@opengeni/worker-bundle 2.0.1 → 2.0.3-canary.36199476632001

package/dist/{activities-turn-YVVKCGAK.js → activities-turn-CSDKK4N3.js}

@@ -24,6 +24,7 @@ import {
   compactionFailureReasonFromError,
   compactionFailureTurnEventPayload,
   computeIdleDelayMs,
+  createFreshSandboxReadinessReplacementBudget,
   createKnowledgeSourceSyncActivities,
   createModelHistoryAttachmentProjector,
   createRuntimeBatcher,
@@ -86,13 +87,14 @@ import {
   withFirstPartyTools,
   wrapLazyTurnBoxWithRouting,
   wrapTurnBoxWithRouting
-} from "./chunk-M3NVMF2V.js";
+} from "./chunk-7M6G2SCF.js";
 import {
   StreamTimingMetrics,
   makeMachineOpObserver,
   modelCallAccountContext,
   modelRequestLifecycleMetricsFor,
   recordBatchFlush,
+  recordCodeSearchCall,
   recordCompanyBrainContributions,
   recordContextCompaction,
   recordContextCompactionStarted,
@@ -113,7 +115,7 @@ import {
   recordTurnWorkerPreparationTotal,
   runtimeMetricsHooksForObservability,
   turnLifecycleMetricsFor
-} from "./chunk-I7HKKMUJ.js";
+} from "./chunk-DSPP6CZL.js";
 import {
   __export
 } from "./chunk-PZ5AY32C.js";
@@ -1445,11 +1447,13 @@ import {
   COMPUTER_SCREENSHOT_RETENTION_MS,
   COMPUTER_SCREENSHOT_WORKSPACE_QUOTA_BYTES,
   RetainedArtifactMetadataSchema,
-  retainedScreenshotReferenceFromFile
+  retainedScreenshotReferenceFromFile,
+  retainedSessionScreenshotKindFromObjectKey
 } from "@opengeni/contracts";
 import {
   RetainedScreenshotQuotaExceededError,
   getRetainedScreenshotArtifact,
+  getRetainedScreenshotArtifactForToolCall,
   isDatabasePersistenceFailure,
   isSessionEventPersistenceError,
   prepareRetainedScreenshotArtifact,
@@ -1554,13 +1558,16 @@ function toolOutputContainsInlineImage(output) {
     return output.some((entry) => {
       if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
       const record7 = entry;
-      return record7.type === "input_image" && sdkImageSourceContainsInlineImage(record7.image ?? record7.image_url ?? record7.imageUrl) || record7.type === "image" && decodeInlineMcpImage(record7.data, record7.mimeType) !== null;
+      return record7.type === "input_image" && sdkImageSourceContainsInlineImage(record7.image ?? record7.image_url ?? record7.imageUrl) || record7.type === "image" && isDeclaredInlineMcpImage(record7);
     });
   }
   if (!output || typeof output !== "object") return false;
   const record6 = output;
   if (Array.isArray(record6.content)) return toolOutputContainsInlineImage(record6.content);
-  return record6.type === "image" && sdkImageSourceContainsInlineImage(record6.image);
+  return record6.type === "image" && (sdkImageSourceContainsInlineImage(record6.image) || isDeclaredInlineMcpImage(record6));
+}
+function isDeclaredInlineMcpImage(record6) {
+  return typeof record6.data === "string" && typeof record6.mimeType === "string" && record6.mimeType.toLowerCase().startsWith("image/");
 }
 function decodeInlineMcpImage(data, mimeType) {
   if (typeof data !== "string" || typeof mimeType !== "string" || !["image/png", "image/jpeg", "image/webp"].includes(mimeType)) {
@@ -1798,7 +1805,9 @@ function validateRetainableSessionImage(input, limits = {}) {
   };
 }
 function retainedScreenshotIdentity(input) {
-  const settlementKey = createHash3("sha256").update("opengeni:computer-screenshot:v1\0").update(input.sessionId).update("\0").update(input.turnId).update("\0").update(input.attemptId).update("\0").update(input.toolCallId).update("\0").update(input.toolOutputId).digest("hex");
+  const settlementKey = createHash3("sha256").update(
+    input.kind === "browser_screenshot" ? "opengeni:browser-screenshot:v1\0" : "opengeni:computer-screenshot:v1\0"
+  ).update(input.sessionId).update("\0").update(input.turnId).update("\0").update(input.attemptId).update("\0").update(input.toolCallId).update("\0").update(input.toolOutputId).digest("hex");
   const uuidBytes = Uint8Array.from(Buffer.from(settlementKey.slice(0, 32), "hex"));
   uuidBytes[6] = uuidBytes[6] & 15 | 128;
   uuidBytes[8] = uuidBytes[8] & 63 | 128;
@@ -1812,13 +1821,14 @@ function unavailableRetainedSessionImage(input) {
   const identity = retainedScreenshotIdentity(input);
   return unavailable(identity.artifactId, input.reason);
 }
-async function retainComputerScreenshot(input) {
+async function retainSessionScreenshot(input) {
   const identity = retainedScreenshotIdentity({
     sessionId: input.sessionId,
     turnId: input.turnId,
     attemptId: input.attemptId,
     toolCallId: input.output.callId,
-    toolOutputId: input.output.toolOutputId
+    toolOutputId: input.output.toolOutputId,
+    kind: input.kind
   });
   let screenshot;
   try {
@@ -1837,7 +1847,8 @@ async function retainComputerScreenshot(input) {
   const retentionExpiresAt = new Date(
     now.getTime() + (input.retentionMs ?? COMPUTER_SCREENSHOT_RETENTION_MS)
   );
-  const objectKey = `workspaces/${input.workspaceId}/files/${identity.artifactId}/retained/session-image.${screenshot.extension}`;
+  const objectName = input.kind === "browser_screenshot" ? "browser-screenshot" : "session-image";
+  const objectKey = `workspaces/${input.workspaceId}/files/${identity.artifactId}/retained/${objectName}.${screenshot.extension}`;
   let prepared;
   try {
     prepared = (await prepareRetainedScreenshotArtifact(input.db, {
@@ -1924,6 +1935,7 @@ async function retainComputerScreenshot(input) {
     return unavailable(identity.artifactId, "pending");
   }
 }
+var retainComputerScreenshot = retainSessionScreenshot;
 function compactRetainedScreenshotHistory(history, receiptsByCallId) {
   if (receiptsByCallId.size === 0) return history;
   return history.map((item) => {
@@ -2005,6 +2017,20 @@ async function materializeRetainedScreenshotHistory(input) {
 }
 async function materializeRetainedScreenshotHistoryWithCache(input, cache) {
   const now = input.now ?? /* @__PURE__ */ new Date();
+  const receiptForMarker = async (marker, callId) => {
+    if (!isRetainedImageMarker(marker)) return null;
+    const receipt = retainedReceipt(marker.artifact);
+    if (receipt) return receipt;
+    if (!callId) throw new Error("Retained screenshot receipt has no tool call identity");
+    const artifact = await getRetainedScreenshotArtifactForToolCall(
+      input.db,
+      input.workspaceId,
+      input.sessionId,
+      callId
+    );
+    if (!artifact) throw new Error("Retained screenshot receipt cannot be recovered");
+    return reference(artifact);
+  };
   const dataUrlForReceipt = async (receipt) => {
     let dataUrl = cache.get(receipt.artifactId);
     if (!dataUrl) {
@@ -2045,15 +2071,17 @@ async function materializeRetainedScreenshotHistoryWithCache(input, cache) {
     }
     return dataUrl;
   };
-  const materializeEntry = async (entry) => {
-    const receipt = retainedReceiptFromImageContent(entry);
+  const materializeEntry = async (entry, callId) => {
+    const image = entry && typeof entry === "object" && !Array.isArray(entry) ? entry.image : null;
+    const receipt = await receiptForMarker(image, callId);
