@opengeni/runtime 0.7.1 → 0.13.0

package/src/index.ts

@@ -12,19 +12,45 @@ import {
   sandboxLifecycleHookIds,
 } from "@opengeni/config";
 import {
+  approvalIdentifier,
   CAPABILITY_DESCRIPTORS,
+  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
+  assertUniqueResourceMountPaths,
+  gitCredentialBindingIdForRepository,
+  gitCredentialProviderForRepository,
   isClearedRunStateBlob,
+  normalizeRepositorySubpath,
+  normalizeResourceMountPath,
   prefixedMcpToolName as sharedPrefixedMcpToolName,
+  resourceMountPath,
+  sessionEventMediaPreview,
+  sessionEventMediaPreviewFromDataUrl,
   signDelegatedAccessToken,
+  RequestHumanInputToolInput,
   type GitCredentialProvider,
+  type GitCredentialTransport,
+  type HumanInputResponse,
   type McpServerConnectionRef,
   type Permission,
   type ReasoningEffort,
   type ResourceRef,
   type SessionEventType,
+  type SessionEventMediaPreview,
   type ToolAuthNeededPayload,
   type ToolRef,
 } from "@opengeni/contracts";
+import {
+  MCP_MAX_CONCURRENT_SERVER_OPERATIONS,
+  MCP_MAX_TOOL_RESULT_BYTES,
+  McpAggregateToolListBudget,
+  assertMcpPayloadWithinBytes,
+  assertMcpServerSelectionWithinBounds,
+  assertMcpToolListWithinBounds,
+  boundedParallelMap,
+  cancelMcpResponseBody,
+  guardedMcpFetch,
+  undiciFetch,
+} from "./mcp-network";
 import {
   Agent,
   AgentsError,
@@ -52,6 +78,7 @@ import {
   setDefaultOpenAIKey,
   setOpenAIResponsesTransport,
   setTracingDisabled,
+  tool as agentTool,
   // Hosted web_search tool factory. Re-exported from @openai/agents-openai via
   // `export * from '@openai/agents-openai'` in @openai/agents' index (0.11.6);
   // it returns a { type: 'hosted_tool', providerData: { type: 'web_search' } }
@@ -104,11 +131,14 @@ import {
   CODEX_APPS_MCP_SERVER_ID,
   CODEX_MODEL_ID_PREFIX,
   CODEX_ORIGINATOR,
+  CODEX_RESPONSE_SDK_OUTER_TIMEOUT_MS,
+  boundModelToolOutputItems,
   codexAppsSanitizingFetch,
   codexRequestStorage,
   codexSubscriptionFetch,
 } from "@opengeni/codex";
 import { cpSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { dirname, isAbsolute, join, posix as posixPath, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -121,22 +151,61 @@ import {
 import { installCodexToolSearch } from "./codex-tool-search";
 import {
   CompactionNeededError,
+  CompactionProviderResponseError,
+  EmptyCompactionSummaryError,
   SUMMARY_BUFFER_TOKENS,
   compactionThresholdTokens,
-  estimateTokens,
+  estimateCompleteModelInput,
+  estimateSerializedValueTokens,
+  hasModelGeneratedItem,
   renderCompactionPromptInputForChat,
+  type CompleteModelInputFootprint,
+  type ProviderContextTokenSignal,
 } from "./context-compaction";
 import {
   createSandboxClient,
   desktopCapableBackend,
   restoredSandboxSessionStateFromEntry,
   setSelfhostedApplyDiff,
+  toolspaceTokenFileFromEnvironment,
+  withToolspaceTokenClient,
+  withToolspaceTokenSession,
+  withRunCredentialsClient,
+  withRunCredentialsSession,
+  type RunCredentialSessionReady,
 } from "./sandbox";
 import { runWithToolCallCorrelation } from "./sandbox/op-correlation";
+import {
+  createTurnToolCancellationController,
+  TurnSandboxCommandCancelledError,
+  wrapCapabilityToolsForTurnCancellation,
+  type TurnSandboxCommandArgs,
+  type TurnSandboxCommandSession,
+  type TurnToolCancellationFence,
+} from "./sandbox/turn-tool-cancellation";
 import { computerUse, type ComputerToolMode } from "./sandbox-computer";
 import type { RuntimeMetricsHooks } from "./metrics";
+export {
+  getSkillLibraryEntry,
+  isSkillLibraryEntryId,
+  listSkillLibraryEntries,
+  loadSkillLibrarySkill,
+  type SkillLibraryEntry,
+  type SkillLibraryFile,
+  type SkillLibrarySkill,
+} from "./skill-library";
 
 export type { RuntimeMetricsHooks } from "./metrics";
+export {
+  createTurnToolCancellationController,
+  TurnSandboxCommandCancelledError,
+} from "./sandbox/turn-tool-cancellation";
+export type {
+  TurnSandboxCommandArgs,
+  TurnSandboxCommandSession,
+  TurnToolCancellationController,
+  TurnToolCancellationFence,
+} from "./sandbox/turn-tool-cancellation";
 
 // P4.3 computer-use surface (the agent's :0 driver). Re-exported from the barrel
 // so callers (the worker, live proofs) reach SandboxComputer/ComputerUseCapability
@@ -188,17 +257,25 @@ export { OpenAIChatCompletionsModel, OpenAIResponsesModel } from "@openai/agents
 
 export {
   CompactionNeededError,
+  CompactionProviderResponseError,
+  EmptyCompactionSummaryError,
   buildCompactionPromptInput,
   buildCompactionReplacementHistory,
+  compactionReplacementFingerprint,
   compactionThresholdTokens,
   clampCompactionThresholdRatio,
   decideCompaction,
   buildSummaryItem,
   findCompactionNeededError,
   isCompactionSummary,
+  latestCompactionReplacementFingerprint,
+  prepareCompactionPromptInput,
   isUserMessage,
   estimateTokens,
   estimateItemTokens,
+  estimateCompleteModelInput,
+  estimateSerializedValueTokens,
+  hasModelGeneratedItem,
   renderCompactionPromptInputForChat,
   COMPACTION_SUMMARY_MARKER,
   COMPACTION_PROMPT,
@@ -211,9 +288,22 @@ export {
   isEphemeralInternalContext,
   USER_MESSAGE_TRUNCATION_MARKER,
 } from "./context-compaction";
-export type { CompactionDecision, CompactionItem } from "./context-compaction";
-export { modelCallUsageTelemetry } from "./usage-telemetry";
-export type { ModelCallUsageTelemetry } from "./usage-telemetry";
+export type {
+  CompactionDecision,
+  CompactionItem,
+  PreparedCompactionPromptInput,
+} from "./context-compaction";
+export {
+  MAX_MODEL_USAGE_TOKEN_COUNT,
+  modelCallUsageTelemetry,
+  modelUsageTokenCountOrNull,
+  normalizeModelCallUsage,
+} from "./usage-telemetry";
+export type {
+  ModelCallUsageInput,
+  ModelCallUsageNormalization,
+  ModelCallUsageTelemetry,
+} from "./usage-telemetry";
 
 ensureReadableStreamFrom();
 
@@ -232,6 +322,18 @@ export type ModelResponseUsage = {
     totalTokens?: number;
     inputTokensDetails?: Record<string, number> | Array<Record<string, number>>;
     outputTokensDetails?: Record<string, number> | Array<Record<string, number>>;
+    requestUsageEntries?: Array<{
+      inputTokens?: number;
+      input_tokens?: number;
+      outputTokens?: number;
+      output_tokens?: number;
+      totalTokens?: number;
+      total_tokens?: number;
+      inputTokensDetails?: Record<string, number>;
+      input_tokens_details?: Record<string, number>;
+      outputTokensDetails?: Record<string, number>;
+      output_tokens_details?: Record<string, number>;
+    }>;
   };
 };
 
@@ -245,6 +347,8 @@ export type ResolveConnectionCredentialInput = {
   serverId: string;
   toolName?: string;
   connectionRef: McpServerConnectionRef;
+  /** Exact MCP destination whose request would receive the resolved headers. */
+  destinationUrl: string;
   forceRefresh?: boolean;
 };
 
@@ -259,9 +363,11 @@ export type ResolveConnectionCredentialResult =
       status: "auth_needed";
       reason: ToolAuthNeededPayload["reason"];
       providerDomain: string;
+      provider?: string;
       connectionId?: string;
       scopes?: string[];
       resource?: string;
+      selectedResources?: McpServerConnectionRef["selectedResources"];
       authorizationUrl?: string;
     };
 
@@ -316,6 +422,11 @@ export type AgentSegmentInput =
       approvalId: string;
       decision: "approve" | "reject";
       message?: string;
+    }
+  | {
+      kind: "human_input";
+      serializedRunState: string;
+      toolCallId: string;
     };
 
 export type PreparedAgentInput = {
@@ -323,6 +434,13 @@ export type PreparedAgentInput = {
   sandboxSessionState?: SandboxSessionState;
 };
 
+export const HUMAN_INPUT_TOOL_NAME = "request_human_input";
+
+export type SerializedHumanInputInterruption = {
+  toolCallId: string;
+  input: ReturnType<typeof RequestHumanInputToolInput.parse>;
+};
+
 export type SandboxFileDownload = {
   fileId: string;
   mountPath: string;
@@ -381,6 +499,7 @@ export type OpenGeniRuntime = {
     options?: RunAgentStreamOptions,
   ) => Promise<Awaited<ReturnType<typeof runAgentStream>>>;
   serializeApprovals: (interruptions: unknown[]) => unknown[];
+  serializeHumanInputRequests?: (interruptions: unknown[]) => SerializedHumanInputInterruption[];
 };
 
 export type ProductionRuntimeOverrides = {
@@ -416,6 +535,7 @@ export function createProductionAgentRuntime(
         sandboxClient: overrides.sandboxClient,
       }),
     serializeApprovals,
+    serializeHumanInputRequests,
   };
 }
 
@@ -491,6 +611,10 @@ export function buildProviderClient(provider: ResolvedModelProvider, settings: S
           // SDK retries on network/5xx/partial streams can replay provider work
           // or external tool side effects without a durable checkpoint.
           maxRetries: 0,
+          // The Codex transport owns finer headers/idle/whole deadlines and
+          // emits typed durable evidence. Keep the SDK's opaque envelope beyond
+          // that whole-response budget so `Request timed out.` cannot win first.
+          timeout: CODEX_RESPONSE_SDK_OUTER_TIMEOUT_MS,
           fetch: codexSubscriptionFetch(instrumentedModelFetch(provider.id, globalThis.fetch)),
         })
       : // ResolvedModelProvider.apiKey is already the resolved key (configuredProviders
@@ -552,7 +676,7 @@ export function resolveTurnModel(
   return {
     provider: resolved.provider,
     client,
-    model: buildModelInstance(resolved.provider, client, resolved.model.id),
+    model: buildModelInstance(resolved.provider, client, resolved.model.upstreamModelId),
     configured: resolved.model,
   };
 }
@@ -804,19 +928,28 @@ export async function summarizeForCompaction(
   const maxTokens = options.maxOutputTokens ?? SUMMARY_BUFFER_TOKENS;
   if (api === "chat") {
     const transcript = renderCompactionPromptInputForChat(input);
-    const completion = await client.chat.completions.create({
-      model,
-      max_tokens: maxTokens,
-      messages: [{ role: "user", content: transcript }],
-      ...(options.promptCacheKey ? { prompt_cache_key: options.promptCacheKey } : {}),
-    } as any);
+    let completion: unknown;
+    try {
+      completion = await client.chat.completions.create({
+        model,
+        max_tokens: maxTokens,
+        messages: [{ role: "user", content: transcript }],
+        ...(options.promptCacheKey ? { prompt_cache_key: options.promptCacheKey } : {}),
+      } as any);
+    } catch (error) {
+      throw new CompactionProviderResponseError(compactionProviderFailureDiagnostics(error), error);
+    }
     const usage = modelResponseUsageFromResponse(completion);
     if (usage) {
       await options.onUsage?.(usage);
     }
     const text = (completion as { choices?: Array<{ message?: { content?: unknown } }> })
       .choices?.[0]?.message?.content;
-    return typeof text === "string" ? text.trim() : "";
+    const summary = typeof text === "string" ? text.trim() : "";
+    if (!summary) {
+      throw new EmptyCompactionSummaryError(compactionResponseDiagnostics(completion, summary));
+    }
+    return summary;
   }
   // Use the same SDK Responses adapter as the real agent call. It converts the
   // structured AgentInputItems (callId/providerData/etc.) to provider wire
@@ -839,12 +972,205 @@ export async function summarizeForCompaction(
     handoffs: [],
     tracing: false,
   };
-  const response = await new CompactionResponsesModel(client, model).fetchResponse(request);
+  let response: unknown;
+  try {
+    response = await new CompactionResponsesModel(client, model).fetchResponse(request);
+  } catch (error) {
+    throw new CompactionProviderResponseError(compactionProviderFailureDiagnostics(error), error);
+  }
   const usage = modelResponseUsageFromResponse(response);
   if (usage) {
     await options.onUsage?.(usage);
   }
-  return extractResponseOutputText(response).trim();
+  if (isFailedCompactionProviderResponse(response)) {
+    throw new CompactionProviderResponseError(compactionProviderFailureDiagnostics(response));
+  }
+  const summary = extractResponseOutputText(response).trim();
+  if (!summary) {
+    throw new EmptyCompactionSummaryError(compactionResponseDiagnostics(response, summary));
+  }
+  return summary;
+}
+
+function isFailedCompactionProviderResponse(response: unknown): boolean {
+  if (!response || typeof response !== "object") return false;
+  const record = response as Record<string, unknown>;
+  return (
+    record.status === "failed" ||
+    record.status === "incomplete" ||
+    (record.error !== null && record.error !== undefined)
+  );
+}
+
+/** Bounded provider diagnostics: identifiers and classifications, never messages or model data. */
+export function compactionProviderFailureDiagnostics(error: unknown): Record<string, unknown> {
+  let current = error;
+  let errorName: string | null = null;
+  let httpStatus: number | null = null;
+  let responseStatus: string | null = null;
+  let responseId: string | null = null;
+  let code: string | null = null;
+  let type: string | null = null;
+  let requestId: string | null = null;
+  let eventType: string | null = null;
+  const seen = new Set<object>();
+  for (let depth = 0; depth < 6 && current && typeof current === "object"; depth += 1) {
+    if (seen.has(current)) break;
+    seen.add(current);
+    const record = current as Record<string, unknown>;
+    if (!errorName && current instanceof Error) {
+      errorName = boundCompactionDiagnosticField(current.name);
+    }
+    if (
+      httpStatus === null &&
+      typeof record.status === "number" &&
+      Number.isFinite(record.status)
+    ) {
+      httpStatus = record.status;
+    }
+    if (responseStatus === null && typeof record.status === "string") {
+      responseStatus = boundCompactionDiagnosticField(record.status);
+    }
+    const directResponseStatus = record.response_status ?? record.responseStatus;
+    if (responseStatus === null && typeof directResponseStatus === "string") {
+      responseStatus = boundCompactionDiagnosticField(directResponseStatus);
+    }
+    const directResponseId = record.response_id ?? record.responseId ?? record.id;
+    if (responseId === null && typeof directResponseId === "string") {
+      responseId = boundCompactionDiagnosticField(directResponseId);
+    }
+    if (code === null && typeof record.code === "string") {
+      code = boundCompactionDiagnosticField(record.code);
+    }
+    if (type === null && typeof record.type === "string") {
+      type = boundCompactionDiagnosticField(record.type);
+    }
+    const directEventType = record.event_type ?? record.eventType;
+    if (eventType === null && typeof directEventType === "string") {
+      eventType = boundCompactionDiagnosticField(directEventType);
+    }
+    if (requestId === null) {
+      const directRequestId = record.request_id ?? record.requestId ?? record._request_id;
+      if (typeof directRequestId === "string") {
+        requestId = boundCompactionDiagnosticField(directRequestId);
+      }
+      const headers = record.headers;
+      if (!requestId && headers && typeof headers === "object") {
+        const get = (headers as { get?: unknown }).get;
+        if (typeof get === "function") {
+          const headerId = get.call(headers, "x-request-id");
+          if (typeof headerId === "string") {
+            requestId = boundCompactionDiagnosticField(headerId);
+          }
+        }
+      }
+    }
+    const nestedError = record.error;
+    if (nestedError && typeof nestedError === "object" && !seen.has(nestedError)) {
+      const nested = nestedError as Record<string, unknown>;
+      if (code === null && typeof nested.code === "string") {
+        code = boundCompactionDiagnosticField(nested.code);
+      }
+      if (type === null && typeof nested.type === "string") {
+        type = boundCompactionDiagnosticField(nested.type);
+      }
+      const nestedResponseStatus = nested.response_status ?? nested.responseStatus;
+      if (responseStatus === null && typeof nestedResponseStatus === "string") {
+        responseStatus = boundCompactionDiagnosticField(nestedResponseStatus);
+      }
+      const nestedResponseId = nested.response_id ?? nested.responseId ?? nested.id;
+      if (responseId === null && typeof nestedResponseId === "string") {
+        responseId = boundCompactionDiagnosticField(nestedResponseId);
+      }
+      const nestedEventType = nested.event_type ?? nested.eventType;
+      if (eventType === null && typeof nestedEventType === "string") {
+        eventType = boundCompactionDiagnosticField(nestedEventType);
+      }
+    }
+    current = record.cause;
+  }
+  return {
+    errorName,
+    httpStatus,
+    responseStatus,
+    responseId,
+    code,
+    type,
+    requestId,
+    ...(eventType ? { eventType } : {}),
+  };
+}
+
+const COMPACTION_DIAGNOSTIC_FIELD_MAX_BYTES = 256;
+const COMPACTION_DIAGNOSTIC_TRUNCATION_MARKER = "…[truncated]";
+
+function boundCompactionDiagnosticField(value: string): string {
+  const bytes = Buffer.from(value, "utf8");
+  if (bytes.length <= COMPACTION_DIAGNOSTIC_FIELD_MAX_BYTES) return value;
+  const markerBytes = Buffer.byteLength(COMPACTION_DIAGNOSTIC_TRUNCATION_MARKER, "utf8");
+  let end = COMPACTION_DIAGNOSTIC_FIELD_MAX_BYTES - markerBytes;
+  while (end > 0 && isUtf8ContinuationByte(bytes[end]!)) end -= 1;
+  return `${bytes.subarray(0, end).toString("utf8")}${COMPACTION_DIAGNOSTIC_TRUNCATION_MARKER}`;
+}
+
+function isUtf8ContinuationByte(value: number): boolean {
+  return (value & 0xc0) === 0x80;
+}
+
+/** Bounded, content-free diagnostics for a semantically empty checkpoint. */
+export function compactionResponseDiagnostics(
+  response: unknown,
+  extractedText = extractResponseOutputText(response).trim(),
+): Record<string, unknown> {
+  if (!response || typeof response !== "object") {
+    return { responseShape: typeof response, extractedTextLength: extractedText.length };
+  }
+  const record = response as Record<string, unknown>;
+  const output = Array.isArray(record.output) ? record.output : [];
+  const outputItems = output.slice(0, 50).map((item) => {
+    if (!item || typeof item !== "object") return { type: typeof item };
+    const value = item as Record<string, unknown>;
+    const content = Array.isArray(value.content) ? value.content : [];
+    return {
+      type: typeof value.type === "string" ? value.type : null,
+      role: typeof value.role === "string" ? value.role : null,
+      status: typeof value.status === "string" ? value.status : null,
+      contentPartTypes: content
+        .slice(0, 50)
+        .map((part) =>
+          part && typeof part === "object" && typeof (part as { type?: unknown }).type === "string"
+            ? (part as { type: string }).type
+            : typeof part,
+        ),
+      contentPartCount: content.length,
+    };
+  });
+  const choices = Array.isArray(record.choices) ? record.choices : [];
+  const usage = modelResponseUsageFromResponse(response)?.usage;
+  const incomplete =
+    record.incomplete_details && typeof record.incomplete_details === "object"
+      ? (record.incomplete_details as Record<string, unknown>)
+      : null;
+  return {
+    responseId: typeof record.id === "string" ? record.id : null,
+    status: typeof record.status === "string" ? record.status : null,
+    outputItemCount: output.length,
+    outputItems,
+    choiceCount: choices.length,
+    finishReasons: choices
+      .slice(0, 20)
+      .map((choice) =>
+        choice && typeof choice === "object"
+          ? ((choice as Record<string, unknown>).finish_reason ?? null)
+          : null,
+      ),
+    incompleteReason:
+      incomplete && typeof incomplete.reason === "string" ? incomplete.reason : null,
+    inputTokens: usage?.inputTokens ?? null,
+    outputTokens: usage?.outputTokens ?? null,
+    totalTokens: usage?.totalTokens ?? null,
+    extractedTextLength: extractedText.length,
+  };
 }
 
