType<typeof runAgentStream>>>;
   serializeApprovals: (interruptions: unknown[]) => unknown[];
+  serializeHumanInputRequests?: (interruptions: unknown[]) => SerializedHumanInputInterruption[];
 };
 
 export type ProductionRuntimeOverrides = {
@@ -411,6 +488,7 @@ export function createProductionAgentRuntime(
         sandboxClient: overrides.sandboxClient,
       }),
     serializeApprovals,
+    serializeHumanInputRequests,
   };
 }
 
@@ -799,19 +877,28 @@ export async function summarizeForCompaction(
   const maxTokens = options.maxOutputTokens ?? SUMMARY_BUFFER_TOKENS;
   if (api === "chat") {
     const transcript = renderCompactionPromptInputForChat(input);
-    const completion = await client.chat.completions.create({
-      model,
-      max_tokens: maxTokens,
-      messages: [{ role: "user", content: transcript }],
-      ...(options.promptCacheKey ? { prompt_cache_key: options.promptCacheKey } : {}),
-    } as any);
+    let completion: unknown;
+    try {
+      completion = await client.chat.completions.create({
+        model,
+        max_tokens: maxTokens,
+        messages: [{ role: "user", content: transcript }],
+        ...(options.promptCacheKey ? { prompt_cache_key: options.promptCacheKey } : {}),
+      } as any);
+    } catch (error) {
+      throw new CompactionProviderResponseError(compactionProviderFailureDiagnostics(error), error);
+    }
     const usage = modelResponseUsageFromResponse(completion);
     if (usage) {
       await options.onUsage?.(usage);
     }
     const text = (completion as { choices?: Array<{ message?: { content?: unknown } }> })
       .choices?.[0]?.message?.content;
-    return typeof text === "string" ? text.trim() : "";
+    const summary = typeof text === "string" ? text.trim() : "";
+    if (!summary) {
+      throw new EmptyCompactionSummaryError(compactionResponseDiagnostics(completion, summary));
+    }
+    return summary;
   }
   // Use the same SDK Responses adapter as the real agent call. It converts the
   // structured AgentInputItems (callId/providerData/etc.) to provider wire
@@ -834,12 +921,205 @@ export async function summarizeForCompaction(
     handoffs: [],
     tracing: false,
   };
-  const response = await new CompactionResponsesModel(client, model).fetchResponse(request);
+  let response: unknown;
+  try {
+    response = await new CompactionResponsesModel(client, model).fetchResponse(request);
+  } catch (error) {
+    throw new CompactionProviderResponseError(compactionProviderFailureDiagnostics(error), error);
+  }
   const usage = modelResponseUsageFromResponse(response);
   if (usage) {
     await options.onUsage?.(usage);
   }
-  return extractResponseOutputText(response).trim();
+  if (isFailedCompactionProviderResponse(response)) {
+    throw new CompactionProviderResponseError(compactionProviderFailureDiagnostics(response));
+  }
+  const summary = extractResponseOutputText(response).trim();
+  if (!summary) {
+    throw new EmptyCompactionSummaryError(compactionResponseDiagnostics(response, summary));
+  }
+  return summary;
+}
+
+function isFailedCompactionProviderResponse(response: unknown): boolean {
+  if (!response || typeof response !== "object") return false;
+  const record = response as Record<string, unknown>;
+  return (
+    record.status === "failed" ||
+    record.status === "incomplete" ||
+    (record.error !== null && record.error !== undefined)
+  );
+}
+
+/** Bounded provider diagnostics: identifiers and classifications, never messages or model data. */
+export function compactionProviderFailureDiagnostics(error: unknown): Record<string, unknown> {
+  let current = error;
+  let errorName: string | null = null;
+  let httpStatus: number | null = null;
+  let responseStatus: string | null = null;
+  let responseId: string | null = null;
+  let code: string | null = null;
+  let type: string | null = null;
+  let requestId: string | null = null;
+  let eventType: string | null = null;
+  const seen = new Set<object>();
+  for (let depth = 0; depth < 6 && current && typeof current === "object"; depth += 1) {
+    if (seen.has(current)) break;
+    seen.add(current);
+    const record = current as Record<string, unknown>;
+    if (!errorName && current instanceof Error) {
+      errorName = boundCompactionDiagnosticField(current.name);
+    }
+    if (
+      httpStatus === null &&
+      typeof record.status === "number" &&
+      Number.isFinite(record.status)
+    ) {
+      httpStatus = record.status;
+    }
+    if (responseStatus === null && typeof record.status === "string") {
+      responseStatus = boundCompactionDiagnosticField(record.status);
+    }
+    const directResponseStatus = record.response_status ?? record.responseStatus;
+    if (responseStatus === null && typeof directResponseStatus === "string") {
+      responseStatus = boundCompactionDiagnosticField(directResponseStatus);
+    }
+    const directResponseId = record.response_id ?? record.responseId ?? record.id;
+    if (responseId === null && typeof directResponseId === "string") {
+      responseId = boundCompactionDiagnosticField(directResponseId);
+    }
+    if (code === null && typeof record.code === "string") {
+      code = boundCompactionDiagnosticField(record.code);
+    }
+    if (type === null && typeof record.type === "string") {
+      type = boundCompactionDiagnosticField(record.type);
+    }
+    const directEventType = record.event_type ?? record.eventType;
+    if (eventType === null && typeof directEventType === "string") {
+      eventType = boundCompactionDiagnosticField(directEventType);
+    }
+    if (requestId === null) {
+      const directRequestId = record.request_id ?? record.requestId ?? record._request_id;
+      if (typeof directRequestId === "string") {
+        requestId = boundCompactionDiagnosticField(directRequestId);
+      }
+      const headers = record.headers;
+      if (!requestId && headers && typeof headers === "object") {
+        const get = (headers as { get?: unknown }).get;
+        if (typeof get === "function") {
+          const headerId = get.call(headers, "x-request-id");
+          if (typeof headerId === "string") {
+            requestId = boundCompactionDiagnosticField(headerId);
+          }
+        }
+      }
+    }
+    const nestedError = record.error;
+    if (nestedError && typeof nestedError === "object" && !seen.has(nestedError)) {
+      const nested = nestedError as Record<string, unknown>;
+      if (code === null && typeof nested.code === "string") {
+        code = boundCompactionDiagnosticField(nested.code);
+      }
+      if (type === null && typeof nested.type === "string") {
+        type = boundCompactionDiagnosticField(nested.type);
+      }
+      const nestedResponseStatus = nested.response_status ?? nested.responseStatus;
+      if (responseStatus === null && typeof nestedResponseStatus === "string") {
+        responseStatus = boundCompactionDiagnosticField(nestedResponseStatus);
+      }
+      const nestedResponseId = nested.response_id ?? nested.responseId ?? nested.id;
+      if (responseId === null && typeof nestedResponseId === "string") {
+        responseId = boundCompactionDiagnosticField(nestedResponseId);
+      }
+      const nestedEventType = nested.event_type ?? nested.eventType;
+      if (eventType === null && typeof nestedEventType === "string") {
+        eventType = boundCompactionDiagnosticField(nestedEventType);
+      }
+    }
+    current = record.cause;
+  }
+  return {
+    errorName,
+    httpStatus,
+    responseStatus,
+    responseId,
+    code,
+    type,
+    requestId,
+    ...(eventType ? { eventType } : {}),
+  };
+}
+
+const COMPACTION_DIAGNOSTIC_FIELD_MAX_BYTES = 256;
+const COMPACTION_DIAGNOSTIC_TRUNCATION_MARKER = "…[truncated]";
+
+function boundCompactionDiagnosticField(value: string): string {
+  const bytes = Buffer.from(value, "utf8");
+  if (bytes.length <= COMPACTION_DIAGNOSTIC_FIELD_MAX_BYTES) return value;
+  const markerBytes = Buffer.byteLength(COMPACTION_DIAGNOSTIC_TRUNCATION_MARKER, "utf8");
+  let end = COMPACTION_DIAGNOSTIC_FIELD_MAX_BYTES - markerBytes;
+  while (end > 0 && isUtf8ContinuationByte(bytes[end]!)) end -= 1;
+  return `${bytes.subarray(0, end).toString("utf8")}${COMPACTION_DIAGNOSTIC_TRUNCATION_MARKER}`;
+}
+
+function isUtf8ContinuationByte(value: number): boolean {
+  return (value & 0xc0) === 0x80;
+}
+
+/** Bounded, content-free diagnostics for a semantically empty checkpoint. */
+export function compactionResponseDiagnostics(
+  response: unknown,
+  extractedText = extractResponseOutputText(response).trim(),
+): Record<string, unknown> {
+  if (!response || typeof response !== "object") {
+    return { responseShape: typeof response, extractedTextLength: extractedText.length };
+  }
+  const record = response as Record<string, unknown>;
+  const output = Array.isArray(record.output) ? record.output : [];
+  const outputItems = output.slice(0, 50).map((item) => {
+    if (!item || typeof item !== "object") return { type: typeof item };
+    const value = item as Record<string, unknown>;
+    const content = Array.isArray(value.content) ? value.content : [];
+    return {
+      type: typeof value.type === "string" ? value.type : null,
+      role: typeof value.role === "string" ? value.role : null,
+      status: typeof value.status === "string" ? value.status : null,
+      contentPartTypes: content
+        .slice(0, 50)
+        .map((part) =>
+          part && typeof part === "object" && typeof (part as { type?: unknown }).type === "string"
+            ? (part as { type: string }).type
+            : typeof part,
+        ),
+      contentPartCount: content.length,
+    };
+  });
+  const choices = Array.isArray(record.choices) ? record.choices : [];
+  const usage = modelResponseUsageFromResponse(response)?.usage;
+  const incomplete =
+    record.incomplete_details && typeof record.incomplete_details === "object"
+      ? (record.incomplete_details as Record<string, unknown>)
+      : null;
+  return {
+    responseId: typeof record.id === "string" ? record.id : null,
+    status: typeof record.status === "string" ? record.status : null,
+    outputItemCount: output.length,
+    outputItems,
+    choiceCount: choices.length,
+    finishReasons: choices
+      .slice(0, 20)
+      .map((choice) =>
+        choice && typeof choice === "object"
+          ? ((choice as Record<string, unknown>).finish_reason ?? null)
+          : null,
+      ),
+    incompleteReason:
+      incomplete && typeof incomplete.reason === "string" ? incomplete.reason : null,
+    inputTokens: usage?.inputTokens ?? null,
+    outputTokens: usage?.outputTokens ?? null,
+    totalTokens: usage?.totalTokens ?? null,
+    extractedTextLength: extractedText.length,
+  };
 }
 
 /**
@@ -904,10 +1184,49 @@ class CompactionResponsesModel extends OpenAIResponsesModel {
 }
 
 export type GitTokenSeeds = Partial<Record<GitCredentialProvider, string>>;
+export type GitCredentialBindingSeed = {
+  credentialBindingId: string;
+  provider: GitCredentialProvider;
+  token: string;
+  expiresAt?: string;
+  /** Total active bindings for this provider, used to suppress unsafe aliases. */
+  providerBindingCount?: number;
+};
 export type GitCredentialTokenWriterSession = SandboxSessionLike;
+export type ToolspaceTokenWriterSession = SandboxSessionLike;
+
+export type EffectiveSkillSelection = Readonly<{
+  id: string;
+  name: string;
+  source: "bundled" | "library" | "pack";
+  version: string | null;
+  contentSha256: string | null;
+  reason: string;
+}>;
+
+const agentSkillSelections = new WeakMap<object, readonly EffectiveSkillSelection[]>();
+const emptySkillSelections: readonly EffectiveSkillSelection[] = Object.freeze([]);
+
+/**
+ * Read-only, secret-free skill provenance for an already-built agent. This is
+ * intentionally separate from the model instructions and sandbox manifest so
+ * effective configuration inspection cannot accidentally expose credentials or
+ * turn skill activation into an authorization change.
+ */
+export function effectiveSkillSelectionsForAgent(
+  agent: object,
+): readonly EffectiveSkillSelection[] {
+  return agentSkillSelections.get(agent) ?? emptySkillSelections;
+}
 
 export type BuildAgentOptions = {
   model?: Model;
+  /** Settled response for the one internal human-input interruption resumed by this run. */
+  humanInputResponse?: {
+    requestId: string;
+    toolCallId: string;
+    response: HumanInputResponse;
+  };
   reasoningEffort?: ReasoningEffort;
   // Per-turn gating overrides for the multi-provider path. Each defaults to
   // today's settings-derived behaviour when omitted, so the legacy
@@ -1003,11 +1322,18 @@ export type BuildAgentOptions = {
   // repository-clone hooks; runStream forwards them into the hook context, which
   // seeds provider token FILES before the clone/setup runs.
   gitTokenSeeds?: GitTokenSeeds;
+  // Provider-neutral, independently mintable credentials. Binding ids remain
+  // off-manifest and are hashed before they influence sandbox paths.
+  gitCredentialBindings?: GitCredentialBindingSeed[];
   // TOOLSPACE: the run-scoped delegated token to seed into
   // $OPENGENI_TOOLSPACE_TOKEN_FILE. Like gitTokenSeed, this stays off the
   // manifest/env delta and is written into the sandbox filesystem by a lifecycle
   // hook before the agent starts.
   toolspaceTokenSeed?: string;
+  // Durable OpenGeni session identity used only to derive the off-manifest,
+  // per-session token file. Required together with toolspaceTokenSeed so two
+  // sessions sharing one box never overwrite the same pointer.
+  toolspaceTokenSessionId?: string;
   // Genesis turn only: inject a one-shot instruction into the FIRST model
   // call telling it to title the session via opengeni__set_session_title.
   // Keeping this out of the persistent Agent.instructions prevents every
@@ -1035,10 +1361,32 @@ export type BuildAgentOptions = {
   // timeline message. Omitted ⇒ the composed instructions are byte-identical to
   // a workspace-only persona.
   sessionInstructions?: string;
+  // Host context for this exact accepted turn. Composed system-level after the
+  // durable session persona and omitted from all later turns.
+  turnInstructions?: string;
   // Skills delivered by enabled capability packs. They join the bundled
   // skills in the sandbox skill index (mounted under .agents/) so
   // skills/<name> references resolve like any other indexed skill.
   packSkills?: PackSkill[];
+  // Explicitly selected, immutable curated-library skill content. These are
+  // separate from packSkills so repository-local/pack compatibility does not
+  // turn a curated entry into a mutable override.
+  skillLibrarySkills?: PackSkill[];
+  // Secret-free provenance for effective-configuration inspection. The worker
+  // resolves exact ids/versions/hashes before constructing the agent.
+  skillLibrarySelections?: EffectiveSkillSelection[];
+  /**
+   * Internal per-attempt cancellation boundary. The worker supplies Temporal's
+   * signal so an in-flight shell process is interrupted immediately instead of
+   * holding Steer/Pause behind its requested yield or natural exit.
+   */
+  turnCancellationSignal?: AbortSignal;
+  /**
+   * Receives the physical sandbox-tool fence at agent construction time. A
+   * cancelled/fenced worker attempt must await it before publishing its durable
+   * attempt-quiesced receipt.
+   */
+  onToolCancellationFence?: (fence: TurnToolCancellationFence) => void;
 };
 
 export type PackSkillFile = {
@@ -1070,7 +1418,6 @@ export type WorkspaceEnvironmentContext = {
 
 export type PersistentSessionSettings = {
   titleIsSet: boolean;
-  childNotificationsMode?: "digest" | "passive";
 };
 
 /**
@@ -1167,6 +1514,12 @@ export function appendSessionInstructions(composed: string, sessionInstructions?
   return trimmed ? `${composed} ${trimmed}` : composed;
 }
 