     if (!receipt) return entry;
     const dataUrl = await dataUrlForReceipt(receipt);
     return { ...entry, image: dataUrl };
   };
   const materialized = [];
   for (const item of input.history) {
-    const directReceipt = retainedReceiptFromDirectOutput(item.output);
+    const callId = historyCallId(item);
+    const directReceipt = await receiptForMarker(item.output, callId);
     if (directReceipt) {
       materialized.push({
         ...item,
@@ -2070,7 +2098,7 @@ async function materializeRetainedScreenshotHistoryWithCache(input, cache) {
     let changed = false;
     const output = [];
     for (const entry of outputEntries) {
-      const next = await materializeEntry(entry);
+      const next = await materializeEntry(entry, callId);
       changed ||= next !== entry;
       output.push(next);
     }
@@ -2124,12 +2152,15 @@ function reference(artifact) {
   if (!artifact.sessionId) {
     throw new Error(`Ready retained screenshot is detached: ${artifact.artifactId}`);
   }
+  const kind = retainedSessionScreenshotKindFromObjectKey(artifact.file.objectKey);
+  if (!kind) throw new Error(`Ready retained screenshot has unknown key: ${artifact.artifactId}`);
   const value = retainedScreenshotReferenceFromFile({
     ...artifact.file,
     sessionId: artifact.sessionId,
     width: artifact.width,
     height: artifact.height,
-    expiresAt: artifact.retentionExpiresAt.toISOString()
+    expiresAt: artifact.retentionExpiresAt.toISOString(),
+    kind
   });
   if (!value)
     throw new Error(`Ready retained screenshot receipt is invalid: ${artifact.artifactId}`);
@@ -2166,6 +2197,11 @@ function retainedReceiptFromImageContent(entry) {
   if (marker.type !== RETAINED_IMAGE_MARKER) return null;
   return retainedReceipt(marker.artifact);
 }
+function isRetainedImageMarker(value) {
+  return Boolean(
+    value && typeof value === "object" && !Array.isArray(value) && value.type === RETAINED_IMAGE_MARKER
+  );
+}
 function retainedReceiptFromDirectOutput(output) {
   if (!output || typeof output !== "object" || Array.isArray(output)) return null;
   const marker = output;
@@ -2175,12 +2211,12 @@ function retainedReceiptFromDirectOutput(output) {
 function retainedReceipt(value) {
   const parsed = RetainedArtifactMetadataSchema.safeParse(value);
   if (!parsed.success) return null;
-  return parsed.data.available && parsed.data.kind !== "computer_screenshot" ? null : parsed.data;
+  return parsed.data.available && parsed.data.kind !== "computer_screenshot" && parsed.data.kind !== "browser_screenshot" ? null : parsed.data;
 }
 function isInlineImageContent(entry) {
   if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
   const record6 = entry;
-  return record6.type === "input_image" && typeof record6.image === "string" && record6.image.startsWith("data:image/") || record6.type === "image" && decodeInlineMcpImage(record6.data, record6.mimeType) !== null;
+  return record6.type === "input_image" && typeof record6.image === "string" && record6.image.startsWith("data:image/") || record6.type === "image" && isDeclaredInlineMcpImage(record6);
 }
 function historyCallId(item) {
   const value = item.callId ?? item.call_id;
@@ -2882,6 +2918,7 @@ var TurnMediaArtifacts = class {
   sandboxFileDownloadBackend;
   nativeImageGenerationRetention = null;
   retainedSessionImageCallIds = /* @__PURE__ */ new Set();
+  retainedSessionImageKindsByCallId = /* @__PURE__ */ new Map();
   rememberGeneratedImageCreatedThisTurn = (receipt) => {
     this.generatedImageReceiptsCreatedThisTurn.set(receipt.artifact.artifactId, receipt);
   };
@@ -3217,7 +3254,10 @@ function pendingToolCallFromSdkEvent(event) {
   };
 }
 function toolCallProducesRetainableSessionImage(name) {
-  return name === "computer_screenshot" || name === "view_image" || name === "interaction__computer_observe";
+  return name === "computer_screenshot" || name === "view_image" || name === "interaction__computer_observe" || retainableBrowserScreenshotToolCall(name);
+}
+function retainableBrowserScreenshotToolCall(name) {
+  return name === "browser_screenshot" || name === "interaction__browser_screenshot" || name === "browser_observe" || name === "interaction__browser_observe" || name === "browser_act" || name === "interaction__browser_act";
 }
 function completedToolCallFromSdkEvent(event) {
   if (!event || typeof event !== "object") return null;
@@ -5110,7 +5150,8 @@ import {
 } from "@opengeni/db";
 import { publishDurableSessionEvents as publishDurableSessionEvents2 } from "@opengeni/events";
 import { maxTurnsExceededRunState } from "@opengeni/runtime";
-import { CancelledFailure } from "@temporalio/activity";
+import { ApplicationFailure, CancelledFailure } from "@temporalio/activity";
+import { TurnExecutionPolicyDefinitionMismatchError } from "@opengeni/config";
 import {
   classifyCodexEncryptedArtifactRejection,
   classifyCodexUsageLimitError,
@@ -6853,10 +6894,11 @@ async function settleTurnFailure(deps) {
       return claimedResult({ status: "recovering" });
     }
   }
-  let failure = agentRunFailurePayload(error51, {
+  const earlyDefinitionMismatch = error51 instanceof TurnExecutionPolicyDefinitionMismatchError && !attempt.modelRequestStarted && !eventing.turnStartedPublished && !!attempt.turnId && !!attempt.triggerEventId && attempt.executionGeneration > 0;
+  let failure = earlyDefinitionMismatch ? { error: error51.message, code: error51.code, retryable: true } : agentRunFailurePayload(error51, {
     isCodexTurn: billingState.isCodexTurn
   });
-  if (failure.retryable && eventing.publish && attempt.turnId && eventing.turnStartedPublished) {
+  if (attempt.turnId && (earlyDefinitionMismatch || failure.retryable && eventing.publish && eventing.turnStartedPublished)) {
     const nextProviderRecoveryCount = attempt.providerRecoveryCount + 1;
     const recoveryResult = providerRecoveryResult({
       failureCode: failure.code,
@@ -6865,8 +6907,10 @@ async function settleTurnFailure(deps) {
     });
     try {
       if (recoveryResult.status === "recovering") {
-        await flushRuntimeBatcher();
-        await historySink.reconcileConversationTruth({ requireDurable: true });
+        if (!earlyDefinitionMismatch) {
+          await flushRuntimeBatcher();
+          await historySink.reconcileConversationTruth({ requireDurable: true });
+        }
         const recovery = await requestSessionTurnRecovery(db, input.workspaceId, {
           sessionId: input.sessionId,
           turnId: attempt.turnId,
@@ -6894,6 +6938,16 @@ async function settleTurnFailure(deps) {
         return claimedResult(recoveryResult);
       }
       failure = providerRecoveryExhaustedFailure(failure, recoveryResult);
+      if (earlyDefinitionMismatch) {
+        control.activityStatus = "failed";
+        control.turnMetricOutcome = "failed";
+        control.activityError = error51;
+        throw ApplicationFailure.create({