 /**
@@ -909,10 +1235,50 @@ class CompactionResponsesModel extends OpenAIResponsesModel {
 }
 
 export type GitTokenSeeds = Partial<Record<GitCredentialProvider, string>>;
+export type GitCredentialBindingSeed = {
+  credentialBindingId: string;
+  provider: GitCredentialProvider;
+  token: string;
+  transport?: GitCredentialTransport;
+  expiresAt?: string;
+  /** Total active bindings for this provider, used to suppress unsafe aliases. */
+  providerBindingCount?: number;
+};
 export type GitCredentialTokenWriterSession = SandboxSessionLike;
+export type ToolspaceTokenWriterSession = SandboxSessionLike;
+
+export type EffectiveSkillSelection = Readonly<{
+  id: string;
+  name: string;
+  source: "bundled" | "library" | "pack";
+  version: string | null;
+  contentSha256: string | null;
+  reason: string;
+}>;
+
+const agentSkillSelections = new WeakMap<object, readonly EffectiveSkillSelection[]>();
+const emptySkillSelections: readonly EffectiveSkillSelection[] = Object.freeze([]);
+
+/**
+ * Read-only, secret-free skill provenance for an already-built agent. This is
+ * intentionally separate from the model instructions and sandbox manifest so
+ * effective configuration inspection cannot accidentally expose credentials or
+ * turn skill activation into an authorization change.
+ */
+export function effectiveSkillSelectionsForAgent(
+  agent: object,
+): readonly EffectiveSkillSelection[] {
+  return agentSkillSelections.get(agent) ?? emptySkillSelections;
+}
 
 export type BuildAgentOptions = {
   model?: Model;
+  /** Settled response for the one internal human-input interruption resumed by this run. */
+  humanInputResponse?: {
+    requestId: string;
+    toolCallId: string;
+    response: HumanInputResponse;
+  };
   reasoningEffort?: ReasoningEffort;
   // Per-turn gating overrides for the multi-provider path. Each defaults to
   // today's settings-derived behaviour when omitted, so the legacy
@@ -1008,11 +1374,18 @@ export type BuildAgentOptions = {
   // repository-clone hooks; runStream forwards them into the hook context, which
   // seeds provider token FILES before the clone/setup runs.
   gitTokenSeeds?: GitTokenSeeds;
+  // Provider-neutral, independently mintable credentials. Binding ids remain
+  // off-manifest and are hashed before they influence sandbox paths.
+  gitCredentialBindings?: GitCredentialBindingSeed[];
   // TOOLSPACE: the run-scoped delegated token to seed into
   // $OPENGENI_TOOLSPACE_TOKEN_FILE. Like gitTokenSeed, this stays off the
   // manifest/env delta and is written into the sandbox filesystem by a lifecycle
   // hook before the agent starts.
   toolspaceTokenSeed?: string;
+  // Durable OpenGeni session identity used only to derive the off-manifest,
+  // per-session token file. Required together with toolspaceTokenSeed so two
+  // sessions sharing one box never overwrite the same pointer.
+  toolspaceTokenSessionId?: string;
   // Genesis turn only: inject a one-shot instruction into the FIRST model
   // call telling it to title the session via opengeni__set_session_title.
   // Keeping this out of the persistent Agent.instructions prevents every
@@ -1040,10 +1413,32 @@ export type BuildAgentOptions = {
   // timeline message. Omitted ⇒ the composed instructions are byte-identical to
   // a workspace-only persona.
   sessionInstructions?: string;
+  // Host context for this exact accepted turn. Composed system-level after the
+  // durable session persona and omitted from all later turns.
+  turnInstructions?: string;
   // Skills delivered by enabled capability packs. They join the bundled
   // skills in the sandbox skill index (mounted under .agents/) so
   // skills/<name> references resolve like any other indexed skill.
   packSkills?: PackSkill[];
+  // Explicitly selected, immutable curated-library skill content. These are
+  // separate from packSkills so repository-local/pack compatibility does not
+  // turn a curated entry into a mutable override.
+  skillLibrarySkills?: PackSkill[];
+  // Secret-free provenance for effective-configuration inspection. The worker
+  // resolves exact ids/versions/hashes before constructing the agent.
+  skillLibrarySelections?: EffectiveSkillSelection[];
+  /**
+   * Internal per-attempt cancellation boundary. The worker supplies Temporal's
+   * signal so an in-flight shell process is interrupted immediately instead of
+   * holding Steer/Pause behind its requested yield or natural exit.
+   */
+  turnCancellationSignal?: AbortSignal;
+  /**
+   * Receives the physical sandbox-tool fence at agent construction time. A
+   * cancelled/fenced worker attempt must await it before publishing its durable
+   * attempt-quiesced receipt.
+   */
+  onToolCancellationFence?: (fence: TurnToolCancellationFence) => void;
 };
 
 export type PackSkillFile = {
@@ -1171,6 +1566,12 @@ export function appendSessionInstructions(composed: string, sessionInstructions?
   return trimmed ? `${composed} ${trimmed}` : composed;
 }
 
+/** Append system instructions that apply to this exact turn only. */
+export function appendTurnInstructions(composed: string, turnInstructions?: string): string {
+  const trimmed = turnInstructions?.trim();
+  return trimmed ? `${composed} ${trimmed}` : composed;
+}
+
 /**
  * Append the durable session metadata the model otherwise cannot observe.
  * This is deliberately declarative and excludes the title text: the title is
@@ -1239,7 +1640,9 @@ const agentRepositoryCloneHooks = new WeakMap<object, SandboxLifecycleHook[]>();
 // provided-session env; runStream reads them to build the clone hook context.
 // Absent when no brokered repo is attached / on the selfhosted path.
 const agentGitTokenSeeds = new WeakMap<object, GitTokenSeeds>();
+const agentGitCredentialBindings = new WeakMap<object, GitCredentialBindingSeed[]>();
 const agentToolspaceTokenSeed = new WeakMap<object, string>();
+const agentToolspaceTokenSessionId = new WeakMap<object, string>();
 // A genesis directive is consumed by runAgentStream exactly once for the
 // freshly-built agent. It must not remain in Agent.instructions: those
 // instructions are presented again on every internal model/tool loop.
@@ -1308,6 +1711,9 @@ export function buildOpenGeniAgent(
   resources: ResourceRef[],
   options: BuildAgentOptions = {},
 ): Agent<any, any> {
+  if (Boolean(options.toolspaceTokenSeed) !== Boolean(options.toolspaceTokenSessionId)) {
+    throw new Error("toolspaceTokenSeed and toolspaceTokenSessionId must be supplied together");
+  }
   // Resolved per-turn gating. Each override defaults to today's settings-derived
   // behaviour, so the legacy global-client callers (no resolved model) build the
   // exact same agent as before; the multi-provider worker path passes the
@@ -1329,6 +1735,28 @@ export function buildOpenGeniAgent(
   // [...agent.tools, ...capability.tools()]), so hosted web_search coexists with
   // both rather than overriding them.
   const hostedTools = hostedWebSearch ? [webSearchTool()] : [];
+  const humanInputTool = agentTool({
+    name: HUMAN_INPUT_TOOL_NAME,
+    description:
+      "Pause this turn and request structured human input. Use for decisions or missing information that only a person can provide. Supports free text, single-select, multi-select, an optional Other value, multiple questions, explicit skip policy, and an optional expiry.",
+    parameters: RequestHumanInputToolInput,
+    needsApproval: true,
+    // A missing/mismatched durable response is a protocol integrity failure,
+    // not model-visible tool output the agent may reason past.
+    errorFunction: null,
+    execute: (_input, _context, details) => {
+      const settled = options.humanInputResponse;
+      if (!settled) {
+        throw new Error("Human-input tool resumed without a durable response");
+      }
+      const resumedCallId = details?.toolCall?.callId;
+      if (resumedCallId && resumedCallId !== settled.toolCallId) {
+        throw new Error("Human-input response does not belong to the resumed tool call");
+      }
+      return JSON.stringify({ requestId: settled.requestId, ...settled.response });
+    },
+  });
+  const agentTools = [...hostedTools, humanInputTool];
   const baseConfig = {
     name: "OpenGeni Agent",
     model: options.model ?? settings.openaiModel,
@@ -1351,24 +1779,28 @@ export function buildOpenGeniAgent(
     //      and the worker resolved a nonblank block — appendWorkspaceMemory,
     //   4. + the per-session persona instructions (session-specific, so it
     //      refines both the workspace persona and the substrate note),
-    //   5. + durable session-setting state (title present + child notification
+    //   5. + host context for this exact turn, when supplied,
+    //   6. + durable session-setting state (title present + child notification
     //      mode), when supplied by the worker,
     // The genesis title directive is deliberately NOT part of this persistent
     // string. runAgentStream injects it into the first model call only.
     instructions: appendPersistentSessionSettings(
-      appendSessionInstructions(
-        appendWorkspaceMemory(
-          appendToolspaceInstructions(
-            composeAgentInstructions(
-              options.instructionsTemplate ?? settings.agentInstructionsTemplate,
-              options.workspaceEnvironment,
-              options.rig,
+      appendTurnInstructions(
+        appendSessionInstructions(
+          appendWorkspaceMemory(
+            appendToolspaceInstructions(
+              composeAgentInstructions(
+                options.instructionsTemplate ?? settings.agentInstructionsTemplate,
+                options.workspaceEnvironment,
+                options.rig,
+              ),
+              settings.toolspaceEnabled && Boolean(options.toolspaceTokenSeed),
             ),
-            settings.toolspaceEnabled && Boolean(options.toolspaceTokenSeed),
+            options.workspaceMemory,
           ),
-          options.workspaceMemory,
+          options.sessionInstructions,
         ),
-        options.sessionInstructions,
+        options.turnInstructions,
       ),
       options.persistentSessionSettings,
     ),
@@ -1391,7 +1823,7 @@ export function buildOpenGeniAgent(
     // `new Agent(baseConfig)` path (sandboxBackend === "none") and the
     // `new SandboxAgent({ ...baseConfig, ... })` path via the shared baseConfig
     // spread; the SDK concatenates these with MCP and sandbox capability tools.
-    ...(hostedTools.length ? { tools: hostedTools } : {}),
+    tools: agentTools,
     ...(options.mcpServers?.length ? { mcpServers: options.mcpServers } : {}),
     // Surface FAILED MCP tool calls as `{ isError: true }` tool output (see
     // mcpToolErrorFunction / mcpToolErrorOutput) instead of the SDK's default
@@ -1423,6 +1855,9 @@ export function buildOpenGeniAgent(
     ),
     ...(runAs ? { runAs } : {}),
     capabilities: buildAgentCapabilities(settings, options.packSkills ?? [], {
+      ...(options.skillLibrarySkills?.length
+        ? { skillLibrarySkills: options.skillLibrarySkills }
+        : {}),
       ...(options.structuredToolTransport !== undefined
         ? { structuredToolTransport: options.structuredToolTransport }
         : {}),
@@ -1430,8 +1865,24 @@ export function buildOpenGeniAgent(
         ? { computerToolMode: options.computerToolMode }
         : {}),
       ...(options.onComputerUseReady ? { onComputerUseReady: options.onComputerUseReady } : {}),
+      ...(options.turnCancellationSignal
+        ? { turnCancellationSignal: options.turnCancellationSignal }
+        : {}),
+      ...(options.onToolCancellationFence
+        ? { onToolCancellationFence: options.onToolCancellationFence }
+        : {}),
     }),
   });
+  agentSkillSelections.set(
+    agent,
+    Object.freeze(
+      effectiveSkillSelections(
+        options.skillLibrarySelections ?? [],
+        options.skillLibrarySkills ?? [],
+        options.packSkills ?? [],
+      ).map((selection) => Object.freeze(selection)),
+    ),
+  );
   if (options.genesisTitleHint) {
     agentsNeedingGenesisTitleDirective.add(agent);
   }
@@ -1463,8 +1914,12 @@ export function buildOpenGeniAgent(
   if (Object.keys(gitTokenSeeds).length > 0) {
     agentGitTokenSeeds.set(agent, gitTokenSeeds);
   }
+  if (options.gitCredentialBindings && options.gitCredentialBindings.length > 0) {
+    agentGitCredentialBindings.set(agent, options.gitCredentialBindings);
+  }
   if (options.toolspaceTokenSeed) {
     agentToolspaceTokenSeed.set(agent, options.toolspaceTokenSeed);
+    agentToolspaceTokenSessionId.set(agent, options.toolspaceTokenSessionId!);
   }
   // M3: stash the rig setup descriptor + RESOLVE the rig credential hooks now.
   // sandboxLifecycleHooksForIds throws on an unknown hook name, so a typo'd rig
@@ -1504,14 +1959,17 @@ function maybeInstallCodexToolSearch(
 }
 
 /** True when the unprefixed tool `name` requires approval under `policy`. */
-function mcpToolRequiresApproval(policy: boolean | string[], unprefixedName: string): boolean {
-  return policy === true || (Array.isArray(policy) && policy.includes(unprefixedName));
+function mcpToolRequiresApproval(
+  policy: boolean | ReadonlySet<string>,
+  unprefixedName: string,
+): boolean {
+  return policy === true || (policy !== false && policy.has(unprefixedName));
 }
 
 /** A per-server approval policy keyed by the server's `<id>__` tool prefix. */
 type McpApprovalPolicy = {
   prefix: string;
-  requireApproval: boolean | string[];
+  requireApproval: boolean | ReadonlySet<string>;
 };
 
 /** The subset of the agent surface the approval wrap needs — including `clone`. */
@@ -1602,7 +2060,8 @@ function applyMcpApprovalPolicy(agent: Agent<any, any>, settings: Settings): voi
     )
     .map((server) => ({
       prefix: prefixedMcpToolName(server.id, ""),
-      requireApproval: server.requireApproval as boolean | string[],
+      requireApproval:
+        server.requireApproval === true ? true : new Set(server.requireApproval as string[]),
     }))
     .sort((a, b) => b.prefix.length - a.prefix.length);
   if (policies.length === 0) {
@@ -1721,6 +2180,7 @@ export function buildAgentCapabilities(
   settings: Settings,
   packSkills: PackSkill[],
   options: {
+    skillLibrarySkills?: PackSkill[];
     structuredToolTransport?: boolean;
     // EXPLICIT computer-use transport (see BuildAgentOptions.computerToolMode). When
     // present, computerUse() is handed the mode directly and its tools() obeys it
@@ -1728,8 +2188,15 @@ export function buildAgentCapabilities(
     // imageFunctionResults path (driven by structuredToolTransport) is unchanged.
     computerToolMode?: ComputerToolMode;
     onComputerUseReady?: (session: SandboxSessionLike) => Promise<void>;
+    turnCancellationSignal?: AbortSignal;
+    onToolCancellationFence?: (fence: TurnToolCancellationFence) => void;
   } = {},
 ): ReturnType<typeof Capabilities.default> {
+  const toolCancellation =
+    options.turnCancellationSignal || options.onToolCancellationFence
+      ? createTurnToolCancellationController(options.turnCancellationSignal)
+      : null;
+  if (toolCancellation) options.onToolCancellationFence?.(toolCancellation);
   // The `filesystem()` capability picks hosted-vs-function tool variants from the
   // bound model instance (supportsApplyPatchTransport / structured tool output).
   // When the caller declares the backend does NOT support that structured/hosted
@@ -1748,9 +2215,13 @@ export function buildAgentCapabilities(
   }
   const caps: ReturnType<typeof Capabilities.default> = [
     filesystemCapability,
-    shell({ configureTools: withExecOpCorrelation }),
+    shell({ ...(toolCancellation ? {} : { configureTools: withExecOpCorrelation }) }),
   ];
-  caps.push(skills({ lazyFrom: lazySkillSourceWithPackSkills(packSkills) }));
+  caps.push(
+    skills({
+      lazyFrom: lazySkillSourceWithPackSkills(packSkills, options.skillLibrarySkills ?? []),
+    }),
+  );
   // P4.3 computer-use: the agent drives the SAME :0 humans watch (xdotool/XTEST +
   // scrot), but only when the desktop tier is ON, computer-use is enabled, and the
   // backend is one whose image carries the X stack (descriptorgate — honest about
@@ -1802,6 +2273,14 @@ export function buildAgentCapabilities(
     }
     caps.push(computerCapability as unknown as ReturnType<typeof Capabilities.default>[number]);
   }
+  if (toolCancellation) {
+    for (const capability of caps) {
+      wrapCapabilityToolsForTurnCancellation(
+        capability as unknown as { tools(): Tool<unknown>[] },
+        toolCancellation,
+      );
+    }
+  }
   return caps;
 }
 