+/** Append system instructions that apply to this exact turn only. */
+export function appendTurnInstructions(composed: string, turnInstructions?: string): string {
+  const trimmed = turnInstructions?.trim();
+  return trimmed ? `${composed} ${trimmed}` : composed;
+}
+
 /**
  * Append the durable session metadata the model otherwise cannot observe.
  * This is deliberately declarative and excludes the title text: the title is
@@ -1181,13 +1534,7 @@ export function appendPersistentSessionSettings(
   if (!settings) {
     return composed;
   }
-  const childState = settings.childNotificationsMode
-    ? `; spawned-worker completion notifications are ${settings.childNotificationsMode}`
-    : "";
-  const persistentTools = settings.childNotificationsMode
-    ? "opengeni__set_session_title or opengeni__set_child_notifications_mode"
-    : "opengeni__set_session_title";
-  return `${composed} Persistent session settings already in effect: the display title is ${settings.titleIsSet ? "set" : "not set"}${childState}. These settings persist across turns, continuations, and interruptions. Do not call ${persistentTools} merely to reassert an unchanged value; call them only when the current value actually needs to change.`;
+  return `${composed} Persistent session settings already in effect: the display title is ${settings.titleIsSet ? "set" : "not set"}. This setting persists across turns, continuations, and interruptions. Do not call opengeni__set_session_title merely to reassert an unchanged value; call it only when the current value actually needs to change.`;
 }
 
 /**
@@ -1241,7 +1588,9 @@ const agentRepositoryCloneHooks = new WeakMap<object, SandboxLifecycleHook[]>();
 // provided-session env; runStream reads them to build the clone hook context.
 // Absent when no brokered repo is attached / on the selfhosted path.
 const agentGitTokenSeeds = new WeakMap<object, GitTokenSeeds>();
+const agentGitCredentialBindings = new WeakMap<object, GitCredentialBindingSeed[]>();
 const agentToolspaceTokenSeed = new WeakMap<object, string>();
+const agentToolspaceTokenSessionId = new WeakMap<object, string>();
 // A genesis directive is consumed by runAgentStream exactly once for the
 // freshly-built agent. It must not remain in Agent.instructions: those
 // instructions are presented again on every internal model/tool loop.
@@ -1310,6 +1659,9 @@ export function buildOpenGeniAgent(
   resources: ResourceRef[],
   options: BuildAgentOptions = {},
 ): Agent<any, any> {
+  if (Boolean(options.toolspaceTokenSeed) !== Boolean(options.toolspaceTokenSessionId)) {
+    throw new Error("toolspaceTokenSeed and toolspaceTokenSessionId must be supplied together");
+  }
   // Resolved per-turn gating. Each override defaults to today's settings-derived
   // behaviour, so the legacy global-client callers (no resolved model) build the
   // exact same agent as before; the multi-provider worker path passes the
@@ -1331,6 +1683,28 @@ export function buildOpenGeniAgent(
   // [...agent.tools, ...capability.tools()]), so hosted web_search coexists with
   // both rather than overriding them.
   const hostedTools = hostedWebSearch ? [webSearchTool()] : [];
+  const humanInputTool = agentTool({
+    name: HUMAN_INPUT_TOOL_NAME,
+    description:
+      "Pause this turn and request structured human input. Use for decisions or missing information that only a person can provide. Supports free text, single-select, multi-select, an optional Other value, multiple questions, explicit skip policy, and an optional expiry.",
+    parameters: RequestHumanInputToolInput,
+    needsApproval: true,
+    // A missing/mismatched durable response is a protocol integrity failure,
+    // not model-visible tool output the agent may reason past.
+    errorFunction: null,
+    execute: (_input, _context, details) => {
+      const settled = options.humanInputResponse;
+      if (!settled) {
+        throw new Error("Human-input tool resumed without a durable response");
+      }
+      const resumedCallId = details?.toolCall?.callId;
+      if (resumedCallId && resumedCallId !== settled.toolCallId) {
+        throw new Error("Human-input response does not belong to the resumed tool call");
+      }
+      return JSON.stringify({ requestId: settled.requestId, ...settled.response });
+    },
+  });
+  const agentTools = [...hostedTools, humanInputTool];
   const baseConfig = {
     name: "OpenGeni Agent",
     model: options.model ?? settings.openaiModel,
@@ -1353,24 +1727,28 @@ export function buildOpenGeniAgent(
     //      and the worker resolved a nonblank block — appendWorkspaceMemory,
     //   4. + the per-session persona instructions (session-specific, so it
     //      refines both the workspace persona and the substrate note),
-    //   5. + durable session-setting state (title present + child notification
+    //   5. + host context for this exact turn, when supplied,
+    //   6. + durable session-setting state (title present + child notification
     //      mode), when supplied by the worker,
     // The genesis title directive is deliberately NOT part of this persistent
     // string. runAgentStream injects it into the first model call only.
     instructions: appendPersistentSessionSettings(
-      appendSessionInstructions(
-        appendWorkspaceMemory(
-          appendToolspaceInstructions(
-            composeAgentInstructions(
-              options.instructionsTemplate ?? settings.agentInstructionsTemplate,
-              options.workspaceEnvironment,
-              options.rig,
+      appendTurnInstructions(
+        appendSessionInstructions(
+          appendWorkspaceMemory(
+            appendToolspaceInstructions(
+              composeAgentInstructions(
+                options.instructionsTemplate ?? settings.agentInstructionsTemplate,
+                options.workspaceEnvironment,
+                options.rig,
+              ),
+              settings.toolspaceEnabled && Boolean(options.toolspaceTokenSeed),
             ),
-            settings.toolspaceEnabled && Boolean(options.toolspaceTokenSeed),
+            options.workspaceMemory,
           ),
-          options.workspaceMemory,
+          options.sessionInstructions,
         ),
-        options.sessionInstructions,
+        options.turnInstructions,
       ),
       options.persistentSessionSettings,
     ),
@@ -1393,7 +1771,7 @@ export function buildOpenGeniAgent(
     // `new Agent(baseConfig)` path (sandboxBackend === "none") and the
     // `new SandboxAgent({ ...baseConfig, ... })` path via the shared baseConfig
     // spread; the SDK concatenates these with MCP and sandbox capability tools.
-    ...(hostedTools.length ? { tools: hostedTools } : {}),
+    tools: agentTools,
     ...(options.mcpServers?.length ? { mcpServers: options.mcpServers } : {}),
     // Surface FAILED MCP tool calls as `{ isError: true }` tool output (see
     // mcpToolErrorFunction / mcpToolErrorOutput) instead of the SDK's default
@@ -1425,6 +1803,9 @@ export function buildOpenGeniAgent(
     ),
     ...(runAs ? { runAs } : {}),
     capabilities: buildAgentCapabilities(settings, options.packSkills ?? [], {
+      ...(options.skillLibrarySkills?.length
+        ? { skillLibrarySkills: options.skillLibrarySkills }
+        : {}),
       ...(options.structuredToolTransport !== undefined
         ? { structuredToolTransport: options.structuredToolTransport }
         : {}),
@@ -1432,8 +1813,24 @@ export function buildOpenGeniAgent(
         ? { computerToolMode: options.computerToolMode }
         : {}),
       ...(options.onComputerUseReady ? { onComputerUseReady: options.onComputerUseReady } : {}),
+      ...(options.turnCancellationSignal
+        ? { turnCancellationSignal: options.turnCancellationSignal }
+        : {}),
+      ...(options.onToolCancellationFence
+        ? { onToolCancellationFence: options.onToolCancellationFence }
+        : {}),
     }),
   });
+  agentSkillSelections.set(
+    agent,
+    Object.freeze(
+      effectiveSkillSelections(
+        options.skillLibrarySelections ?? [],
+        options.skillLibrarySkills ?? [],
+        options.packSkills ?? [],
+      ).map((selection) => Object.freeze(selection)),
+    ),
+  );
   if (options.genesisTitleHint) {
     agentsNeedingGenesisTitleDirective.add(agent);
   }
@@ -1465,8 +1862,12 @@ export function buildOpenGeniAgent(
   if (Object.keys(gitTokenSeeds).length > 0) {
     agentGitTokenSeeds.set(agent, gitTokenSeeds);
   }
+  if (options.gitCredentialBindings && options.gitCredentialBindings.length > 0) {
+    agentGitCredentialBindings.set(agent, options.gitCredentialBindings);
+  }
   if (options.toolspaceTokenSeed) {
     agentToolspaceTokenSeed.set(agent, options.toolspaceTokenSeed);
+    agentToolspaceTokenSessionId.set(agent, options.toolspaceTokenSessionId!);
   }
   // M3: stash the rig setup descriptor + RESOLVE the rig credential hooks now.
   // sandboxLifecycleHooksForIds throws on an unknown hook name, so a typo'd rig
@@ -1511,7 +1912,10 @@ function mcpToolRequiresApproval(policy: boolean | string[], unprefixedName: str
 }
 
 /** A per-server approval policy keyed by the server's `<id>__` tool prefix. */
-type McpApprovalPolicy = { prefix: string; requireApproval: boolean | string[] };
+type McpApprovalPolicy = {
+  prefix: string;
+  requireApproval: boolean | string[];
+};
 
 /** The subset of the agent surface the approval wrap needs — including `clone`. */
 type ApprovalCapableAgent = {
@@ -1720,6 +2124,7 @@ export function buildAgentCapabilities(
   settings: Settings,
   packSkills: PackSkill[],
   options: {
+    skillLibrarySkills?: PackSkill[];
     structuredToolTransport?: boolean;
     // EXPLICIT computer-use transport (see BuildAgentOptions.computerToolMode). When
     // present, computerUse() is handed the mode directly and its tools() obeys it
@@ -1727,8 +2132,15 @@ export function buildAgentCapabilities(
     // imageFunctionResults path (driven by structuredToolTransport) is unchanged.
     computerToolMode?: ComputerToolMode;
     onComputerUseReady?: (session: SandboxSessionLike) => Promise<void>;
+    turnCancellationSignal?: AbortSignal;
+    onToolCancellationFence?: (fence: TurnToolCancellationFence) => void;
   } = {},
 ): ReturnType<typeof Capabilities.default> {
+  const toolCancellation =
+    options.turnCancellationSignal || options.onToolCancellationFence
+      ? createTurnToolCancellationController(options.turnCancellationSignal)
+      : null;
+  if (toolCancellation) options.onToolCancellationFence?.(toolCancellation);
   // The `filesystem()` capability picks hosted-vs-function tool variants from the
   // bound model instance (supportsApplyPatchTransport / structured tool output).
   // When the caller declares the backend does NOT support that structured/hosted
@@ -1747,9 +2159,13 @@ export function buildAgentCapabilities(
   }
   const caps: ReturnType<typeof Capabilities.default> = [
     filesystemCapability,
-    shell({ configureTools: withExecOpCorrelation }),
+    shell({ ...(toolCancellation ? {} : { configureTools: withExecOpCorrelation }) }),
   ];
-  caps.push(skills({ lazyFrom: lazySkillSourceWithPackSkills(packSkills) }));
+  caps.push(
+    skills({
+      lazyFrom: lazySkillSourceWithPackSkills(packSkills, options.skillLibrarySkills ?? []),
+    }),
+  );
   // P4.3 computer-use: the agent drives the SAME :0 humans watch (xdotool/XTEST +
   // scrot), but only when the desktop tier is ON, computer-use is enabled, and the
   // backend is one whose image carries the X stack (descriptorgate — honest about
@@ -1801,6 +2217,14 @@ export function buildAgentCapabilities(
     }
     caps.push(computerCapability as unknown as ReturnType<typeof Capabilities.default>[number]);
   }
+  if (toolCancellation) {
+    for (const capability of caps) {
+      wrapCapabilityToolsForTurnCancellation(
+        capability as unknown as { tools(): Tool<unknown>[] },
+        toolCancellation,
+      );
+    }
+  }
   return caps;
 }
 
@@ -1829,6 +2253,9 @@ export type PrepareToolsOptions = {
   // The calling turn's id, signed into the token so tools can classify the
   // caller from its own identity instead of the session's live active pointer.
   turnId?: string;
+  // The exact executing attempt that owns the MCP call.
+  attemptId?: string;
+  executionGeneration?: number;
   subjectId?: string;
   subjectLabel?: string;
   // Overrides the fixed first-party MCP permission set for this session's
@@ -2019,9 +2446,13 @@ function connectionBrokerFetch(
             status: "auth_needed",
             reason: "expired",
             providerDomain: connectionRef.providerDomain,
+            ...(connectionRef.provider ? { provider: connectionRef.provider } : {}),
             connectionId: refreshed.connectionId,
             ...(connectionRef.scopes ? { scopes: connectionRef.scopes } : {}),
             ...(connectionRef.resource ? { resource: connectionRef.resource } : {}),
+            ...(connectionRef.selectedResources
+              ? { selectedResources: connectionRef.selectedResources }
+              : {}),
           },
           connectionRef,
         );
@@ -2050,9 +2481,13 @@ async function resolveConnectionForRequest(
       status: "auth_needed",
       reason: "missing_connection",
       providerDomain: connectionRef.providerDomain,
+      ...(connectionRef.provider ? { provider: connectionRef.provider } : {}),
       ...(connectionRef.connectionId ? { connectionId: connectionRef.connectionId } : {}),
       ...(connectionRef.scopes ? { scopes: connectionRef.scopes } : {}),
       ...(connectionRef.resource ? { resource: connectionRef.resource } : {}),
+      ...(connectionRef.selectedResources
+        ? { selectedResources: connectionRef.selectedResources }
+        : {}),
     };
   }
   const request: ResolveConnectionCredentialInput = {
@@ -2070,9 +2505,13 @@ async function resolveConnectionForRequest(
       status: "auth_needed",
       reason: "refresh_failed",
       providerDomain: connectionRef.providerDomain,
+      ...(connectionRef.provider ? { provider: connectionRef.provider } : {}),
       ...(connectionRef.connectionId ? { connectionId: connectionRef.connectionId } : {}),
       ...(connectionRef.scopes ? { scopes: connectionRef.scopes } : {}),
       ...(connectionRef.resource ? { resource: connectionRef.resource } : {}),
+      ...(connectionRef.selectedResources
+        ? { selectedResources: connectionRef.selectedResources }
+        : {}),
     };
   }
 }
@@ -2090,6 +2529,7 @@ function insufficientScopeAuth(
     status: "auth_needed",
     reason: "insufficient_scope",
     providerDomain: connectionRef.providerDomain,
+    ...(connectionRef.provider ? { provider: connectionRef.provider } : {}),
     connectionId,
     ...(challenge.scope?.length
       ? { scopes: challenge.scope }
@@ -2101,6 +2541,9 @@ function insufficientScopeAuth(
       : connectionRef.resource
         ? { resource: connectionRef.resource }
         : {}),
+    ...(connectionRef.selectedResources
+      ? { selectedResources: connectionRef.selectedResources }
+      : {}),
   };
 }
 
