@opengeni/runtime 3.0.2-canary.38894290271001 → 3.1.2

package/dist/context-compaction.d.ts

@@ -47,7 +47,8 @@ export declare function jsonSerializedUtf8ByteLength(value: unknown): number;
 /** Count raw UTF-8 bytes using the standard three-byte lone-surrogate replacement. */
 export declare function utf8ByteLength(value: string): number;
 export declare const UNKNOWN_IMAGE_TOKENS = 4096;
-export declare const MAX_NATIVE_IMAGE_TOKENS = 8192;
+/** OpenAI rejects images above 30,000 of its patches (about 36,000 tokens). */
+export declare const MAX_NATIVE_IMAGE_TOKENS = 36000;
 export type NativeImageEstimateReason = "dimensions" | "bounded_fallback";
 export type NativeImageTokenEstimate = {
     tokens: number;
@@ -265,7 +266,8 @@ export declare function prepareCompactionPromptInput(items: readonly CompactionI
 /**
  * Build the active history after compaction:
  * the newest user/system input messages that fit one cumulative, model-bounded budget
- * (prior summaries excluded, retained images preserved) plus one marked summary item.
+ * (prior summaries excluded) plus one marked summary item. Only the newest
+ * user message with attachments keeps its images inline.
  * Each distinct session goal context is kept once, and answered transient
  * machine-status batches are left to the summary.
  * Attachments of messages that were not retained are listed in one dated
@@ -281,8 +283,8 @@ export declare function isRetainedRemoteV2Message(item: unknown): boolean;
  * newest retained user/system/developer messages within the CLI 64k budget plus the
  * opaque `{ type: "compaction", encrypted_content }` item.
  *
- * Both modes preserve retained image parts. Charge their projected image
- * tokens, including uploads represented by durable refs, against the budget.
+ * Both modes keep attachments inline only on the newest user message that has
+ * them, and charge its projected image tokens against the budget.
  */
 export declare function buildRemoteV2ReplacementHistory(items: readonly CompactionItem[], compactionItem: CompactionItem, retainedItemTokens?: (item: CompactionItem) => number, attachmentUploadTimes?: AttachmentUploadTimes): CompactionItem[];
 /** Upload time of each referenced file, frozen into a catalog when compaction creates it. */

package/dist/index.d.ts

@@ -2,6 +2,7 @@ import { type InteractionToolErrorResult } from "./interaction-tools.js";
 export { preparedCompactionRequest, queuePreparedCompaction } from "./prepared-compaction-request.js";
 export { createAnthropicCompactionSizer, fitCompactionPrefix, compactionPrefixCuts, } from "./anthropic-compaction.js";
 export { AnthropicProviderRejection } from "./anthropic-messages.js";
+export { createModelImageSizer, type ModelImageSizerOptions, type SizedImage, } from "./model-image-sizing.js";
 export { runSingleModelCall, SingleModelCallProviderError, SingleModelCallUnsupportedError, type SingleModelCallContentPart, type SingleModelCallFinishReason, type SingleModelCallMessage, type SingleModelCallOptions, type SingleModelCallOutputFormat, type SingleModelCallRequest, type SingleModelCallResult, type SingleModelCallTarget, } from "./single-model-call.js";
 import type { ModelProviderApi, ResolvedModelProvider, Settings } from "@opengeni/config";
 import { RunMcpCredentials } from "./mcp-run-credentials.js";