@@ -1843,8 +2322,73 @@ export type PrepareToolsOptions = {
     input: ResolveConnectionCredentialInput,
   ) => Promise<ResolveConnectionCredentialResult>;
   onAuthNeeded?: (payload: ToolAuthNeededPayload) => Promise<void> | void;
+  /** Injectable final MCP transport for tests and embedded hosts. */
+  mcpFetchImpl?: FetchLike;
+};
+
+type ConnectedMcpServerBatch = Awaited<ReturnType<typeof connectMcpServers>>;
+
+export type ConnectedMcpServerBatches = {
+  active: MCPServer[];
+  failed: MCPServer[];
+  errors: ReadonlyMap<MCPServer, Error>;
+  close: () => Promise<void>;
 };
 
+/**
+ * Connect SDK-managed MCP servers in stable, bounded batches. The SDK cleans a
+ * failing strict batch; this wrapper additionally closes every earlier batch
+ * before rethrowing, so a later-batch failure cannot leak live connections.
+ */
+export async function connectMcpServersInBatches(
+  servers: MCPServer[],
+  options: { strict: boolean },
+): Promise<ConnectedMcpServerBatches> {
+  assertMcpServerSelectionWithinBounds(servers);
+  const batches: ConnectedMcpServerBatch[] = [];
+  try {
+    for (let offset = 0; offset < servers.length; offset += MCP_MAX_CONCURRENT_SERVER_OPERATIONS) {
+      batches.push(
+        await connectMcpServers(
+          servers.slice(offset, offset + MCP_MAX_CONCURRENT_SERVER_OPERATIONS),
+          {
+            connectInParallel: true,
+            strict: options.strict,
+          },
+        ),
+      );
+    }
+  } catch (error) {
+    await closeMcpServerBatches(batches).catch(() => undefined);
+    throw error;
+  }
+
+  const errors = new Map<MCPServer, Error>();
+  for (const batch of batches) {
+    for (const [server, error] of batch.errors) errors.set(server, error);
+  }
+  return {
+    active: batches.flatMap((batch) => batch.active),
+    failed: batches.flatMap((batch) => batch.failed),
+    errors,
+    close: async () => {
+      await closeMcpServerBatches(batches);
+    },
+  };
+}
+
+async function closeMcpServerBatches(batches: ConnectedMcpServerBatch[]): Promise<void> {
+  let firstError: unknown;
+  for (const batch of [...batches].reverse()) {
+    try {
+      await batch.close();
+    } catch (error) {
+      firstError ??= error;
+    }
+  }
+  if (firstError !== undefined) throw firstError;
+}
+
 export async function prepareAgentTools(
   settings: Settings,
   tools: ToolRef[],
@@ -1854,25 +2398,36 @@ export async function prepareAgentTools(
   // codex_apps sanitizing fetch so every tools/list this turn accumulates the
   // account's connector namespaces. Surfaced on PreparedAgentTools for the worker.
   const codexConnectorNamespaces = new Set<string>();
+  assertMcpServerSelectionWithinBounds(tools);
   if (tools.length === 0) {
     return { mcpServers: [], close: async () => {}, codexConnectorNamespaces };
   }
   const registry = new Map(settings.mcpServers.map((server) => [server.id, server]));
-  const servers = await Promise.all(
-    tools.map(async (tool) => {
+  const aggregateToolBudget = new McpAggregateToolListBudget();
+  const mcpFetchImpl = options.mcpFetchImpl ?? undiciFetch;
+  const servers = await boundedParallelMap(
+    tools,
+    MCP_MAX_CONCURRENT_SERVER_OPERATIONS,
+    async (tool, index) => {
       const config = registry.get(tool.id);
       if (!config) {
         throw new Error(`Unknown MCP server id: ${tool.id}`);
       }
       const url = firstPartyMcpServerUrlForRun(settings, config, options.workspaceId) ?? config.url;
+      const firstParty = isFirstPartyMcpServer(settings, config);
       const baseFetch = isCodexAppsMcpServer(config)
-        ? codexAppsSanitizingFetch(globalThis.fetch, codexConnectorNamespaces)
-        : globalThis.fetch;
+        ? codexAppsSanitizingFetch(mcpFetchImpl, codexConnectorNamespaces)
+        : mcpFetchImpl;
+      const guardedFetch = guardedMcpFetch(
+        firstParty ? { ...settings, integrationsAllowPrivateNetworkTargets: true } : settings,
+        baseFetch,
+        firstParty ? { requireHttpsOutsideLocalTest: false } : {},
+      );
       const fetchImpl = config.connectionRef
-        ? connectionBrokerFetch(baseFetch, config, options)
-        : isFirstPartyMcpServer(settings, config)
-          ? firstPartyAuthFetch(baseFetch, settings, options)
-          : baseFetch;
+        ? connectionBrokerFetch(guardedFetch, config, options)
+        : firstParty
+          ? firstPartyAuthFetch(guardedFetch, settings, options)
+          : guardedFetch;
       // A server is connected BEST-EFFORT (a connect OR tools-list failure drops
       // it — its tools go unavailable for the turn — instead of failing the turn)
       // in two cases:
@@ -1904,7 +2459,7 @@ export async function prepareAgentTools(
           // MCP SDK's strict Tool schema rejects (fails the turn during tools/list);
           // sanitize the response on the wire before validation. The namespace Set
           // also captures each tool's original connector namespace (P4 Part B.1).
-          ...(fetchImpl !== globalThis.fetch ? { fetch: fetchImpl } : {}),
+          fetch: fetchImpl,
           ...(await mcpServerRequestInit(settings, config)),
           ...(config.timeoutMs
             ? {
@@ -1916,13 +2471,15 @@ export async function prepareAgentTools(
         config.id,
         config.allowedTools,
         bestEffort,
+        aggregateToolBudget,
+        `${config.id}:${index}`,
       );
       return {
         server,
         bestEffort,
         optional,
       };
-    }),
+    },
   );
   const requiredServers = servers.filter((entry) => !entry.bestEffort).map((entry) => entry.server);
   const bestEffortServers = servers
@@ -1934,18 +2491,21 @@ export async function prepareAgentTools(
   const optionalServerNames = new Set(
     servers.filter((entry) => entry.optional).map((entry) => entry.server.name),
   );
-  const connectedRequired = await connectMcpServers(requiredServers, {
-    connectInParallel: true,
-    strict: true,
-  });
-  const connectedBestEffort = bestEffortServers.length
-    ? await connectMcpServers(bestEffortServers, {
-        connectInParallel: true,
-        strict: false,
-      })
-    : null;
+  const connectedRequired = await connectMcpServersInBatches(requiredServers, { strict: true });
+  let connectedBestEffort: ConnectedMcpServerBatches | null = null;
+  try {
+    connectedBestEffort = bestEffortServers.length
+      ? await connectMcpServersInBatches(bestEffortServers, { strict: false })
+      : null;
+  } catch (error) {
+    await connectedRequired.close().catch(() => undefined);
+    throw error;
+  }
   if (connectedBestEffort) {
     for (const failed of connectedBestEffort.failed) {
+      if (failed instanceof PrefixedMcpServer) {
+        failed.releaseAggregateBudget();
+      }
       if (!optionalServerNames.has(failed.name)) {
         continue;
       }
@@ -1959,10 +2519,20 @@ export async function prepareAgentTools(
   return {
     mcpServers: [...connectedRequired.active, ...(connectedBestEffort?.active ?? [])],
     close: async () => {
-      await connectedRequired.close();
+      let firstError: unknown;
       if (connectedBestEffort) {
-        await connectedBestEffort.close();
+        try {
+          await connectedBestEffort.close();
+        } catch (error) {
+          firstError ??= error;
+        }
       }
+      try {
+        await connectedRequired.close();
+      } catch (error) {
+        firstError ??= error;
+      }
+      if (firstError !== undefined) throw firstError;
     },
     codexConnectorNamespaces,
   };
@@ -1979,10 +2549,12 @@ function connectionBrokerFetch(
   }
   return async (input, init) => {
     const request = await mcpRequestInfo(input, init);
+    const destinationUrl = mcpRequestDestinationUrl(input);
     const first = await resolveConnectionForRequest(
       options,
       config.id,
       connectionRef,
+      destinationUrl,
       request.toolName,
       false,
     );
@@ -1994,10 +2566,12 @@ function connectionBrokerFetch(
       withConnectionHeaders(input, init, first.headers),
     );
     if (response.status === 401) {
+      await cancelMcpResponseBody(response);
       const refreshed = await resolveConnectionForRequest(
         options,
         config.id,
         connectionRef,
+        destinationUrl,
         request.toolName,
         true,
       );
@@ -2010,11 +2584,14 @@ function connectionBrokerFetch(
       );
       if (retry.status === 403) {
         const auth = insufficientScopeAuth(retry.headers, connectionRef, refreshed.connectionId);
-        return auth
-          ? await authNeededFetchResponse(options, config.id, request, auth, connectionRef)
-          : retry;
+        if (auth) {
+          await cancelMcpResponseBody(retry);
+          return await authNeededFetchResponse(options, config.id, request, auth, connectionRef);
+        }
+        return retry;
       }
       if (retry.status === 401) {
+        await cancelMcpResponseBody(retry);
         return await authNeededFetchResponse(
           options,
           config.id,
@@ -2023,9 +2600,13 @@ function connectionBrokerFetch(
             status: "auth_needed",
             reason: "expired",
             providerDomain: connectionRef.providerDomain,
+            ...(connectionRef.provider ? { provider: connectionRef.provider } : {}),
             connectionId: refreshed.connectionId,
             ...(connectionRef.scopes ? { scopes: connectionRef.scopes } : {}),
             ...(connectionRef.resource ? { resource: connectionRef.resource } : {}),
+            ...(connectionRef.selectedResources
+              ? { selectedResources: connectionRef.selectedResources }
+              : {}),
           },
           connectionRef,
         );
@@ -2034,9 +2615,11 @@ function connectionBrokerFetch(
     }
     if (response.status === 403) {
       const auth = insufficientScopeAuth(response.headers, connectionRef, first.connectionId);
-      return auth
-        ? await authNeededFetchResponse(options, config.id, request, auth, connectionRef)
-        : response;
+      if (auth) {
+        await cancelMcpResponseBody(response);
+        return await authNeededFetchResponse(options, config.id, request, auth, connectionRef);
+      }
+      return response;
     }
     return response;
   };
@@ -2046,6 +2629,7 @@ async function resolveConnectionForRequest(
   options: PrepareToolsOptions,
   serverId: string,
   connectionRef: McpServerConnectionRef,
+  destinationUrl: string,
   toolName: string | undefined,
   forceRefresh: boolean,
 ): Promise<ResolveConnectionCredentialResult> {
@@ -2054,15 +2638,20 @@ async function resolveConnectionForRequest(
       status: "auth_needed",
       reason: "missing_connection",
       providerDomain: connectionRef.providerDomain,
+      ...(connectionRef.provider ? { provider: connectionRef.provider } : {}),
       ...(connectionRef.connectionId ? { connectionId: connectionRef.connectionId } : {}),
       ...(connectionRef.scopes ? { scopes: connectionRef.scopes } : {}),
       ...(connectionRef.resource ? { resource: connectionRef.resource } : {}),
+      ...(connectionRef.selectedResources
+        ? { selectedResources: connectionRef.selectedResources }
+        : {}),
     };
   }
   const request: ResolveConnectionCredentialInput = {
     workspaceId: options.workspaceId,
     serverId,
     connectionRef,
+    destinationUrl,
     forceRefresh,
     ...(toolName ? { toolName } : {}),
     ...(options.subjectId ? { subjectId: options.subjectId } : {}),
@@ -2074,9 +2663,13 @@ async function resolveConnectionForRequest(
       status: "auth_needed",
       reason: "refresh_failed",
       providerDomain: connectionRef.providerDomain,
+      ...(connectionRef.provider ? { provider: connectionRef.provider } : {}),
       ...(connectionRef.connectionId ? { connectionId: connectionRef.connectionId } : {}),
       ...(connectionRef.scopes ? { scopes: connectionRef.scopes } : {}),
       ...(connectionRef.resource ? { resource: connectionRef.resource } : {}),
+      ...(connectionRef.selectedResources
+        ? { selectedResources: connectionRef.selectedResources }
+        : {}),
     };
   }
 }
@@ -2094,6 +2687,7 @@ function insufficientScopeAuth(
     status: "auth_needed",
     reason: "insufficient_scope",
     providerDomain: connectionRef.providerDomain,
+    ...(connectionRef.provider ? { provider: connectionRef.provider } : {}),
     connectionId,
     ...(challenge.scope?.length
       ? { scopes: challenge.scope }
@@ -2105,6 +2699,9 @@ function insufficientScopeAuth(
       : connectionRef.resource
         ? { resource: connectionRef.resource }
         : {}),
+    ...(connectionRef.selectedResources
+      ? { selectedResources: connectionRef.selectedResources }
+      : {}),
   };
 }
 
@@ -2120,6 +2717,11 @@ async function authNeededFetchResponse(
     serverId,
     toolName: request.toolName ?? null,
     providerDomain: auth.providerDomain,
+    ...(auth.provider
+      ? { provider: auth.provider }
+      : connectionRef.provider
+        ? { provider: connectionRef.provider }
+        : {}),
     reason: auth.reason,
     ...(connectionId ? { connectionId } : {}),
     ...(auth.scopes
@@ -2132,6 +2734,11 @@ async function authNeededFetchResponse(
       : connectionRef.resource
         ? { resource: connectionRef.resource }
         : {}),
+    ...(auth.selectedResources
+      ? { selectedResources: auth.selectedResources }
+      : connectionRef.selectedResources
+        ? { selectedResources: connectionRef.selectedResources }
+        : {}),
     ...(auth.authorizationUrl ? { authorizationUrl: auth.authorizationUrl } : {}),
     ...(options.subjectId ? { subjectId: options.subjectId } : {}),
   });
@@ -2161,6 +2768,10 @@ type McpRequestInfo = {
   toolName?: string;
 };
 
+function mcpRequestDestinationUrl(input: string | URL | Request): string {
+  return new URL(input instanceof Request ? input.url : input.toString()).toString();
+}
+
 async function mcpRequestInfo(
   input: string | URL | Request,
   init?: RequestInit,
@@ -2389,7 +3000,7 @@ async function signFirstPartyDelegatedBearer(
     workspaceId: options.workspaceId,
     subjectId: options.subjectId ?? "worker:first-party-mcp",
     ...(options.subjectLabel ? { subjectLabel: options.subjectLabel } : {}),
-    permissions: options.firstPartyPermissions ?? firstPartyMcpPermissions,
+    permissions: options.firstPartyPermissions ?? [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS],
     ...(options.sessionId ? { sessionId: options.sessionId } : {}),
     ...(options.turnId ? { turnId: options.turnId } : {}),
     ...(options.attemptId ? { attemptId: options.attemptId } : {}),
@@ -2473,22 +3084,6 @@ async function codexAppsMcpRequestInit(
 // level scopes (billing/account/members/api_keys/workspace:admin) are
 // intentionally excluded: they gate no first-party tool and are not agent
 // capabilities. (A finer-grained capability model comes later.)
-const firstPartyMcpPermissions: Permission[] = [
-  "workspace:read",
-  "files:read",
-  "documents:search",
-  "scheduled_tasks:manage",
-  "scheduled_tasks:run",
-  "goals:manage",
-  "sessions:read",
-  "sessions:create",
-  "sessions:control",
-  "variable-sets:use",
-  "variable-sets:manage",
-  "rigs:use",
-  "github:use",
-];
-
 // codex_apps is third-party-by-trust (the external ChatGPT connectors backend)
 // but needs DYNAMIC auth, so it is its own category — deliberately NOT folded
 // into the first-party allowlist, which would wrongly sign an OpenGeni delegated
@@ -2588,12 +3183,15 @@ class PrefixedMcpServer implements MCPServer {
   // doesn't spam the log when the SDK re-lists across model turns.
   private readonly bestEffort: boolean;
   private loggedListToolsFailure = false;
+  private listedToolSchemaTokens = 0;
 
   constructor(
     private readonly inner: MCPServer,
     registryId: string,
     allowedTools?: string[],
     bestEffort = false,
+    private readonly aggregateToolBudget?: McpAggregateToolListBudget,
+    private readonly aggregateSourceId = registryId,
   ) {
     this.name = registryId;
     this.prefix = prefixedMcpToolName(registryId, "");
@@ -2607,13 +3205,27 @@ class PrefixedMcpServer implements MCPServer {
   }
 
   close(): Promise<void> {
+    this.releaseAggregateBudget();
     return this.inner.close();
   }
 