@@ -2116,6 +2559,11 @@ async function authNeededFetchResponse(
     serverId,
     toolName: request.toolName ?? null,
     providerDomain: auth.providerDomain,
+    ...(auth.provider
+      ? { provider: auth.provider }
+      : connectionRef.provider
+        ? { provider: connectionRef.provider }
+        : {}),
     reason: auth.reason,
     ...(connectionId ? { connectionId } : {}),
     ...(auth.scopes
@@ -2128,13 +2576,20 @@ async function authNeededFetchResponse(
       : connectionRef.resource
         ? { resource: connectionRef.resource }
         : {}),
+    ...(auth.selectedResources
+      ? { selectedResources: auth.selectedResources }
+      : connectionRef.selectedResources
+        ? { selectedResources: connectionRef.selectedResources }
+        : {}),
     ...(auth.authorizationUrl ? { authorizationUrl: auth.authorizationUrl } : {}),
     ...(options.subjectId ? { subjectId: options.subjectId } : {}),
   });
   if (request.method === "tools/call") {
     return mcpToolAuthNeededResponse(request.id);
   }
-  return new Response("Authentication required for MCP server connection", { status: 401 });
+  return new Response("Authentication required for MCP server connection", {
+    status: 401,
+  });
 }
 
 async function publishAuthNeeded(
@@ -2295,7 +2750,10 @@ function mcpToolUnavailableMessage(reason: string): string {
 // transport error carries the raw response BODY in its `.message` (a broker
 // 401/403 body can echo request detail), so `.message` is never included; the
 // numeric `.code`/`.status` (e.g. 401) is safe and useful.
-function safeMcpErrorFields(error: unknown): { errorClass: string; status?: number } {
+function safeMcpErrorFields(error: unknown): {
+  errorClass: string;
+  status?: number;
+} {
   const errorClass = error instanceof Error ? error.constructor.name : typeof error;
   const raw = (error as { code?: unknown; status?: unknown } | null)?.code;
   const status = typeof raw === "number" ? raw : undefined;
@@ -2383,6 +2841,8 @@ async function signFirstPartyDelegatedBearer(
     permissions: options.firstPartyPermissions ?? firstPartyMcpPermissions,
     ...(options.sessionId ? { sessionId: options.sessionId } : {}),
     ...(options.turnId ? { turnId: options.turnId } : {}),
+    ...(options.attemptId ? { attemptId: options.attemptId } : {}),
+    ...(options.executionGeneration ? { executionGeneration: options.executionGeneration } : {}),
     exp: Math.floor(Date.now() / 1000) + 60 * 60,
   });
 }
@@ -2577,6 +3037,7 @@ class PrefixedMcpServer implements MCPServer {
   // doesn't spam the log when the SDK re-lists across model turns.
   private readonly bestEffort: boolean;
   private loggedListToolsFailure = false;
+  private listedToolSchemaTokens = 0;
 
   constructor(
     private readonly inner: MCPServer,
@@ -2633,9 +3094,19 @@ class PrefixedMcpServer implements MCPServer {
       }
       return [];
     }
-    return tools
+    const exposed = tools
       .filter((tool) => this.isAllowed(tool.name))
-      .map((tool) => ({ ...tool, name: prefixedMcpToolName(this.name, tool.name) }));
+      .map((tool) => ({
+        ...tool,
+        name: prefixedMcpToolName(this.name, tool.name),
+      }));
+    this.listedToolSchemaTokens = estimateSerializedValueTokens(exposed);
+    return exposed;
+  }
+
+  /** Latest exact tools/list projection used to build the model request. */
+  modelToolSchemaTokens(): number {
+    return this.listedToolSchemaTokens;
   }
 
   async callTool(
@@ -2657,7 +3128,10 @@ class PrefixedMcpServer implements MCPServer {
       // This applies to ANY server — an auth-needed is recoverable once the user
       // re-links, so even a required tool degrades gracefully here.
       if (isAuthNeededMcpError(error)) {
-        return { isError: true, content: [{ type: "text", text: MCP_AUTH_NEEDED_MESSAGE }] };
+        return {
+          isError: true,
+          content: [{ type: "text", text: MCP_AUTH_NEEDED_MESSAGE }],
+        };
       }
       // Best-effort INVOCATION isolation (sibling to the listTools guard). When
       // the model calls a best-effort server's tool and the call throws for ANY
@@ -2679,7 +3153,12 @@ class PrefixedMcpServer implements MCPServer {
         );
         return {
           isError: true,
-          content: [{ type: "text", text: mcpToolUnavailableMessage(mcpErrorReason(fields)) }],
+          content: [
+            {
+              type: "text",
+              text: mcpToolUnavailableMessage(mcpErrorReason(fields)),
+            },
+          ],
         };
       }
       throw error;
@@ -2791,22 +3270,25 @@ export async function prepareRunInput(
       ...(sandboxSessionState ? { sandboxSessionState } : {}),
     };
   }
-  // An approval can only be resumed against a real saved run state. If the
+  // An interrupted tool can only be resumed against a real saved run state. If the
   // latest blob is the cleared sentinel the awaiting turn was wiped (the API
   // refuses clear in requires_action, so this is a defensive guard) — fail with
   // an honest message instead of the cryptic SDK "missing schema version".
   if (isClearedRunStateBlob(input.serializedRunState)) {
     throw new Error(
-      "Cannot resume an approval: the session context was cleared, so the awaiting run state no longer exists.",
+      "Cannot resume an interrupted tool: the session context was cleared, so the awaiting run state no longer exists.",
     );
   }
   const state = await RunState.fromString(agent, input.serializedRunState);
   const interruptions = state.getInterruptions();
-  const target = interruptions.find((item: any) => approvalIdentifier(item) === input.approvalId);
+  const interruptionId = input.kind === "human_input" ? input.toolCallId : input.approvalId;
+  const target = interruptions.find((item: any) => approvalIdentifier(item) === interruptionId);
   if (!target) {
-    throw new Error(`Approval not found in saved run state: ${input.approvalId}`);
+    throw new Error(`Interrupted tool not found in saved run state: ${interruptionId}`);
   }
-  if (input.decision === "approve") {
+  if (input.kind === "human_input") {
+    state.approve(target as any);
+  } else if (input.decision === "approve") {
     state.approve(target as any);
   } else {
     state.reject(target as any, input.message ? { message: input.message } : undefined);
@@ -2815,16 +3297,26 @@ export async function prepareRunInput(
 }
 
 export type RunAgentStreamOptions = {
+  /** Abort the provider/tool loop when the owning activity is cancelled. */
+  signal?: AbortSignal;
   sandboxClient?: unknown;
   sandboxEnvironment?: Record<string, string>;
   onRuntimeEvent?: (event: NormalizedRuntimeEvent) => Promise<void> | void;
-  contextCompactionSignalTokens?: () => number | null | undefined;
+  contextCompactionSignal?: () => ProviderContextTokenSignal | null | undefined;
   contextCompactionRequested?: () => boolean | Promise<boolean>;
   // Host-managed git credential renewal registration. Called only after the
   // initial token-file seed completed on a real provisioned box. The worker
   // owns the multi-day timer and uses this pinned, un-proxied session to
   // atomically replace token files; runtime never mints credentials itself.
   onGitCredentialSessionReady?: (session: GitCredentialTokenWriterSession) => Promise<void> | void;
+  // OpenGeni-minted Toolspace token renewal registration. Called only after the
+  // initial token file reached the real sandbox session.
+  onToolspaceTokenSessionReady?: (session: ToolspaceTokenWriterSession) => Promise<void> | void;
+  // Host-owned run material is seeded off-manifest before setup and every
+  // agent-created process sources the active immutable generation. The worker
+  // owns resolution/renewal/fencing; runtime owns sandbox transport.
+  runCredentialSessionId?: string;
+  onRunCredentialSessionReady?: RunCredentialSessionReady;
   // OWNERSHIP INVERSION (P1.2): an externally-owned, already-live sandbox
   // session resolved by the per-turn resume-by-id path. When present,
   // runAgentStream does NOT build (or resume, or discard) a client — it threads
@@ -2855,6 +3347,13 @@ export type RunAgentStreamOptions = {
     // after establish, so runAgentStream must not run it eagerly here.
     deferredSetup?: boolean;
   };
+  /**
+   * The attempt's authoritative physical sandbox-operation fence. Platform
+   * lifecycle commands use its command runner too, so Steer/Pause can interrupt
+   * repository clone, rig setup, file materialization, and credential seeding
+   * before the attempt-quiesced receipt opens queue admission.
+   */
+  turnToolCancellationFence?: TurnToolCancellationFence;
   // A per-turn model-input filter chained AFTER the provider-item-id strip.
   // Used by the genesis-title injection to prepend a hidden, NON-PERSISTED
   // directive: a callModelInputFilter mutates only `modelData.input` for each
@@ -2864,7 +3363,7 @@ export type RunAgentStreamOptions = {
 };
 
 export type ContextRobustnessFilterOptions = {
-  contextCompactionSignalTokens?: () => number | null | undefined;
+  contextCompactionSignal?: () => ProviderContextTokenSignal | null | undefined;
   contextCompactionRequested?: () => boolean | Promise<boolean>;
   throwOnCompactionNeeded?: boolean;
 };
@@ -2910,9 +3409,10 @@ function takeGenesisTitleInputFilter(agent: Agent<any, any>): CallModelInputFilt
 // Generic substrate prompting for programmatic tool calling (toolspace). Same
 // text for every host; gated per-turn by appendToolspaceInstructions on the
 // presence of a minted toolspace token, so it only appears when the sandbox
-// actually exposes the ogtool CLI + $OPENGENI_TOOLSPACE_URL/_TOKEN_FILE.
+// exposes $OPENGENI_TOOLSPACE_URL/_TOKEN_FILE. Stock images carry ogtool;
+// custom environments get only an exact deployment-pinned bootstrap hint.
 export const TOOLSPACE_PROGRAMMATIC_DIRECTIVE =
-  "Every tool on your MCP surface is also callable programmatically from the sandbox shell, so scripts can invoke tools without a model round trip per call. Run `ogtool list` to see the available tools and their input schemas (from tools/list), then `ogtool call <tool-name> '<json-args>'`; equivalently, POST MCP JSON-RPC to $OPENGENI_TOOLSPACE_URL with the bearer token read from $OPENGENI_TOOLSPACE_TOKEN_FILE. Prefer programmatic calls for loops, polling, and bulk filtering: their results stay in the sandbox and do not consume your context window. Tools that require human approval must still be invoked normally — called programmatically they return a typed error.";
+  "Every tool on your MCP surface is also callable programmatically from the sandbox shell, so scripts can invoke tools without a model round trip per call. If `ogtool` is installed, run `ogtool list` to see the available tools and their input schemas (from tools/list), then `ogtool call <tool-name> '<json-args>'`. If it is absent and both npm and $OPENGENI_OGTOOL_PACKAGE_SPEC are available, run the exact deployment-pinned package with `npm exec --yes --package=\"$OPENGENI_OGTOOL_PACKAGE_SPEC\" -- ogtool ...`; never guess a version or install `latest`. Otherwise POST MCP JSON-RPC directly to $OPENGENI_TOOLSPACE_URL with the bearer token read from $OPENGENI_TOOLSPACE_TOKEN_FILE. Prefer programmatic calls for loops, polling, and bulk filtering: their results stay in the sandbox and do not consume your context window. Tools that require human approval must still be invoked normally — called programmatically they return a typed error.";
 
 /**
  * callModelInputFilter that removes provider-assigned item ids (rs_/msg_/fc_…)
@@ -2971,24 +3471,89 @@ export const elideSupersededViewImagesFilter: CallModelInputFilter = ({ modelDat
   ) as unknown as AgentInputItem[],
 });
 
+/**
+ * Canonical Codex-style tool-result bound at the final model-input seam. The
+ * identical pure normalizer also runs before conversation rows are persisted,
+ * so this is a live-turn defense rather than a request-only alternate history.
+ */
+export function boundModelToolOutputsFilterForSettings(settings: Settings): CallModelInputFilter {
+  return ({ modelData }) => ({
+    ...modelData,
+    input: boundModelToolOutputItems(
+      modelData.input as unknown as Array<Record<string, unknown>>,
+      settings.modelToolOutputTruncationTokens,
+    ) as unknown as AgentInputItem[],
+  });
+}
+
+function estimateAgentToolSchemaTokens(agent: Agent<any, any>): number {
+  const localTools = Array.isArray((agent as { tools?: unknown }).tools)
+    ? ((agent as { tools: unknown[] }).tools ?? [])
+    : [];
+  const localDescriptors = localTools.map((candidate) => {
+    if (!candidate || typeof candidate !== "object") return candidate;
+    const tool = candidate as Record<string, unknown>;
+    return {
+      type: tool.type,
+      name: tool.name,
+      description: tool.description,
+      parameters: tool.parameters,
+      inputSchema: tool.inputSchema,
+      strict: tool.strict,
+      providerData: tool.providerData,
+    };
+  });
+  const mcpServers = Array.isArray((agent as { mcpServers?: unknown }).mcpServers)
+    ? ((agent as { mcpServers: unknown[] }).mcpServers ?? [])
+    : [];
+  const mcpTokens = mcpServers.reduce<number>((total, server) => {
+    const getter = (server as { modelToolSchemaTokens?: () => number } | null)
+      ?.modelToolSchemaTokens;
+    return total + (typeof getter === "function" ? getter.call(server) : 0);
+  }, 0);
+  return estimateSerializedValueTokens(localDescriptors) + mcpTokens;
+}
+
 export function contextRobustnessFilterForSettings(
   settings: Settings,
   options: ContextRobustnessFilterOptions = {},
 ): CallModelInputFilter {
   const thresholdTokens = compactionThresholdTokens(settings);
-  return async ({ modelData }) => {
+  let previousRequest: { revision: number; footprint: CompleteModelInputFootprint } | null = null;
+  let requestRevision = 0;
+  return async ({ modelData, agent }) => {
     const input = modelData.input;
     if (options.throwOnCompactionNeeded) {
-      const reported = options.contextCompactionSignalTokens?.();
-      const hasReported = typeof reported === "number" && reported > 0;
-      const signalTokens = hasReported
-        ? reported
-        : estimateTokens(input as unknown as Array<Record<string, unknown>>);
+      const reported = options.contextCompactionSignal?.();
+      const current: CompleteModelInputFootprint = {
+        input: input as unknown as Array<Record<string, unknown>>,
+        instructionsTokens: estimateSerializedValueTokens(modelData.instructions ?? ""),
+        toolSchemaTokens: estimateAgentToolSchemaTokens(agent),
+      };
+      // Stream consumption can lag the SDK's background model loop. A provider
+      // usage signal is safe only when its response revision belongs to the
+      // immediately preceding request. Never attach a delayed response count to
+      // a newer footprint: doing so can hide all model output produced between
+      // them and recreate an under-counting compaction loop.
+      const boundProvider =
+        reported &&
+        previousRequest &&
+        reported.revision === previousRequest.revision &&
+        hasModelGeneratedItem(current.input)
+          ? reported
+          : null;
+      const estimate = estimateCompleteModelInput({
+        current,
+        provider: boundProvider,
+        providerRequestFootprint: boundProvider ? (previousRequest?.footprint ?? null) : null,
+      });
+      const signalTokens = estimate.tokens;
+      previousRequest = { revision: ++requestRevision, footprint: current };
       if (await options.contextCompactionRequested?.()) {
         throw new CompactionNeededError({
           signalTokens,
           thresholdTokens,
-          signalSource: hasReported ? "provider" : "estimate",
+          signalSource: boundProvider ? "provider" : "estimate",
           trigger: "operator",
         });
       }
@@ -2996,7 +3561,7 @@ export function contextRobustnessFilterForSettings(
         throw new CompactionNeededError({
           signalTokens,
           thresholdTokens,
-          signalSource: hasReported ? "provider" : "estimate",
+          signalSource: boundProvider ? "provider" : "estimate",
         });
       }
     }
@@ -3033,6 +3598,7 @@ export function callModelInputFilterForSettings(
   const filters: CallModelInputFilter[] = [
     normalizeComputerCallsFilter,
     elideSupersededViewImagesFilter,
+    boundModelToolOutputsFilterForSettings(settings),
   ];
   if (settings.openaiProviderItemIds === "strip") {
     filters.push(stripProviderItemIdsFilter);
@@ -3050,7 +3616,11 @@ export async function runAgentStream(
   const prepared: PreparedAgentInput =
     typeof input === "string" || input instanceof RunState ? { input } : input;
   const environment = overrides.sandboxEnvironment ?? collectSandboxEnvironment(settings);
+  const toolspaceTokenFile = toolspaceTokenFileForAgent(agent, environment);
   const genesisTitleInputFilter = takeGenesisTitleInputFilter(agent);
+  if (overrides.onRunCredentialSessionReady && !overrides.runCredentialSessionId) {
+    throw new Error("runCredentialSessionId is required when run credential setup is enabled");
+  }
 