package/dist/index.js

@@ -117,6 +117,7 @@ import {
   modelResponseHasVisibleText,
   modelToolResultFits,
   modelToolResultOverflowError,
+  nativeCuaSchema,
   normalizeComputerCallsFilter,
   observeMcpOperation,
   oneShotGenesisTitleInputFilter,
@@ -186,7 +187,7 @@ import {
   workspaceEnvironmentInstructions,
   wrapAttemptToolDefinitions,
   wrapAttemptToolExecute
-} from "./chunk-JDNBDSQV.js";
+} from "./chunk-TE3JIUL6.js";
 import {
   ActiveBackendUnresolvableError,
   BROWSER_CONTROL_ADMIN_TOKEN_FILE,
@@ -491,6 +492,7 @@ import {
   compactionSummaryOutputTokens,
   compactionThresholdTokens,
   configureRuntimeMetricsHooks,
+  createModelImageSizer,
   decideCompaction,
   describeCompactionProviderRejection,
   elideSupersededViewImagePairs,
@@ -556,7 +558,7 @@ import {
   toolCallIdFromSdkItem,
   vercelGatewayRoutingFetch,
   withClaudeUsageObserver
-} from "./chunk-EQQ3YOKR.js";
+} from "./chunk-7OUG7WBV.js";
 import {
   UnsupportedProtocolJsonValueError,
   normalizeProtocolJsonValue
@@ -999,6 +1001,7 @@ export {
   createFirstPartyInteractionAttemptToolDefinitions,
   createInteractionAttemptToolDefinitions,
   createMockSelfhostedOpStream,
+  createModelImageSizer,
   createModelVisibleContextCaptureFilter,
   createProductionAgentRuntime,
   createSandboxClient,
@@ -1143,6 +1146,7 @@ export {
   modelToolResultFits,
   modelToolResultOverflowError,
   modelUsageTokenCountOrNull,
+  nativeCuaSchema,
   negotiateCapabilities,
   negotiateSelfhostedCapabilities,
   nextDurableOpId,

package/dist/interaction-tools.d.ts

@@ -1,4 +1,4 @@
-import { InteractionIntervention, type FirstPartyMcpToolName, type Permission, type AttemptToolResult as AttemptToolResultValue } from "@opengeni/contracts";
+import { InteractionIntervention, type FirstPartyMcpToolName, type Permission, type AttemptToolJsonSchema, type AttemptToolResult as AttemptToolResultValue } from "@opengeni/contracts";
 import { type Settings } from "@opengeni/config";
 import type { AttemptToolDefinition, AttemptToolScope } from "@opengeni/codemode";
 import { type InteractionControlFailure, type InteractionTransport } from "@opengeni/sdk";
@@ -18,6 +18,16 @@ export type CreateInteractionAttemptToolsInput = {
     interventionResume?: InteractionInterventionResume | null;
 };
 export declare function createInteractionAttemptToolDefinitions(input: CreateInteractionAttemptToolsInput): AttemptToolDefinition[];
+/**
+ * One top-level object schema for every platform variant of a native CUA tool.
+ * Model providers require a plain object at the top level of a function schema
+ * (a top-level anyOf is rejected or ignored, so the model loses every argument
+ * type). Properties are the union across platforms; a property whose platform
+ * schemas differ in more than wording keeps those alternatives at property
+ * level. Only properties every platform requires stay required. The session's
+ * CUA worker still validates arguments against its own exact platform schema.
+ */
+export declare function nativeCuaSchema(variants: Record<string, unknown>[]): AttemptToolJsonSchema;
 export type CreateFirstPartyInteractionAttemptToolsInput = Omit<CreateInteractionAttemptToolsInput, "transport" | "workspaceId" | "sessionId"> & {
     settings: Settings;
     scope: AttemptToolScope;

package/dist/model-call.js

@@ -4,7 +4,7 @@ import {
   SingleModelCallUnsupportedError,
   normalizeModelCallUsage,
   runSingleModelCall
-} from "./chunk-EQQ3YOKR.js";
+} from "./chunk-7OUG7WBV.js";
 import "./chunk-5ULGMFKR.js";
 import "./chunk-KCPW4K7L.js";
 import "./chunk-7LJ7KDPI.js";

package/dist/model-image-sizing.d.ts

@@ -1,4 +1,4 @@
-type SizedImage = {
+export type SizedImage = {
     data: string;
     mediaType: string;
     originalWidth: number;
@@ -6,6 +6,12 @@ type SizedImage = {
     width: number;
     height: number;
 };
-/** A bounded, run-local cache. Image count never changes an image's projection. */
-export declare function createModelImageSizer(maxDimension: number, maxEncodedBytes?: number): (data: string, mediaType: string) => Promise<SizedImage>;
-export {};
+export type ModelImageSizerOptions = {
+    /**
+     * Re-encode a resized JPEG as JPEG at this quality instead of starting with
+     * lossless PNG. Photos then stay small without a PNG encode per image.
+     */
+    jpegQuality?: number;
+};
+/** A bounded cache. Image count never changes an image's projection. */
+export declare function createModelImageSizer(maxDimension: number, maxEncodedBytes?: number, options?: ModelImageSizerOptions): (data: string, mediaType: string) => Promise<SizedImage>;