+          message: `${error51.message}. Automatic same-turn configuration recovery exhausted after ${recoveryResult.providerRecoveryCount} retries.`,
+          type: "TurnExecutionPolicyDefinitionMismatchError",
+          nonRetryable: true
+        });
+      }
     } catch (recoveryError) {
       const escaped = recoveryResult.status === "recovering" ? escapedMcpTimeoutRecoveryFailure({
         failureCode: failure.code,
@@ -7017,7 +7071,8 @@ import {
 import {
   EmptyCompactionSummaryError,
   REMOTE_COMPACTION_V2_IMPLEMENTATION,
-  SUMMARY_BUFFER_TOKENS,
+  compactionSummaryOutputTokens,
+  buildSummaryItem,
   buildCompactionReplacementHistory,
   buildRemoteV2ReplacementHistory,
   compactionThresholdTokens,
@@ -7032,7 +7087,7 @@ import {
 } from "@opengeni/runtime";
 import { contextInputBudgetTokens } from "@opengeni/config";
 async function maybeCompactContext(db, settings, scope, lastInputTokens, summarize = (s, m) => summarizeForCompaction(s, m, {
-  maxOutputTokens: SUMMARY_BUFFER_TOKENS
+  maxOutputTokens: compactionSummaryOutputTokens(s.contextWindowTokens)
 }), options = {}) {
   if (options.codexCompactionMode === "remote_v2" && options.isCodexSubscriptionTurn !== true) {
     throw new Error(
@@ -7263,12 +7318,23 @@ async function compactContextPortable(db, settings, scope, canonicalItems, items
   const summarized = await summarizeWithCodexOverflowTrimming(summarize, settings, items);
   const summaryBody = summarized.summaryBody;
   const retainedTokens = await retentionTokenCounts(canonicalItems, projectForWire);
+  const outputReserve = compactionSummaryOutputTokens(settings.contextWindowTokens);
+  const structuralBudget = Math.min(
+    contextInputBudgetTokens(settings) || settings.contextWindowTokens - outputReserve,
+    settings.contextWindowTokens - outputReserve
+  );
+  const prefixTokens = Math.max(0, Math.ceil(summarize.estimatePrefixTokens?.() ?? 0));
+  const summaryTokens = estimateTokens([buildSummaryItem(summaryBody)]);
   const replacementHistory = buildCompactionReplacementHistory(
     canonicalItems,
     summaryBody,
-    (item) => retainedTokens.get(item) ?? estimateTokens([item])
+    (item) => retainedTokens.get(item) ?? estimateTokens([item]),
+    Math.min(outputReserve, Math.max(0, structuralBudget - prefixTokens - summaryTokens))
   );
   const estimatedTokensAfter = estimateTokens(await projectForWire(replacementHistory));
+  if (estimatedTokensAfter + prefixTokens > structuralBudget) {
+    return await settleSkippedAfterStart(db, scope, options, "replacement_exceeds_model_budget");
+  }
   const replacementFingerprint = compactionReplacementFingerprint(replacementHistory);
   const previousReplacementFingerprint = latestCompactionReplacementFingerprint(canonicalItems);
   const summaryIndex = replacementHistory.length - (readReasoningConfiguration(replacementHistory.at(-1) ?? {}) ? 2 : 1);
@@ -7321,14 +7387,27 @@ async function compactContextPortable(db, settings, scope, canonicalItems, items
   };
 }
 async function summarizeWithCodexOverflowTrimming(summarize, settings, activeHistory) {
-  const summaryAwareBudget = Math.max(0, settings.contextWindowTokens - SUMMARY_BUFFER_TOKENS);
+  const summaryAwareBudget = Math.max(
+    0,
+    settings.contextWindowTokens - compactionSummaryOutputTokens(settings.contextWindowTokens)
+  );
   const configuredInputBudget = contextInputBudgetTokens(settings);
   const structuralBudget = Math.min(
     configuredInputBudget > 0 ? configuredInputBudget : summaryAwareBudget,
     summaryAwareBudget
   );
-  const initialBudget = Math.floor(structuralBudget * 0.85);
+  const prefixTokens = Math.max(0, Math.ceil(summarize.estimatePrefixTokens?.() ?? 0));
+  const initialBudget = Math.max(0, structuralBudget - prefixTokens);
   let preparation = prepareCompactionPromptInput(activeHistory, initialBudget);
+  const requireHistory = () => {
+    if (activeHistory.length > 0 && preparation.input.length === 1) {
+      throw new EmptyCompactionSummaryError({
+        stage: "portable_input_budget",
+        reason: "no_history_fit"
+      });
+    }
+  };
+  requireHistory();
   try {
     return {
       summaryBody: await summarize(settings, preparation.input),
@@ -7338,9 +7417,10 @@ async function summarizeWithCodexOverflowTrimming(summarize, settings, activeHis
   } catch (error51) {
     if (!isContextWindowExceeded(error51)) throw error51;
     const retryBudget = Math.floor(
-      Math.min(initialBudget * 0.5, preparation.estimatedInputTokens * 0.5)
+      Math.min(initialBudget * 0.4, preparation.estimatedInputTokens * 0.4)
     );
     preparation = prepareCompactionPromptInput(activeHistory, retryBudget);
+    requireHistory();
     return {
       summaryBody: await summarize(settings, preparation.input),
       preparation,
@@ -7708,9 +7788,11 @@ import {
 
 // src/activities/agent-turn/session-title.ts
 import { hasPermission } from "@opengeni/core";
+import { isManagedOpenRouterFreeRoute } from "@opengeni/config";
 import {
   AUTOMATIC_SESSION_TITLE_FALLBACK,
-  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS
+  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
+  ReasoningEffort
 } from "@opengeni/contracts";
 var SESSION_TITLE_MODEL_TOOL_NAME = "opengeni__set_session_title";
 var SESSION_TITLE_DESCRIPTION = "Set this session's display title to a concise 3-7 word topic label. Use a stable noun phrase about the actual task or subject, never a quote/prefix of a prompt, greeting, request boilerplate, URL, identifier, credential, token, or other sensitive value. Call once on a new session, then only when the topic materially changes. Never call it as routine setup after a continuation, resume, or interruption, or merely to reassert the same title. A human-set title cannot be replaced.";
@@ -7722,10 +7804,14 @@ function shouldRequestMissingSessionTitle(input) {
   const permissions = input.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS;
   return hasPermission([...permissions], "sessions:control");
 }
+function routeAllowsSessionTitleRequests(resolvedModel) {
+  return !resolvedModel || !isManagedOpenRouterFreeRoute(resolvedModel);
+}
 function sessionTitleToolPlan(input) {
   const titleToolAvailable = input.shouldRequestTitle && input.tools.some((tool) => tool.kind === "mcp" && tool.id === "opengeni");
-  const generateTitleInParallel = titleToolAvailable && input.parallelGenerationAvailable;
-  const promoteTitleTool = titleToolAvailable && !generateTitleInParallel;
+  const titleRequestAllowed = titleToolAvailable && input.routeAllowsTitleRequests;
+  const generateTitleInParallel = titleRequestAllowed && input.parallelGenerationAvailable;
+  const promoteTitleTool = titleRequestAllowed && !generateTitleInParallel;
   return {
     promoteTitleTool,
     generateTitleInParallel,
@@ -7734,6 +7820,31 @@ function sessionTitleToolPlan(input) {
   };
 }
 var PARALLEL_SESSION_TITLE_TIMEOUT_MS = 15e3;
+function sessionTitleReasoningEffort(capabilities) {
+  const reasoning = capabilities?.reasoning;
+  if (!reasoning?.runnable) return void 0;