+  releaseAggregateBudget(): void {
+    this.aggregateToolBudget?.remove(this.aggregateSourceId);
+  }
+
   async listTools(): Promise<RuntimeMcpTool[]> {
-    let tools: RuntimeMcpTool[];
     try {
-      tools = await this.inner.listTools();
+      const tools = assertMcpToolListWithinBounds(await this.inner.listTools()) as RuntimeMcpTool[];
+      const exposed = tools
+        .filter((tool) => this.isAllowed(tool.name))
+        .map((tool) => ({
+          ...tool,
+          name: prefixedMcpToolName(this.name, tool.name),
+        }));
+      const bounded = (this.aggregateToolBudget?.replace(this.aggregateSourceId, exposed) ??
+        assertMcpToolListWithinBounds(exposed)) as RuntimeMcpTool[];
+      this.listedToolSchemaTokens = estimateSerializedValueTokens(bounded);
+      return bounded;
     } catch (error) {
       // A REQUIRED server's tools/list failure is fatal (fail-loud default): the
       // caller explicitly requested it, so its absence must fail the turn.
@@ -2642,14 +3254,14 @@ class PrefixedMcpServer implements MCPServer {
           { serverId: this.name, ...safeMcpErrorFields(error) },
         );
       }
+      this.releaseAggregateBudget();
       return [];
     }
-    return tools
-      .filter((tool) => this.isAllowed(tool.name))
-      .map((tool) => ({
-        ...tool,
-        name: prefixedMcpToolName(this.name, tool.name),
-      }));
+  }
+
+  /** Latest exact tools/list projection used to build the model request. */
+  modelToolSchemaTokens(): number {
+    return this.listedToolSchemaTokens;
   }
 
   async callTool(
@@ -2662,7 +3274,9 @@ class PrefixedMcpServer implements MCPServer {
       throw new Error(`MCP tool ${unprefixed} is not allowed for server ${this.name}`);
     }
     try {
-      return await this.inner.callTool(unprefixed, args, meta);
+      const output = await this.inner.callTool(unprefixed, args, meta);
+      assertMcpPayloadWithinBytes(output, MCP_MAX_TOOL_RESULT_BYTES, "MCP tool result");
+      return output;
     } catch (error) {
       // The connection broker's auth-needed short-circuit arrives as a thrown
       // JSON-RPC error (an inline isError result would be stripped by the SDK
@@ -2813,22 +3427,25 @@ export async function prepareRunInput(
       ...(sandboxSessionState ? { sandboxSessionState } : {}),
     };
   }
-  // An approval can only be resumed against a real saved run state. If the
+  // An interrupted tool can only be resumed against a real saved run state. If the
   // latest blob is the cleared sentinel the awaiting turn was wiped (the API
   // refuses clear in requires_action, so this is a defensive guard) — fail with
   // an honest message instead of the cryptic SDK "missing schema version".
   if (isClearedRunStateBlob(input.serializedRunState)) {
     throw new Error(
-      "Cannot resume an approval: the session context was cleared, so the awaiting run state no longer exists.",
+      "Cannot resume an interrupted tool: the session context was cleared, so the awaiting run state no longer exists.",
     );
   }
   const state = await RunState.fromString(agent, input.serializedRunState);
   const interruptions = state.getInterruptions();
-  const target = interruptions.find((item: any) => approvalIdentifier(item) === input.approvalId);
+  const interruptionId = input.kind === "human_input" ? input.toolCallId : input.approvalId;
+  const target = interruptions.find((item: any) => approvalIdentifier(item) === interruptionId);
   if (!target) {
-    throw new Error(`Approval not found in saved run state: ${input.approvalId}`);
+    throw new Error(`Interrupted tool not found in saved run state: ${interruptionId}`);
   }
-  if (input.decision === "approve") {
+  if (input.kind === "human_input") {
+    state.approve(target as any);
+  } else if (input.decision === "approve") {
     state.approve(target as any);
   } else {
     state.reject(target as any, input.message ? { message: input.message } : undefined);
@@ -2842,13 +3459,21 @@ export type RunAgentStreamOptions = {
   sandboxClient?: unknown;
   sandboxEnvironment?: Record<string, string>;
   onRuntimeEvent?: (event: NormalizedRuntimeEvent) => Promise<void> | void;
-  contextCompactionSignalTokens?: () => number | null | undefined;
+  contextCompactionSignal?: () => ProviderContextTokenSignal | null | undefined;
   contextCompactionRequested?: () => boolean | Promise<boolean>;
   // Host-managed git credential renewal registration. Called only after the
   // initial token-file seed completed on a real provisioned box. The worker
   // owns the multi-day timer and uses this pinned, un-proxied session to
   // atomically replace token files; runtime never mints credentials itself.
   onGitCredentialSessionReady?: (session: GitCredentialTokenWriterSession) => Promise<void> | void;
+  // OpenGeni-minted Toolspace token renewal registration. Called only after the
+  // initial token file reached the real sandbox session.
+  onToolspaceTokenSessionReady?: (session: ToolspaceTokenWriterSession) => Promise<void> | void;
+  // Host-owned run material is seeded off-manifest before setup and every
+  // agent-created process sources the active immutable generation. The worker
+  // owns resolution/renewal/fencing; runtime owns sandbox transport.
+  runCredentialSessionId?: string;
+  onRunCredentialSessionReady?: RunCredentialSessionReady;
   // OWNERSHIP INVERSION (P1.2): an externally-owned, already-live sandbox
   // session resolved by the per-turn resume-by-id path. When present,
   // runAgentStream does NOT build (or resume, or discard) a client — it threads
@@ -2879,6 +3504,13 @@ export type RunAgentStreamOptions = {
     // after establish, so runAgentStream must not run it eagerly here.
     deferredSetup?: boolean;
   };
+  /**
+   * The attempt's authoritative physical sandbox-operation fence. Platform
+   * lifecycle commands use its command runner too, so Steer/Pause can interrupt
+   * repository clone, rig setup, file materialization, and credential seeding
+   * before the attempt-quiesced receipt opens queue admission.
+   */
+  turnToolCancellationFence?: TurnToolCancellationFence;
   // A per-turn model-input filter chained AFTER the provider-item-id strip.
   // Used by the genesis-title injection to prepend a hidden, NON-PERSISTED
   // directive: a callModelInputFilter mutates only `modelData.input` for each
@@ -2888,7 +3520,7 @@ export type RunAgentStreamOptions = {
 };
 
 export type ContextRobustnessFilterOptions = {
-  contextCompactionSignalTokens?: () => number | null | undefined;
+  contextCompactionSignal?: () => ProviderContextTokenSignal | null | undefined;
   contextCompactionRequested?: () => boolean | Promise<boolean>;
   throwOnCompactionNeeded?: boolean;
 };
@@ -2934,9 +3566,10 @@ function takeGenesisTitleInputFilter(agent: Agent<any, any>): CallModelInputFilt
 // Generic substrate prompting for programmatic tool calling (toolspace). Same
 // text for every host; gated per-turn by appendToolspaceInstructions on the
 // presence of a minted toolspace token, so it only appears when the sandbox
-// actually exposes the ogtool CLI + $OPENGENI_TOOLSPACE_URL/_TOKEN_FILE.
+// exposes $OPENGENI_TOOLSPACE_URL/_TOKEN_FILE. Stock images carry ogtool;
+// custom environments get only an exact deployment-pinned bootstrap hint.
 export const TOOLSPACE_PROGRAMMATIC_DIRECTIVE =
-  "Every tool on your MCP surface is also callable programmatically from the sandbox shell, so scripts can invoke tools without a model round trip per call. Run `ogtool list` to see the available tools and their input schemas (from tools/list), then `ogtool call <tool-name> '<json-args>'`; equivalently, POST MCP JSON-RPC to $OPENGENI_TOOLSPACE_URL with the bearer token read from $OPENGENI_TOOLSPACE_TOKEN_FILE. Prefer programmatic calls for loops, polling, and bulk filtering: their results stay in the sandbox and do not consume your context window. Tools that require human approval must still be invoked normally — called programmatically they return a typed error.";
+  "Every tool on your MCP surface is also callable programmatically from the sandbox shell, so scripts can invoke tools without a model round trip per call. If `ogtool` is installed, run `ogtool list` to see the available tools and their input schemas (from tools/list), then `ogtool call <tool-name> '<json-args>'`. If it is absent and both npm and $OPENGENI_OGTOOL_PACKAGE_SPEC are available, run the exact deployment-pinned package with `npm exec --yes --package=\"$OPENGENI_OGTOOL_PACKAGE_SPEC\" -- ogtool ...`; never guess a version or install `latest`. Otherwise POST MCP JSON-RPC directly to $OPENGENI_TOOLSPACE_URL with the bearer token read from $OPENGENI_TOOLSPACE_TOKEN_FILE. Prefer programmatic calls for loops, polling, and bulk filtering: their results stay in the sandbox and do not consume your context window. Tools that require human approval must still be invoked normally — called programmatically they return a typed error.";
 
 /**
  * callModelInputFilter that removes provider-assigned item ids (rs_/msg_/fc_…)
@@ -2995,24 +3628,89 @@ export const elideSupersededViewImagesFilter: CallModelInputFilter = ({ modelDat
   ) as unknown as AgentInputItem[],
 });
 
+/**
+ * Canonical Codex-style tool-result bound at the final model-input seam. The
+ * identical pure normalizer also runs before conversation rows are persisted,
+ * so this is a live-turn defense rather than a request-only alternate history.
+ */
+export function boundModelToolOutputsFilterForSettings(settings: Settings): CallModelInputFilter {
+  return ({ modelData }) => ({
+    ...modelData,
+    input: boundModelToolOutputItems(
+      modelData.input as unknown as Array<Record<string, unknown>>,
+      settings.modelToolOutputTruncationTokens,
+    ) as unknown as AgentInputItem[],
+  });
+}
+
+function estimateAgentToolSchemaTokens(agent: Agent<any, any>): number {
+  const localTools = Array.isArray((agent as { tools?: unknown }).tools)
+    ? ((agent as { tools: unknown[] }).tools ?? [])
+    : [];
+  const localDescriptors = localTools.map((candidate) => {
+    if (!candidate || typeof candidate !== "object") return candidate;
+    const tool = candidate as Record<string, unknown>;
+    return {
+      type: tool.type,
+      name: tool.name,
+      description: tool.description,
+      parameters: tool.parameters,
+      inputSchema: tool.inputSchema,
+      strict: tool.strict,
+      providerData: tool.providerData,
+    };
+  });
+  const mcpServers = Array.isArray((agent as { mcpServers?: unknown }).mcpServers)
+    ? ((agent as { mcpServers: unknown[] }).mcpServers ?? [])
+    : [];
+  const mcpTokens = mcpServers.reduce<number>((total, server) => {
+    const getter = (server as { modelToolSchemaTokens?: () => number } | null)
+      ?.modelToolSchemaTokens;
+    return total + (typeof getter === "function" ? getter.call(server) : 0);
+  }, 0);
+  return estimateSerializedValueTokens(localDescriptors) + mcpTokens;
+}
+
 export function contextRobustnessFilterForSettings(
   settings: Settings,
   options: ContextRobustnessFilterOptions = {},
 ): CallModelInputFilter {
   const thresholdTokens = compactionThresholdTokens(settings);
-  return async ({ modelData }) => {
+  let previousRequest: { revision: number; footprint: CompleteModelInputFootprint } | null = null;
+  let requestRevision = 0;
+  return async ({ modelData, agent }) => {
     const input = modelData.input;
     if (options.throwOnCompactionNeeded) {
-      const reported = options.contextCompactionSignalTokens?.();
-      const hasReported = typeof reported === "number" && reported > 0;
-      const signalTokens = hasReported
-        ? reported
-        : estimateTokens(input as unknown as Array<Record<string, unknown>>);
+      const reported = options.contextCompactionSignal?.();
+      const current: CompleteModelInputFootprint = {
+        input: input as unknown as Array<Record<string, unknown>>,
+        instructionsTokens: estimateSerializedValueTokens(modelData.instructions ?? ""),
+        toolSchemaTokens: estimateAgentToolSchemaTokens(agent),
+      };
+      // Stream consumption can lag the SDK's background model loop. A provider
+      // usage signal is safe only when its response revision belongs to the
+      // immediately preceding request. Never attach a delayed response count to
+      // a newer footprint: doing so can hide all model output produced between
+      // them and recreate an under-counting compaction loop.
+      const boundProvider =
+        reported &&
+        previousRequest &&
+        reported.revision === previousRequest.revision &&
+        hasModelGeneratedItem(current.input)
+          ? reported
+          : null;
+      const estimate = estimateCompleteModelInput({
+        current,
+        provider: boundProvider,
+        providerRequestFootprint: boundProvider ? (previousRequest?.footprint ?? null) : null,
+      });
+      const signalTokens = estimate.tokens;
+      previousRequest = { revision: ++requestRevision, footprint: current };
       if (await options.contextCompactionRequested?.()) {
         throw new CompactionNeededError({
           signalTokens,
           thresholdTokens,
-          signalSource: hasReported ? "provider" : "estimate",
+          signalSource: boundProvider ? "provider" : "estimate",
           trigger: "operator",
         });
       }
@@ -3020,7 +3718,7 @@ export function contextRobustnessFilterForSettings(
         throw new CompactionNeededError({
           signalTokens,
           thresholdTokens,
-          signalSource: hasReported ? "provider" : "estimate",
+          signalSource: boundProvider ? "provider" : "estimate",
         });
       }
     }
@@ -3057,6 +3755,7 @@ export function callModelInputFilterForSettings(
   const filters: CallModelInputFilter[] = [
     normalizeComputerCallsFilter,
     elideSupersededViewImagesFilter,
+    boundModelToolOutputsFilterForSettings(settings),
   ];
   if (settings.openaiProviderItemIds === "strip") {
     filters.push(stripProviderItemIdsFilter);
@@ -3074,7 +3773,11 @@ export async function runAgentStream(
   const prepared: PreparedAgentInput =
     typeof input === "string" || input instanceof RunState ? { input } : input;
   const environment = overrides.sandboxEnvironment ?? collectSandboxEnvironment(settings);
+  const toolspaceTokenFile = toolspaceTokenFileForAgent(agent, environment);
   const genesisTitleInputFilter = takeGenesisTitleInputFilter(agent);
+  if (overrides.onRunCredentialSessionReady && !overrides.runCredentialSessionId) {
+    throw new Error("runCredentialSessionId is required when run credential setup is enabled");
+  }
 