package/dist/workspace-tool-gateway.js

@@ -3,10 +3,10 @@ import {
   prepareAgentTools,
   secretArgumentMode,
   sessionMcpApprovalConnectionId
-} from "./chunk-JDNBDSQV.js";
+} from "./chunk-TE3JIUL6.js";
 import "./chunk-462CH77G.js";
 import "./chunk-4KFT2G3W.js";
-import "./chunk-EQQ3YOKR.js";
+import "./chunk-7OUG7WBV.js";
 import "./chunk-5ULGMFKR.js";
 import "./chunk-XQ23VCZ4.js";
 import "./chunk-RSHQSLEJ.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/runtime",
-  "version": "3.0.2-canary.38894290271001",
+  "version": "3.1.2",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -75,19 +75,19 @@
     "@openai/agents": "0.14.3",
     "@openai/agents-core": "0.14.3",
     "@openai/agents-extensions": "0.14.3",
-    "@opengeni/agent-proto": "3.0.2-canary.38894290271001",
-    "@opengeni/capabilities": "3.0.2-canary.38894290271001",
-    "@opengeni/codemode": "3.0.2-canary.38894290271001",
-    "@opengeni/codex": "3.0.2-canary.38894290271001",
-    "@opengeni/config": "3.0.2-canary.38894290271001",
-    "@opengeni/contracts": "3.0.2-canary.38894290271001",
-    "@opengeni/interaction": "3.0.2-canary.38894290271001",
-    "@opengeni/network": "3.0.2-canary.38894290271001",
-    "@opengeni/observability": "3.0.2-canary.38894290271001",
-    "@opengeni/sdk": "3.0.2-canary.38894290271001",
-    "@opengeni/tool-gateway": "3.0.2-canary.38894290271001",
-    "@opengeni/vaults": "3.0.2-canary.38894290271001",
-    "@opengeni/xai-subscription": "3.0.2-canary.38894290271001",
+    "@opengeni/agent-proto": "3.1.2",
+    "@opengeni/capabilities": "3.1.2",
+    "@opengeni/codemode": "3.1.2",
+    "@opengeni/codex": "3.1.2",
+    "@opengeni/config": "3.1.2",
+    "@opengeni/contracts": "3.1.2",
+    "@opengeni/interaction": "3.1.2",
+    "@opengeni/network": "3.1.2",
+    "@opengeni/observability": "3.1.2",
+    "@opengeni/sdk": "3.1.2",
+    "@opengeni/tool-gateway": "3.1.2",
+    "@opengeni/vaults": "3.1.2",
+    "@opengeni/xai-subscription": "3.1.2",
     "debug": "4.4.3",
     "modal": "0.9.0",
     "openai": "6.47.0",

package/src/bundled_site_skills/opengeni-sites/SKILL.md

@@ -61,6 +61,45 @@ say which designs are possible and ask before building.
 - Keep secrets, Opengeni access keys, OAuth tokens, workspace ids, API base
   URLs, and signed URLs out of the source and generated HTML.
 