+  const order = ReasoningEffort.options;
+  let lowest;
+  for (const effort of reasoning.efforts) {
+    if (!lowest || order.indexOf(effort) < order.indexOf(lowest)) lowest = effort;
+  }
+  return lowest;
+}
+function sessionTitleGenerationOptions(input) {
+  const { resolvedModel, serviceTier } = input;
+  const reasoningEffort = sessionTitleReasoningEffort(resolvedModel?.configured.capabilities);
+  return {
+    ...resolvedModel ? {
+      client: resolvedModel.client,
+      provider: resolvedModel.provider,
+      model: resolvedModel.model
+    } : {},
+    modelName: input.modelName,
+    ...serviceTier ? { serviceTier } : {},
+    ...reasoningEffort ? { reasoningEffort } : {},
+    signal: input.signal
+  };
+}
 function startParallelSessionTitleGeneration(input) {
   const cancellationController = new AbortController();
   const timeoutSignal = AbortSignal.timeout(input.timeoutMs ?? PARALLEL_SESSION_TITLE_TIMEOUT_MS);
@@ -8695,6 +8806,12 @@ async function runTurnStreamAttempt(deps) {
           currentToolBatchCallIds.add(pendingToolCall.callId);
           if (toolCallProducesRetainableSessionImage(pendingToolCall.callName)) {
             media.retainedSessionImageCallIds.add(pendingToolCall.callId);
+            if (retainableBrowserScreenshotToolCall(pendingToolCall.callName)) {
+              media.retainedSessionImageKindsByCallId.set(
+                pendingToolCall.callId,
+                "browser_screenshot"
+              );
+            }
           }
         }
         const completedToolCall = completedToolCallFromSdkEvent(durableSdkEvent);
@@ -8708,7 +8825,8 @@ async function runTurnStreamAttempt(deps) {
               attemptId: input.attemptId,
               toolCallId: completedToolCall.callId,
               toolOutputId: completedToolCall.callId,
-              reason: "unsupported"
+              reason: "unsupported",
+              kind: media.retainedSessionImageKindsByCallId.get(completedToolCall.callId)
             });
             media.retainedScreenshotReceiptsByCallId.set(
               completedToolCall.callId,
@@ -8722,13 +8840,14 @@ async function runTurnStreamAttempt(deps) {
               attemptId: input.attemptId,
               toolCallId: typedScreenshot.callId,
               toolOutputId: typedScreenshot.toolOutputId,
-              reason: "pending"
+              reason: "pending",
+              kind: media.retainedSessionImageKindsByCallId.get(completedToolCall.callId)
             });
             media.retainedScreenshotReceiptsByCallId.set(
               completedToolCall.callId,
               retainedScreenshotMetadata
             );
-            retainedScreenshotMetadata = await retainComputerScreenshot({
+            retainedScreenshotMetadata = await retainSessionScreenshot({
               db,
               objectStorage,
               accountId: input.accountId,
@@ -8736,7 +8855,8 @@ async function runTurnStreamAttempt(deps) {
               sessionId: input.sessionId,
               turnId: activeTurnId,
               attemptId: input.attemptId,
-              output: typedScreenshot
+              output: typedScreenshot,
+              kind: media.retainedSessionImageKindsByCallId.get(completedToolCall.callId)
             });
             media.retainedScreenshotReceiptsByCallId.set(
               completedToolCall.callId,
@@ -8855,6 +8975,7 @@ async function runTurnStreamAttempt(deps) {
           }
           for (const callId of stableToolCallIdsToClear) {
             media.retainedSessionImageCallIds.delete(callId);
+            media.retainedSessionImageKindsByCallId.delete(callId);
           }
         }
       }
@@ -9223,16 +9344,16 @@ async function runTurnStreamAttempt(deps) {
     parallelSessionTitle = startParallelSessionTitleGeneration({
       signal: runtimeCancellationSignal,
       generate: async (signal) => await withSessionTitleProviderRequestContext(
-        () => runtime.generateSessionTitle(runSettings, sessionTitlePrompt, {
-          ...resolvedModel ? {
-            client: resolvedModel.client,
-            provider: resolvedModel.provider,
-            model: resolvedModel.model
-          } : {},
-          modelName: turnExecutionPolicy.upstreamModelId,
-          ...serviceTier ? { serviceTier } : {},
-          signal
-        })
+        () => runtime.generateSessionTitle(
+          runSettings,
+          sessionTitlePrompt,
+          sessionTitleGenerationOptions({
+            resolvedModel,
+            modelName: turnExecutionPolicy.upstreamModelId,
+            serviceTier,
+            signal
+          })
+        )
       ),
       onError: (error51) => {
         observability.warn("parallel session title generation failed", {
@@ -10245,6 +10366,24 @@ function safeErrorName(error51) {
 
 // src/activities/agent-turn/codex-capacity.ts
 import { randomUUID as randomUUID2 } from "crypto";
+import { createLogThrottle } from "@opengeni/observability";
+var CODEX_POOL_LOW_WARNING_INTERVAL_MS = 10 * 6e4;
+var codexPoolLowWarningThrottle = createLogThrottle({
+  intervalMs: CODEX_POOL_LOW_WARNING_INTERVAL_MS,
+  maxKeys: 1024
+});
+function warnCodexPoolLow(observability, input, throttle = codexPoolLowWarningThrottle) {
+  const admission = throttle.admit(`${input.workspaceKey}:${input.depth}`);
+  if (!admission) return;
+  observability.warn("Codex eligible credential pool is low", {
+    workspaceId: input.workspaceId,
+    eligibleCount: input.eligibleCount,
+    connectedCount: input.connectedCount,
+    depth: input.depth,
+    reason: input.depth === "zero" ? "eligible_pool_zero" : "eligible_pool_one",
+    ...admission.suppressedCount > 0 ? { suppressedCount: admission.suppressedCount } : {}
+  });
+}
 async function selectCodexTurnCapacity(deps) {
   const {
     input,
@@ -10510,11 +10649,12 @@ async function selectCodexTurnCapacity(deps) {
           help: "Alert signal emitted when the eligible Codex pool is zero or one.",
           labels: { workspace_key: codexWorkspaceKey, depth: poolDepth }
         });
-        observability.warn("Codex eligible credential pool is low", {
+        warnCodexPoolLow(observability, {
+          workspaceKey: codexWorkspaceKey,
           workspaceId: input.workspaceId,
           eligibleCount,
           connectedCount: leased.accounts.length,
-          depth: poolDepth
+          depth: poolDepth === "zero" ? "zero" : "one"
         });
       }
       if (providerTurn.effectiveCodexCredentialId === null && leased.accounts.length > 0 && (rotationDecision.kind === "allocatorDisabled" || leased.accounts.every((account) => !account.allocatorEnabled)) && turnId) {
@@ -10885,7 +11025,10 @@ import {
   hasActiveWorkspaceInstructionPolicy,
   renderWorkspaceGovernanceContext
 } from "@opengeni/runtime";
-import { settingsWithResolvedModelContext } from "@opengeni/config";
+import {
+  codeSearchDeploymentPolicy,
+  settingsWithResolvedModelContext
+} from "@opengeni/config";