   // OWNED PATH (P1.2 ownership inversion): the per-turn resume path injected a
   // live, externally-owned box. We thread the live `session` straight into
@@ -3093,11 +3796,24 @@ export async function runAgentStream(
     // whose per-op pointer re-read could land these execs on a machine swapped in
     // mid-turn.
     const setupSession = (overrides.ownedSandbox.setupSession ?? session) as SandboxSessionLike;
+    const credentialAgentSession = overrides.runCredentialSessionId
+      ? withRunCredentialsSession(session as SandboxSessionLike, overrides.runCredentialSessionId)
+      : (session as SandboxSessionLike);
+    const agentSession = toolspaceTokenFile
+      ? withToolspaceTokenSession(credentialAgentSession, toolspaceTokenFile)
+      : credentialAgentSession;
+    const credentialSetupSession = overrides.runCredentialSessionId
+      ? withRunCredentialsSession(setupSession, overrides.runCredentialSessionId)
+      : setupSession;
+    const decoratedSetupSession = toolspaceTokenFile
+      ? withToolspaceTokenSession(credentialSetupSession, toolspaceTokenFile)
+      : credentialSetupSession;
     // Platform setup (manifest-env pin + beforeAgentStart hooks + file downloads)
     // against the UN-proxied established box — the ONE-TRUTH helper shared with the
     // lazy provisioner. Eager path: runs here, before the run starts (unchanged).
     if (!overrides.ownedSandbox.deferredSetup) {
-      await runOwnedSandboxSetup(agent, session as SandboxSessionLike, setupSession, {
+      await overrides.onRunCredentialSessionReady?.(session as SandboxSessionLike);
+      await runOwnedSandboxSetup(agent, session as SandboxSessionLike, decoratedSetupSession, {
         settings,
         environment,
         preparedInput: prepared,
@@ -3105,7 +3821,17 @@ export async function runAgentStream(
           ? { fileDownloadsMaterialized: true }
           : {}),
         ...(overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {}),
+        ...(overrides.turnToolCancellationFence
+          ? {
+              commandRunner: overrides.turnToolCancellationFence.runSandboxCommand.bind(
+                overrides.turnToolCancellationFence,
+              ),
+            }
+          : {}),
       });
+      if (toolspaceTokenSeedForAgent(agent)) {
+        await overrides.onToolspaceTokenSessionReady?.(agentSession);
+      }
       await overrides.onGitCredentialSessionReady?.(setupSession);
     }
     const runAs = sandboxRunAs(settings);
@@ -3115,11 +3841,19 @@ export async function runAgentStream(
         ? withSandboxFileDownloads(ownedClient as SandboxClient, fileDownloads, {
             ...(overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {}),
             ...(runAs ? { runAs } : {}),
+            ...(overrides.turnToolCancellationFence
+              ? {
+                  commandRunner: overrides.turnToolCancellationFence.runSandboxCommand.bind(
+                    overrides.turnToolCancellationFence,
+                  ),
+                }
+              : {}),
           })
         : (ownedClient as SandboxClient);
     // TOKEN-BROKER (B1): the per-turn git token seed, forwarded OFF-MANIFEST so the
     // repository-clone hook seeds it to the box's token file before the clone.
     const ownedGitTokenSeeds = gitTokenSeedsForAgent(agent);
+    const ownedGitCredentialBindings = gitCredentialBindingsForAgent(agent);
     const ownedToolspaceTokenSeed = toolspaceTokenSeedForAgent(agent);
     const ownedRigSetup = rigSetupDescriptorForAgent(agent);
     const ownedHooks = [
@@ -3132,6 +3866,9 @@ export async function runAgentStream(
         rigCredentialHooksForAgent(agent),
       ),
       ...sandboxToolspaceTokenHooksForAgent(agent),
+      ...toolspaceTokenSessionRegistrationHooks(
+        ownedToolspaceTokenSeed ? overrides.onToolspaceTokenSessionReady : undefined,
+      ),
       ...sandboxRepositoryCloneHooksForAgent(agent),
       ...gitCredentialSessionRegistrationHooks(overrides.onGitCredentialSessionReady),
     ];
@@ -3140,31 +3877,49 @@ export async function runAgentStream(
       ...(overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {}),
       ...(runAs ? { runAs } : {}),
       ...(ownedGitTokenSeeds ? { gitTokenSeeds: ownedGitTokenSeeds } : {}),
+      ...(ownedGitCredentialBindings ? { gitCredentialBindings: ownedGitCredentialBindings } : {}),
       ...(ownedToolspaceTokenSeed ? { toolspaceTokenSeed: ownedToolspaceTokenSeed } : {}),
+      ...(toolspaceTokenFile ? { toolspaceTokenFile } : {}),
       ...(ownedRigSetup ? { rigSetup: ownedRigSetup } : {}),
     };
-    // Keep the decoration as a safety net for any session the SDK does create/resume
-    // through the client during this run (it is inert for the provided session).
-    const decoratedClient = withSandboxLifecycleHooks(resourceClient, ownedHooks, ownedHookContext);
+    // Keep both credential seeding and lifecycle decoration as a safety net for
+    // any session the SDK does create/resume during this run. They are inert for
+    // the provided session, which remains the normal ownership-inverted path.
+    const credentialResourceClient = overrides.runCredentialSessionId
+      ? withRunCredentialsClient(
+          resourceClient,
+          overrides.runCredentialSessionId,
+          overrides.onRunCredentialSessionReady,
+        )
+      : resourceClient;
+    const toolspaceResourceClient = toolspaceTokenFile
+      ? withToolspaceTokenClient(credentialResourceClient, toolspaceTokenFile)
+      : credentialResourceClient;
+    const decoratedClient = withSandboxLifecycleHooks(
+      toolspaceResourceClient,
+      ownedHooks,
+      ownedHookContext,
+    );
     const ownedFilter = composeCallModelInputFilters(
       [
-        callModelInputFilterForSettings(settings, {
+        callModelInputFilterForSettings(settings),
+        genesisTitleInputFilter,
+        overrides.callModelInputFilter,
+        // A caller filter may synthesize model input. Re-apply the idempotent
+        // canonical bound at the literal final seam before accounting/provider
+        // serialization so no extension can bypass the policy.
+        boundModelToolOutputsFilterForSettings(settings),
+        contextRobustnessFilterForSettings(settings, {
           throwOnCompactionNeeded: Boolean(
-            overrides.contextCompactionSignalTokens || overrides.contextCompactionRequested,
+            overrides.contextCompactionSignal || overrides.contextCompactionRequested,
           ),
-          ...(overrides.contextCompactionSignalTokens
-            ? {
-                contextCompactionSignalTokens: overrides.contextCompactionSignalTokens,
-              }
+          ...(overrides.contextCompactionSignal
+            ? { contextCompactionSignal: overrides.contextCompactionSignal }
             : {}),
           ...(overrides.contextCompactionRequested
-            ? {
-                contextCompactionRequested: overrides.contextCompactionRequested,
-              }
+            ? { contextCompactionRequested: overrides.contextCompactionRequested }
             : {}),
         }),
-        genesisTitleInputFilter,
-        overrides.callModelInputFilter,
       ].filter((f): f is CallModelInputFilter => Boolean(f)),
     );
     const ownedRunOptions: Parameters<typeof run>[2] = {
@@ -3175,7 +3930,7 @@ export async function runAgentStream(
     };
     ownedRunOptions.sandbox = {
       client: decoratedClient,
-      session,
+      session: agentSession,
       ...(sessionState ? { sessionState } : {}),
     } as SandboxRunConfig;
     return await runScopedRunner(settings).run(agent, prepared.input, ownedRunOptions);
@@ -3200,14 +3955,27 @@ export async function runAgentStream(
           ...(runAs ? { runAs } : {}),
         })
       : refreshedClient;
+  const credentialClient =
+    resourceClient && overrides.runCredentialSessionId
+      ? withRunCredentialsClient(
+          resourceClient,
+          overrides.runCredentialSessionId,
+          overrides.onRunCredentialSessionReady,
+        )
+      : resourceClient;
+  const toolspaceClient =
+    credentialClient && toolspaceTokenFile
+      ? withToolspaceTokenClient(credentialClient, toolspaceTokenFile)
+      : credentialClient;
   // TOKEN-BROKER (B1): the per-turn git token seed, forwarded OFF-MANIFEST so the
   // repository-clone hook seeds it to the box's token file before the clone.
   const gitTokenSeeds = gitTokenSeedsForAgent(agent);
+  const gitCredentialBindings = gitCredentialBindingsForAgent(agent);
   const toolspaceTokenSeed = toolspaceTokenSeedForAgent(agent);
   const legacyRigSetup = rigSetupDescriptorForAgent(agent);
-  const client = resourceClient
+  const client = toolspaceClient
     ? withSandboxLifecycleHooks(
-        resourceClient,
+        toolspaceClient,
         [
           // M3: same rig-setup-first ordering + credential-hook union as the owned
           // path (this legacy create/resume decoration path is byte-for-byte today
@@ -3218,6 +3986,9 @@ export async function runAgentStream(
             rigCredentialHooksForAgent(agent),
           ),
           ...sandboxToolspaceTokenHooksForAgent(agent),
+          ...toolspaceTokenSessionRegistrationHooks(
+            toolspaceTokenSeed ? overrides.onToolspaceTokenSessionReady : undefined,
+          ),
           ...sandboxRepositoryCloneHooksForAgent(agent),
           ...gitCredentialSessionRegistrationHooks(overrides.onGitCredentialSessionReady),
         ],
@@ -3226,7 +3997,9 @@ export async function runAgentStream(
           ...(overrides.onRuntimeEvent ? { onRuntimeEvent: overrides.onRuntimeEvent } : {}),
           ...(runAs ? { runAs } : {}),
           ...(gitTokenSeeds ? { gitTokenSeeds } : {}),
+          ...(gitCredentialBindings ? { gitCredentialBindings } : {}),
           ...(toolspaceTokenSeed ? { toolspaceTokenSeed } : {}),
+          ...(toolspaceTokenFile ? { toolspaceTokenFile } : {}),
           ...(legacyRigSetup ? { rigSetup: legacyRigSetup } : {}),
         },
       )
@@ -3239,21 +4012,21 @@ export async function runAgentStream(
   // OpenGeni's durable conversation truth is still reconciled explicitly below.
   const callModelInputFilter = composeCallModelInputFilters(
     [
-      callModelInputFilterForSettings(settings, {
+      callModelInputFilterForSettings(settings),
+      genesisTitleInputFilter,
+      overrides.callModelInputFilter,
+      boundModelToolOutputsFilterForSettings(settings),
+      contextRobustnessFilterForSettings(settings, {
         throwOnCompactionNeeded: Boolean(
-          overrides.contextCompactionSignalTokens || overrides.contextCompactionRequested,
+          overrides.contextCompactionSignal || overrides.contextCompactionRequested,
         ),
-        ...(overrides.contextCompactionSignalTokens
-          ? {
-              contextCompactionSignalTokens: overrides.contextCompactionSignalTokens,
-            }
+        ...(overrides.contextCompactionSignal
+          ? { contextCompactionSignal: overrides.contextCompactionSignal }
           : {}),
         ...(overrides.contextCompactionRequested
           ? { contextCompactionRequested: overrides.contextCompactionRequested }
           : {}),
       }),
-      genesisTitleInputFilter,
-      overrides.callModelInputFilter,
     ].filter((f): f is CallModelInputFilter => Boolean(f)),
   );
   const runOptions: Parameters<typeof run>[2] = {
@@ -3656,6 +4429,9 @@ export async function runOwnedSandboxSetup(
     onRuntimeEvent?: SandboxLifecycleHookContext["onRuntimeEvent"];
     gitTokenSeedsOverride?: GitTokenSeeds;
     gitTokenSeedOverride?: string;
+    gitCredentialBindingsOverride?: GitCredentialBindingSeed[];
+    toolspaceTokenSeedOverride?: string;
+    commandRunner?: SandboxLifecycleCommandRunner;
   },
 ): Promise<void> {
   const { settings, environment } = opts;
@@ -3677,7 +4453,11 @@ export async function runOwnedSandboxSetup(
     ...(opts.gitTokenSeedOverride ? { github: opts.gitTokenSeedOverride } : {}),
     ...(opts.gitTokenSeedsOverride ?? {}),
   } satisfies GitTokenSeeds;
-  const ownedToolspaceTokenSeed = toolspaceTokenSeedForAgent(agent);
+  const ownedGitCredentialBindings =
+    opts.gitCredentialBindingsOverride ?? gitCredentialBindingsForAgent(agent);
+  const ownedToolspaceTokenSeed =
+    opts.toolspaceTokenSeedOverride ?? toolspaceTokenSeedForAgent(agent);
+  const ownedToolspaceTokenFile = toolspaceTokenFileForAgent(agent, environment);
   const ownedRigSetup = rigSetupDescriptorForAgent(agent);
   const ownedHooks = [
     // M3: rig setup runs FIRST so any tooling it installs is present for the
@@ -3699,8 +4479,11 @@ export async function runOwnedSandboxSetup(
     ...(opts.onRuntimeEvent ? { onRuntimeEvent: opts.onRuntimeEvent } : {}),
     ...(runAs ? { runAs } : {}),
     ...(Object.keys(ownedGitTokenSeeds).length > 0 ? { gitTokenSeeds: ownedGitTokenSeeds } : {}),
+    ...(ownedGitCredentialBindings ? { gitCredentialBindings: ownedGitCredentialBindings } : {}),
     ...(ownedToolspaceTokenSeed ? { toolspaceTokenSeed: ownedToolspaceTokenSeed } : {}),
+    ...(ownedToolspaceTokenFile ? { toolspaceTokenFile: ownedToolspaceTokenFile } : {}),
     ...(ownedRigSetup ? { rigSetup: ownedRigSetup } : {}),
+    ...(opts.commandRunner ? { commandRunner: opts.commandRunner } : {}),
   };
   // OWNED-PATH HOOKS: run the beforeAgentStart hooks directly against the provided
   // box, once per turn, BEFORE the run starts (repository-clone hook seeds the B1
@@ -3720,6 +4503,7 @@ export async function runOwnedSandboxSetup(
       const materialized = await materializeSandboxFileDownloads(setupSession, fileDownloads, {
         ...(opts.onRuntimeEvent ? { onRuntimeEvent: opts.onRuntimeEvent } : {}),
         ...(runAs ? { runAs } : {}),
+        ...(opts.commandRunner ? { commandRunner: opts.commandRunner } : {}),
       });
       if (opts.preparedInput) {
         appendSandboxFileDownloadFailureNote(opts.preparedInput, materialized.failures);
@@ -3753,7 +4537,7 @@ function mergePathGrants(
 export function withSandboxFileDownloads(
   client: SandboxClient,
   downloads: SandboxFileDownload[],
-  context: Pick<SandboxLifecycleHookContext, "onRuntimeEvent" | "runAs"> = {},
+  context: Pick<SandboxLifecycleHookContext, "onRuntimeEvent" | "runAs" | "commandRunner"> = {},
 ): SandboxClient {
   const normalizedDownloads = normalizeSandboxFileDownloads(downloads);
   if (normalizedDownloads.length === 0) {
@@ -3819,7 +4603,7 @@ export function withSandboxFileDownloads(
 export async function materializeSandboxFileDownloads(
   session: SandboxSessionLike,
   downloads: SandboxFileDownload[],
-  context: Pick<SandboxLifecycleHookContext, "onRuntimeEvent" | "runAs"> = {},
+  context: Pick<SandboxLifecycleHookContext, "onRuntimeEvent" | "runAs" | "commandRunner"> = {},
 ): Promise<SandboxFileDownloadMaterializationResult> {
   const normalizedDownloads = normalizeSandboxFileDownloads(downloads);
   if (normalizedDownloads.length === 0) {
@@ -3857,27 +4641,24 @@ export async function materializeSandboxFileDownloads(
     }
     let result: unknown;
     try {
-      result = session.exec
-        ? await session.exec({
-            cmd: sandboxFileDownloadCommand(download, targetPath),
-            workdir: "/workspace",
-            ...(context.runAs ? { runAs: context.runAs } : {}),
-            yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
-            maxOutputTokens: 20_000,
-          })
-        : await session.execCommand!({
-            cmd: sandboxFileDownloadCommand(download, targetPath),
-            workdir: "/workspace",
-            ...(context.runAs ? { runAs: context.runAs } : {}),
-            yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
-            maxOutputTokens: 20_000,
-          });
+      result = await runSandboxLifecycleCommand(
+        session,
+        {
+          cmd: sandboxFileDownloadCommand(download, targetPath),
+          workdir: "/workspace",
+          ...(context.runAs ? { runAs: context.runAs } : {}),
+          yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
+          maxOutputTokens: 20_000,
+        },
+        context.commandRunner,
+      );
       assertSandboxCommandSucceeded(result, `Sandbox file resource download ${download.fileId}`);
       await context.onRuntimeEvent?.({
         type: "sandbox.operation.completed",
         payload: { name: "file-resource-download", ...payload },
       });
     } catch (error) {
+      if (error instanceof TurnSandboxCommandCancelledError) throw error;
       const failure = sandboxFileDownloadFailure(download, targetPath, error, result);
       failures.push(failure);
       await context.onRuntimeEvent?.({
@@ -3954,86 +4735,87 @@ function ensureManifest(
   });
 }
 
-/** Coerce the various binary shapes a tool-output image `data` field can take into
- *  a Uint8Array. Handles a live `Uint8Array`, a plain number[] , and the
- *  object-of-numbers (`{"0":137,"1":80,…}`) that a `Uint8Array` degrades into after
- *  a JSON round-trip — the exact 10x-bloat shape this normalizer exists to kill. */
-function toImageBytes(data: unknown): Uint8Array | null {
-  if (data instanceof Uint8Array) {
-    return data;
-  }
+function base64DecodedByteLength(value: string): number {
+  const padding = value.endsWith("==") ? 2 : value.endsWith("=") ? 1 : 0;
+  return Math.max(0, Math.floor((value.length * 3) / 4) - padding);
+}
+
+/** Determine image byte length without allocating another binary/base64 copy. */
+function imageDataByteLength(data: unknown): number | null {
+  if (ArrayBuffer.isView(data)) return data.byteLength;
+  if (data instanceof ArrayBuffer) return data.byteLength;
   if (Array.isArray(data)) {
-    return data.every((n) => typeof n === "number") ? Uint8Array.from(data as number[]) : null;
+    return data.every((value) => typeof value === "number") ? data.length : null;
   }
-  if (data && typeof data === "object") {
-    const values = Object.values(data as Record<string, unknown>);
-    if (values.length > 0 && values.every((n) => typeof n === "number")) {
-      return Uint8Array.from(values as number[]);
-    }
+  if (!data || typeof data !== "object") return null;
+  const record = data as Record<string, unknown>;
+  if (record.type === "Buffer" && Array.isArray(record.data)) {
+    return record.data.every((value) => typeof value === "number") ? record.data.length : null;
   }
-  return null;
+  const keys = Object.keys(record);
+  return keys.length > 0 &&
+    keys.every((key) => /^\d+$/.test(key) && typeof record[key] === "number")
+    ? keys.length
+    : null;
 }
 
-/** Compact a structured image tool output — the SDK's `{type:'image', image:{data,mediaType}}`
- *  shape (produced by the codex-path `computer_screenshot` function tool) OR the already-
- *  normalized protocol `{type:'input_image', image:'data:…'}` item — into a `data:<mt>;base64,…`
- *  string. Returns null when `value` is not an image output. */
-function structuredImageToDataUrl(value: unknown): string | null {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return null;
-  }
-  const v = value as { type?: unknown; image?: unknown };
-  if (v.type === "input_image") {
-    // Protocol item: `image` is already a `data:…` (or plain URL) string.
-    return typeof v.image === "string" && v.image.length > 0 ? v.image : null;
-  }
-  if (v.type !== "image" || !v.image || typeof v.image !== "object") {
-    return null;
-  }
-  const image = v.image as {
-    data?: unknown;
-    mediaType?: unknown;
-    url?: unknown;
-  };
-  if (typeof image.url === "string" && image.url.length > 0) {
-    return image.url;
-  }
+/**
+ * Convert one image-shaped tool result into a content-free audit fact. This is
+ * intentionally different from model history: the model keeps its structured
+ * image item, while `session_events` never becomes an implicit image blob store.
+ */
+function toolOutputMediaPreview(value: unknown): SessionEventMediaPreview | null {
+  if (typeof value === "string") {
+    return sessionEventMediaPreviewFromDataUrl(value);
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const record = value as Record<string, unknown>;
+  if (record.type === "input_image") {
+    const source = record.image ?? record.image_url ?? record.imageUrl;
+    const url =
+      typeof source === "string"
+        ? source
+        : source && typeof source === "object"
+          ? (source as Record<string, unknown>).url
+          : null;
+    if (typeof url !== "string" || url.length === 0) return null;
+    return sessionEventMediaPreviewFromDataUrl(url) ?? sessionEventMediaPreview("image/*", null);
+  }
+  if (record.type !== "image" || !record.image || typeof record.image !== "object") return null;
+  const image = record.image as Record<string, unknown>;
   const mediaType =
     typeof image.mediaType === "string" && image.mediaType.length > 0
       ? image.mediaType
       : "image/png";
+  if (typeof image.url === "string" && image.url.length > 0) {
+    return (
+      sessionEventMediaPreviewFromDataUrl(image.url) ?? sessionEventMediaPreview(mediaType, null)
+    );
+  }
   if (typeof image.data === "string") {
-    return image.data.startsWith("data:") ? image.data : `data:${mediaType};base64,${image.data}`;
+    return (
+      sessionEventMediaPreviewFromDataUrl(image.data) ??
+      sessionEventMediaPreview(mediaType, base64DecodedByteLength(image.data))
+    );
   }
-  const bytes = toImageBytes(image.data);
-  return bytes ? `data:${mediaType};base64,${Buffer.from(bytes).toString("base64")}` : null;
+  const byteLength = imageDataByteLength(image.data);
+  return byteLength === null ? null : sessionEventMediaPreview(mediaType, byteLength);
 }
 
 /**
- * Compact a tool-call output for the `agent.toolCall.output` SESSION EVENT so it
- * never carries a raw binary payload. The codex-path `computer_screenshot` function
- * tool returns a structured `{type:'image', image:{data: Uint8Array, mediaType}}`;
- * captured verbatim its `Uint8Array` JSON-serializes as an object-of-numbers (~12.7MB
- * per screenshot in session_events — ~10x the base64 form). This mirrors the desktop
- * screenshot to the SAME compact `data:<mediaType>;base64,…` STRING the HOSTED
- * `computer_call` event already carries (agents-core sets its output to that data-URL),
- * so both computer-use transports emit one representation. The full data-URL is kept
- * (not truncated) because the web timeline RENDERS the screenshot from this event
- * payload — packages/react/src/timeline/tool-renderers.tsx ComputerCallRenderer
- * (`out.startsWith("data:image")` → <ScreenshotFigure src={out}/>) and ViewImageRenderer.
- * Non-image outputs (text strings, MCP `{isError,content}` objects, hosted computer_call
- * data-URL strings) pass through unchanged.
+ * Normalize a tool-call output for the lossy `agent.toolCall.output` audit event.
+ * Inline image bytes/data URLs become a compact `media_preview` with exact byte
+ * length where knowable and `fullOutputAvailable:false`. The model-facing output
+ * is not changed here, and mixed arrays retain their non-image text/error facts.
  */
 export function normalizeToolOutputForEvent(output: unknown): unknown {
-  const single = structuredImageToDataUrl(output);
+  const single = toolOutputMediaPreview(output);
   if (single !== null) {
     return single;
   }
   if (Array.isArray(output)) {
-    const normalized = output.map((el) => structuredImageToDataUrl(el) ?? el);
-    // A lone image content item unwraps to the bare data-URL string the timeline
-    // image renderers expect; a mixed/multi array keeps its (now-compact) shape.
-    if (normalized.length === 1 && typeof normalized[0] === "string") {
+    const normalized = output.map((el) => toolOutputMediaPreview(el) ?? el);
+    if (normalized.length === 1 && normalized[0]?.type === "media_preview") {
       return normalized[0];
     }
     return normalized;
@@ -4090,8 +4872,8 @@ export function normalizeSdkEvent(event: RunStreamEvent): NormalizedRuntimeEvent
       type: "agent.toolCall.output",
       payload: {
         id: item.rawItem?.callId ?? item.id ?? null,
-        // Compact any structured/binary image output to a data-URL string so a
-        // screenshot never bloats session_events ~10x as an object-of-numbers.
+        // Inline media becomes a content-free audit fact. Model history keeps
+        // the provider's real structured image output on its separate path.
         output: normalizeToolOutputForEvent(item.output),
       },
     });
@@ -4204,6 +4986,7 @@ function usageFromResponse(response: unknown): ModelResponseUsage["usage"] | nul
     ...numberProp(record, "totalTokens", "totalTokens", "total_tokens"),
     ...inputTokenDetailsProp(record),
     ...outputTokenDetailsProp(record),
+    ...requestUsageEntriesProp(record),
   };
   return Object.keys(usage).length > 0 ? usage : null;
 }
@@ -4214,7 +4997,11 @@ function numberProp(
   ...keys: string[]
 ): Partial<ModelResponseUsage["usage"]> {
   const value = keys.map((key) => raw[key]).find((candidate) => candidate !== undefined);
-  return typeof value === "number" && Number.isFinite(value) ? { [outputKey]: value } : {};
+  // Preserve numeric provider values verbatim here, including malformed ones.
+  // The shared usage normalizer is the single bounded validation boundary and
+  // needs to see NaN/infinite/fractional/oversized values so it can emit safe
+  // field-path diagnostics rather than silently erasing the evidence.
+  return typeof value === "number" ? { [outputKey]: value } : {};
 }
 
 function inputTokenDetailsProp(raw: Record<string, unknown>): Partial<ModelResponseUsage["usage"]> {
@@ -4223,7 +5010,7 @@ function inputTokenDetailsProp(raw: Record<string, unknown>): Partial<ModelRespo
     raw.input_tokens_details ??
     raw.promptTokensDetails ??
     raw.prompt_tokens_details;
-  if (!details || typeof details !== "object") {
+  if (details === undefined || details === null) {
     return {};
   }
   return {
@@ -4236,7 +5023,7 @@ function outputTokenDetailsProp(
 ): Partial<ModelResponseUsage["usage"]> {
   const details = raw.outputTokensDetails ?? raw.output_tokens_details;
   const normalized = details ?? raw.completionTokensDetails ?? raw.completion_tokens_details;
-  if (!normalized || typeof normalized !== "object") {
+  if (normalized === undefined || normalized === null) {
     return {};
   }
   return {
@@ -4244,18 +5031,61 @@ function outputTokenDetailsProp(
   };
 }
 