+## Make new Sites readable by default
+
+Choose a clear type scale before building. For new Sites without an explicit
+type scale, start main reading text at 16–18px, controls and table content at
+14–16px, and reserve smaller text for genuinely secondary metadata, not
+descriptions, navigation, labels needed to use a control, or key results.
+Use comfortable line heights (about 1.5–1.7 for prose) and reading widths of
+roughly 60–75 characters. Check the chosen font at its rendered size: a large
+headline does not make small body copy readable.
+
+Use `rem`/`em` for text, keep the browser's root font size, and allow browser
+zoom and user text scaling. Do not shrink primary copy on mobile to fit more
+columns; reflow the layout, wrap content, or scroll a wide table instead.
+Keep form text readable and let controls grow with their labels.
+
+These are authoring defaults, not a mandatory theme or runtime CSS override.
+Honor a user's deliberate design, retain an existing app's type system, and
+leave embedded components such as `SessionConversation` on their own styles.
+Do not inject a blanket font-size rule into existing Sites or use `!important`
+to force this scale onto a component library. If `frontend-design` is available,
+use it for visual direction alongside these readability defaults.
+
+For a new page, this optional starting point applies only to elements you mark
+with these classes; adapt it to the design rather than importing a global reset.
+The sizes below assume the usual 16px browser default and scale with it.
+
+```css
+.site-copy { font-size: 1.0625rem; line-height: 1.6; max-width: 70ch; }
+.site-control { font: inherit; font-size: 1rem; line-height: 1.5; }
+.site-table { font-size: 0.9375rem; line-height: 1.5; }
+.site-meta { font-size: 0.8125rem; line-height: 1.5; }
+```
+
+Before publishing, inspect actual paragraphs, labels, inputs, buttons, table
+cells and empty/error states at desktop and narrow mobile widths, then with
+text enlarged to 200%. Check computed sizes and look for clipped or overlapping
+text; fix layout pressure rather than making the content smaller. A fixture can
+demonstrate a type scale, but does not prove every generated Site follows it.
+
 ## Use normal Bun + React
 
 Use the repository's pinned Bun version and ordinary package scripts. A minimal
@@ -672,6 +711,8 @@ with `textContent` or React text, never `innerHTML`.
 - The compiled runtime is one self-contained HTML document within the published
   size limit.
 - Desktop and mobile interactions were exercised in the sandbox-local preview.
+- Reading text, controls and tables follow the chosen readable type scale;
+  mobile and 200% text scaling do not clip or shrink primary content.
 - Exercise live tools and SDK operations locally through `/__opengeni/site-tools/*`
   wherever the attempt's Codemode authority permits. Report remaining
   viewer-only checks explicitly; those do not by themselves block publication.

package/src/codex-tool-search.ts

@@ -98,6 +98,43 @@ export function isHarnessControlMcpToolName(registryId: string, modelName: strin
   );
 }
 
+/**
+ * First-party interaction tools that are only useful together. Disclosing one
+ * member through search discloses the whole working set, so an agent that asks
+ * for "a browser" gets open, observe, act, screenshot and tab control in one
+ * search instead of rediscovering each schema in its own model round trip.
+ * Members are matched by their name after the server separator and only ever
+ * drawn from the already-authorized searchable pool.
+ */
+const INTERACTION_MCP_SERVER_ID = "interaction";
+const INTERACTION_TOOL_FAMILIES: readonly (readonly string[])[] = [
+  ["browser_open", "browser_observe", "browser_act", "browser_screenshot", "browser_tabs"],
+  ["computer_open", "computer_observe", "computer_act"],
+];
+
+/** The interaction tool's name after its server prefix, or null for any other tool. */
+function interactionToolName(name: string): string | null {
+  const prefix = `${INTERACTION_MCP_SERVER_ID}${MCP_TOOL_NAME_SEPARATOR}`;
+  return name.startsWith(prefix) ? name.slice(prefix.length) : null;
+}
+
+/** The other members of every family a disclosed tool belongs to, in family order. */
+function familyCompanions<T extends Tool & { name: string }>(disclosed: T[], pool: T[]): T[] {
+  const disclosedShort = new Set(
+    disclosed.map((tool) => interactionToolName(tool.name)).filter((name) => name !== null),
+  );
+  const wanted = INTERACTION_TOOL_FAMILIES.filter((family) =>
+    family.some((member) => disclosedShort.has(member)),
+  ).flat();
+  const companions: T[] = [];
+  for (const member of wanted) {
+    if (disclosedShort.has(member)) continue;
+    const tool = pool.find((candidate) => interactionToolName(candidate.name) === member);
+    if (tool && !companions.includes(tool)) companions.push(tool);
+  }
+  return companions;
+}
+
 /**
  * True when a prepared MCP function tool is one of the harness control tools
  * served by the authorized first-party `opengeni` server. These stay in the
@@ -353,5 +390,16 @@ export function searchToolPool(availableTools: Tool[], rawArguments: unknown): T
     bounded.push(tool);
     if (bounded.length >= limit) break;
   }
+  // Complete any interaction family a result belongs to. Companions come after
+  // the ranked results, so they never displace them, and they still respect the
+  // per-tool and total disclosure byte budgets (but not the result count limit).
+  for (const tool of familyCompanions(bounded as (Tool & { name: string })[], searchable)) {
+    if (bounded.includes(tool)) continue;
+    const toolBytes = mcpSerializedSizeBytes(tool);
+    if (toolBytes > MCP_MAX_TOOL_DEFINITION_BYTES) continue;
+    if (disclosedBytes + toolBytes > MCP_MAX_TOOL_SEARCH_DISCLOSURE_BYTES) continue;
+    disclosedBytes += toolBytes;
+    bounded.push(tool);
+  }
   return bounded;
 }