 import { projectReasoningConfigurations, supportsReasoningConfiguration } from "@opengeni/codex";
 import { resolveRigProviderImageForRun } from "@opengeni/core";
 import { retryWhileMissing as retryWhileMissing3 } from "@opengeni/storage";
@@ -10894,6 +11037,7 @@ import {
   evaluateWorkspaceModelPolicy,
   resolveWorkspaceAgentHumanInputEnabled as resolveWorkspaceAgentHumanInputEnabled2
 } from "@opengeni/contracts";
+import { codeSearchEnabledForTurn } from "@opengeni/contracts/code-search";
 
 // src/activities/agent-turn/tool-policy.ts
 import {
@@ -11266,6 +11410,11 @@ async function prepareGovernanceAndModel(deps) {
   workspaceRefs.rigVersionId = session.rigVersionId ?? "";
   if (!workspace) throw new Error(`Workspace not found: ${input.workspaceId}`);
   const agentHumanInputEnabled = resolveWorkspaceAgentHumanInputEnabled2(workspace.settings);
+  const codeSearchEnabled = codeSearchEnabledForTurn(
+    session.codeSearchEnabled,
+    workspace.settings,
+    codeSearchDeploymentPolicy(capabilitySettings)
+  );
   const contextSelection = await resolveCompanyBrainContextSelection(db, governanceClaims);
   const workspaceAgentInstructions = contextSelection.legacyWorkspaceInstructions;
   const memoryPromptMode = contextSelection.receipt.memoryPromptMode;
@@ -11421,6 +11570,7 @@ async function prepareGovernanceAndModel(deps) {
       rigVersion,
       rigName,
       agentHumanInputEnabled,
+      codeSearchEnabled,
       workspaceAgentInstructions,
       workspaceGovernance,
       structuredWorkspacePolicyActive,
@@ -11456,7 +11606,8 @@ import {
   compactionThresholdTokens as compactionThresholdTokens2,
   CompactionNeededError,
   compactionProviderRejection as compactionProviderRejection2,
-  SUMMARY_BUFFER_TOKENS as SUMMARY_BUFFER_TOKENS2
+  estimateSerializedValueTokens,
+  compactionSummaryOutputTokens as compactionSummaryOutputTokens2
 } from "@opengeni/runtime";
 async function prepareCompaction(deps) {
   const {
@@ -11495,6 +11646,11 @@ async function prepareCompaction(deps) {
   const remotePrefix = {
     agent: null
   };
+  const portableResponsesNeedsAgentPrefix = resolvedModel?.provider.api === "responses" && !(billingState.isCodexTurn && session.codexCompactionMode === "remote_v2");
+  const preparedPortableRequest = () => {
+    if (!remotePrefix.agent) throw new Error("Compaction agent is unavailable");
+    return preparedCompactionRequest(remotePrefix.agent);
+  };
   const promptCacheKey = acceptsPromptCacheKeyForTurn(resolvedModel) ? input.sessionId : void 0;
   const compactionUsageState = createCompactionModelUsageEventState(claimedModelUsageSourceKeys);
   const recordCompactionUsage = async (usage) => {
@@ -11526,24 +11682,37 @@ async function prepareCompaction(deps) {
       contextContributions: eventing.companyBrainContextContributions
     });
   };
-  const compactionSummarizerFor = (systemInstructions) => resolvedModel ? (s, m) => withProviderRequestContext(
-    () => summarizeContextForCompaction(s, m, {
-      client: resolvedModel.client,
-      provider: resolvedModel.provider,
-      api: resolvedModel.provider.api,
+  const compactionSummarizerFor = (systemInstructions) => {
+    const summarize = resolvedModel ? (s, m) => withProviderRequestContext(
+      () => summarizeContextForCompaction(s, m, {
+        client: resolvedModel.client,
+        provider: resolvedModel.provider,
+        api: resolvedModel.provider.api,
+        model: turnExecutionPolicy.upstreamModelId,
+        maxOutputTokens: compactionSummaryOutputTokens2(s.contextWindowTokens),
+        ...cancellationSignal ? { signal: cancellationSignal } : {},
+        onUsage: recordCompactionUsage,
+        ...systemInstructions ? { systemInstructions } : {},
+        ...promptCacheKey ? { promptCacheKey } : {},
+        ...portableResponsesNeedsAgentPrefix ? { preparedRequest: preparedPortableRequest() } : {}
+      })
+    ) : (s, m) => summarizeContextForCompaction(s, m, {
       model: turnExecutionPolicy.upstreamModelId,
-      maxOutputTokens: SUMMARY_BUFFER_TOKENS2,
+      maxOutputTokens: compactionSummaryOutputTokens2(s.contextWindowTokens),
+      ...cancellationSignal ? { signal: cancellationSignal } : {},
       onUsage: recordCompactionUsage,
       ...systemInstructions ? { systemInstructions } : {},
       ...promptCacheKey ? { promptCacheKey } : {}
-    })
-  ) : (s, m) => summarizeContextForCompaction(s, m, {
-    model: turnExecutionPolicy.upstreamModelId,
-    maxOutputTokens: SUMMARY_BUFFER_TOKENS2,
-    onUsage: recordCompactionUsage,
-    ...systemInstructions ? { systemInstructions } : {},
-    ...promptCacheKey ? { promptCacheKey } : {}
-  });
+    });
+    summarize.estimatePrefixTokens = () => {
+      if (resolvedModel?.provider.api === "chat") {
+        return estimateSerializedValueTokens(systemInstructions ?? "");
+      }
+      const prepared = portableResponsesNeedsAgentPrefix ? preparedPortableRequest() : null;
+      return estimateSerializedValueTokens(prepared?.systemInstructions ?? systemInstructions ?? "") + (prepared ? estimateSerializedValueTokens(prepared.tools) : 0);
+    };
+    return summarize;
+  };
   const remoteCompactionRequester = resolvedModel && billingState.isCodexTurn ? (s, m) => withCodexRemoteCompaction(async () => {
     if (!remotePrefix.agent) throw new Error("Compaction agent is unavailable");
     const preparedRequest = preparedCompactionRequest(remotePrefix.agent);
@@ -11606,7 +11775,7 @@ async function prepareCompaction(deps) {
     control.activityStatus = "idle";
     return claimedResult({ status: "idle" });
   };
-  if (compactionOnlyTurn && !remoteV2CompactionNeedsAgentPrefix) {
+  if (compactionOnlyTurn && !remoteV2CompactionNeedsAgentPrefix && !portableResponsesNeedsAgentPrefix) {
     const compactionInstructions = appendWorkspaceMemory(
       appendSessionInstructions(
         appendWorkspaceGovernance(
@@ -11748,6 +11917,7 @@ async function runPostAgentCompaction(deps) {
     claimedResult,
     turn,
     session,
+    resolvedModel,
     remotePrefix,
     remoteCompactionRequester,
     publishCompactionLiveEvents,
@@ -11761,16 +11931,17 @@ async function runPostAgentCompaction(deps) {
     agent
   } = deps;
   const agentInstructions = typeof agent.instructions === "string" ? agent.instructions : "";
+  const preparedPortable = resolvedModel?.provider.api === "responses" && !(remoteCompactionRequester && session.codexCompactionMode === "remote_v2");
   const compactSummarizer = compactionSummarizerFor(
     agentInstructions.trim() ? agentInstructions : void 0
   );
-  if (remoteCompactionRequester) {
+  if (remoteCompactionRequester || preparedPortable) {
     remotePrefix.agent = agent;
   }
   if (compactionOnlyTurn) {
     const requested = await isSessionCompactionRequested2(db, input.workspaceId, input.sessionId);
     let outcome = null;
-    if (requested && remoteCompactionRequester && session.codexCompactionMode === "remote_v2") {
+    if (requested && (preparedPortable || remoteCompactionRequester && session.codexCompactionMode === "remote_v2")) {