   // OWNED PATH (P1.2 ownership inversion): the per-turn resume path injected a
   // live, externally-owned box. We thread the live `session` straight into
@@ -3069,11 +3639,24 @@ export async function runAgentStream(
     // whose per-op pointer re-read could land these execs on a machine swapped in
     // mid-turn.
     const setupSession = (overrides.ownedSandbox.setupSession ?? session) as SandboxSessionLike;
+    const credentialAgentSession = overrides.runCredentialSessionId
+      ? withRunCredentialsSession(session as SandboxSessionLike, overrides.runCredentialSessionId)
+      : (session as SandboxSessionLike);
+    const agentSession = toolspaceTokenFile
+      ? withToolspaceTokenSession(credentialAgentSession, toolspaceTokenFile)
+      : credentialAgentSession;
+    const credentialSetupSession = overrides.runCredentialSessionId
+      ? withRunCredentialsSession(setupSession, overrides.runCredentialSessionId)
+      : setupSession;
+    const decoratedSetupSession = toolspaceTokenFile
+      ? withToolspaceTokenSession(credentialSetupSession, toolspaceTokenFile)
+      : credentialSetupSession;
     // Platform setup (manifest-env pin + beforeAgentStart hooks + file downloads)
     // against the UN-proxied established box — the ONE-TRUTH helper shared with the
     // lazy provisioner. Eager path: runs here, before the run starts (unchanged).
     if (!overrides.ownedSandbox.deferredSetup) {
-      await runOwnedSandboxSetup(agent, session as SandboxSessionLike, setupSession, {
+      await overrides.onRunCredentialSessionReady?.(session as SandboxSessionLike);
+      await runOwnedSandboxSetup(agent, session as SandboxSessionLike, decoratedSetupSession, {
         settings,
         environment,
         preparedInput: prepared,
@@ -3081,7 +3664,17 @@ export async function runAgentStream(
           ? { fileDownloadsMaterialized: true }
           : {}),
         ...(overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {}),
+        ...(overrides.turnToolCancellationFence
+          ? {
+              commandRunner: overrides.turnToolCancellationFence.runSandboxCommand.bind(
+                overrides.turnToolCancellationFence,
+              ),
+            }
+          : {}),
       });
+      if (toolspaceTokenSeedForAgent(agent)) {
+        await overrides.onToolspaceTokenSessionReady?.(agentSession);
+      }
       await overrides.onGitCredentialSessionReady?.(setupSession);
     }
     const runAs = sandboxRunAs(settings);
@@ -3091,11 +3684,19 @@ export async function runAgentStream(
         ? withSandboxFileDownloads(ownedClient as SandboxClient, fileDownloads, {
             ...(overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {}),
             ...(runAs ? { runAs } : {}),
+            ...(overrides.turnToolCancellationFence
+              ? {
+                  commandRunner: overrides.turnToolCancellationFence.runSandboxCommand.bind(
+                    overrides.turnToolCancellationFence,
+                  ),
+                }
+              : {}),
           })
         : (ownedClient as SandboxClient);
     // TOKEN-BROKER (B1): the per-turn git token seed, forwarded OFF-MANIFEST so the
     // repository-clone hook seeds it to the box's token file before the clone.
     const ownedGitTokenSeeds = gitTokenSeedsForAgent(agent);
+    const ownedGitCredentialBindings = gitCredentialBindingsForAgent(agent);
     const ownedToolspaceTokenSeed = toolspaceTokenSeedForAgent(agent);
     const ownedRigSetup = rigSetupDescriptorForAgent(agent);
     const ownedHooks = [
@@ -3108,6 +3709,9 @@ export async function runAgentStream(
         rigCredentialHooksForAgent(agent),
       ),
       ...sandboxToolspaceTokenHooksForAgent(agent),
+      ...toolspaceTokenSessionRegistrationHooks(
+        ownedToolspaceTokenSeed ? overrides.onToolspaceTokenSessionReady : undefined,
+      ),
       ...sandboxRepositoryCloneHooksForAgent(agent),
       ...gitCredentialSessionRegistrationHooks(overrides.onGitCredentialSessionReady),
     ];
@@ -3116,37 +3720,60 @@ export async function runAgentStream(
       ...(overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {}),
       ...(runAs ? { runAs } : {}),
       ...(ownedGitTokenSeeds ? { gitTokenSeeds: ownedGitTokenSeeds } : {}),
+      ...(ownedGitCredentialBindings ? { gitCredentialBindings: ownedGitCredentialBindings } : {}),
       ...(ownedToolspaceTokenSeed ? { toolspaceTokenSeed: ownedToolspaceTokenSeed } : {}),
+      ...(toolspaceTokenFile ? { toolspaceTokenFile } : {}),
       ...(ownedRigSetup ? { rigSetup: ownedRigSetup } : {}),
     };
-    // Keep the decoration as a safety net for any session the SDK does create/resume
-    // through the client during this run (it is inert for the provided session).
-    const decoratedClient = withSandboxLifecycleHooks(resourceClient, ownedHooks, ownedHookContext);
+    // Keep both credential seeding and lifecycle decoration as a safety net for
+    // any session the SDK does create/resume during this run. They are inert for
+    // the provided session, which remains the normal ownership-inverted path.
+    const credentialResourceClient = overrides.runCredentialSessionId
+      ? withRunCredentialsClient(
+          resourceClient,
+          overrides.runCredentialSessionId,
+          overrides.onRunCredentialSessionReady,
+        )
+      : resourceClient;
+    const toolspaceResourceClient = toolspaceTokenFile
+      ? withToolspaceTokenClient(credentialResourceClient, toolspaceTokenFile)
+      : credentialResourceClient;
+    const decoratedClient = withSandboxLifecycleHooks(
+      toolspaceResourceClient,
+      ownedHooks,
+      ownedHookContext,
+    );
     const ownedFilter = composeCallModelInputFilters(
       [
-        callModelInputFilterForSettings(settings, {
+        callModelInputFilterForSettings(settings),
+        genesisTitleInputFilter,
+        overrides.callModelInputFilter,
+        // A caller filter may synthesize model input. Re-apply the idempotent
+        // canonical bound at the literal final seam before accounting/provider
+        // serialization so no extension can bypass the policy.
+        boundModelToolOutputsFilterForSettings(settings),
+        contextRobustnessFilterForSettings(settings, {
           throwOnCompactionNeeded: Boolean(
-            overrides.contextCompactionSignalTokens || overrides.contextCompactionRequested,
+            overrides.contextCompactionSignal || overrides.contextCompactionRequested,
           ),
-          ...(overrides.contextCompactionSignalTokens
-            ? { contextCompactionSignalTokens: overrides.contextCompactionSignalTokens }
+          ...(overrides.contextCompactionSignal
+            ? { contextCompactionSignal: overrides.contextCompactionSignal }
             : {}),
           ...(overrides.contextCompactionRequested
             ? { contextCompactionRequested: overrides.contextCompactionRequested }
             : {}),
         }),
-        genesisTitleInputFilter,
-        overrides.callModelInputFilter,
       ].filter((f): f is CallModelInputFilter => Boolean(f)),
     );
     const ownedRunOptions: Parameters<typeof run>[2] = {
       stream: true,
       maxTurns: settings.agentMaxModelCallsPerTurn,
       callModelInputFilter: ownedFilter,
+      ...(overrides.signal ? { signal: overrides.signal } : {}),
     };
     ownedRunOptions.sandbox = {
       client: decoratedClient,
-      session,
+      session: agentSession,
       ...(sessionState ? { sessionState } : {}),
     } as SandboxRunConfig;
     return await runScopedRunner(settings).run(agent, prepared.input, ownedRunOptions);
@@ -3171,14 +3798,27 @@ export async function runAgentStream(
           ...(runAs ? { runAs } : {}),
         })
       : refreshedClient;
+  const credentialClient =
+    resourceClient && overrides.runCredentialSessionId
+      ? withRunCredentialsClient(
+          resourceClient,
+          overrides.runCredentialSessionId,
+          overrides.onRunCredentialSessionReady,
+        )
+      : resourceClient;
+  const toolspaceClient =
+    credentialClient && toolspaceTokenFile
+      ? withToolspaceTokenClient(credentialClient, toolspaceTokenFile)
+      : credentialClient;
   // TOKEN-BROKER (B1): the per-turn git token seed, forwarded OFF-MANIFEST so the
   // repository-clone hook seeds it to the box's token file before the clone.
   const gitTokenSeeds = gitTokenSeedsForAgent(agent);
+  const gitCredentialBindings = gitCredentialBindingsForAgent(agent);
   const toolspaceTokenSeed = toolspaceTokenSeedForAgent(agent);
   const legacyRigSetup = rigSetupDescriptorForAgent(agent);
-  const client = resourceClient
+  const client = toolspaceClient
     ? withSandboxLifecycleHooks(
-        resourceClient,
+        toolspaceClient,
         [
           // M3: same rig-setup-first ordering + credential-hook union as the owned
           // path (this legacy create/resume decoration path is byte-for-byte today
@@ -3189,6 +3829,9 @@ export async function runAgentStream(
             rigCredentialHooksForAgent(agent),
           ),
           ...sandboxToolspaceTokenHooksForAgent(agent),
+          ...toolspaceTokenSessionRegistrationHooks(
+            toolspaceTokenSeed ? overrides.onToolspaceTokenSessionReady : undefined,
+          ),
           ...sandboxRepositoryCloneHooksForAgent(agent),
           ...gitCredentialSessionRegistrationHooks(overrides.onGitCredentialSessionReady),
         ],
@@ -3197,7 +3840,9 @@ export async function runAgentStream(
           ...(overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {}),
           ...(runAs ? { runAs } : {}),
           ...(gitTokenSeeds ? { gitTokenSeeds } : {}),
+          ...(gitCredentialBindings ? { gitCredentialBindings } : {}),
           ...(toolspaceTokenSeed ? { toolspaceTokenSeed } : {}),
+          ...(toolspaceTokenFile ? { toolspaceTokenFile } : {}),
           ...(legacyRigSetup ? { rigSetup: legacyRigSetup } : {}),
         },
       )
@@ -3210,19 +3855,21 @@ export async function runAgentStream(
   // OpenGeni's durable conversation truth is still reconciled explicitly below.
   const callModelInputFilter = composeCallModelInputFilters(
     [
-      callModelInputFilterForSettings(settings, {
+      callModelInputFilterForSettings(settings),
+      genesisTitleInputFilter,
+      overrides.callModelInputFilter,
+      boundModelToolOutputsFilterForSettings(settings),
+      contextRobustnessFilterForSettings(settings, {
         throwOnCompactionNeeded: Boolean(
-          overrides.contextCompactionSignalTokens || overrides.contextCompactionRequested,
+          overrides.contextCompactionSignal || overrides.contextCompactionRequested,
         ),
-        ...(overrides.contextCompactionSignalTokens
-          ? { contextCompactionSignalTokens: overrides.contextCompactionSignalTokens }
+        ...(overrides.contextCompactionSignal
+          ? { contextCompactionSignal: overrides.contextCompactionSignal }
           : {}),
         ...(overrides.contextCompactionRequested
           ? { contextCompactionRequested: overrides.contextCompactionRequested }
           : {}),
       }),
-      genesisTitleInputFilter,
-      overrides.callModelInputFilter,
     ].filter((f): f is CallModelInputFilter => Boolean(f)),
   );
   const runOptions: Parameters<typeof run>[2] = {
@@ -3233,6 +3880,7 @@ export async function runAgentStream(
     // raise the proactive compaction signal. This runs for turn-start replay AND
     // every mid-turn follow-up.
     callModelInputFilter,
+    ...(overrides.signal ? { signal: overrides.signal } : {}),
   };
   if (client) {
     runOptions.sandbox = {
@@ -3282,7 +3930,9 @@ function appendSandboxFileDownloadFailureNote(
  * default runner. setDefaultModelProvider remains only as a boot-time fallback.
  */
 function runScopedRunner(settings: Settings): Runner {
-  return new Runner({ modelProvider: new MultiProviderModelProvider(settings) });
+  return new Runner({
+    modelProvider: new MultiProviderModelProvider(settings),
+  });
 }
 
 export { MaxTurnsExceededError } from "@openai/agents";
@@ -3338,7 +3988,9 @@ export function withManifestRefreshOnResume(
       ? { supportsDefaultOptions: client.supportsDefaultOptions }
       : {}),
     ...(client.create
-      ? { create: async (...args: any[]) => await (client.create as any)(...args) }
+      ? {
+          create: async (...args: any[]) => await (client.create as any)(...args),
+        }
       : {}),
     resume: async (state: SandboxSessionState) => {
       const session = await client.resume!(state);
@@ -3346,7 +3998,9 @@ export function withManifestRefreshOnResume(
       return session;
     },
     ...(client.delete
-      ? { delete: async (state: SandboxSessionState) => await client.delete!(state) }
+      ? {
+          delete: async (state: SandboxSessionState) => await client.delete!(state),
+        }
       : {}),
     ...(client.serializeSessionState
       ? {
@@ -3395,7 +4049,11 @@ export async function applyMissingManifestEntries(
       state?: {
         manifest?:
           | Manifest
-          | { root?: string; entries?: Record<string, any>; environment?: Record<string, any> };
+          | {
+              root?: string;
+              entries?: Record<string, any>;
+              environment?: Record<string, any>;
+            };
       };
     }
   ).state?.manifest;
@@ -3505,7 +4163,11 @@ export function manifestEnvironmentDrift(
   if (added.length === 0 && removed.length === 0 && changed.length === 0) {
     return null;
   }
-  return { added: added.sort(), removed: removed.sort(), changed: changed.sort() };
+  return {
+    added: added.sort(),
+    removed: removed.sort(),
+    changed: changed.sort(),
+  };
 }
 