package/src/context-compaction.ts

@@ -22,6 +22,7 @@ import {
   FileResourceRef,
   MODEL_ATTACHMENT_CATALOG_MARKER,
   MODEL_ATTACHMENT_CATALOG_RENDERED_FIELD,
+  MODEL_ATTACHMENT_IMAGE_MAX_DIMENSION_FIELD,
   MODEL_ATTACHMENT_REFS_FIELD,
   collapseRepeatedSessionGoalContexts,
   expandUnchangedSessionGoalContexts,
@@ -482,13 +483,15 @@ function jsonStringUtf8ByteLength(value: string): number {
 }
 
 const IMAGE_LOW_DETAIL_TOKENS = 85;
-const IMAGE_HIGH_DETAIL_BASE_TOKENS = 85;
-const IMAGE_HIGH_DETAIL_TILE_TOKENS = 170;
-const IMAGE_HIGH_DETAIL_TILE_SIZE = 512;
-const IMAGE_HIGH_DETAIL_MAX_SIDE = 2_048;
-const IMAGE_HIGH_DETAIL_TARGET_SHORT_SIDE = 768;
+// Current vision models price an image by the patches it covers at the
+// resolution it is sent. One token per 28 px patch is a safe bound for both
+// families in use: OpenAI's 32 px patches cost about 1.2 tokens each, which is
+// slightly less per pixel. A photo sent at full resolution therefore costs
+// many thousands of tokens, not a few hundred.
+const IMAGE_PATCH_SIZE = 28;
 export const UNKNOWN_IMAGE_TOKENS = 4_096;
-export const MAX_NATIVE_IMAGE_TOKENS = 8_192;
+/** OpenAI rejects images above 30,000 of its patches (about 36,000 tokens). */
+export const MAX_NATIVE_IMAGE_TOKENS = 36_000;
 
 export type NativeImageEstimateReason = "dimensions" | "bounded_fallback";
 export type NativeImageTokenEstimate = {
@@ -701,27 +704,10 @@ function dimensionsFromImageSource(source: unknown): [number, number] | null {
   );
 }
 
-function highDetailImageTokens(width: number, height: number): number {
-  let scaledWidth = width;
-  let scaledHeight = height;
-  const longest = Math.max(scaledWidth, scaledHeight);
-  if (longest > IMAGE_HIGH_DETAIL_MAX_SIDE) {
-    const scale = IMAGE_HIGH_DETAIL_MAX_SIDE / longest;
-    scaledWidth *= scale;
-    scaledHeight *= scale;
-  }
-  const shortest = Math.min(scaledWidth, scaledHeight);
-  if (shortest > IMAGE_HIGH_DETAIL_TARGET_SHORT_SIDE) {
-    const scale = IMAGE_HIGH_DETAIL_TARGET_SHORT_SIDE / shortest;
-    scaledWidth *= scale;
-    scaledHeight *= scale;
-  }
-  const tiles =
-    Math.ceil(scaledWidth / IMAGE_HIGH_DETAIL_TILE_SIZE) *
-    Math.ceil(scaledHeight / IMAGE_HIGH_DETAIL_TILE_SIZE);
+function patchImageTokens(width: number, height: number): number {
   return Math.min(
     MAX_NATIVE_IMAGE_TOKENS,
-    IMAGE_HIGH_DETAIL_BASE_TOKENS + IMAGE_HIGH_DETAIL_TILE_TOKENS * Math.max(1, tiles),
+    Math.max(1, Math.ceil(width / IMAGE_PATCH_SIZE) * Math.ceil(height / IMAGE_PATCH_SIZE)),
   );
 }
 