       queuePreparedCompaction(
         agent,
         new CompactionNeededError({
@@ -11880,7 +12051,7 @@ async function runPostAgentCompaction(deps) {
     control.activityStatus = "idle";
     return { exit: claimedResult({ status: "idle" }) };
   }
-  if (remoteCompactionRequester && session.codexCompactionMode === "remote_v2") {
+  if (preparedPortable || remoteCompactionRequester && session.codexCompactionMode === "remote_v2") {
     const forced = await isSessionCompactionRequested2(db, input.workspaceId, input.sessionId);
     const thresholdTokens = compactionThresholdTokens2(eventing.modelRunSettings);
     if (forced || (attempt.triggerType === "user.message" || attempt.triggerType === "system.update.delivered") && (session.lastInputTokens ?? 0) >= thresholdTokens) {
@@ -12004,7 +12175,7 @@ async function runPostAgentCompaction(deps) {
 import {
   advanceWorkspaceGeneration,
   verifyWorkspaceMutationSettlement,
-  heartbeatLeaseHolder,
+  heartbeatLeaseHolderStatus,
   readLease as readLease2,
   accrueWarmSeconds,
   SandboxWorkspaceMutationFencedError
@@ -12312,21 +12483,29 @@ function createSandboxTurnRuntime(deps) {
     const heartbeatEpoch = sandbox.leaseEpoch;
     const heartbeatHolderId = sandboxState.sandboxHolderId;
     const heartbeatGroupId = sandboxState.sandboxGroupId;
-    const warmRate = sandboxWarmRateMicrosPerSecond(
+    const warmRate = settings.sandboxWarmBillingMode === "usage_only" ? 0 : sandboxWarmRateMicrosPerSecond(
       settings,
       warmBackend ?? sandbox.established.backendId
     );
     sandboxState.leaseHeartbeatTimer = setInterval(() => {
-      void heartbeatLeaseHolder(db, {
+      void heartbeatLeaseHolderStatus(db, {
         accountId: input.accountId,
         workspaceId: input.workspaceId,
         sandboxGroupId: heartbeatGroupId,
         kind: "turn",
         holderId: heartbeatHolderId,
         leaseTtlMs: settings.sandboxLeaseTtlMs,
-        expectedEpoch: heartbeatEpoch
-      }).then(async (alive) => {
-        if (alive) return;
+        expectedEpoch: heartbeatEpoch,
+        billingMode: settings.sandboxWarmBillingMode
+      }).then(async (status) => {
+        if (status.fence === "funding") {
+          stopLeaseHeartbeat();
+          sandboxRotationController.abort(
+            new Error("Insufficient OpenGeni credits to extend paid sandbox compute")
+          );
+          return;
+        }
+        if (status.leaseExtended) return;
         const rotation = await beginRotationPreemption(sandbox, heartbeatEpoch, heartbeatGroupId);
         if (rotation === "not_rotating") {
           stopLeaseHeartbeat();
@@ -12338,8 +12517,13 @@ function createSandboxTurnRuntime(deps) {
         sandboxGroupId: heartbeatGroupId,
         expectedEpoch: heartbeatEpoch,
         warmRateMicrosPerSecond: warmRate,
+        billingMode: settings.sandboxWarmBillingMode,
         subjectId: input.sessionId
-      }).then((result) => recordCreditMicros(observability, "usage", result.costMicros)).catch(() => void 0);
+      }).then((result) => {
+        if (settings.sandboxWarmBillingMode === "credits") {
+          recordCreditMicros(observability, "usage", result.costMicros);
+        }
+      }).catch(() => void 0);
       const snapshotSession = sandboxState.setupBoxSession;
       const snapshotTurnId = attempt.turnId;
       if (snapshotSession && snapshotTurnId && shouldStartPeriodicWorkspaceSnapshot({
@@ -12678,6 +12862,7 @@ async function resolveSandboxRoute(deps) {
   };
 }
 async function establishTurnSandbox(deps) {
+  const freshSandboxReadinessReplacementBudget = createFreshSandboxReadinessReplacementBudget();
   const {
     input,
     settings,
@@ -12913,6 +13098,8 @@ async function establishTurnSandbox(deps) {
               logicalFallbackSettings: logicalSandboxSettings,
               cancellationSignal: sandboxResumeSignal,
               sandboxMetrics: runtimeMetricsHooksForObservability(observability),
+              observability,
+              freshSandboxReadinessReplacementBudget,
               onSandboxLost: publishSandboxLost,
               objectStorage
             },
@@ -12984,6 +13171,8 @@ async function establishTurnSandbox(deps) {
                 logicalFallbackSettings: logicalSandboxSettings,
                 cancellationSignal: sandboxResumeSignal,
                 sandboxMetrics: runtimeMetricsHooksForObservability(observability),
+                observability,
+                freshSandboxReadinessReplacementBudget,
                 onSandboxLost: publishSandboxLost,
                 objectStorage
               },
@@ -14696,6 +14885,7 @@ import {
   organizationModelProviderConnectionActiveForWorkspace,
   persistAttemptToolCatalog,
   prepareConnectorActionApproval,
+  recordUsageEvent as recordUsageEvent4,
   previewConnectorActionApproval,
   namedSubjectHasLiveWorkspaceAuthority as namedSubjectHasLiveWorkspaceAuthority2,
   updateSessionTitleWithEvent as updateSessionTitleWithEvent2,
@@ -31415,6 +31605,205 @@ function createListModelsAttemptToolDefinition(input) {
   };
 }
 
+// src/activities/agent-turn/code-search.ts
+import { usableJevApiKey } from "@opengeni/config";
+import {
+  CODE_SEARCH_TOOL_DESCRIPTION,
+  CODE_SEARCH_TOOL_NAME,
+  CodeSearchArgumentError,
+  CodeSearchRipgrepMissingError,
+  CodeSearchWorkspaceError,
+  JevCircuitBreaker,
+  JevClient,
+  JevRequestError,
+  JevUnavailableError,
+  codeSearchInputSchema,
+  parseCodeSearchArguments,
+  renderCodeSearchError,
+  runCodeSearch
+} from "@opengeni/jev";
+import {
+  ChannelANotFoundError,
+  ChannelAUnavailableError,
+  ChannelAUnsupportedError,
+  ChannelAValidationError,
+  isWindowsConnectedMachinePath
+} from "@opengeni/runtime/sandbox";
+var codeSearchCircuitBreaker = new JevCircuitBreaker();
+var CODE_SEARCH_RIPGREP_MAX_BYTES = 32 * 1024 * 1024;
+function codeSearchWorkspaceFromChannel(channel) {
+  return {
+    ripgrep: async (args, options) => {
+      options.signal?.throwIfAborted();
+      const outcome = await channel.codeSearchRipgrep(args, {
+        timeoutMs: options.timeoutMs,
+        maxBytes: CODE_SEARCH_RIPGREP_MAX_BYTES
+      });
+      if (!outcome.available) throw new CodeSearchRipgrepMissingError();
+      return {
+        stdout: outcome.stdout,
+        exitCode: outcome.exitCode,
+        truncated: outcome.truncated,
+        timedOut: outcome.timedOut
+      };
+    },
+    readText: async (path, options) => {
+      options.signal?.throwIfAborted();
+      try {
+        const read = await channel.fsRead({ path, encoding: "utf8", maxBytes: options.maxBytes });
+        return { text: read.content, truncated: read.truncated, binary: read.isBinary };
+      } catch (error51) {
+        if (error51 instanceof ChannelANotFoundError) return null;
+        throw error51;
+      }
+    },
+    pathKinds: async (paths, options) => {
+      options.signal?.throwIfAborted();
+      return await channel.codeSearchPathKinds(paths);