+function requestUsageEntriesProp(
+  raw: Record<string, unknown>,
+): Partial<ModelResponseUsage["usage"]> {
+  const entries = raw.requestUsageEntries ?? raw.request_usage_entries;
+  if (entries === undefined || entries === null) {
+    return {};
+  }
+  return {
+    // The normalizer validates every entry and all supported field aliases.
+    // Preserve the SDK objects rather than rebuilding them and accidentally
+    // dropping provider detail fields such as cache_write_tokens.
+    requestUsageEntries: entries as NonNullable<ModelResponseUsage["usage"]["requestUsageEntries"]>,
+  };
+}
+
 export function serializeApprovals(interruptions: unknown[]): unknown[] {
-  return interruptions.map((item: any) => {
-    if (typeof item?.toJSON === "function") {
-      return item.toJSON();
-    }
-    return {
-      id: approvalIdentifier(item),
-      name: item?.name ?? item?.rawItem?.name ?? "tool",
-      arguments: item?.arguments ?? item?.rawItem?.arguments ?? null,
-      raw: item,
-    };
-  });
+  return interruptions
+    .filter((item) => interruptionToolName(item) !== HUMAN_INPUT_TOOL_NAME)
+    .map((item: any) => {
+      if (typeof item?.toJSON === "function") {
+        return item.toJSON();
+      }
+      return {
+        id: approvalIdentifier(item) ?? "approval",
+        name: item?.name ?? item?.rawItem?.name ?? "tool",
+        arguments: item?.arguments ?? item?.rawItem?.arguments ?? null,
+        raw: item,
+      };
+    });
+}
+
+export function serializeHumanInputRequests(
+  interruptions: unknown[],
+): SerializedHumanInputInterruption[] {
+  return interruptions
+    .filter((item) => interruptionToolName(item) === HUMAN_INPUT_TOOL_NAME)
+    .map((item: any) => {
+      const rawArguments = item?.arguments ?? item?.rawItem?.arguments;
+      let parsedArguments: unknown = rawArguments;
+      if (typeof rawArguments === "string") {
+        try {
+          parsedArguments = JSON.parse(rawArguments);
+        } catch {
+          throw new Error("Human-input interruption contains invalid JSON arguments");
+        }
+      }
+      const toolCallId = approvalIdentifier(item);
+      if (!toolCallId) {
+        throw new Error("Human-input interruption is missing a stable tool-call identity");
+      }
+      return {
+        toolCallId,
+        input: RequestHumanInputToolInput.parse(parsedArguments),
+      };
+    });
 }
 
 export function buildManifest(
@@ -4264,6 +5094,7 @@ export function buildManifest(
   environment = collectSandboxEnvironment(settings),
   fileResourceDownloads: SandboxFileDownload[] = [],
 ): Manifest {
+  assertUniqueResourceMountPaths(resources);
   const entries: Record<string, any> = {};
   const downloadsByFileId = new Map(
     normalizeSandboxFileDownloads(fileResourceDownloads).map((download) => [
@@ -4274,9 +5105,9 @@ export function buildManifest(
   for (const resource of resources) {
     if (resource.kind === "repository") {
       const url = new URL(resource.uri);
-      const host = url.hostname.toLowerCase();
+      const host = url.host.toLowerCase();
       const repo = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
-      const mountPath = normalizeManifestPath(resource.mountPath ?? `repos/${repo}`);
+      const mountPath = resourceMountPath(resource);
       if (repositoryUsesSandboxClone(settings, resource)) {
         entries[mountPath] = dir();
         continue;
@@ -4285,12 +5116,12 @@ export function buildManifest(
         host,
         repo,
         ref: resource.ref,
-        ...(resource.subpath ? { subpath: normalizeManifestPath(resource.subpath) } : {}),
+        ...(resource.subpath ? { subpath: normalizeRepositorySubpath(resource.subpath) } : {}),
       });
       continue;
     }
     if (resource.kind === "file") {
-      const mountPath = normalizeManifestPath(resource.mountPath ?? `files/${resource.fileId}`);
+      const mountPath = resourceMountPath(resource);
       const download = downloadsByFileId.get(resource.fileId);
       entries[mountPath] = download
         ? sandboxDownloadDirectory(download, mountPath)
@@ -4450,11 +5281,7 @@ function parseAzureConnectionString(value: string): Record<string, string> {
 }
 
 function normalizeManifestPath(path: string): string {
-  const normalized = path.replace(/^\/+|\/+$/g, "");
-  if (!normalized || normalized.includes("..")) {
-    throw new Error(`Invalid sandbox resource path: ${path}`);
-  }
-  return normalized;
+  return normalizeResourceMountPath(path);
 }
 
 function normalizeSandboxFileDownloads(downloads: SandboxFileDownload[]): SandboxFileDownload[] {
@@ -4517,6 +5344,11 @@ function shellQuote(value: string): string {
 
 export type SandboxLifecycleHookPhase = "beforeAgentStart";
 
+export type SandboxLifecycleCommandRunner = (
+  session: TurnSandboxCommandSession,
+  args: TurnSandboxCommandArgs,
+) => Promise<unknown>;
+
 export type SandboxLifecycleHookContext = {
   environment: Record<string, string>;
   onRuntimeEvent?: (event: NormalizedRuntimeEvent) => Promise<void> | void;
@@ -4528,12 +5360,28 @@ export type SandboxLifecycleHookContext = {
   // NEVER the box/agent manifest env (validateNoEnvironmentDelta must never see
   // rotating values).
   gitTokenSeeds?: GitTokenSeeds;
+  gitCredentialBindings?: GitCredentialBindingSeed[];
   toolspaceTokenSeed?: string;
+  toolspaceTokenFile?: string;
   // M3: the rig setup descriptor for the rig-setup hook (the script + marker
   // version id + the rig's own timeout). Present only on a rig-bound turn.
   rigSetup?: RigSetupDescriptor;
+  commandRunner?: SandboxLifecycleCommandRunner;
 };
 
+async function runSandboxLifecycleCommand(
+  session: SandboxSessionLike,
+  args: TurnSandboxCommandArgs,
+  commandRunner?: SandboxLifecycleCommandRunner,
+): Promise<unknown> {
+  if (commandRunner) {
+    return await commandRunner(session as TurnSandboxCommandSession, args);
+  }
+  if (session.exec) return await session.exec(args);
+  if (session.execCommand) return await session.execCommand(args);
+  throw new Error("Sandbox session does not support command execution");
+}
+
 // M3: everything the rig-setup hook needs to run the frozen rig version's setup
 // script exactly once per box. `versionId` keys the idempotence marker
 // (/var/opengeni/rig-setup-<versionId>.done); `timeoutMs` is the rig-specific
@@ -4683,10 +5531,32 @@ function gitTokenSeedsForAgent(agent: Agent<any, any>): GitTokenSeeds | undefine
   return agentGitTokenSeeds.get(agent);
 }
 
+function gitCredentialBindingsForAgent(
+  agent: Agent<any, any>,
+): GitCredentialBindingSeed[] | undefined {
+  return agentGitCredentialBindings.get(agent);
+}
+
 function toolspaceTokenSeedForAgent(agent: Agent<any, any>): string | undefined {
   return agentToolspaceTokenSeed.get(agent);
 }
 
+function toolspaceTokenSessionIdForAgent(agent: Agent<any, any>): string | undefined {
+  return agentToolspaceTokenSessionId.get(agent);
+}
+
+function toolspaceTokenFileForAgent(
+  agent: Agent<any, any>,
+  environment: Readonly<Record<string, string>>,
+): string | undefined {
+  if (!toolspaceTokenSeedForAgent(agent)) return undefined;
+  const sessionId = toolspaceTokenSessionIdForAgent(agent);
+  if (!sessionId) {
+    throw new Error("Toolspace token seed is missing its session identity");
+  }
+  return toolspaceTokenFileFromEnvironment(environment, sessionId);
+}
+
 function sandboxToolspaceTokenHooksForAgent(agent: Agent<any, any>): SandboxLifecycleHook[] {
   return toolspaceTokenSeedForAgent(agent)
     ? [
@@ -4756,6 +5626,22 @@ function gitCredentialSessionRegistrationHooks(
     : [];
 }
 
+function toolspaceTokenSessionRegistrationHooks(
+  callback: RunAgentStreamOptions["onToolspaceTokenSessionReady"],
+): SandboxLifecycleHook[] {
+  return callback
+    ? [
+        {
+          id: "toolspace-token-renewal-registration",
+          phase: "beforeAgentStart",
+          run: async (session) => {
+            await callback(session);
+          },
+        },
+      ]
+    : [];
+}
+
 function sandboxRepositoryCloneHooks(
   settings: Settings,
   resources: ResourceRef[],
@@ -4823,6 +5709,20 @@ function gitProviderSeedEnv(provider: GitCredentialProvider): string {
   return `OPENGENI_GIT_${provider.toUpperCase()}_TOKEN_SEED`;
 }
 
+export function gitCredentialBindingHash(credentialBindingId: string): string {
+  return createHash("sha256").update(credentialBindingId, "utf8").digest("hex").slice(0, 32);
+}
+
+function gitBindingSeedEnv(binding: GitCredentialBindingSeed): string {
+  return `OPENGENI_GIT_BINDING_${gitCredentialBindingHash(binding.credentialBindingId).toUpperCase()}_TOKEN_SEED`;
+}
+
+function gitCredentialBindingSeedExportPrefix(bindings: GitCredentialBindingSeed[]): string {
+  return bindings
+    .map((binding) => `export ${gitBindingSeedEnv(binding)}=${shellQuote(binding.token)}`)
+    .join("\n");
+}
+
 function gitTokenSeedExportPrefix(seeds: GitTokenSeeds): string {
   const lines: string[] = [];
   for (const provider of GIT_CREDENTIAL_PROVIDERS) {
@@ -4838,37 +5738,268 @@ function gitTokenSeedExportPrefix(seeds: GitTokenSeeds): string {
   return lines.join("\n");
 }
 
-function repositoryCredentialProvider(
-  resource: Extract<ResourceRef, { kind: "repository" }>,
-): GitCredentialProvider {
-  return resource.provider ?? "github";
+type RuntimeGitBindingDescriptor = {
+  provider: GitCredentialProvider;
+  credentialBindingId: string;
+  bindingHash: string;
+  protocol: string;
+  host: string;
+  path: string;
+  uri: string;
+};
+
+type RuntimeGitHttpBrokerRouteDescriptor = {
+  provider: GitCredentialProvider;
+  credentialBindingId: string;
+  bindingHash: string;
+  repositoryUri: string;
+  brokerUri: string;
+  protocol: "https";
+  host: string;
+  path: string;
+};
+
+function runtimeGitBindingDescriptors(
+  resources: Extract<ResourceRef, { kind: "repository" }>[],
+): RuntimeGitBindingDescriptor[] {
+  const remoteBindings = new Map<string, string>();
+  const bindingProviders = new Map<string, GitCredentialProvider>();
+  return resources.map((resource) => {
+    const url = new URL(resource.uri);
+    const credentialProvider = gitCredentialProviderForRepository(resource);
+    // Provider-less public/legacy resources retain the historical GitHub
+    // askpass fallback, but credential-bound resources derive through the
+    // shared contracts helper used by the worker and core.
+    const provider = credentialProvider ?? "github";
+    const credentialBindingId =
+      gitCredentialBindingIdForRepository(resource, credentialProvider) ?? provider;
+    const path = url.pathname.replace(/^\/+|\/+$/g, "");
+    const remote = `${url.protocol.toLowerCase()}//${url.host.toLowerCase()}/${path.replace(/\.git$/, "")}`;
+    const bindingKey = `${provider}\u0000${credentialBindingId}`;
+    const boundProvider = bindingProviders.get(credentialBindingId);
+    if (boundProvider && boundProvider !== provider) {
+      throw new Error(
+        `credential binding ${credentialBindingId} is assigned to multiple Git providers`,
+      );
+    }
+    bindingProviders.set(credentialBindingId, provider);
+    const claimed = remoteBindings.get(remote);
+    if (claimed && claimed !== bindingKey) {
+      throw new Error(
+        `repository remote ${resource.uri} is claimed by multiple credential bindings`,
+      );
+    }
+    remoteBindings.set(remote, bindingKey);
+    return {
+      provider,
+      credentialBindingId,
+      bindingHash: gitCredentialBindingHash(credentialBindingId),
+      protocol: url.protocol.replace(/:$/, "").toLowerCase(),
+      host: url.host.toLowerCase(),
+      path,
+      uri: resource.uri,
+    };
+  });
 }
 
-function gitAskpassHostProviderCaseLines(
+function gitCredentialBindingKey(
+  provider: GitCredentialProvider,
+  credentialBindingId: string,
+): string {
+  return `${provider}\u0000${credentialBindingId}`;
+}
+
+function brokeredGitCredentialBindingKeys(
+  bindings: GitCredentialBindingSeed[],
+): ReadonlySet<string> {
+  return new Set(
+    bindings
+      .filter((binding) => binding.transport?.kind === "http_broker")
+      .map((binding) => gitCredentialBindingKey(binding.provider, binding.credentialBindingId)),
+  );
+}
+
+function runtimeGitHttpBrokerRouteDescriptors(
   resources: Extract<ResourceRef, { kind: "repository" }>[],
-): string[] {
-  const hosts = new Map<string, GitCredentialProvider>();
-  for (const resource of resources) {
-    try {
-      const hostname = new URL(resource.uri).hostname.toLowerCase();
-      if (!hostname) {
-        continue;
+  bindings: GitCredentialBindingSeed[],
+): RuntimeGitHttpBrokerRouteDescriptor[] {
+  const resourceDescriptors = runtimeGitBindingDescriptors(resources);
+  const byBindingAndUri = new Map<string, RuntimeGitBindingDescriptor>();
+  for (const descriptor of resourceDescriptors) {
+    byBindingAndUri.set(
+      `${gitCredentialBindingKey(descriptor.provider, descriptor.credentialBindingId)}\u0000${descriptor.uri}`,
+      descriptor,
+    );
+  }
+
+  const routes: RuntimeGitHttpBrokerRouteDescriptor[] = [];
+  const claimedRepositoryUris = new Set<string>();
+  const claimedBrokerUris = new Set<string>();
+  for (const binding of bindings) {
+    if (!binding.transport) continue;
+    if (
+      typeof binding.transport !== "object" ||
+      binding.transport.kind !== "http_broker" ||
+      !Array.isArray(binding.transport.repositories)
+    ) {
+      throw new Error(
+        `Git credential binding ${binding.credentialBindingId} uses an unsupported transport`,
+      );
+    }
+    const bindingKey = gitCredentialBindingKey(binding.provider, binding.credentialBindingId);
+    const expected = resourceDescriptors.filter(
+      (descriptor) =>
+        gitCredentialBindingKey(descriptor.provider, descriptor.credentialBindingId) === bindingKey,
+    );
+    if (expected.length === 0 || binding.transport.repositories.length !== expected.length) {
+      throw new Error(
+        `Git HTTP broker binding ${binding.credentialBindingId} does not cover its exact repository set`,
+      );
+    }
+    for (const route of binding.transport.repositories) {
+      if (
+        !route ||
+        typeof route !== "object" ||
+        typeof route.repositoryUri !== "string" ||
+        typeof route.brokerUri !== "string"
+      ) {
+        throw new Error(
+          `Git HTTP broker binding ${binding.credentialBindingId} contains an invalid repository route`,
+        );
+      }
+      const descriptor = byBindingAndUri.get(`${bindingKey}\u0000${route.repositoryUri}`);
+      if (!descriptor || claimedRepositoryUris.has(route.repositoryUri)) {
+        throw new Error(
+          `Git HTTP broker binding ${binding.credentialBindingId} contains an unexpected repository route`,
+        );
+      }
+      let brokerUrl: URL;
+      try {
+        brokerUrl = new URL(route.brokerUri);
+      } catch {
+        throw new Error(
+          `Git HTTP broker binding ${binding.credentialBindingId} contains an invalid broker URI`,
+        );
+      }
+      if (
+        brokerUrl.protocol !== "https:" ||
+        brokerUrl.username ||
+        brokerUrl.password ||
+        brokerUrl.search ||
+        brokerUrl.hash ||
+        brokerUrl.href !== route.brokerUri ||
+        claimedBrokerUris.has(brokerUrl.href)
+      ) {
+        throw new Error(
+          `Git HTTP broker binding ${binding.credentialBindingId} contains an unsafe broker URI`,
+        );
       }
-      hosts.set(hostname, repositoryCredentialProvider(resource));
-    } catch {
-      // Resource validation catches invalid URIs before normal runtime use. Keep
-      // helper generation tolerant so tests for clone failure can still build.
+      claimedRepositoryUris.add(route.repositoryUri);
+      claimedBrokerUris.add(brokerUrl.href);
+      routes.push({
+        provider: binding.provider,
+        credentialBindingId: binding.credentialBindingId,
+        bindingHash: gitCredentialBindingHash(binding.credentialBindingId),
+        repositoryUri: route.repositoryUri,
+        brokerUri: route.brokerUri,
+        protocol: "https",
+        host: brokerUrl.host.toLowerCase(),
+        path: brokerUrl.pathname.replace(/^\/+|\/+$/g, ""),
+      });
     }
   }
-  return [...hosts.entries()]
-    .sort(([a], [b]) => a.localeCompare(b))
-    .map(
-      ([hostname, provider]) =>
-        `    ${shellQuote(hostname)}) printf '%s\\n' ${provider}; return 0 ;;`,
+  return routes;
+}
+
+function gitUsernameForProvider(provider: GitCredentialProvider): string {
+  if (provider === "github") return "x-access-token";
+  if (provider === "gitlab") return "oauth2";
+  return "opengeni";
+}
+
+function gitCredentialHelperBindingCaseLines(
+  resources: Extract<ResourceRef, { kind: "repository" }>[],
+  bindings: GitCredentialBindingSeed[],
+): string[] {
+  const brokeredBindings = brokeredGitCredentialBindingKeys(bindings);
+  return runtimeGitBindingDescriptors(resources)
+    .filter(
+      (descriptor) =>
+        !brokeredBindings.has(
+          gitCredentialBindingKey(descriptor.provider, descriptor.credentialBindingId),
+        ),
+    )
+    .flatMap((descriptor) => {
+      const paths = new Set([
+        descriptor.path,
+        descriptor.path.replace(/\.git$/, ""),
+        `${descriptor.path.replace(/\.git$/, "")}.git`,
+      ]);
+      return [...paths].map(
+        (path) =>
+          `  ${shellQuote(`${descriptor.protocol}|${descriptor.host}|${path}`)}) username=${shellQuote(gitUsernameForProvider(descriptor.provider))}; token_file="$credential_dir/${descriptor.bindingHash}-token" ;;`,
+      );
+    });
+}
+
+function gitCredentialHelperBrokerCaseLines(
+  routes: RuntimeGitHttpBrokerRouteDescriptor[],
+): string[] {
+  return routes.flatMap((route) => {
+    const paths = new Set([
+      route.path,
+      route.path.replace(/\.git$/, ""),
+      `${route.path.replace(/\.git$/, "")}.git`,
+    ]);
+    return [...paths].map(
+      (path) =>
+        `  ${shellQuote(`${route.protocol}|${route.host}|${path}`)}) username=opengeni; token_file="$credential_dir/${route.bindingHash}-token" ;;`,
     );
+  });
+}
+
+function gitAskpassHostProviderCaseLines(
+  resources: Extract<ResourceRef, { kind: "repository" }>[],
+  brokerRoutes: RuntimeGitHttpBrokerRouteDescriptor[],
+): string[] {
+  const hosts = new Map<string, { provider: GitCredentialProvider; bindings: Set<string> }>();
+  for (const descriptor of runtimeGitBindingDescriptors(resources)) {
+    const entry = hosts.get(descriptor.host) ?? {
+      provider: descriptor.provider,
+      bindings: new Set<string>(),
+    };
+    entry.bindings.add(`${descriptor.provider}\u0000${descriptor.credentialBindingId}`);
+    hosts.set(descriptor.host, entry);
+  }
+  const brokerHosts = [...new Set(brokerRoutes.map((route) => route.host))]
+    .sort((a, b) => a.localeCompare(b))
+    .map((hostname) => `    ${shellQuote(hostname)}) printf '\\n'; return 0 ;;`);
+  return [
+    ...brokerHosts,
+    ...[...hosts.entries()]
+      .filter(([, entry]) => entry.bindings.size === 1)
+      .sort(([a], [b]) => a.localeCompare(b))
+      .map(
+        ([hostname, entry]) =>
+          `    ${shellQuote(hostname)}) printf '%s\\n' ${entry.provider}; return 0 ;;`,
+      ),
+  ];
 }
 