@@ -755,7 +741,7 @@ export function estimateNativeImageTokens(input: {
     };
   }
   return {
-    tokens: highDetailImageTokens(width, height),
+    tokens: patchImageTokens(width, height),
     width,
     height,
     detail,
@@ -1680,10 +1666,41 @@ function isPortableRetentionCandidate(item: CompactionItem): boolean {
   return isPortableInputMessage(item) && !isCompactionSummary(item) && !isAttachmentCatalog(item);
 }
 
+function hasAttachmentRefs(item: CompactionItem): boolean {
+  const raw = item[MODEL_ATTACHMENT_REFS_FIELD];
+  return Array.isArray(raw) && raw.length > 0;
+}
+
+/**
+ * Only the newest user message that carries attachments keeps them inline
+ * after compaction. Older retained messages drop their references, so their
+ * files are listed in the dated attachment catalog instead of being replayed
+ * as images on every later request. Their text is unchanged and they are
+ * charged only for that text.
+ */
+function withOnlyNewestAttachmentsInline(items: readonly CompactionItem[]): CompactionItem[] {
+  let newest = -1;
+  for (let index = items.length - 1; index >= 0; index -= 1) {
+    const item = items[index]!;
+    if (itemRole(item) === "user" && !isAttachmentCatalog(item) && hasAttachmentRefs(item)) {
+      newest = index;
+      break;
+    }
+  }
+  return items.map((item, index) => {
+    if (index === newest || isAttachmentCatalog(item) || !hasAttachmentRefs(item)) return item;
+    const stripped: CompactionItem = { ...item };
+    delete stripped[MODEL_ATTACHMENT_REFS_FIELD];
+    delete stripped[MODEL_ATTACHMENT_IMAGE_MAX_DIMENSION_FIELD];
+    return stripped;
+  });
+}
+
 /**
  * Build the active history after compaction:
  * the newest user/system input messages that fit one cumulative, model-bounded budget
- * (prior summaries excluded, retained images preserved) plus one marked summary item.
+ * (prior summaries excluded) plus one marked summary item. Only the newest
+ * user message with attachments keeps its images inline.
  * Each distinct session goal context is kept once, and answered transient
  * machine-status batches are left to the summary.
  * Attachments of messages that were not retained are listed in one dated
@@ -1701,7 +1718,10 @@ export function buildCompactionReplacementHistory(
     0,
     Math.min(COMPACT_USER_MESSAGE_MAX_TOKENS, retainedMessageBudgetTokens),
   );
-  const prepared = prepareRetainedInputs(items, isPortableRetentionCandidate);
+  const prepared = prepareRetainedInputs(
+    withOnlyNewestAttachmentsInline(items),
+    isPortableRetentionCandidate,
+  );
   for (let index = prepared.charged.length - 1; index >= 0 && remaining > 0; index -= 1) {
     const item = prepared.charged[index]!;
     if (!isPortableRetentionCandidate(item) || prepared.skip(index)) {
@@ -1763,8 +1783,8 @@ export function isRetainedRemoteV2Message(item: unknown): boolean {
  * newest retained user/system/developer messages within the CLI 64k budget plus the
  * opaque `{ type: "compaction", encrypted_content }` item.
  *
- * Both modes preserve retained image parts. Charge their projected image
- * tokens, including uploads represented by durable refs, against the budget.
+ * Both modes keep attachments inline only on the newest user message that has
+ * them, and charge its projected image tokens against the budget.
  */
 export function buildRemoteV2ReplacementHistory(
   items: readonly CompactionItem[],
@@ -1780,7 +1800,7 @@ export function buildRemoteV2ReplacementHistory(
   const retainedReversed: CompactionItem[] = [];
   let remaining = REMOTE_V2_RETAINED_MESSAGE_TOKEN_BUDGET;
   const prepared = prepareRetainedInputs(
-    items,
+    withOnlyNewestAttachmentsInline(items),
     (item) => readSkillCatalogContext(item) === null && isRetainedRemoteV2Message(item),
   );
   for (let index = prepared.charged.length - 1; index >= 0 && remaining > 0; index -= 1) {