+    }
+  };
+}
+function textResult(text, isError) {
+  return { isError, content: [{ type: "text", text }] };
+}
+function createCodeSearchAttemptToolDefinition(input) {
+  const breaker = input.breaker ?? codeSearchCircuitBreaker;
+  const jev = new JevClient({
+    apiKey: input.apiKey,
+    baseUrl: input.settings.jevBaseUrl,
+    model: input.settings.jevModel,
+    timeoutMs: input.settings.jevRequestTimeoutMs,
+    ...input.fetch ? { fetch: input.fetch } : {}
+  });
+  return {
+    identity: { serverId: "opengeni", toolName: CODE_SEARCH_TOOL_NAME },
+    modelName: CODE_SEARCH_TOOL_NAME,
+    codemodePath: ["opengeni", CODE_SEARCH_TOOL_NAME],
+    title: "Search code",
+    description: CODE_SEARCH_TOOL_DESCRIPTION,
+    inputSchema: codeSearchInputSchema,
+    annotations: {
+      title: "Search code",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
+    source: "opengeni",
+    approval: "none",
+    execute: async (args, context) => {
+      const startedAt = performance.now();
+      let outcome = "failed";
+      let jevRequests = 0;
+      let jevCostUsd = 0;
+      let lease = null;
+      try {
+        const request = parseCodeSearchArguments(args);
+        lease = breaker.tryAcquire(Date.now());
+        if (!lease) {
+          outcome = "breaker_open";
+          return textResult(
+            renderCodeSearchError(
+              new JevUnavailableError("Jev is not responding; calls are paused for a few minutes")
+            ),
+            true
+          );
+        }
+        const workspace = await input.workspace();
+        const result = await runCodeSearch({
+          ...request,
+          workspace,
+          jev,
+          ...context.signal ? { signal: context.signal } : {}
+        });
+        const held = lease;
+        lease = null;
+        if (result.statusCheckError instanceof JevUnavailableError) {
+          breaker.recordFailure(result.statusCheckError, Date.now(), held);
+        } else if (result.stats.jev.requests > 0) {
+          breaker.recordSuccess(held);
+        } else {
+          breaker.release(held);
+        }
+        outcome = "completed";
+        jevRequests = result.stats.jev.requests;
+        jevCostUsd = result.stats.jev.costUsd;
+        if (input.recordUsage && jevRequests > 0) {
+          await input.recordUsage({
+            operationId: context.operationId,
+            jevRequests,
+            jevInputTokens: result.stats.jev.inputTokens,
+            jevCostUsd
+          }).catch((error51) => {
+            input.observability.warn("code_search usage record failed", {
+              error: error51 instanceof Error ? error51.message : String(error51)
+            });
+          });
+        }
+        return textResult(result.text, false);
+      } catch (error51) {
+        if (context.signal?.aborted) {
+          outcome = "cancelled";
+          throw error51;
+        }
+        if (error51 instanceof CodeSearchArgumentError) {
+          outcome = "invalid_arguments";
+          return textResult(error51.message, true);
+        }
+        if (error51 instanceof JevUnavailableError) {
+          const held = lease;
+          lease = null;
+          breaker.recordFailure(error51, Date.now(), held);
+          outcome = "jev_unavailable";
+          return textResult(renderCodeSearchError(error51), true);
+        }
+        if (error51 instanceof JevRequestError) {
+          outcome = "jev_rejected";
+          return textResult(renderCodeSearchError(error51), true);
+        }
+        if (error51 instanceof CodeSearchWorkspaceError) {
+          outcome = "workspace_unavailable";
+          return textResult(renderCodeSearchError(error51), true);
+        }
+        if (error51 instanceof ChannelAUnavailableError || error51 instanceof ChannelAUnsupportedError || error51 instanceof ChannelAValidationError) {
+          outcome = "workspace_unavailable";
+          return textResult(
+            renderCodeSearchError(new CodeSearchWorkspaceError(error51.message)),
+            true
+          );
+        }
+        throw error51;
+      } finally {
+        if (lease) breaker.release(lease);
+        recordCodeSearchCall(input.observability, {
+          outcome,
+          durationSeconds: (performance.now() - startedAt) / 1e3,
+          jevRequests,
+          jevCostUsd
+        });
+      }
+    }
+  };
+}
+function codeSearchToolDefinitions(input) {
+  const apiKey = usableJevApiKey(input.settings);
+  const breaker = input.breaker ?? codeSearchCircuitBreaker;
+  if (!input.enabled || !apiKey || input.backend === "none") return [];
+  if (input.machineWorkspaceRoot && isWindowsConnectedMachinePath(input.machineWorkspaceRoot)) {
+    return [];
+  }
+  return [
+    createCodeSearchAttemptToolDefinition({
+      settings: input.settings,
+      apiKey,
+      workspace: input.workspace,
+      observability: input.observability,
+      ...input.recordUsage ? { recordUsage: input.recordUsage } : {},
+      breaker
+    })
+  ];
+}
+
 // src/activities/agent-turn/skill-tools.ts
 import { createHash as createHash12 } from "crypto";
 import {
@@ -32354,6 +32743,7 @@ async function prepareTurnToolRuntime(deps) {
     turnExecutionPolicy,
     trigger,
     runSettings: canonicalRunSettings,
+    resolvedModel,
     lazyToolTransport,
     turnTools: canonicalTurnTools,
     sandboxArtifactRuntime,
@@ -32364,6 +32754,7 @@ async function prepareTurnToolRuntime(deps) {
     credentialSubjectId,
     interactionInterventionResume,
     runWorkspaceMutationForSandbox,
+    codeSearchEnabled,
     throwIfWorkerShuttingDown,
     throwIfTurnCancelled
   } = deps;
@@ -32534,7 +32925,8 @@ async function prepareTurnToolRuntime(deps) {
       firstPartyMcpTools: selectedFirstPartyMcpTools,
       firstPartyMcpPermissions: effectiveFirstPartyPermissions
     }),
-    parallelGenerationAvailable: typeof runtime.generateSessionTitle === "function"
+    parallelGenerationAvailable: typeof runtime.generateSessionTitle === "function",
+    routeAllowsTitleRequests: routeAllowsSessionTitleRequests(resolvedModel)
   });
   const googleDrivePublicationAllowed = selectedFirstPartyMcpTools.includes("editable_artifact_export") && selectedFirstPartyMcpTools.includes("editable_artifact_export_status") && hasPermission2(
     [...effectiveFirstPartyPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS2],
@@ -32694,6 +33086,60 @@ async function prepareTurnToolRuntime(deps) {
       return (await prepared.ready ?? prepared).attemptToolEnvironment;
     }
   });
+  const codeSearchTools = codeSearchToolDefinitions({
+    enabled: codeSearchEnabled,
+    settings: runSettings,
+    backend: activeSandboxBackend ?? groupBoxBackend,
+    machineWorkspaceRoot: sandboxState.machinePrimarySession?.workspaceRoot ?? null,
+    observability,
+    // OpenGeni's Jev key pays for these calls whatever model billing the
+    // workspace uses; record them per workspace so the cost stays visible.