 async function reportManifestEnvironmentDrift(
@@ -3520,7 +4182,10 @@ async function reportManifestEnvironmentDrift(
   // Reporting must never break a resume: the drift itself is benign under the
   // env pin (the box keeps running on its baked env); only the SIGNAL matters.
   try {
-    await context.onRuntimeEvent?.({ type: "sandbox.env.drift", payload: drift });
+    await context.onRuntimeEvent?.({
+      type: "sandbox.env.drift",
+      payload: drift,
+    });
   } catch {
     // Swallow: a failed emit must not fail the turn.
   }
@@ -3549,7 +4214,11 @@ export async function pinProvidedSessionManifestEnvironment(
       state?: {
         manifest?:
           | Manifest
-          | { root?: string; entries?: Record<string, any>; environment?: Record<string, any> };
+          | {
+              root?: string;
+              entries?: Record<string, any>;
+              environment?: Record<string, any>;
+            };
       };
     }
   ).state?.manifest;
@@ -3603,6 +4272,9 @@ export async function runOwnedSandboxSetup(
     onRuntimeEvent?: SandboxLifecycleHookContext["onRuntimeEvent"];
     gitTokenSeedsOverride?: GitTokenSeeds;
     gitTokenSeedOverride?: string;
+    gitCredentialBindingsOverride?: GitCredentialBindingSeed[];
+    toolspaceTokenSeedOverride?: string;
+    commandRunner?: SandboxLifecycleCommandRunner;
   },
 ): Promise<void> {
   const { settings, environment } = opts;
@@ -3624,7 +4296,11 @@ export async function runOwnedSandboxSetup(
     ...(opts.gitTokenSeedOverride ? { github: opts.gitTokenSeedOverride } : {}),
     ...(opts.gitTokenSeedsOverride ?? {}),
   } satisfies GitTokenSeeds;
-  const ownedToolspaceTokenSeed = toolspaceTokenSeedForAgent(agent);
+  const ownedGitCredentialBindings =
+    opts.gitCredentialBindingsOverride ?? gitCredentialBindingsForAgent(agent);
+  const ownedToolspaceTokenSeed =
+    opts.toolspaceTokenSeedOverride ?? toolspaceTokenSeedForAgent(agent);
+  const ownedToolspaceTokenFile = toolspaceTokenFileForAgent(agent, environment);
   const ownedRigSetup = rigSetupDescriptorForAgent(agent);
   const ownedHooks = [
     // M3: rig setup runs FIRST so any tooling it installs is present for the
@@ -3646,8 +4322,11 @@ export async function runOwnedSandboxSetup(
     ...(opts.onRuntimeEvent ? { onRuntimeEvent: opts.onRuntimeEvent } : {}),
     ...(runAs ? { runAs } : {}),
     ...(Object.keys(ownedGitTokenSeeds).length > 0 ? { gitTokenSeeds: ownedGitTokenSeeds } : {}),
+    ...(ownedGitCredentialBindings ? { gitCredentialBindings: ownedGitCredentialBindings } : {}),
     ...(ownedToolspaceTokenSeed ? { toolspaceTokenSeed: ownedToolspaceTokenSeed } : {}),
+    ...(ownedToolspaceTokenFile ? { toolspaceTokenFile: ownedToolspaceTokenFile } : {}),
     ...(ownedRigSetup ? { rigSetup: ownedRigSetup } : {}),
+    ...(opts.commandRunner ? { commandRunner: opts.commandRunner } : {}),
   };
   // OWNED-PATH HOOKS: run the beforeAgentStart hooks directly against the provided
   // box, once per turn, BEFORE the run starts (repository-clone hook seeds the B1
@@ -3667,6 +4346,7 @@ export async function runOwnedSandboxSetup(
       const materialized = await materializeSandboxFileDownloads(setupSession, fileDownloads, {
         ...(opts.onRuntimeEvent ? { onRuntimeEvent: opts.onRuntimeEvent } : {}),
         ...(runAs ? { runAs } : {}),
+        ...(opts.commandRunner ? { commandRunner: opts.commandRunner } : {}),
       });
       if (opts.preparedInput) {
         appendSandboxFileDownloadFailureNote(opts.preparedInput, materialized.failures);
@@ -3700,7 +4380,7 @@ function mergePathGrants(
 export function withSandboxFileDownloads(
   client: SandboxClient,
   downloads: SandboxFileDownload[],
-  context: Pick<SandboxLifecycleHookContext, "onRuntimeEvent" | "runAs"> = {},
+  context: Pick<SandboxLifecycleHookContext, "onRuntimeEvent" | "runAs" | "commandRunner"> = {},
 ): SandboxClient {
   const normalizedDownloads = normalizeSandboxFileDownloads(downloads);
   if (normalizedDownloads.length === 0) {
@@ -3732,7 +4412,9 @@ export function withSandboxFileDownloads(
         }
       : {}),
     ...(client.delete
-      ? { delete: async (state: SandboxSessionState) => await client.delete!(state) }
+      ? {
+          delete: async (state: SandboxSessionState) => await client.delete!(state),
+        }
       : {}),
     ...(client.serializeSessionState
       ? {
@@ -3764,7 +4446,7 @@ export function withSandboxFileDownloads(
 export async function materializeSandboxFileDownloads(
   session: SandboxSessionLike,
   downloads: SandboxFileDownload[],
-  context: Pick<SandboxLifecycleHookContext, "onRuntimeEvent" | "runAs"> = {},
+  context: Pick<SandboxLifecycleHookContext, "onRuntimeEvent" | "runAs" | "commandRunner"> = {},
 ): Promise<SandboxFileDownloadMaterializationResult> {
   const normalizedDownloads = normalizeSandboxFileDownloads(downloads);
   if (normalizedDownloads.length === 0) {
@@ -3802,27 +4484,24 @@ export async function materializeSandboxFileDownloads(
     }
     let result: unknown;
     try {
-      result = session.exec
-        ? await session.exec({
-            cmd: sandboxFileDownloadCommand(download, targetPath),
-            workdir: "/workspace",
-            ...(context.runAs ? { runAs: context.runAs } : {}),
-            yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
-            maxOutputTokens: 20_000,
-          })
-        : await session.execCommand!({
-            cmd: sandboxFileDownloadCommand(download, targetPath),
-            workdir: "/workspace",
-            ...(context.runAs ? { runAs: context.runAs } : {}),
-            yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
-            maxOutputTokens: 20_000,
-          });
+      result = await runSandboxLifecycleCommand(
+        session,
+        {
+          cmd: sandboxFileDownloadCommand(download, targetPath),
+          workdir: "/workspace",
+          ...(context.runAs ? { runAs: context.runAs } : {}),
+          yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
+          maxOutputTokens: 20_000,
+        },
+        context.commandRunner,
+      );
       assertSandboxCommandSucceeded(result, `Sandbox file resource download ${download.fileId}`);
       await context.onRuntimeEvent?.({
         type: "sandbox.operation.completed",
         payload: { name: "file-resource-download", ...payload },
       });
     } catch (error) {
+      if (error instanceof TurnSandboxCommandCancelledError) throw error;
       const failure = sandboxFileDownloadFailure(download, targetPath, error, result);
       failures.push(failure);
       await context.onRuntimeEvent?.({
@@ -3899,82 +4578,87 @@ function ensureManifest(
   });
 }
 
-/** Coerce the various binary shapes a tool-output image `data` field can take into
- *  a Uint8Array. Handles a live `Uint8Array`, a plain number[] , and the
- *  object-of-numbers (`{"0":137,"1":80,…}`) that a `Uint8Array` degrades into after
- *  a JSON round-trip — the exact 10x-bloat shape this normalizer exists to kill. */
-function toImageBytes(data: unknown): Uint8Array | null {
-  if (data instanceof Uint8Array) {
-    return data;
-  }
+function base64DecodedByteLength(value: string): number {
+  const padding = value.endsWith("==") ? 2 : value.endsWith("=") ? 1 : 0;
+  return Math.max(0, Math.floor((value.length * 3) / 4) - padding);
+}
+
+/** Determine image byte length without allocating another binary/base64 copy. */
+function imageDataByteLength(data: unknown): number | null {
+  if (ArrayBuffer.isView(data)) return data.byteLength;
+  if (data instanceof ArrayBuffer) return data.byteLength;
   if (Array.isArray(data)) {
-    return data.every((n) => typeof n === "number") ? Uint8Array.from(data as number[]) : null;
+    return data.every((value) => typeof value === "number") ? data.length : null;
   }
-  if (data && typeof data === "object") {
-    const values = Object.values(data as Record<string, unknown>);
-    if (values.length > 0 && values.every((n) => typeof n === "number")) {
-      return Uint8Array.from(values as number[]);
-    }
+  if (!data || typeof data !== "object") return null;
+  const record = data as Record<string, unknown>;
+  if (record.type === "Buffer" && Array.isArray(record.data)) {
+    return record.data.every((value) => typeof value === "number") ? record.data.length : null;
   }
-  return null;
+  const keys = Object.keys(record);
+  return keys.length > 0 &&
+    keys.every((key) => /^\d+$/.test(key) && typeof record[key] === "number")
+    ? keys.length
+    : null;
 }
 
-/** Compact a structured image tool output — the SDK's `{type:'image', image:{data,mediaType}}`
- *  shape (produced by the codex-path `computer_screenshot` function tool) OR the already-
- *  normalized protocol `{type:'input_image', image:'data:…'}` item — into a `data:<mt>;base64,…`
- *  string. Returns null when `value` is not an image output. */
-function structuredImageToDataUrl(value: unknown): string | null {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return null;
-  }
-  const v = value as { type?: unknown; image?: unknown };
-  if (v.type === "input_image") {
-    // Protocol item: `image` is already a `data:…` (or plain URL) string.
-    return typeof v.image === "string" && v.image.length > 0 ? v.image : null;
-  }
-  if (v.type !== "image" || !v.image || typeof v.image !== "object") {
-    return null;
-  }
-  const image = v.image as { data?: unknown; mediaType?: unknown; url?: unknown };
-  if (typeof image.url === "string" && image.url.length > 0) {
-    return image.url;
-  }
+/**
+ * Convert one image-shaped tool result into a content-free audit fact. This is
+ * intentionally different from model history: the model keeps its structured
+ * image item, while `session_events` never becomes an implicit image blob store.
+ */
+function toolOutputMediaPreview(value: unknown): SessionEventMediaPreview | null {
+  if (typeof value === "string") {
+    return sessionEventMediaPreviewFromDataUrl(value);
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const record = value as Record<string, unknown>;
+  if (record.type === "input_image") {
+    const source = record.image ?? record.image_url ?? record.imageUrl;
+    const url =
+      typeof source === "string"
+        ? source
+        : source && typeof source === "object"
+          ? (source as Record<string, unknown>).url
+          : null;
+    if (typeof url !== "string" || url.length === 0) return null;
+    return sessionEventMediaPreviewFromDataUrl(url) ?? sessionEventMediaPreview("image/*", null);
+  }
+  if (record.type !== "image" || !record.image || typeof record.image !== "object") return null;
+  const image = record.image as Record<string, unknown>;
   const mediaType =
     typeof image.mediaType === "string" && image.mediaType.length > 0
       ? image.mediaType
       : "image/png";
+  if (typeof image.url === "string" && image.url.length > 0) {
+    return (
+      sessionEventMediaPreviewFromDataUrl(image.url) ?? sessionEventMediaPreview(mediaType, null)
+    );
+  }
   if (typeof image.data === "string") {
-    return image.data.startsWith("data:") ? image.data : `data:${mediaType};base64,${image.data}`;
+    return (
+      sessionEventMediaPreviewFromDataUrl(image.data) ??
+      sessionEventMediaPreview(mediaType, base64DecodedByteLength(image.data))
+    );
   }
-  const bytes = toImageBytes(image.data);
-  return bytes ? `data:${mediaType};base64,${Buffer.from(bytes).toString("base64")}` : null;
+  const byteLength = imageDataByteLength(image.data);
+  return byteLength === null ? null : sessionEventMediaPreview(mediaType, byteLength);
 }
 
 /**
- * Compact a tool-call output for the `agent.toolCall.output` SESSION EVENT so it
- * never carries a raw binary payload. The codex-path `computer_screenshot` function
- * tool returns a structured `{type:'image', image:{data: Uint8Array, mediaType}}`;
- * captured verbatim its `Uint8Array` JSON-serializes as an object-of-numbers (~12.7MB
- * per screenshot in session_events — ~10x the base64 form). This mirrors the desktop
- * screenshot to the SAME compact `data:<mediaType>;base64,…` STRING the HOSTED
- * `computer_call` event already carries (agents-core sets its output to that data-URL),
- * so both computer-use transports emit one representation. The full data-URL is kept
- * (not truncated) because the web timeline RENDERS the screenshot from this event
- * payload — packages/react/src/timeline/tool-renderers.tsx ComputerCallRenderer
- * (`out.startsWith("data:image")` → <ScreenshotFigure src={out}/>) and ViewImageRenderer.
- * Non-image outputs (text strings, MCP `{isError,content}` objects, hosted computer_call
- * data-URL strings) pass through unchanged.
+ * Normalize a tool-call output for the lossy `agent.toolCall.output` audit event.
+ * Inline image bytes/data URLs become a compact `media_preview` with exact byte
+ * length where knowable and `fullOutputAvailable:false`. The model-facing output
+ * is not changed here, and mixed arrays retain their non-image text/error facts.
  */
 export function normalizeToolOutputForEvent(output: unknown): unknown {
-  const single = structuredImageToDataUrl(output);
+  const single = toolOutputMediaPreview(output);
   if (single !== null) {
     return single;
   }
   if (Array.isArray(output)) {
-    const normalized = output.map((el) => structuredImageToDataUrl(el) ?? el);
-    // A lone image content item unwraps to the bare data-URL string the timeline
-    // image renderers expect; a mixed/multi array keeps its (now-compact) shape.
-    if (normalized.length === 1 && typeof normalized[0] === "string") {
+    const normalized = output.map((el) => toolOutputMediaPreview(el) ?? el);
+    if (normalized.length === 1 && normalized[0]?.type === "media_preview") {
       return normalized[0];
     }
     return normalized;
@@ -4002,7 +4686,10 @@ export function normalizeSdkEvent(event: RunStreamEvent): NormalizedRuntimeEvent
     return out;
   }
   if (event.type === "agent_updated_stream_event") {
-    out.push({ type: "agent.updated", payload: { agent: (event as any).agent?.name ?? null } });
+    out.push({
+      type: "agent.updated",
+      payload: { agent: (event as any).agent?.name ?? null },
+    });
     return out;
   }
   if (event.type !== "run_item_stream_event") {
@@ -4028,8 +4715,8 @@ export function normalizeSdkEvent(event: RunStreamEvent): NormalizedRuntimeEvent
       type: "agent.toolCall.output",
       payload: {
         id: item.rawItem?.callId ?? item.id ?? null,
-        // Compact any structured/binary image output to a data-URL string so a
-        // screenshot never bloats session_events ~10x as an object-of-numbers.
+        // Inline media becomes a content-free audit fact. Model history keeps
+        // the provider's real structured image output on its separate path.
         output: normalizeToolOutputForEvent(item.output),
       },
     });
@@ -4164,7 +4851,9 @@ function inputTokenDetailsProp(raw: Record<string, unknown>): Partial<ModelRespo
   if (!details || typeof details !== "object") {
     return {};
   }
-  return { inputTokensDetails: details as Record<string, number> | Array<Record<string, number>> };
+  return {
+    inputTokensDetails: details as Record<string, number> | Array<Record<string, number>>,
+  };
 }
 
 function outputTokenDetailsProp(
@@ -4181,17 +4870,45 @@ function outputTokenDetailsProp(
 }
 
 export function serializeApprovals(interruptions: unknown[]): unknown[] {
-  return interruptions.map((item: any) => {
-    if (typeof item?.toJSON === "function") {
-      return item.toJSON();
-    }
-    return {
-      id: approvalIdentifier(item),
-      name: item?.name ?? item?.rawItem?.name ?? "tool",
-      arguments: item?.arguments ?? item?.rawItem?.arguments ?? null,
-      raw: item,
-    };
-  });
+  return interruptions
+    .filter((item) => interruptionToolName(item) !== HUMAN_INPUT_TOOL_NAME)
+    .map((item: any) => {
+      if (typeof item?.toJSON === "function") {
+        return item.toJSON();
+      }
+      return {
+        id: approvalIdentifier(item) ?? "approval",
+        name: item?.name ?? item?.rawItem?.name ?? "tool",
+        arguments: item?.arguments ?? item?.rawItem?.arguments ?? null,
+        raw: item,
+      };
+    });
+}
+
+export function serializeHumanInputRequests(
+  interruptions: unknown[],
+): SerializedHumanInputInterruption[] {
+  return interruptions
+    .filter((item) => interruptionToolName(item) === HUMAN_INPUT_TOOL_NAME)
+    .map((item: any) => {
+      const rawArguments = item?.arguments ?? item?.rawItem?.arguments;
+      let parsedArguments: unknown = rawArguments;
+      if (typeof rawArguments === "string") {
+        try {
+          parsedArguments = JSON.parse(rawArguments);
+        } catch {
+          throw new Error("Human-input interruption contains invalid JSON arguments");
+        }
+      }
+      const toolCallId = approvalIdentifier(item);
+      if (!toolCallId) {
+        throw new Error("Human-input interruption is missing a stable tool-call identity");
+      }
+      return {
+        toolCallId,
+        input: RequestHumanInputToolInput.parse(parsedArguments),
+      };
+    });
 }
 