package/src/history-sanitizer.ts

@@ -35,6 +35,7 @@ import {
 import {
   MODEL_ATTACHMENT_CATALOG_MARKER,
   MODEL_ATTACHMENT_CATALOG_RENDERED_FIELD,
+  MODEL_ATTACHMENT_IMAGE_MAX_DIMENSION_FIELD,
   MODEL_ATTACHMENT_REFS_FIELD,
   MODEL_TIMELINE_ANNOTATIONS_FIELD,
 } from "@opengeni/contracts";
@@ -340,6 +341,7 @@ export function stripInternalModelMetadata<T extends HistoryItem>(item: T): T {
   if (
     !(MODEL_ATTACHMENT_CATALOG_MARKER in withoutResume) &&
     !(MODEL_ATTACHMENT_CATALOG_RENDERED_FIELD in withoutResume) &&
+    !(MODEL_ATTACHMENT_IMAGE_MAX_DIMENSION_FIELD in withoutResume) &&
     !(MODEL_ATTACHMENT_REFS_FIELD in withoutResume) &&
     !(MODEL_TIMELINE_ANNOTATIONS_FIELD in withoutResume)
   ) {
@@ -348,6 +350,7 @@ export function stripInternalModelMetadata<T extends HistoryItem>(item: T): T {
   const clone = { ...withoutResume } as Record<string, unknown>;
   delete clone[MODEL_ATTACHMENT_CATALOG_MARKER];
   delete clone[MODEL_ATTACHMENT_CATALOG_RENDERED_FIELD];
+  delete clone[MODEL_ATTACHMENT_IMAGE_MAX_DIMENSION_FIELD];
   delete clone[MODEL_ATTACHMENT_REFS_FIELD];
   delete clone[MODEL_TIMELINE_ANNOTATIONS_FIELD];
   return clone as T;

package/src/index.ts

@@ -15,6 +15,11 @@ export {
   compactionPrefixCuts,
 } from "./anthropic-compaction";
 export { AnthropicProviderRejection } from "./anthropic-messages";
+export {
+  createModelImageSizer,
+  type ModelImageSizerOptions,
+  type SizedImage,
+} from "./model-image-sizing";
 import { runSingleModelCall, type SingleModelCallTarget } from "./single-model-call";
 export {
   runSingleModelCall,
@@ -33,6 +38,7 @@ import { instrumentedModelFetch } from "./model-provider-client";
 import type { ModelProviderApi, ResolvedModelProvider, Settings } from "@opengeni/config";
 import { isRunMcpCredentialError, RunMcpCredentials } from "./mcp-run-credentials";
 import {
+  mcpToolRecommendsApproval,
   normalizeCredentialProviderMcpUrl,
   toolPolicyActionName,
   toolReviewContextFromSchema,
@@ -3584,6 +3590,7 @@ function installMcpApprovalPolicy(
         inputSchema: unknown;
         title?: string;
         accountLabel?: string | undefined;
+        recommendsApproval: boolean;
         readReview: ToolReviewReader;
       }
     >();
@@ -3602,6 +3609,7 @@ function installMcpApprovalPolicy(
           serverId: server.registryId,
           toolName: await server.unprefixedToolName(descriptor.name),
           inputSchema: descriptor.inputSchema,
+          recommendsApproval: mcpToolRecommendsApproval(descriptor),
           readReview: (name, args) => server.reviewContext(name, args),
           ...(descriptor.title ? { title: descriptor.title } : {}),
           ...(accountLabel ? { accountLabel } : {}),
@@ -3622,8 +3630,12 @@ function installMcpApprovalPolicy(
       const unprefixed = identity?.toolName ?? tool.name.slice(policy.prefix.length);
       const originalNeedsApproval = tool.needsApproval.bind(tool);
       const originalInvoke = tool.invoke.bind(tool);
-      const legacyApproval =
-        !policy.connectorBacked && mcpToolRequiresApproval(policy.requireApproval, unprefixed);
+      // The recommendation: the session's requireApproval or the tool's own
+      // tools/list `_meta`. Either one asking makes Ask the default.
+      const recommendsApproval =
+        mcpToolRequiresApproval(policy.requireApproval, unprefixed) ||
+        identity?.recommendsApproval === true;
+      const legacyApproval = !policy.connectorBacked && recommendsApproval;
       if (!policy.connectorBacked && !legacyApproval && !connectorActionPolicy) {
         return tool;
       }
@@ -3645,9 +3657,7 @@ function installMcpApprovalPolicy(
           }),
           actionName: toolPolicyActionName(unprefixed, identity?.inputSchema, args),
           ...(legacyApproval ? { approvalMode: "session_mcp" as const } : {}),
-          defaultDecision: mcpToolRequiresApproval(policy.requireApproval, unprefixed)
-            ? "ask"
-            : "allow",
+          defaultDecision: recommendsApproval ? "ask" : "allow",
         };
       };
       return {
@@ -3659,8 +3669,7 @@ function installMcpApprovalPolicy(
         ) => {
           if (!connectorActionPolicy) {
             return (
-              mcpToolRequiresApproval(policy.requireApproval, unprefixed) ||
-              (await originalNeedsApproval(runContext, parsedInput, callId))
+              recommendsApproval || (await originalNeedsApproval(runContext, parsedInput, callId))
             );
           }
           if (!callId) {
@@ -3679,7 +3688,7 @@ function installMcpApprovalPolicy(
           // An explicit Allow is a decision, not an exemption from one of several floors.
           const requiresApproval = preparation.managed
             ? preparation.decision === "ask"
-            : mcpToolRequiresApproval(policy.requireApproval, unprefixed);
+            : recommendsApproval;
           if (requiresApproval) approvalRequiredCallIds.add(callId);
           else approvalRequiredCallIds.delete(callId);
           return requiresApproval;
@@ -3936,7 +3945,9 @@ function installInteractionInterventionPolicy(
 