-function gitCredentialTokenWriterCommandLines(): string[] {
+function gitCredentialTokenWriterCommandLines(bindings: GitCredentialBindingSeed[] = []): string[] {
+  const bindingWrites = bindings.flatMap((binding) => {
+    const hash = gitCredentialBindingHash(binding.credentialBindingId);
+    const seedEnv = gitBindingSeedEnv(binding);
+    const count = Math.max(1, binding.providerBindingCount ?? 1);
+    const provider = binding.provider;
+    const lines = [`write_git_binding_token ${shellQuote(hash)} "\${${seedEnv}:-}"`];
+    if (count === 1 && binding.transport?.kind !== "http_broker") {
+      lines.push(`write_git_provider_token ${shellQuote(provider)} "\${${seedEnv}:-}"`);
+    } else {
+      lines.push(`remove_git_provider_token ${shellQuote(provider)}`);
+    }
+    return lines;
+  });
   return [
     // TOKEN-BROKER (B1/B2): seed run-scoped provider tokens into stable files and
     // atomically replace each provider file. Token VALUES are supplied only by
@@ -4882,6 +6013,23 @@ function gitCredentialTokenWriterCommandLines(): string[] {
     "    *) printf '%s\\n' \"${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/$provider-token\" ;;",
     "  esac",
     "}",
+    "write_git_binding_token() {",
+    '  binding_hash="$1"',
+    '  token="$2"',
+    '  [ -n "$token" ] || return 0',
+    '  credential_dir="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}"',
+    '  mkdir -p "$credential_dir"',
+    '  token_file="$credential_dir/$binding_hash-token"',
+    '  printf \'%s\' "$token" > "$token_file.tmp.$$"',
+    '  mv -f "$token_file.tmp.$$" "$token_file"',
+    "}",
+    "remove_git_provider_token() {",
+    '  provider="$1"',
+    '  rm -f "$(git_provider_token_file "$provider")"',
+    '  if [ "$provider" = github ]; then',
+    '    rm -f "${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/github-token"',
+    "  fi",
+    "}",
     "write_git_provider_token() {",
     '  provider="$1"',
     '  token="$2"',
@@ -4902,16 +6050,109 @@ function gitCredentialTokenWriterCommandLines(): string[] {
     'write_git_provider_token github "${OPENGENI_GIT_GITHUB_TOKEN_SEED:-${OPENGENI_GIT_TOKEN_SEED:-}}"',
     'write_git_provider_token gitlab "${OPENGENI_GIT_GITLAB_TOKEN_SEED:-}"',
     'write_git_provider_token azure_devops "${OPENGENI_GIT_AZURE_DEVOPS_TOKEN_SEED:-}"',
+    ...bindingWrites,
     'umask "$seed_umask"',
   ];
 }
 
+function gitHttpBrokerConfigCommandLines(routes: RuntimeGitHttpBrokerRouteDescriptor[]): string[] {
+  return [
+    'git_http_broker_config="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/http-broker.gitconfig"',
+    'mkdir -p "$(dirname "$git_http_broker_config")"',
+    'broker_umask="$(umask)"',
+    "umask 077",
+    ': > "$git_http_broker_config.tmp.$$"',
+    ...routes.map(
+      (route) =>
+        `git config --file "$git_http_broker_config.tmp.$$" --add ${shellQuote(`url.${route.brokerUri}.insteadOf`)} ${shellQuote(route.repositoryUri)}`,
+    ),
+    'mv -f "$git_http_broker_config.tmp.$$" "$git_http_broker_config"',
+    'umask "$broker_umask"',
+    'git config --global --unset-all include.path "$git_http_broker_config" >/dev/null 2>&1 || true',
+    'git config --global --add include.path "$git_http_broker_config"',
+  ];
+}
+
 function gitCredentialHelperCommandLines(
   resources: Extract<ResourceRef, { kind: "repository" }>[] = [],
+  bindings: GitCredentialBindingSeed[] = [],
 ): string[] {
-  const hostProviderCases = gitAskpassHostProviderCaseLines(resources);
+  const brokerRoutes = runtimeGitHttpBrokerRouteDescriptors(resources, bindings);
+  const hostProviderCases = gitAskpassHostProviderCaseLines(resources, brokerRoutes);
+  const bindingCases = [
+    ...gitCredentialHelperBindingCaseLines(resources, bindings),
+    ...gitCredentialHelperBrokerCaseLines(brokerRoutes),
+  ];
+  const descriptors = runtimeGitBindingDescriptors(resources);
+  const brokeredBindings = brokeredGitCredentialBindingKeys(bindings);
+  const wrapperDescriptors =
+    bindings.length > 0
+      ? descriptors.filter(
+          (descriptor) =>
+            !brokeredBindings.has(
+              gitCredentialBindingKey(descriptor.provider, descriptor.credentialBindingId),
+            ),
+        )
+      : [];
+  const bindingProviders = new Map<GitCredentialProvider, Set<string>>();
+  for (const descriptor of runtimeGitBindingDescriptors(resources)) {
+    const ids = bindingProviders.get(descriptor.provider) ?? new Set<string>();
+    ids.add(descriptor.credentialBindingId);
+    bindingProviders.set(descriptor.provider, ids);
+  }
+  const strictAskpass = [...bindingProviders.values()].some((ids) => ids.size > 1);
+  const allowedWrapperHashes = [
+    ...new Set(wrapperDescriptors.map((item) => `${item.provider}|${item.bindingHash}`)),
+  ].map((key) => `    ${shellQuote(key)}) return 0 ;;`);
+  const originWrapperHashes = wrapperDescriptors.flatMap((item) => {
+    const base = item.uri.replace(/\.git$/, "");
+    return [...new Set([item.uri, base, `${base}.git`])].map(
+      (uri) =>
+        `    ${shellQuote(`${item.provider}|${uri}`)}) printf '%s\\n' ${shellQuote(item.bindingHash)}; return 0 ;;`,
+    );
+  });
+  const soleWrapperHashes = [...bindingProviders.entries()].flatMap(([provider, ids]) => {
+    if (ids.size !== 1) return [];
+    const descriptor = wrapperDescriptors.find((item) => item.provider === provider);
+    return descriptor
+      ? [
+          `    ${shellQuote(provider)}) printf '%s\\n' ${shellQuote(descriptor.bindingHash)}; return 0 ;;`,
+        ]
+      : [];
+  });
+  const multiWrapperProviders =
+    bindings.length > 0
+      ? [...bindingProviders.entries()]
+          .filter(([, ids]) => ids.size > 1)
+          .map(([provider]) => provider)
+      : [];
+  const brokeredOriginCases = brokerRoutes.flatMap((route) => {
+    const base = route.repositoryUri.replace(/\.git$/, "");
+    return [...new Set([route.repositoryUri, base, `${base}.git`])].map(
+      (uri) => `    ${shellQuote(`${route.provider}|${uri}`)}) return 0 ;;`,
+    );
+  });
+  const brokeredBindingHashCases = bindings
+    .filter((binding) => binding.transport?.kind === "http_broker")
+    .map(
+      (binding) =>
+        `    ${shellQuote(`${binding.provider}|${gitCredentialBindingHash(binding.credentialBindingId)}`)}) return 0 ;;`,
+    );
+  const providerBindingKinds = new Map<
+    GitCredentialProvider,
+    { direct: number; brokered: number }
+  >();
+  for (const binding of bindings) {
+    const counts = providerBindingKinds.get(binding.provider) ?? { direct: 0, brokered: 0 };
+    if (binding.transport?.kind === "http_broker") counts.brokered += 1;
+    else counts.direct += 1;
+    providerBindingKinds.set(binding.provider, counts);
+  }
+  const brokerOnlyProviders = [...providerBindingKinds.entries()]
+    .filter(([, counts]) => counts.brokered > 0 && counts.direct === 0)
+    .map(([provider]) => provider);
   return [
-    ...gitCredentialTokenWriterCommandLines(),
+    ...gitCredentialTokenWriterCommandLines(bindings),
     // Provision git/provider-CLI helpers at SETUP (runtime) before any clone
     // runs. Renewal updates only token files and deliberately leaves these
     // repository-specific host mappings intact.
@@ -4928,8 +6169,8 @@ function gitCredentialHelperCommandLines(
     '  rest="${prompt_lower#*://}"',
     '  rest="${rest#*@}"',
     '  host="${rest%%/*}"',
-    '  host="${host%%:*}"',
     '  host="$(printf \'%s\\n\' "$host" | tr -d "\'")"',
+    '  host="${host%:}"',
     "  printf '%s\\n' \"$host\"",
     "}",
     "provider_for_prompt() {",
@@ -4941,7 +6182,7 @@ function gitCredentialHelperCommandLines(
     "    *github.com*|*githubusercontent.com*) printf '%s\\n' github ;;",
     "    *gitlab*) printf '%s\\n' gitlab ;;",
     "    *dev.azure.com*|*.visualstudio.com*) printf '%s\\n' azure_devops ;;",
-    "    *) printf '%s\\n' github ;;",
+    strictAskpass ? "    *) printf '\\n' ;;" : "    *) printf '%s\\n' github ;;",
     "  esac",
     "}",
     "token_file_for_provider() {",
@@ -4967,6 +6208,41 @@ function gitCredentialHelperCommandLines(
     "ASKPASS_EOF",
     'chmod 0755 "$git_askpass.tmp.$$"',
     'mv -f "$git_askpass.tmp.$$" "$git_askpass"',
+    'git_credential_helper="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/helper"',
+    'mkdir -p "$(dirname "$git_credential_helper")"',
+    "cat > \"$git_credential_helper.tmp.$$\" <<'GIT_CREDENTIAL_HELPER_EOF'",
+    "#!/usr/bin/env sh",
+    "set -eu",
+    '[ "${1:-get}" = get ] || exit 0',
+    "protocol= host= path=",
+    "while IFS='=' read -r key value; do",
+    '  case "$key" in',
+    "    protocol) protocol=\"$(printf '%s' \"$value\" | tr '[:upper:]' '[:lower:]')\" ;;",
+    "    host) host=\"$(printf '%s' \"$value\" | tr '[:upper:]' '[:lower:]')\" ;;",
+    '    path) path="${value#/}" ;;',
+    "  esac",
+    "done",
+    'credential_dir="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}"',
+    "username= token_file=",
+    'case "$protocol|$host|$path" in',
+    ...bindingCases,
+    "  *) exit 0 ;;",
+    "esac",
+    '[ -r "$token_file" ] || exit 0',
+    'password="$(cat "$token_file" 2>/dev/null || true)"',
+    '[ -n "$password" ] || exit 0',
+    'printf \'username=%s\\npassword=%s\\n\' "$username" "$password"',
+    "GIT_CREDENTIAL_HELPER_EOF",
+    'chmod 0755 "$git_credential_helper.tmp.$$"',
+    'mv -f "$git_credential_helper.tmp.$$" "$git_credential_helper"',
+    // Empty helper resets lower-priority/system helpers; our exact path-aware
+    // helper returns no credential for an unbound remote, so multi-binding
+    // sessions fail closed instead of falling through to ambient credentials.
+    "git config --global --unset-all credential.helper >/dev/null 2>&1 || true",
+    "git config --global --add credential.helper ''",
+    'git config --global --add credential.helper "$git_credential_helper"',
+    "git config --global credential.useHttpPath true",
+    ...gitHttpBrokerConfigCommandLines(brokerRoutes),
     'wrapper_dir="${OPENGENI_GIT_CLI_WRAPPER_DIR:-$HOME/.opengeni/bin}"',
     'mkdir -p "$wrapper_dir"',
     "for opengeni_git_cli_tool in gh glab az; do",
@@ -4981,11 +6257,71 @@ function gitCredentialHelperCommandLines(
     "  az) provider=azure_devops; token_env=AZURE_DEVOPS_EXT_PAT ;;",
     "  *) provider=; token_env= ;;",
     "esac",
-    'if [ -n "$provider" ]; then',
+    "hash_binding_id() {",
+    "  if command -v sha256sum >/dev/null 2>&1; then printf '%s' \"$1\" | sha256sum | cut -c1-32; return; fi",
+    "  if command -v shasum >/dev/null 2>&1; then printf '%s' \"$1\" | shasum -a 256 | cut -c1-32; return; fi",
+    "  if command -v openssl >/dev/null 2>&1; then printf '%s' \"$1\" | openssl dgst -sha256 | sed 's/^.*= //' | cut -c1-32; return; fi",
+    "  printf '%s\\n' 'No SHA-256 utility is available to select OPENGENI_GIT_BINDING' >&2",
+    "  return 127",
+    "}",
+    "binding_hash_allowed() {",
+    '  case "$provider|$1" in',
+    ...allowedWrapperHashes,
+    "    *) return 1 ;;",
+    "  esac",
+    "}",
+    "binding_hash_is_brokered() {",
+    '  case "$provider|$1" in',
+    ...brokeredBindingHashCases,
+    "    *) return 1 ;;",
+    "  esac",
+    "}",
+    "binding_hash_for_origin() {",
+    '  case "$provider|$1" in',
+    ...originWrapperHashes,
+    "    *) return 1 ;;",
+    "  esac",
+    "}",
+    "origin_is_brokered() {",
+    '  case "$provider|$1" in',
+    ...brokeredOriginCases,
+    "    *) return 1 ;;",
+    "  esac",
+    "}",
+    "sole_binding_hash() {",
     '  case "$provider" in',
-    '    github) token_file="${OPENGENI_GIT_TOKEN_FILE:-$HOME/.opengeni/git-token}" ;;',
-    '    *) token_file="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/$provider-token" ;;',
+    ...soleWrapperHashes,
+    "    *) return 1 ;;",
     "  esac",
+    "}",
+    `multi_binding_providers=${shellQuote(multiWrapperProviders.join(" "))}`,
+    `broker_only_providers=${shellQuote(brokerOnlyProviders.join(" "))}`,
+    'if [ -n "$provider" ]; then',
+    "  binding_hash=",
+    '  if [ -n "${OPENGENI_GIT_BINDING:-}" ]; then',
+    '    binding_hash="$(hash_binding_id "$OPENGENI_GIT_BINDING")"',
+    '    binding_hash_is_brokered "$binding_hash" && { printf \'%s\\n\' "$tool provider API authentication is host-brokered for OPENGENI_GIT_BINDING; use the configured provider MCP tools" >&2; exit 2; }',
+    '    binding_hash_allowed "$binding_hash" || { printf \'%s\\n\' "OPENGENI_GIT_BINDING does not select a $provider credential attached to this session" >&2; exit 2; }',
+    "  elif command -v git >/dev/null 2>&1; then",
+    '    origin="$(git config --get remote.origin.url 2>/dev/null || true)"',
+    '    [ -z "$origin" ] || ! origin_is_brokered "$origin" || { printf \'%s\\n\' "$tool provider API authentication is host-brokered for this repository; use the configured provider MCP tools" >&2; exit 2; }',
+    '    [ -z "$origin" ] || binding_hash="$(binding_hash_for_origin "$origin" 2>/dev/null || true)"',
+    "  fi",
+    '  [ -n "$binding_hash" ] || binding_hash="$(sole_binding_hash 2>/dev/null || true)"',
+    '  if [ -n "$binding_hash" ]; then',
+    '    token_file="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/$binding_hash-token"',
+    "  else",
+    '    case " $broker_only_providers " in',
+    '      *" $provider "*) printf \'%s\\n\' "$tool provider API authentication is host-brokered for this session; use the configured provider MCP tools" >&2; exit 2 ;;',
+    "    esac",
+    '    case " $multi_binding_providers " in',
+    '      *" $provider "*) printf \'%s\\n\' "Unable to select one of multiple $provider credentials; run inside an attached repository or set OPENGENI_GIT_BINDING" >&2; exit 2 ;;',
+    "    esac",
+    '    case "$provider" in',
+    '      github) token_file="${OPENGENI_GIT_TOKEN_FILE:-$HOME/.opengeni/git-token}" ;;',
+    '      *) token_file="${OPENGENI_GIT_CREDENTIALS_DIR:-$HOME/.opengeni/git-credentials}/$provider-token" ;;',
+    "    esac",
+    "  fi",
     '  if [ -f "$token_file" ]; then',
     '    token="$(cat "$token_file" 2>/dev/null || true)"',
     '    if [ -n "$token" ]; then',
@@ -5040,10 +6376,23 @@ export function gitProviderTokenRefreshCommand(seeds: GitTokenSeeds): string {
   ].join("\n");
 }
 