 export function buildManifest(
@@ -4200,6 +4917,7 @@ export function buildManifest(
   environment = collectSandboxEnvironment(settings),
   fileResourceDownloads: SandboxFileDownload[] = [],
 ): Manifest {
+  assertUniqueResourceMountPaths(resources);
   const entries: Record<string, any> = {};
   const downloadsByFileId = new Map(
     normalizeSandboxFileDownloads(fileResourceDownloads).map((download) => [
@@ -4210,9 +4928,9 @@ export function buildManifest(
   for (const resource of resources) {
     if (resource.kind === "repository") {
       const url = new URL(resource.uri);
-      const host = url.hostname.toLowerCase();
+      const host = url.host.toLowerCase();
       const repo = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
-      const mountPath = normalizeManifestPath(resource.mountPath ?? `repos/${repo}`);
+      const mountPath = resourceMountPath(resource);
       if (repositoryUsesSandboxClone(settings, resource)) {
         entries[mountPath] = dir();
         continue;
@@ -4221,12 +4939,12 @@ export function buildManifest(
         host,
         repo,
         ref: resource.ref,
-        ...(resource.subpath ? { subpath: normalizeManifestPath(resource.subpath) } : {}),
+        ...(resource.subpath ? { subpath: normalizeRepositorySubpath(resource.subpath) } : {}),
       });
       continue;
     }
     if (resource.kind === "file") {
-      const mountPath = normalizeManifestPath(resource.mountPath ?? `files/${resource.fileId}`);
+      const mountPath = resourceMountPath(resource);
       const download = downloadsByFileId.get(resource.fileId);
       entries[mountPath] = download
         ? sandboxDownloadDirectory(download, mountPath)
@@ -4282,7 +5000,9 @@ function objectStorageFileMount(settings: Settings, prefix: string): any {
       accountKey: config.accountKey,
       endpointUrl: config.endpointUrl,
       readOnly: true,
-      mountStrategy: inContainerMountStrategy({ pattern: { type: "rclone", mode: "fuse" } }),
+      mountStrategy: inContainerMountStrategy({
+        pattern: { type: "rclone", mode: "fuse" },
+      }),
     });
   }
   if (settings.objectStorageBackend === "aws-s3" || settings.objectStorageBackend === "gcs") {
@@ -4384,11 +5104,7 @@ function parseAzureConnectionString(value: string): Record<string, string> {
 }
 
 function normalizeManifestPath(path: string): string {
-  const normalized = path.replace(/^\/+|\/+$/g, "");
-  if (!normalized || normalized.includes("..")) {
-    throw new Error(`Invalid sandbox resource path: ${path}`);
-  }
-  return normalized;
+  return normalizeResourceMountPath(path);
 }
 
 function normalizeSandboxFileDownloads(downloads: SandboxFileDownload[]): SandboxFileDownload[] {
@@ -4451,6 +5167,11 @@ function shellQuote(value: string): string {
 
 export type SandboxLifecycleHookPhase = "beforeAgentStart";
 
+export type SandboxLifecycleCommandRunner = (
+  session: TurnSandboxCommandSession,
+  args: TurnSandboxCommandArgs,
+) => Promise<unknown>;
+
 export type SandboxLifecycleHookContext = {
   environment: Record<string, string>;
   onRuntimeEvent?: (event: NormalizedRuntimeEvent) => Promise<void> | void;
@@ -4462,12 +5183,28 @@ export type SandboxLifecycleHookContext = {
   // NEVER the box/agent manifest env (validateNoEnvironmentDelta must never see
   // rotating values).
   gitTokenSeeds?: GitTokenSeeds;
+  gitCredentialBindings?: GitCredentialBindingSeed[];
   toolspaceTokenSeed?: string;
+  toolspaceTokenFile?: string;
   // M3: the rig setup descriptor for the rig-setup hook (the script + marker
   // version id + the rig's own timeout). Present only on a rig-bound turn.
   rigSetup?: RigSetupDescriptor;
+  commandRunner?: SandboxLifecycleCommandRunner;
 };
 
+async function runSandboxLifecycleCommand(
+  session: SandboxSessionLike,
+  args: TurnSandboxCommandArgs,
+  commandRunner?: SandboxLifecycleCommandRunner,
+): Promise<unknown> {
+  if (commandRunner) {
+    return await commandRunner(session as TurnSandboxCommandSession, args);
+  }
+  if (session.exec) return await session.exec(args);
+  if (session.execCommand) return await session.execCommand(args);
+  throw new Error("Sandbox session does not support command execution");
+}
+
 // M3: everything the rig-setup hook needs to run the frozen rig version's setup
 // script exactly once per box. `versionId` keys the idempotence marker
 // (/var/opengeni/rig-setup-<versionId>.done); `timeoutMs` is the rig-specific
@@ -4574,7 +5311,9 @@ export function withSandboxLifecycleHooks(
         }
       : {}),
     ...(client.delete
-      ? { delete: async (state: SandboxSessionState) => await client.delete!(state) }
+      ? {
+          delete: async (state: SandboxSessionState) => await client.delete!(state),
+        }
       : {}),
     ...(client.serializeSessionState
       ? {
@@ -4615,10 +5354,32 @@ function gitTokenSeedsForAgent(agent: Agent<any, any>): GitTokenSeeds | undefine
   return agentGitTokenSeeds.get(agent);
 }
 
+function gitCredentialBindingsForAgent(
+  agent: Agent<any, any>,
+): GitCredentialBindingSeed[] | undefined {
+  return agentGitCredentialBindings.get(agent);
+}
+
 function toolspaceTokenSeedForAgent(agent: Agent<any, any>): string | undefined {
   return agentToolspaceTokenSeed.get(agent);
 }
 
+function toolspaceTokenSessionIdForAgent(agent: Agent<any, any>): string | undefined {
+  return agentToolspaceTokenSessionId.get(agent);
+}
+
+function toolspaceTokenFileForAgent(
+  agent: Agent<any, any>,
+  environment: Readonly<Record<string, string>>,
+): string | undefined {
+  if (!toolspaceTokenSeedForAgent(agent)) return undefined;
+  const sessionId = toolspaceTokenSessionIdForAgent(agent);
+  if (!sessionId) {
+    throw new Error("Toolspace token seed is missing its session identity");
+  }
+  return toolspaceTokenFileFromEnvironment(environment, sessionId);
+}
+
 function sandboxToolspaceTokenHooksForAgent(agent: Agent<any, any>): SandboxLifecycleHook[] {
   return toolspaceTokenSeedForAgent(agent)
     ? [
@@ -4688,6 +5449,22 @@ function gitCredentialSessionRegistrationHooks(
     : [];
 }
 
+function toolspaceTokenSessionRegistrationHooks(
+  callback: RunAgentStreamOptions["onToolspaceTokenSessionReady"],
+): SandboxLifecycleHook[] {
+  return callback
+    ? [
+        {
+          id: "toolspace-token-renewal-registration",
+          phase: "beforeAgentStart",
+          run: async (session) => {
+            await callback(session);
+          },
+        },
+      ]
+    : [];
+}
+
 function sandboxRepositoryCloneHooks(
   settings: Settings,
   resources: ResourceRef[],
@@ -4755,6 +5532,20 @@ function gitProviderSeedEnv(provider: GitCredentialProvider): string {
   return `OPENGENI_GIT_${provider.toUpperCase()}_TOKEN_SEED`;
 }
 
+export function gitCredentialBindingHash(credentialBindingId: string): string {
+  return createHash("sha256").update(credentialBindingId, "utf8").digest("hex").slice(0, 32);
+}
+
+function gitBindingSeedEnv(binding: GitCredentialBindingSeed): string {
+  return `OPENGENI_GIT_BINDING_${gitCredentialBindingHash(binding.credentialBindingId).toUpperCase()}_TOKEN_SEED`;
+}
+
+function gitCredentialBindingSeedExportPrefix(bindings: GitCredentialBindingSeed[]): string {
+  return bindings
+    .map((binding) => `export ${gitBindingSeedEnv(binding)}=${shellQuote(binding.token)}`)
+    .join("\n");
+}
+
 function gitTokenSeedExportPrefix(seeds: GitTokenSeeds): string {
   const lines: string[] = [];
   for (const provider of GIT_CREDENTIAL_PROVIDERS) {
@@ -4770,37 +5561,116 @@ function gitTokenSeedExportPrefix(seeds: GitTokenSeeds): string {
   return lines.join("\n");
 }
 
-function repositoryCredentialProvider(
-  resource: Extract<ResourceRef, { kind: "repository" }>,
-): GitCredentialProvider {
-  return resource.provider ?? "github";
+type RuntimeGitBindingDescriptor = {
+  provider: GitCredentialProvider;
+  credentialBindingId: string;
+  bindingHash: string;
+  protocol: string;
+  host: string;
+  path: string;
+  uri: string;
+};
+
+function runtimeGitBindingDescriptors(
+  resources: Extract<ResourceRef, { kind: "repository" }>[],
+): RuntimeGitBindingDescriptor[] {
+  const remoteBindings = new Map<string, string>();
+  const bindingProviders = new Map<string, GitCredentialProvider>();
+  return resources.map((resource) => {
+    const url = new URL(resource.uri);
+    const credentialProvider = gitCredentialProviderForRepository(resource);
+    // Provider-less public/legacy resources retain the historical GitHub
+    // askpass fallback, but credential-bound resources derive through the
+    // shared contracts helper used by the worker and core.
+    const provider = credentialProvider ?? "github";
+    const credentialBindingId =
+      gitCredentialBindingIdForRepository(resource, credentialProvider) ?? provider;
+    const path = url.pathname.replace(/^\/+|\/+$/g, "");
+    const remote = `${url.protocol.toLowerCase()}//${url.host.toLowerCase()}/${path.replace(/\.git$/, "")}`;
+    const bindingKey = `${provider}\u0000${credentialBindingId}`;
+    const boundProvider = bindingProviders.get(credentialBindingId);
+    if (boundProvider && boundProvider !== provider) {
+      throw new Error(
+        `credential binding ${credentialBindingId} is assigned to multiple Git providers`,
+      );
+    }
+    bindingProviders.set(credentialBindingId, provider);
+    const claimed = remoteBindings.get(remote);
+    if (claimed && claimed !== bindingKey) {
+      throw new Error(
+        `repository remote ${resource.uri} is claimed by multiple credential bindings`,
+      );
+    }
+    remoteBindings.set(remote, bindingKey);
+    return {
+      provider,
+      credentialBindingId,
+      bindingHash: gitCredentialBindingHash(credentialBindingId),
+      protocol: url.protocol.replace(/:$/, "").toLowerCase(),
+      host: url.host.toLowerCase(),
+      path,
+      uri: resource.uri,
+    };
+  });
+}
+
+function gitUsernameForProvider(provider: GitCredentialProvider): string {
+  if (provider === "github") return "x-access-token";
+  if (provider === "gitlab") return "oauth2";
+  return "opengeni";
+}
+
+function gitCredentialHelperBindingCaseLines(
+  resources: Extract<ResourceRef, { kind: "repository" }>[],
+): string[] {
+  return runtimeGitBindingDescriptors(resources).flatMap((descriptor) => {
+    const paths = new Set([
+      descriptor.path,
+      descriptor.path.replace(/\.git$/, ""),
+      `${descriptor.path.replace(/\.git$/, "")}.git`,
+    ]);
+    return [...paths].map(
+      (path) =>
+        `  ${shellQuote(`${descriptor.protocol}|${descriptor.host}|${path}`)}) username=${shellQuote(gitUsernameForProvider(descriptor.provider))}; token_file="$credential_dir/${descriptor.bindingHash}-token" ;;`,
+    );
+  });
 }
 
 function gitAskpassHostProviderCaseLines(
   resources: Extract<ResourceRef, { kind: "repository" }>[],
 ): string[] {
-  const hosts = new Map<string, GitCredentialProvider>();
-  for (const resource of resources) {
-    try {
-      const hostname = new URL(resource.uri).hostname.toLowerCase();
-      if (!hostname) {
-        continue;
-      }
-      hosts.set(hostname, repositoryCredentialProvider(resource));
-    } catch {
-      // Resource validation catches invalid URIs before normal runtime use. Keep
-      // helper generation tolerant so tests for clone failure can still build.
-    }
+  const hosts = new Map<string, { provider: GitCredentialProvider; bindings: Set<string> }>();
+  for (const descriptor of runtimeGitBindingDescriptors(resources)) {
+    const entry = hosts.get(descriptor.host) ?? {
+      provider: descriptor.provider,
+      bindings: new Set<string>(),
+    };
+    entry.bindings.add(`${descriptor.provider}\u0000${descriptor.credentialBindingId}`);
+    hosts.set(descriptor.host, entry);
   }
   return [...hosts.entries()]
+    .filter(([, entry]) => entry.bindings.size === 1)
     .sort(([a], [b]) => a.localeCompare(b))
     .map(
-      ([hostname, provider]) =>
-        `    ${shellQuote(hostname)}) printf '%s\\n' ${provider}; return 0 ;;`,
+      ([hostname, entry]) =>
+        `    ${shellQuote(hostname)}) printf '%s\\n' ${entry.provider}; return 0 ;;`,
     );
 }
 