+    recordUsage: async (usage) => {
+      const shared = {
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        sourceResourceType: "code_search",
+        sourceResourceId: usage.operationId,
+        sessionId: input.sessionId,
+        turnId: turn.id,
+        turnAttemptId: input.attemptId
+      };
+      await recordUsageEvent4(db, {
+        ...shared,
+        eventType: "code_search.jev_input_tokens",
+        quantity: usage.jevInputTokens,
+        unit: "tokens",
+        idempotencyKey: `usage:code_search.jev_input_tokens:${input.attemptId}:${usage.operationId}`
+      });
+      await recordUsageEvent4(db, {
+        ...shared,
+        eventType: "code_search.jev_cost",
+        quantity: Math.round(usage.jevCostUsd * 1e6),
+        unit: "usd_micros",
+        idempotencyKey: `usage:code_search.jev_cost:${input.attemptId}:${usage.operationId}`
+      });
+    },
+    workspace: async () => {
+      throwIfWorkerShuttingDown();
+      throwIfTurnCancelled();
+      const access = await resolveTurnSandboxAccess(
+        sandboxState,
+        media.sdkOwnedSandboxSession,
+        "code_search requires a sandbox or Connected Machine."
+      );
+      const machineRoot = sandboxState.machinePrimarySession?.workspaceRoot;
+      const runAs = sandboxRunAs4(runSettings);
+      return codeSearchWorkspaceFromChannel(
+        new SandboxChannelAService3({
+          session: access.session,
+          workspaceRoot: machineRoot ?? "/workspace",
+          ...machineRoot ? { providerPathMode: "workspace-relative" } : {},
+          leaseEpoch: access.leaseEpoch,
+          ...runAs ? { runAs } : {}
+        })
+      );
+    }
+  });
   const attemptToolDefinitions = [
     ...operationReadStore ? [
       createOperationReadAttemptToolDefinition({
@@ -32823,7 +33269,8 @@ async function prepareTurnToolRuntime(deps) {
       subjectLabel: "OpenGeni worker",
       ...interactionInterventionResume ? { interventionResume: interactionInterventionResume } : {}
     }),
-    ...googleDrivePublicationTool && googleDrivePublicationAllowed ? [googleDrivePublicationTool] : []
+    ...googleDrivePublicationTool && googleDrivePublicationAllowed ? [googleDrivePublicationTool] : [],
+    ...codeSearchTools
   ];
   recordTurnStartupPhase(observability, {
     phase: "tool_context_preparation",
@@ -33012,6 +33459,7 @@ async function prepareTurnToolRuntime(deps) {
       ...titleToolPlan.preparationIndependentToolNames,
       "skill_read"
     ],
+    codeSearchAvailable: codeSearchTools.length > 0,
     skillCatalog
   };
 }
@@ -34430,6 +34878,7 @@ async function buildTurnAgent(deps) {
     connectorActionPolicy,
     trigger,
     preparationIndependentToolNames,
+    codeSearchAvailable,
     videoGenerationAcceptancesByCallId,
     activeSandboxBackend,
     groupBoxBackend,
@@ -34836,6 +35285,7 @@ async function buildTurnAgent(deps) {
         ...activeSandboxBackend !== "selfhosted" && sandboxGitCredentialBindings ? { gitCredentialBindings: sandboxGitCredentialBindings } : {},
         ...activeSandboxBackend !== "selfhosted" && !sandboxGitTokens && sandboxGitToken ? { gitTokenSeed: sandboxGitToken } : {},
         ...sandboxCodemodeToken ? { codemodeAvailable: true } : {},
+        ...codeSearchAvailable ? { codeSearchAvailable: true } : {},
         // Managed boxes receive the bearer through their protected per-session
         // token file. Connected Machines use transient per-exec delivery above,
         // so they must not run the file-seeding lifecycle hook.
@@ -35320,6 +35770,7 @@ function createRunAgentTurnActivity(services) {
             rigVersion,
             rigName,
             agentHumanInputEnabled,
+            codeSearchEnabled,
             workspaceAgentInstructions,
             workspaceGovernance,
             structuredWorkspacePolicyActive,
@@ -35953,6 +36404,7 @@ These are publication receipts for the human's earlier answer. Do not call the r
             turnExecutionPolicy,
             trigger,
             runSettings,
+            resolvedModel,
             lazyToolTransport,
             turnTools,
             connectionScope,
@@ -35964,6 +36416,7 @@ These are publication receipts for the human's earlier answer. Do not call the r
             credentialSubjectId,
             interactionInterventionResume,
             runWorkspaceMutationForSandbox,
+            codeSearchEnabled,
             throwIfWorkerShuttingDown,
             throwIfTurnCancelled
           });
@@ -36026,6 +36479,7 @@ These are publication receipts for the human's earlier answer. Do not call the r
             connectorActionPolicy,
             trigger,
             preparationIndependentToolNames,
+            codeSearchAvailable: toolRuntime.codeSearchAvailable,
             videoGenerationAcceptancesByCallId,
             activeSandboxBackend,
             groupBoxBackend,
@@ -37533,4 +37987,4 @@ export {
   createTurnActivities,
   createTurnActivitiesFromServices
 };
-//# sourceMappingURL=activities-turn-YVVKCGAK.js.map
+//# sourceMappingURL=activities-turn-CSDKK4N3.js.map