 /**
  * Translate the canonical decision into the model SDK interruption protocol.
- * Legacy requireApproval is a recommendation only when no explicit choice exists.
+ * Legacy requireApproval and a tool's `opengeni/recommendedPermission` `_meta`
+ * are recommendations only when no explicit choice exists. Every external MCP
+ * server is wrapped so a tool's own recommendation holds even without hooks.
  * Standalone runtimes without policy hooks retain their configured behavior;
  * they cannot execute an approval-gated call without the durable authority.
  * Prepared server/tool identities take precedence over longest-prefix legacy
@@ -3953,7 +3964,7 @@ function applyMcpApprovalPolicy(
     .filter(
       (server) =>
         Boolean(server.connectionRef) ||
-        Boolean(connectorActionPolicy && attemptToolSource(server.id) === "mcp") ||
+        attemptToolSource(server.id) === "mcp" ||
         server.requireApproval === true ||
         (Array.isArray(server.requireApproval) && server.requireApproval.length > 0),
     )
@@ -5851,10 +5862,7 @@ function installAttemptConnectorActionGatewayLifecycle(
                 definition.inputSchema,
                 arguments_,
               ),
-              defaultDecision:
-                attemptToolApproval(config!, definition.identity.toolName) === "human"
-                  ? "ask"
-                  : "allow",
+              defaultDecision: definition.approval === "human" ? "ask" : "allow",
             };
           }
         : (approvalId: string, arguments_: unknown): ConnectorActionToolCall => ({
@@ -6163,7 +6171,7 @@ async function prepareToolGatewayDefinitionsFromServers(
           ...(tool.annotations ? { annotations: tool.annotations } : {}),
           ...(tool.icons ? { icons: tool.icons } : {}),
           source: attemptToolSource(server.registryId),
-          approval: attemptToolApproval(config, toolName),
+          approval: attemptToolApproval(config, toolName, tool),
           effectAuthorityDigest: digestCanonicalJson({
             version: 1,
             serverId: server.registryId,
@@ -6331,10 +6339,12 @@ function attemptToolSource(serverId: string): ToolGatewayDefinition["source"] {
 function attemptToolApproval(
   config: Settings["mcpServers"][number],
   toolName: string,
+  tool: object,
 ): ToolGatewayDefinition["approval"] {
   if (
     config.requireApproval === true ||
-    (Array.isArray(config.requireApproval) && config.requireApproval.includes(toolName))
+    (Array.isArray(config.requireApproval) && config.requireApproval.includes(toolName)) ||
+    (attemptToolSource(config.id) === "mcp" && mcpToolRecommendsApproval(tool))
   ) {
     return "human";
   }