-function gitCredentialTokenWriterCommandLines(): string[] {
+function gitCredentialTokenWriterCommandLines(bindings: GitCredentialBindingSeed[] = []): string[] {
+  const bindingWrites = bindings.flatMap((binding) => {
+    const hash = gitCredentialBindingHash(binding.credentialBindingId);
+    const seedEnv = gitBindingSeedEnv(binding);
+    const count = Math.max(1, binding.providerBindingCount ?? 1);
+    const provider = binding.provider;
+    const lines = [`write_git_binding_token ${shellQuote(hash)} "\${${seedEnv}:-}"`];
+    if (count === 1) {
+      lines.push(`write_git_provider_token ${shellQuote(provider)} "\${${seedEnv}:-}"`);
+    } else {
+      lines.push(`remove_git_provider_token ${shellQuote(provider)}`);
+    }
+    return lines;
+  });
   return [
     // TOKEN-BROKER (B1/B2): seed run-scoped provider tokens into stable files and
     // atomically replace each provider file. Token VALUES are supplied only by
@@ -4814,6 +5684,23 @@ function gitCredentialTokenWriterCommandLines(): string[] {
     "    *) printf '%s\\n' \"${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/$provider-token\" ;;",
     "  esac",
     "}",
+    "write_git_binding_token() {",
+    '  binding_hash="$1"',
+    '  token="$2"',
+    '  [ -n "$token" ] || return 0',
+    '  credential_dir="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}"',
+    '  mkdir -p "$credential_dir"',
+    '  token_file="$credential_dir/$binding_hash-token"',
+    '  printf \'%s\' "$token" > "$token_file.tmp.$$"',
+    '  mv -f "$token_file.tmp.$$" "$token_file"',
+    "}",
+    "remove_git_provider_token() {",
+    '  provider="$1"',
+    '  rm -f "$(git_provider_token_file "$provider")"',
+    '  if [ "$provider" = github ]; then',
+    '    rm -f "${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/github-token"',
+    "  fi",
+    "}",
     "write_git_provider_token() {",
     '  provider="$1"',
     '  token="$2"',
@@ -4834,16 +5721,53 @@ function gitCredentialTokenWriterCommandLines(): string[] {
     'write_git_provider_token github "${OPENGENI_GIT_GITHUB_TOKEN_SEED:-${OPENGENI_GIT_TOKEN_SEED:-}}"',
     'write_git_provider_token gitlab "${OPENGENI_GIT_GITLAB_TOKEN_SEED:-}"',
     'write_git_provider_token azure_devops "${OPENGENI_GIT_AZURE_DEVOPS_TOKEN_SEED:-}"',
+    ...bindingWrites,
     'umask "$seed_umask"',
   ];
 }
 
 function gitCredentialHelperCommandLines(
   resources: Extract<ResourceRef, { kind: "repository" }>[] = [],
+  bindings: GitCredentialBindingSeed[] = [],
 ): string[] {
   const hostProviderCases = gitAskpassHostProviderCaseLines(resources);
+  const bindingCases = gitCredentialHelperBindingCaseLines(resources);
+  const descriptors = runtimeGitBindingDescriptors(resources);
+  const wrapperDescriptors = bindings.length > 0 ? descriptors : [];
+  const bindingProviders = new Map<GitCredentialProvider, Set<string>>();
+  for (const descriptor of runtimeGitBindingDescriptors(resources)) {
+    const ids = bindingProviders.get(descriptor.provider) ?? new Set<string>();
+    ids.add(descriptor.credentialBindingId);
+    bindingProviders.set(descriptor.provider, ids);
+  }
+  const strictAskpass = [...bindingProviders.values()].some((ids) => ids.size > 1);
+  const allowedWrapperHashes = [
+    ...new Set(wrapperDescriptors.map((item) => `${item.provider}|${item.bindingHash}`)),
+  ].map((key) => `    ${shellQuote(key)}) return 0 ;;`);
+  const originWrapperHashes = wrapperDescriptors.flatMap((item) => {
+    const base = item.uri.replace(/\.git$/, "");
+    return [...new Set([item.uri, base, `${base}.git`])].map(
+      (uri) =>
+        `    ${shellQuote(`${item.provider}|${uri}`)}) printf '%s\\n' ${shellQuote(item.bindingHash)}; return 0 ;;`,
+    );
+  });
+  const soleWrapperHashes = [...bindingProviders.entries()].flatMap(([provider, ids]) => {
+    if (ids.size !== 1) return [];
+    const descriptor = wrapperDescriptors.find((item) => item.provider === provider);
+    return descriptor
+      ? [
+          `    ${shellQuote(provider)}) printf '%s\\n' ${shellQuote(descriptor.bindingHash)}; return 0 ;;`,
+        ]
+      : [];
+  });
+  const multiWrapperProviders =
+    bindings.length > 0
+      ? [...bindingProviders.entries()]
+          .filter(([, ids]) => ids.size > 1)
+          .map(([provider]) => provider)
+      : [];
   return [
-    ...gitCredentialTokenWriterCommandLines(),
+    ...gitCredentialTokenWriterCommandLines(bindings),
     // Provision git/provider-CLI helpers at SETUP (runtime) before any clone
     // runs. Renewal updates only token files and deliberately leaves these
     // repository-specific host mappings intact.
@@ -4860,8 +5784,8 @@ function gitCredentialHelperCommandLines(
     '  rest="${prompt_lower#*://}"',
     '  rest="${rest#*@}"',
     '  host="${rest%%/*}"',
-    '  host="${host%%:*}"',
     '  host="$(printf \'%s\\n\' "$host" | tr -d "\'")"',
+    '  host="${host%:}"',
     "  printf '%s\\n' \"$host\"",
     "}",
     "provider_for_prompt() {",
@@ -4873,7 +5797,7 @@ function gitCredentialHelperCommandLines(
     "    *github.com*|*githubusercontent.com*) printf '%s\\n' github ;;",
     "    *gitlab*) printf '%s\\n' gitlab ;;",
     "    *dev.azure.com*|*.visualstudio.com*) printf '%s\\n' azure_devops ;;",
-    "    *) printf '%s\\n' github ;;",
+    strictAskpass ? "    *) printf '\\n' ;;" : "    *) printf '%s\\n' github ;;",
     "  esac",
     "}",
     "token_file_for_provider() {",
@@ -4899,6 +5823,40 @@ function gitCredentialHelperCommandLines(
     "ASKPASS_EOF",
     'chmod 0755 "$git_askpass.tmp.$$"',
     'mv -f "$git_askpass.tmp.$$" "$git_askpass"',
+    'git_credential_helper="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/helper"',
+    'mkdir -p "$(dirname "$git_credential_helper")"',
+    "cat > \"$git_credential_helper.tmp.$$\" <<'GIT_CREDENTIAL_HELPER_EOF'",
+    "#!/usr/bin/env sh",
+    "set -eu",
+    '[ "${1:-get}" = get ] || exit 0',
+    "protocol= host= path=",
+    "while IFS='=' read -r key value; do",
+    '  case "$key" in',
+    "    protocol) protocol=\"$(printf '%s' \"$value\" | tr '[:upper:]' '[:lower:]')\" ;;",
+    "    host) host=\"$(printf '%s' \"$value\" | tr '[:upper:]' '[:lower:]')\" ;;",
+    '    path) path="${value#/}" ;;',
+    "  esac",
+    "done",
+    'credential_dir="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}"',
+    "username= token_file=",
+    'case "$protocol|$host|$path" in',
+    ...bindingCases,
+    "  *) exit 0 ;;",
+    "esac",
+    '[ -r "$token_file" ] || exit 0',
+    'password="$(cat "$token_file" 2>/dev/null || true)"',
+    '[ -n "$password" ] || exit 0',
+    'printf \'username=%s\\npassword=%s\\n\' "$username" "$password"',
+    "GIT_CREDENTIAL_HELPER_EOF",
+    'chmod 0755 "$git_credential_helper.tmp.$$"',
+    'mv -f "$git_credential_helper.tmp.$$" "$git_credential_helper"',
+    // Empty helper resets lower-priority/system helpers; our exact path-aware
+    // helper returns no credential for an unbound remote, so multi-binding
+    // sessions fail closed instead of falling through to ambient credentials.
+    "git config --global --unset-all credential.helper >/dev/null 2>&1 || true",
+    "git config --global --add credential.helper ''",
+    'git config --global --add credential.helper "$git_credential_helper"',
+    "git config --global credential.useHttpPath true",
     'wrapper_dir="${OPENGENI_GIT_CLI_WRAPPER_DIR:-$HOME/.opengeni/bin}"',
     'mkdir -p "$wrapper_dir"',
     "for opengeni_git_cli_tool in gh glab az; do",
@@ -4913,11 +5871,53 @@ function gitCredentialHelperCommandLines(
     "  az) provider=azure_devops; token_env=AZURE_DEVOPS_EXT_PAT ;;",
     "  *) provider=; token_env= ;;",
     "esac",
-    'if [ -n "$provider" ]; then',
+    "hash_binding_id() {",
+    "  if command -v sha256sum >/dev/null 2>&1; then printf '%s' \"$1\" | sha256sum | cut -c1-32; return; fi",
+    "  if command -v shasum >/dev/null 2>&1; then printf '%s' \"$1\" | shasum -a 256 | cut -c1-32; return; fi",
+    "  if command -v openssl >/dev/null 2>&1; then printf '%s' \"$1\" | openssl dgst -sha256 | sed 's/^.*= //' | cut -c1-32; return; fi",
+    "  printf '%s\\n' 'No SHA-256 utility is available to select OPENGENI_GIT_BINDING' >&2",
+    "  return 127",
+    "}",
+    "binding_hash_allowed() {",
+    '  case "$provider|$1" in',
+    ...allowedWrapperHashes,
+    "    *) return 1 ;;",
+    "  esac",
+    "}",
+    "binding_hash_for_origin() {",
+    '  case "$provider|$1" in',
+    ...originWrapperHashes,
+    "    *) return 1 ;;",
+    "  esac",
+    "}",
+    "sole_binding_hash() {",
     '  case "$provider" in',
-    '    github) token_file="${OPENGENI_GIT_TOKEN_FILE:-$HOME/.opengeni/git-token}" ;;',
-    '    *) token_file="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/$provider-token" ;;',
+    ...soleWrapperHashes,
+    "    *) return 1 ;;",
     "  esac",
+    "}",
+    `multi_binding_providers=${shellQuote(multiWrapperProviders.join(" "))}`,
+    'if [ -n "$provider" ]; then',
+    "  binding_hash=",
+    '  if [ -n "${OPENGENI_GIT_BINDING:-}" ]; then',
+    '    binding_hash="$(hash_binding_id "$OPENGENI_GIT_BINDING")"',
+    '    binding_hash_allowed "$binding_hash" || { printf \'%s\\n\' "OPENGENI_GIT_BINDING does not select a $provider credential attached to this session" >&2; exit 2; }',
+    "  elif command -v git >/dev/null 2>&1; then",
+    '    origin="$(git config --get remote.origin.url 2>/dev/null || true)"',
+    '    [ -z "$origin" ] || binding_hash="$(binding_hash_for_origin "$origin" 2>/dev/null || true)"',
+    "  fi",
+    '  [ -n "$binding_hash" ] || binding_hash="$(sole_binding_hash 2>/dev/null || true)"',
+    '  if [ -n "$binding_hash" ]; then',
+    '    token_file="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/$binding_hash-token"',
+    "  else",
+    '    case " $multi_binding_providers " in',
+    '      *" $provider "*) printf \'%s\\n\' "Unable to select one of multiple $provider credentials; run inside an attached repository or set OPENGENI_GIT_BINDING" >&2; exit 2 ;;',
+    "    esac",
+    '    case "$provider" in',
+    '      github) token_file="${OPENGENI_GIT_TOKEN_FILE:-$HOME/.opengeni/git-token}" ;;',
+    '      *) token_file="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/$provider-token" ;;',
+    "    esac",
+    "  fi",
     '  if [ -f "$token_file" ]; then',
     '    token="$(cat "$token_file" 2>/dev/null || true)"',
     '    if [ -n "$token" ]; then',
@@ -4972,10 +5972,23 @@ export function gitProviderTokenRefreshCommand(seeds: GitTokenSeeds): string {
   ].join("\n");
 }
 
+export function gitCredentialBindingTokenRefreshCommand(
+  bindings: GitCredentialBindingSeed[],
+): string {
+  const seedPrefix = gitCredentialBindingSeedExportPrefix(bindings);
+  if (!seedPrefix) return "";
+  return [
+    seedPrefix,
+    "set -eu",
+    'export HOME="${HOME:-/workspace}"',
+    ...gitCredentialTokenWriterCommandLines(bindings),
+  ].join("\n");
+}
+
 export async function refreshGitProviderTokenFiles(
   session: GitCredentialTokenWriterSession,
   seeds: GitTokenSeeds,
-  options: { runAs?: string } = {},
+  options: { runAs?: string; commandRunner?: SandboxLifecycleCommandRunner } = {},
 ): Promise<void> {
   const command = gitProviderTokenRefreshCommand(seeds);
   if (!command) {
@@ -4988,23 +6001,41 @@ export async function refreshGitProviderTokenFiles(
     yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
     maxOutputTokens: 4_000,
   };
-  if (session.exec) {
-    assertSandboxCommandSucceeded(await session.exec(args), "Git credential refresh");
-  } else if (session.execCommand) {
-    assertSandboxCommandSucceeded(await session.execCommand(args), "Git credential refresh");
-  } else {
-    throw new Error("Sandbox session does not support command execution");
-  }
+  assertSandboxCommandSucceeded(
+    await runSandboxLifecycleCommand(session, args, options.commandRunner),
+    "Git credential refresh",
+  );
+}
+
+export async function refreshGitCredentialBindingTokenFiles(
+  session: GitCredentialTokenWriterSession,
+  bindings: GitCredentialBindingSeed[],
+  options: { runAs?: string; commandRunner?: SandboxLifecycleCommandRunner } = {},
+): Promise<void> {
+  const command = gitCredentialBindingTokenRefreshCommand(bindings);
+  if (!command) return;
+  const args = {
+    cmd: command,
+    workdir: "/workspace",
+    ...(options.runAs ? { runAs: options.runAs } : {}),
+    yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
+    maxOutputTokens: 4_000,
+  };
+  assertSandboxCommandSucceeded(
+    await runSandboxLifecycleCommand(session, args, options.commandRunner),
+    "Git credential binding refresh",
+  );
 }
 
 export function repositoryCloneCommand(
   resources: Extract<ResourceRef, { kind: "repository" }>[],
+  bindings: GitCredentialBindingSeed[] = [],
 ): string {
+  assertUniqueResourceMountPaths(resources);
   const commands = [
     "set -eu",
     'export HOME="${HOME:-/workspace}"',
     'export GIT_TERMINAL_PROMPT="${GIT_TERMINAL_PROMPT:-0}"',
-    ...gitCredentialHelperCommandLines(resources),
     "ensure_git() {",
     "  if command -v git >/dev/null 2>&1; then",
     "    return 0",
@@ -5020,6 +6051,7 @@ export function repositoryCloneCommand(
     "  exit 127",
     "}",
     "ensure_git",
+    ...gitCredentialHelperCommandLines(resources, bindings),
     "clone_repository() {",
     '  target="$1"',
     '  uri="$2"',
@@ -5092,33 +6124,41 @@ export function repositoryCloneCommand(
     "}",
   ];
   for (const resource of resources) {
-    const url = new URL(resource.uri);
-    const repo = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
-    const mountPath = normalizeManifestPath(resource.mountPath ?? `repos/${repo}`);
+    const mountPath = resourceMountPath(resource);
     commands.push(
       [
         "clone_repository",
         shellQuote(posixPath.join("/workspace", mountPath)),
         shellQuote(resource.uri),
         shellQuote(resource.ref),
-        shellQuote(resource.subpath ? normalizeManifestPath(resource.subpath) : ""),
+        shellQuote(resource.subpath ? normalizeRepositorySubpath(resource.subpath) : ""),
       ].join(" "),
     );
   }
   return commands.join("\n");
 }
 