+export function gitCredentialBindingTokenRefreshCommand(
+  bindings: GitCredentialBindingSeed[],
+): string {
+  const seedPrefix = gitCredentialBindingSeedExportPrefix(bindings);
+  if (!seedPrefix) return "";
+  return [
+    seedPrefix,
+    "set -eu",
+    'export HOME="${HOME:-/workspace}"',
+    ...gitCredentialTokenWriterCommandLines(bindings),
+  ].join("\n");
+}
+
 export async function refreshGitProviderTokenFiles(
   session: GitCredentialTokenWriterSession,
   seeds: GitTokenSeeds,
-  options: { runAs?: string } = {},
+  options: { runAs?: string; commandRunner?: SandboxLifecycleCommandRunner } = {},
 ): Promise<void> {
   const command = gitProviderTokenRefreshCommand(seeds);
   if (!command) {
@@ -5056,23 +6405,41 @@ export async function refreshGitProviderTokenFiles(
     yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
     maxOutputTokens: 4_000,
   };
-  if (session.exec) {
-    assertSandboxCommandSucceeded(await session.exec(args), "Git credential refresh");
-  } else if (session.execCommand) {
-    assertSandboxCommandSucceeded(await session.execCommand(args), "Git credential refresh");
-  } else {
-    throw new Error("Sandbox session does not support command execution");
-  }
+  assertSandboxCommandSucceeded(
+    await runSandboxLifecycleCommand(session, args, options.commandRunner),
+    "Git credential refresh",
+  );
+}
+
+export async function refreshGitCredentialBindingTokenFiles(
+  session: GitCredentialTokenWriterSession,
+  bindings: GitCredentialBindingSeed[],
+  options: { runAs?: string; commandRunner?: SandboxLifecycleCommandRunner } = {},
+): Promise<void> {
+  const command = gitCredentialBindingTokenRefreshCommand(bindings);
+  if (!command) return;
+  const args = {
+    cmd: command,
+    workdir: "/workspace",
+    ...(options.runAs ? { runAs: options.runAs } : {}),
+    yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
+    maxOutputTokens: 4_000,
+  };
+  assertSandboxCommandSucceeded(
+    await runSandboxLifecycleCommand(session, args, options.commandRunner),
+    "Git credential binding refresh",
+  );
 }
 
 export function repositoryCloneCommand(
   resources: Extract<ResourceRef, { kind: "repository" }>[],
+  bindings: GitCredentialBindingSeed[] = [],
 ): string {
+  assertUniqueResourceMountPaths(resources);
   const commands = [
     "set -eu",
     'export HOME="${HOME:-/workspace}"',
     'export GIT_TERMINAL_PROMPT="${GIT_TERMINAL_PROMPT:-0}"',
-    ...gitCredentialHelperCommandLines(resources),
     "ensure_git() {",
     "  if command -v git >/dev/null 2>&1; then",
     "    return 0",
@@ -5088,6 +6455,7 @@ export function repositoryCloneCommand(
     "  exit 127",
     "}",
     "ensure_git",
+    ...gitCredentialHelperCommandLines(resources, bindings),
     "clone_repository() {",
     '  target="$1"',
     '  uri="$2"',
@@ -5160,33 +6528,41 @@ export function repositoryCloneCommand(
     "}",
   ];
   for (const resource of resources) {
-    const url = new URL(resource.uri);
-    const repo = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
-    const mountPath = normalizeManifestPath(resource.mountPath ?? `repos/${repo}`);
+    const mountPath = resourceMountPath(resource);
     commands.push(
       [
         "clone_repository",
         shellQuote(posixPath.join("/workspace", mountPath)),
         shellQuote(resource.uri),
         shellQuote(resource.ref),
-        shellQuote(resource.subpath ? normalizeManifestPath(resource.subpath) : ""),
+        shellQuote(resource.subpath ? normalizeRepositorySubpath(resource.subpath) : ""),
       ].join(" "),
     );
   }
   return commands.join("\n");
 }
 
-export function toolspaceTokenSeedCommand(): string {
+export function toolspaceTokenSeedCommand(
+  options: { tokenFile?: string; legacyTokenFile?: string } = {},
+): string {
   return [
     "set -eu",
     'export HOME="${HOME:-/workspace}"',
     'if [ -n "${OPENGENI_TOOLSPACE_TOKEN_SEED:-}" ]; then',
     '  seed_umask="$(umask)"',
     "  umask 077",
-    '  token_file="${OPENGENI_TOOLSPACE_TOKEN_FILE:-$HOME/.opengeni/toolspace-token}"',
+    options.tokenFile
+      ? `  token_file=${shellQuote(options.tokenFile)}`
+      : '  token_file="${OPENGENI_TOOLSPACE_TOKEN_FILE:-$HOME/.opengeni/toolspace-token}"',
+    options.legacyTokenFile
+      ? `  legacy_token_file=${shellQuote(options.legacyTokenFile)}`
+      : '  legacy_token_file=""',
     '  mkdir -p "$(dirname "$token_file")"',
     '  printf \'%s\' "$OPENGENI_TOOLSPACE_TOKEN_SEED" > "$token_file.tmp.$$"',
     '  mv -f "$token_file.tmp.$$" "$token_file"',
+    '  if [ -n "$legacy_token_file" ] && [ "$legacy_token_file" != "$token_file" ]; then',
+    '    rm -f -- "$legacy_token_file"',
+    "  fi",
     '  umask "$seed_umask"',
     "fi",
   ].join("\n");
@@ -5199,28 +6575,56 @@ export async function runToolspaceTokenSeedHook(
   if (!context.toolspaceTokenSeed) {
     return;
   }
-  const command = `export OPENGENI_TOOLSPACE_TOKEN_SEED=${shellQuote(context.toolspaceTokenSeed)}\n${toolspaceTokenSeedCommand()}`;
-  if (session.exec) {
-    const result = await session.exec({
+  const command = `export OPENGENI_TOOLSPACE_TOKEN_SEED=${shellQuote(context.toolspaceTokenSeed)}\n${toolspaceTokenSeedCommand(
+    {
+      ...(context.toolspaceTokenFile ? { tokenFile: context.toolspaceTokenFile } : {}),
+      ...(context.toolspaceTokenFile && context.environment.OPENGENI_TOOLSPACE_TOKEN_FILE
+        ? { legacyTokenFile: context.environment.OPENGENI_TOOLSPACE_TOKEN_FILE }
+        : {}),
+    },
+  )}`;
+  const result = await runSandboxLifecycleCommand(
+    session,
+    {
       cmd: command,
       workdir: "/workspace",
       ...(context.runAs ? { runAs: context.runAs } : {}),
       yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
       maxOutputTokens: 4_000,
-    });
-    assertSandboxCommandSucceeded(result, "Toolspace token seed hook");
-  } else if (session.execCommand) {
-    const result = await session.execCommand({
+    },
+    context.commandRunner,
+  );
+  assertSandboxCommandSucceeded(result, "Toolspace token seed hook");
+}
+
+export async function refreshToolspaceTokenFile(
+  session: ToolspaceTokenWriterSession,
+  token: string,
+  options: {
+    runAs?: string;
+    commandRunner?: SandboxLifecycleCommandRunner;
+    tokenFile?: string;
+    legacyTokenFile?: string;
+  } = {},
+): Promise<void> {
+  const command = `export OPENGENI_TOOLSPACE_TOKEN_SEED=${shellQuote(token)}\n${toolspaceTokenSeedCommand(
+    {
+      ...(options.tokenFile ? { tokenFile: options.tokenFile } : {}),
+      ...(options.legacyTokenFile ? { legacyTokenFile: options.legacyTokenFile } : {}),
+    },
+  )}`;
+  const result = await runSandboxLifecycleCommand(
+    session,
+    {
       cmd: command,
       workdir: "/workspace",
-      ...(context.runAs ? { runAs: context.runAs } : {}),
+      ...(options.runAs ? { runAs: options.runAs } : {}),
       yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
       maxOutputTokens: 4_000,
-    });
-    assertSandboxCommandSucceeded(result, "Toolspace token seed hook");
-  } else {
-    throw new Error("Sandbox session does not support command execution");
-  }
+    },
+    options.commandRunner,
+  );
+  assertSandboxCommandSucceeded(result, "Toolspace token refresh");
 }
 
 // Bounds the setup output tail carried on a rig.setup failure event/error so a
@@ -5329,13 +6733,7 @@ export async function runRigSetupHook(
   };
   let result: unknown;
   try {
-    if (session.exec) {
-      result = await session.exec(execArgs);
-    } else if (session.execCommand) {
-      result = await session.execCommand(execArgs);
-    } else {
-      throw new Error("Sandbox session does not support command execution");
-    }
+    result = await runSandboxLifecycleCommand(session, execArgs, context.commandRunner);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     await context.onRuntimeEvent?.({
@@ -5414,31 +6812,27 @@ export async function runRepositoryCloneHook(
       ...(context.gitTokenSeeds ?? {}),
       ...(context.gitTokenSeed ? { github: context.gitTokenSeed } : {}),
     } satisfies GitTokenSeeds;
-    const seedPrefix = gitTokenSeedExportPrefix(gitTokenSeeds);
-    const command = seedPrefix
-      ? `${seedPrefix}\n${repositoryCloneCommand(resources)}`
-      : repositoryCloneCommand(resources);
-    if (session.exec) {
-      const result = await session.exec({
-        cmd: command,
-        workdir: "/workspace",
-        ...(context.runAs ? { runAs: context.runAs } : {}),
-        yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
-        maxOutputTokens: 20_000,
-      });
-      assertSandboxCommandSucceeded(result, "Repository clone hook");
-    } else if (session.execCommand) {
-      const result = await session.execCommand({
+    const gitCredentialBindings = context.gitCredentialBindings ?? [];
+    const seedPrefix = [
+      gitTokenSeedExportPrefix(gitTokenSeeds),
+      gitCredentialBindingSeedExportPrefix(gitCredentialBindings),
+    ]
+      .filter(Boolean)
+      .join("\n");
+    const cloneCommand = repositoryCloneCommand(resources, gitCredentialBindings);
+    const command = seedPrefix ? `${seedPrefix}\n${cloneCommand}` : cloneCommand;
+    const result = await runSandboxLifecycleCommand(
+      session,
+      {
         cmd: command,
         workdir: "/workspace",
         ...(context.runAs ? { runAs: context.runAs } : {}),
         yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
         maxOutputTokens: 20_000,
-      });
-      assertSandboxCommandSucceeded(result, "Repository clone hook");
-    } else {
-      throw new Error("Sandbox session does not support command execution");
-    }
+      },
+      context.commandRunner,
+    );
+    assertSandboxCommandSucceeded(result, "Repository clone hook");
     await context.onRuntimeEvent?.({
       type: "sandbox.operation.completed",
       payload,
@@ -5564,27 +6958,18 @@ export async function runAzureCliLoginHook(
     payload,
   });
   try {
-    if (session.exec) {
-      const result = await session.exec({
-        cmd: azureCliLoginCommand(),
-        workdir: "/workspace",
-        ...(context.runAs ? { runAs: context.runAs } : {}),
-        yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
-        maxOutputTokens: 20_000,
-      });
-      assertSandboxCommandSucceeded(result, "Azure CLI login hook");
-    } else if (session.execCommand) {
-      const result = await session.execCommand({
+    const result = await runSandboxLifecycleCommand(
+      session,
+      {
         cmd: azureCliLoginCommand(),
         workdir: "/workspace",
         ...(context.runAs ? { runAs: context.runAs } : {}),
         yieldTimeMs: SANDBOX_LIFECYCLE_COMMAND_TIMEOUT_MS,
         maxOutputTokens: 20_000,
-      });
-      assertSandboxCommandSucceeded(result, "Azure CLI login hook");
-    } else {
-      throw new Error("Sandbox session does not support command execution");
-    }
+      },
+      context.commandRunner,
+    );
+    assertSandboxCommandSucceeded(result, "Azure CLI login hook");
     await context.onRuntimeEvent?.({
       type: "sandbox.operation.completed",
       payload,
@@ -5674,26 +7059,46 @@ function isPathWithin(root: string, candidate: string): boolean {
 }
 
 /**
- * The skill source fed to the SDK Skills capability. Without pack skills this
- * is the plain bundled local-dir source, byte-for-byte the pre-pack behavior.
- * With pack skills it becomes a single in-memory dir source combining bundled
- * skill directories (as local_dir entries the SDK materializes lazily) with
- * pack skill directories built from manifest-carried file content — one skill
- * index, one `## Skills` instruction section, lazy `load_skill` for all of
- * them. A pack skill shadows a bundled skill with the same directory name.
+ * The skill source fed to the SDK Skills capability. Without pack or curated
+ * skills this is the plain bundled local-dir source, byte-for-byte the
+ * pre-pack behavior. With either selected source it becomes a single
+ * in-memory dir source combining bundled skill directories (as local_dir
+ * entries the SDK materializes lazily) with selected in-memory skill
+ * directories — one skill index, one `## Skills` instruction section, lazy
+ * `load_skill` for all of them. A pack skill shadows a bundled or curated
+ * skill with the same directory name, case-insensitively.
  */
-export function lazySkillSourceWithPackSkills(packSkills: PackSkill[]): LocalDirLazySkillSource {
+export function lazySkillSourceWithPackSkills(
+  packSkills: PackSkill[],
+  skillLibrarySkills: PackSkill[] = [],
+): LocalDirLazySkillSource {
   const bundledDir = bundledSkillsDir();
   const bundled = localDirLazySkillSource({ src: bundledDir });
-  if (packSkills.length === 0) {
+  if (packSkills.length === 0 && skillLibrarySkills.length === 0) {
     return bundled;
   }
   const children: Record<string, Entry> = {};
   for (const name of bundledSkillDirNames(bundledDir)) {
     children[name] = localDir({ src: join(bundledDir, name) });
   }
+  const libraryIndex: SkillIndexEntry[] = [];
+  const libraryNameKeys = new Set<string>();
+  for (const skill of skillLibrarySkills) {
+    assertSafePackSkillName(skill.name);
+    const key = skill.name.toLowerCase();
+    if (libraryNameKeys.has(key)) {
+      throw new Error(`Duplicate curated skill name: ${skill.name}`);
+    }
+    libraryNameKeys.add(key);
+    removeSkillChildByNameKey(children, key);
+    children[skill.name] = packSkillDirEntry(skill);
+    libraryIndex.push({
+      name: skill.name,
+      description: packSkillDescription(skill),
+      path: skill.name,
+    });
+  }
   const packIndex: SkillIndexEntry[] = [];
-  const packNames = new Set<string>();
   const packNameKeys = new Set<string>();
   for (const skill of packSkills) {
     assertSafePackSkillName(skill.name);
@@ -5701,7 +7106,7 @@ export function lazySkillSourceWithPackSkills(packSkills: PackSkill[]): LocalDir
       throw new Error(`Duplicate pack skill name: ${skill.name}`);
     }
     packNameKeys.add(skill.name.toLowerCase());
-    packNames.add(skill.name);
+    removeSkillChildByNameKey(children, skill.name.toLowerCase());
     children[skill.name] = packSkillDirEntry(skill);
     packIndex.push({
       name: skill.name,
@@ -5713,13 +7118,62 @@ export function lazySkillSourceWithPackSkills(packSkills: PackSkill[]): LocalDir
     source: dir({ children }),
     getIndex: (manifest, skillsPath) => [
       ...(bundled.getIndex?.(manifest, skillsPath) ?? []).filter(
-        (entry) => !packNames.has(entry.path ?? entry.name),
+        (entry) =>
+          !packNameKeys.has((entry.path ?? entry.name).toLowerCase()) &&
+          !libraryNameKeys.has((entry.path ?? entry.name).toLowerCase()),
+      ),
+      ...libraryIndex.filter(
+        (entry) => !packNameKeys.has((entry.path ?? entry.name).toLowerCase()),
       ),
       ...packIndex,
     ],
   };
 }
 
+function effectiveSkillSelections(
+  librarySelections: readonly EffectiveSkillSelection[],
+  librarySkills: readonly PackSkill[],
+  packSkills: readonly PackSkill[],
+): readonly EffectiveSkillSelection[] {
+  const defaultSelections = bundledSkillDirNames(bundledSkillsDir()).map((name) => ({
+    id: `bundled:${name}`,
+    name,
+    source: "bundled" as const,
+    version: null,
+    contentSha256: null,
+    reason: "deployment default skill bundle",
+  }));
+  const libraryNameKeys = new Set(librarySkills.map((skill) => skill.name.toLowerCase()));
+  const packNameKeys = new Set(packSkills.map((skill) => skill.name.toLowerCase()));
+  const selected = librarySelections.filter((selection) =>
+    libraryNameKeys.has(selection.name.toLowerCase()),
+  );
+  return [
+    ...defaultSelections.filter(
+      (selection) =>
+        !libraryNameKeys.has(selection.name.toLowerCase()) &&
+        !packNameKeys.has(selection.name.toLowerCase()),
+    ),
+    ...selected.filter((selection) => !packNameKeys.has(selection.name.toLowerCase())),
+    ...packSkills.map((skill) => ({
+      id: `pack:${skill.name}`,
+      name: skill.name,
+      source: "pack" as const,
+      version: null,
+      contentSha256: null,
+      reason: "enabled capability pack",
+    })),
+  ];
+}
+
+function removeSkillChildByNameKey(children: Record<string, Entry>, nameKey: string): void {
+  for (const name of Object.keys(children)) {
+    if (name.toLowerCase() === nameKey) {
+      delete children[name];
+    }
+  }
+}
+
 function bundledSkillDirNames(root: string): string[] {
   return readdirSync(root, { withFileTypes: true })
     .filter((entry) => entry.isDirectory() && existsSync(join(root, entry.name, "SKILL.md")))
@@ -5863,7 +7317,12 @@ function sortJson(value: unknown): unknown {
   }
   return value;
 }
-
-function approvalIdentifier(item: any): string {
-  return String(item?.rawItem?.callId ?? item?.rawItem?.id ?? item?.id ?? item?.name ?? "approval");
+function interruptionToolName(item: unknown): string {
+  const candidate = item as {
+    toolName?: unknown;
+    name?: unknown;
+    rawItem?: { name?: unknown };
+  };
+  const name = candidate?.toolName ?? candidate?.name ?? candidate?.rawItem?.name;
+  return typeof name === "string" ? name : "";
 }