-export function toolspaceTokenSeedCommand(): string {
+export function toolspaceTokenSeedCommand(
+  options: { tokenFile?: string; legacyTokenFile?: string } = {},
+): string {
   return [
     "set -eu",
     'export HOME="${HOME:-/workspace}"',
     'if [ -n "${OPENGENI_TOOLSPACE_TOKEN_SEED:-}" ]; then',
     '  seed_umask="$(umask)"',
     "  umask 077",
-    '  token_file="${OPENGENI_TOOLSPACE_TOKEN_FILE:-$HOME/.opengeni/toolspace-token}"',
+    options.tokenFile
+      ? `  token_file=${shellQuote(options.tokenFile)}`
+      : '  token_file="${OPENGENI_TOOLSPACE_TOKEN_FILE:-$HOME/.opengeni/toolspace-token}"',
+    options.legacyTokenFile
+      ? `  legacy_token_file=${shellQuote(options.legacyTokenFile)}`
+      : '  legacy_token_file=""',
     '  mkdir -p "$(dirname "$token_file")"',
     '  printf \'%s\' "$OPENGENI_TOOLSPACE_TOKEN_SEED" > "$token_file.tmp.$$"',
     '  mv -f "$token_file.tmp.$$" "$token_file"',
+    '  if [ -n "$legacy_token_file" ] && [ "$legacy_token_file" != "$token_file" ]; then',
+    '    rm -f -- "$legacy_token_file"',
+    "  fi",
     '  umask "$seed_umask"',
     "fi",
   ].join("\n");
@@ -5131,28 +6171,56 @@ export async function runToolspaceTokenSeedHook(
   if (!context.toolspaceTokenSeed) {
     return;
   }
-  const command = `export OPENGENI_TOOLSPACE_TOKEN_SEED=${shellQuote(context.toolspaceTokenSeed)}\n${toolspaceTokenSeedCommand()}`;
-  if (session.exec) {
-    const result = await session.exec({
+  const command = `export OPENGENI_TOOLSPACE_TOKEN_SEED=${shellQuote(context.toolspaceTokenSeed)}\n${toolspaceTokenSeedCommand(
+    {
+      ...(context.toolspaceTokenFile ? { tokenFile: context.toolspaceTokenFile } : {}),
+      ...(context.toolspaceTokenFile && context.environment.OPENGENI_TOOLSPACE_TOKEN_FILE
+        ? { legacyTokenFile: context.environment.OPENGENI_TOOLSPACE_TOKEN_FILE }
+        : {}),
+    },
+  )}`;
+  const result = await runSandboxLifecycleCommand(
+    session,
+    {
       cmd: command,
       workdir: "/workspace",
       ...(context.runAs ? { runAs: context.runAs } : {}),
       yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
       maxOutputTokens: 4_000,
-    });
-    assertSandboxCommandSucceeded(result, "Toolspace token seed hook");
-  } else if (session.execCommand) {
-    const result = await session.execCommand({
+    },
+    context.commandRunner,
+  );
+  assertSandboxCommandSucceeded(result, "Toolspace token seed hook");
+}
+
+export async function refreshToolspaceTokenFile(
+  session: ToolspaceTokenWriterSession,
+  token: string,
+  options: {
+    runAs?: string;
+    commandRunner?: SandboxLifecycleCommandRunner;
+    tokenFile?: string;
+    legacyTokenFile?: string;
+  } = {},
+): Promise<void> {
+  const command = `export OPENGENI_TOOLSPACE_TOKEN_SEED=${shellQuote(token)}\n${toolspaceTokenSeedCommand(
+    {
+      ...(options.tokenFile ? { tokenFile: options.tokenFile } : {}),
+      ...(options.legacyTokenFile ? { legacyTokenFile: options.legacyTokenFile } : {}),
+    },
+  )}`;
+  const result = await runSandboxLifecycleCommand(
+    session,
+    {
       cmd: command,
       workdir: "/workspace",
-      ...(context.runAs ? { runAs: context.runAs } : {}),
+      ...(options.runAs ? { runAs: options.runAs } : {}),
       yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
       maxOutputTokens: 4_000,
-    });
-    assertSandboxCommandSucceeded(result, "Toolspace token seed hook");
-  } else {
-    throw new Error("Sandbox session does not support command execution");
-  }
+    },
+    options.commandRunner,
+  );
+  assertSandboxCommandSucceeded(result, "Toolspace token refresh");
 }
 
 // Bounds the setup output tail carried on a rig.setup failure event/error so a
@@ -5261,18 +6329,15 @@ export async function runRigSetupHook(
   };
   let result: unknown;
   try {
-    if (session.exec) {
-      result = await session.exec(execArgs);
-    } else if (session.execCommand) {
-      result = await session.execCommand(execArgs);
-    } else {
-      throw new Error("Sandbox session does not support command execution");
-    }
+    result = await runSandboxLifecycleCommand(session, execArgs, context.commandRunner);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     await context.onRuntimeEvent?.({
       type: "rig.setup.failed",
-      payload: { ...payload, error: message.slice(-RIG_SETUP_OUTPUT_TAIL_LIMIT) },
+      payload: {
+        ...payload,
+        error: message.slice(-RIG_SETUP_OUTPUT_TAIL_LIMIT),
+      },
     });
     throw new Error(
       `Rig setup failed for rig "${rigSetup.rigName}" (version ${rigSetup.versionId}): ${message}`,
@@ -5304,7 +6369,10 @@ export async function runRigSetupHook(
     );
     await context.onRuntimeEvent?.({
       type: "rig.setup.failed",
-      payload: { ...payload, error: failure.message.slice(-RIG_SETUP_OUTPUT_TAIL_LIMIT) },
+      payload: {
+        ...payload,
+        error: failure.message.slice(-RIG_SETUP_OUTPUT_TAIL_LIMIT),
+      },
     });
     throw failure;
   }
@@ -5319,8 +6387,14 @@ export async function runRepositoryCloneHook(
   resources: Extract<ResourceRef, { kind: "repository" }>[],
   context: SandboxLifecycleHookContext = { environment: {} },
 ): Promise<void> {
-  const payload = { name: "repository-clone", repositoryCount: resources.length };
-  await context.onRuntimeEvent?.({ type: "sandbox.operation.started", payload });
+  const payload = {
+    name: "repository-clone",
+    repositoryCount: resources.length,
+  };
+  await context.onRuntimeEvent?.({
+    type: "sandbox.operation.started",
+    payload,
+  });
   try {
     // TOKEN-BROKER (B1): thread run-scoped provider tokens PER-EXEC, never on
     // the manifest. The SDK's ExecCommandArgs has no `environment` field (exec
@@ -5334,32 +6408,31 @@ export async function runRepositoryCloneHook(
       ...(context.gitTokenSeeds ?? {}),
       ...(context.gitTokenSeed ? { github: context.gitTokenSeed } : {}),
     } satisfies GitTokenSeeds;
-    const seedPrefix = gitTokenSeedExportPrefix(gitTokenSeeds);
-    const command = seedPrefix
-      ? `${seedPrefix}\n${repositoryCloneCommand(resources)}`
-      : repositoryCloneCommand(resources);
-    if (session.exec) {
-      const result = await session.exec({
-        cmd: command,
-        workdir: "/workspace",
-        ...(context.runAs ? { runAs: context.runAs } : {}),
-        yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
-        maxOutputTokens: 20_000,
-      });
-      assertSandboxCommandSucceeded(result, "Repository clone hook");
-    } else if (session.execCommand) {
-      const result = await session.execCommand({
+    const gitCredentialBindings = context.gitCredentialBindings ?? [];
+    const seedPrefix = [
+      gitTokenSeedExportPrefix(gitTokenSeeds),
+      gitCredentialBindingSeedExportPrefix(gitCredentialBindings),
+    ]
+      .filter(Boolean)
+      .join("\n");
+    const cloneCommand = repositoryCloneCommand(resources, gitCredentialBindings);
+    const command = seedPrefix ? `${seedPrefix}\n${cloneCommand}` : cloneCommand;
+    const result = await runSandboxLifecycleCommand(
+      session,
+      {
         cmd: command,
         workdir: "/workspace",
         ...(context.runAs ? { runAs: context.runAs } : {}),
         yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
         maxOutputTokens: 20_000,
-      });
-      assertSandboxCommandSucceeded(result, "Repository clone hook");
-    } else {
-      throw new Error("Sandbox session does not support command execution");
-    }
-    await context.onRuntimeEvent?.({ type: "sandbox.operation.completed", payload });
+      },
+      context.commandRunner,
+    );
+    assertSandboxCommandSucceeded(result, "Repository clone hook");
+    await context.onRuntimeEvent?.({
+      type: "sandbox.operation.completed",
+      payload,
+    });
   } catch (error) {
     await context.onRuntimeEvent?.({
       type: "sandbox.operation.failed",
@@ -5472,31 +6545,31 @@ export async function runAzureCliLoginHook(
   session: SandboxSessionLike,
   context: SandboxLifecycleHookContext = { environment: {} },
 ): Promise<void> {
-  const payload = { name: "azure-cli-login", command: "az login --service-principal" };
-  await context.onRuntimeEvent?.({ type: "sandbox.operation.started", payload });
+  const payload = {
+    name: "azure-cli-login",
+    command: "az login --service-principal",
+  };
+  await context.onRuntimeEvent?.({
+    type: "sandbox.operation.started",
+    payload,
+  });
   try {
-    if (session.exec) {
-      const result = await session.exec({
-        cmd: azureCliLoginCommand(),
-        workdir: "/workspace",
-        ...(context.runAs ? { runAs: context.runAs } : {}),
-        yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
-        maxOutputTokens: 20_000,
-      });
-      assertSandboxCommandSucceeded(result, "Azure CLI login hook");
-    } else if (session.execCommand) {
-      const result = await session.execCommand({
+    const result = await runSandboxLifecycleCommand(
+      session,
+      {
         cmd: azureCliLoginCommand(),
         workdir: "/workspace",
         ...(context.runAs ? { runAs: context.runAs } : {}),
         yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
         maxOutputTokens: 20_000,
-      });
-      assertSandboxCommandSucceeded(result, "Azure CLI login hook");
-    } else {
-      throw new Error("Sandbox session does not support command execution");
-    }
-    await context.onRuntimeEvent?.({ type: "sandbox.operation.completed", payload });
+      },
+      context.commandRunner,
+    );
+    assertSandboxCommandSucceeded(result, "Azure CLI login hook");
+    await context.onRuntimeEvent?.({
+      type: "sandbox.operation.completed",
+      payload,
+    });
   } catch (error) {
     await context.onRuntimeEvent?.({
       type: "sandbox.operation.failed",
@@ -5582,26 +6655,46 @@ function isPathWithin(root: string, candidate: string): boolean {
 }
 
 /**
- * The skill source fed to the SDK Skills capability. Without pack skills this
- * is the plain bundled local-dir source, byte-for-byte the pre-pack behavior.
- * With pack skills it becomes a single in-memory dir source combining bundled
- * skill directories (as local_dir entries the SDK materializes lazily) with
- * pack skill directories built from manifest-carried file content — one skill
- * index, one `## Skills` instruction section, lazy `load_skill` for all of
- * them. A pack skill shadows a bundled skill with the same directory name.
+ * The skill source fed to the SDK Skills capability. Without pack or curated
+ * skills this is the plain bundled local-dir source, byte-for-byte the
+ * pre-pack behavior. With either selected source it becomes a single
+ * in-memory dir source combining bundled skill directories (as local_dir
+ * entries the SDK materializes lazily) with selected in-memory skill
+ * directories — one skill index, one `## Skills` instruction section, lazy
+ * `load_skill` for all of them. A pack skill shadows a bundled or curated
+ * skill with the same directory name, case-insensitively.
  */
-export function lazySkillSourceWithPackSkills(packSkills: PackSkill[]): LocalDirLazySkillSource {
+export function lazySkillSourceWithPackSkills(
+  packSkills: PackSkill[],
+  skillLibrarySkills: PackSkill[] = [],
+): LocalDirLazySkillSource {
   const bundledDir = bundledSkillsDir();
   const bundled = localDirLazySkillSource({ src: bundledDir });
-  if (packSkills.length === 0) {
+  if (packSkills.length === 0 && skillLibrarySkills.length === 0) {
     return bundled;
   }
   const children: Record<string, Entry> = {};
   for (const name of bundledSkillDirNames(bundledDir)) {
     children[name] = localDir({ src: join(bundledDir, name) });
   }
+  const libraryIndex: SkillIndexEntry[] = [];
+  const libraryNameKeys = new Set<string>();
+  for (const skill of skillLibrarySkills) {
+    assertSafePackSkillName(skill.name);
+    const key = skill.name.toLowerCase();
+    if (libraryNameKeys.has(key)) {
+      throw new Error(`Duplicate curated skill name: ${skill.name}`);
+    }
+    libraryNameKeys.add(key);
+    removeSkillChildByNameKey(children, key);
+    children[skill.name] = packSkillDirEntry(skill);
+    libraryIndex.push({
+      name: skill.name,
+      description: packSkillDescription(skill),
+      path: skill.name,
+    });
+  }
   const packIndex: SkillIndexEntry[] = [];
-  const packNames = new Set<string>();
   const packNameKeys = new Set<string>();
   for (const skill of packSkills) {
     assertSafePackSkillName(skill.name);
@@ -5609,7 +6702,7 @@ export function lazySkillSourceWithPackSkills(packSkills: PackSkill[]): LocalDir
       throw new Error(`Duplicate pack skill name: ${skill.name}`);
     }
     packNameKeys.add(skill.name.toLowerCase());
-    packNames.add(skill.name);
+    removeSkillChildByNameKey(children, skill.name.toLowerCase());
     children[skill.name] = packSkillDirEntry(skill);
     packIndex.push({
       name: skill.name,
@@ -5621,13 +6714,62 @@ export function lazySkillSourceWithPackSkills(packSkills: PackSkill[]): LocalDir
     source: dir({ children }),
     getIndex: (manifest, skillsPath) => [
       ...(bundled.getIndex?.(manifest, skillsPath) ?? []).filter(
-        (entry) => !packNames.has(entry.path ?? entry.name),
+        (entry) =>
+          !packNameKeys.has((entry.path ?? entry.name).toLowerCase()) &&
+          !libraryNameKeys.has((entry.path ?? entry.name).toLowerCase()),
+      ),
+      ...libraryIndex.filter(
+        (entry) => !packNameKeys.has((entry.path ?? entry.name).toLowerCase()),
       ),
       ...packIndex,
     ],
   };
 }
 
+function effectiveSkillSelections(
+  librarySelections: readonly EffectiveSkillSelection[],
+  librarySkills: readonly PackSkill[],
+  packSkills: readonly PackSkill[],
+): readonly EffectiveSkillSelection[] {
+  const defaultSelections = bundledSkillDirNames(bundledSkillsDir()).map((name) => ({
+    id: `bundled:${name}`,
+    name,
+    source: "bundled" as const,
+    version: null,
+    contentSha256: null,
+    reason: "deployment default skill bundle",
+  }));
+  const libraryNameKeys = new Set(librarySkills.map((skill) => skill.name.toLowerCase()));
+  const packNameKeys = new Set(packSkills.map((skill) => skill.name.toLowerCase()));
+  const selected = librarySelections.filter((selection) =>
+    libraryNameKeys.has(selection.name.toLowerCase()),
+  );
+  return [
+    ...defaultSelections.filter(
+      (selection) =>
+        !libraryNameKeys.has(selection.name.toLowerCase()) &&
+        !packNameKeys.has(selection.name.toLowerCase()),
+    ),
+    ...selected.filter((selection) => !packNameKeys.has(selection.name.toLowerCase())),
+    ...packSkills.map((skill) => ({
+      id: `pack:${skill.name}`,
+      name: skill.name,
+      source: "pack" as const,
+      version: null,
+      contentSha256: null,
+      reason: "enabled capability pack",
+    })),
+  ];
+}
+
+function removeSkillChildByNameKey(children: Record<string, Entry>, nameKey: string): void {
+  for (const name of Object.keys(children)) {
+    if (name.toLowerCase() === nameKey) {
+      delete children[name];
+    }
+  }
+}
+
 function bundledSkillDirNames(root: string): string[] {
   return readdirSync(root, { withFileTypes: true })
     .filter((entry) => entry.isDirectory() && existsSync(join(root, entry.name, "SKILL.md")))
@@ -5771,7 +6913,12 @@ function sortJson(value: unknown): unknown {
   }
   return value;
 }
-
-function approvalIdentifier(item: any): string {
-  return String(item?.rawItem?.callId ?? item?.rawItem?.id ?? item?.id ?? item?.name ?? "approval");
+function interruptionToolName(item: unknown): string {
+  const candidate = item as {
+    toolName?: unknown;
+    name?: unknown;
+    rawItem?: { name?: unknown };
+  };
+  const name = candidate?.toolName ?? candidate?.name ?? candidate?.rawItem?.name;
+  return typeof name === "string" ? name : "";
 }