@agenthippo-ai/agenthippo 1.110.9 → 1.110.11

package/out/evidence/sessionShip.js

@@ -95,6 +95,10 @@ function setStatus(patch) {
 function isTruthy(value) {
     return ['1', 'true', 'yes', 'on'].includes((value ?? '').trim().toLowerCase());
 }
+/** evidence-ship reads EVIDENCE_ALLOW_INSECURE_URL; serve documents AGENTHIPPO_EVIDENCE_ALLOW_INSECURE_URL. */
+function resolveAllowInsecure(env) {
+    return isTruthy(env[ALLOW_INSECURE_ENV]) || isTruthy(env.EVIDENCE_ALLOW_INSECURE_URL);
+}
 const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]', '0.0.0.0']);
 /**
  * Validate the ingest URL.
@@ -120,16 +124,19 @@ function validateEvidenceUrl(raw, env = process.env) {
     if (LOOPBACK_HOSTS.has(parsed.hostname)) {
         return { url: parsed.toString().replace(/\/$/, '') };
     }
-    if (isTruthy(env[ALLOW_INSECURE_ENV])) {
+    if (resolveAllowInsecure(env)) {
+        const reason = isTruthy(env[ALLOW_INSECURE_ENV])
+            ? ALLOW_INSECURE_ENV
+            : 'EVIDENCE_ALLOW_INSECURE_URL';
         console.warn(`[evidence-ship] INSECURE: shipping evidence and the ingest token over plaintext http ` +
-            `to ${parsed.host} because ${ALLOW_INSECURE_ENV} is set. Use https unless this network ` +
+            `to ${parsed.host} because ${reason} is set. Use https unless this network ` +
             `is genuinely private.`);
         return { url: parsed.toString().replace(/\/$/, '') };
     }
     return {
         error: `${URL_ENV} must use https — plaintext http to ${parsed.host} would put the ingest ` +
             `token and the audit trail on the wire. Use https, a loopback address, or set ` +
-            `${ALLOW_INSECURE_ENV}=1 if the network is genuinely private.`,
+            `${ALLOW_INSECURE_ENV}=1 (or EVIDENCE_ALLOW_INSECURE_URL=1) if the network is genuinely private.`,
     };
 }
 /** Resolve config from env; returns undefined when shipping is disabled or misconfigured. */
@@ -180,6 +187,7 @@ function resolveSessionShipConfig(instanceId, sessionsDir, stateDir, env = proce
         intervalSec,
         sinceDays,
         drainTimeoutSec,
+        allowInsecure: resolveAllowInsecure(env),
     };
 }
 // -----------------------------------------------------------------------------
@@ -262,6 +270,7 @@ function startSessionShipper(config) {
     const intervalSec = config.intervalSec ?? 60;
     const drainTimeoutMs = (config.drainTimeoutSec ?? DEFAULT_DRAIN_TIMEOUT_SEC) * 1000;
     const captureContent = (0, identity_1.isContentCaptureEnabled)();
+    const allowInsecure = config.allowInsecure === true;
     let stopped = false;
     let inFlight = false;
     let lastOkAt;
@@ -299,6 +308,10 @@ function startSessionShipper(config) {
                 // is safe — but it would also strip content on a deployment that deliberately
                 // opted in, turning the opt-in into a no-op. Pass our own decision through.
                 captureContent,
+                // Compose stacks use http://evidence:8787 on a private network. serve accepts that
+                // via AGENTHIPPO_EVIDENCE_ALLOW_INSECURE_URL; evidence-ship needs allowInsecure here
+                // (or EVIDENCE_ALLOW_INSECURE_URL in the process env).
+                allowInsecure,
                 // Heartbeat is posted here instead: the upstream one is the literal '{}', which
                 // proves the process was alive and nothing about whether records are complete.
                 heartbeat: false,
@@ -449,7 +462,14 @@ function startSessionShipper(config) {
         }
         if (losses.length > 0) {
             // Appended, never truncated: a loss record must outlive the tick that noticed it.
-            const lossFile = path.join(stagingDir, '_evidence-loss.jsonl');
+            //
+            // The NAME matters and cannot be `_evidence-loss.jsonl`: @agenthippo-ai/evidence-ship's
+            // shipSessions() skips every file whose name starts with `_evidence-loss` (it posts its
+            // OWN losses under that name from its cursor, and refuses to re-ingest one found on
+            // disk). Staging ours under that name made it a dead letter — the warning printed, the
+            // counters incremented, and the record never left the machine, which is precisely the
+            // silent gap this feature exists to close.
+            const lossFile = path.join(stagingDir, 'evidence-loss.jsonl');
             await fs_1.promises.appendFile(lossFile, `${losses.join('\n')}\n`);
             const seconds = Date.now() / 1000;
             await fs_1.promises.utimes(lossFile, seconds, seconds);
@@ -532,28 +552,41 @@ function startSessionShipper(config) {
         try {
             const staged = await stage();
             unshippedRecords += staged;
-            const shipper = await getShipper();
-            const ok = await shipper.drain({ sessions: stagingDir, heartbeat: false });
-            if (ok) {
-                const state = await loadCursor();
-                state.pending.shipped += unshippedRecords;
-                totals.shipped += unshippedRecords;
-                unshippedRecords = 0;
-                lastOkAt = Date.now();
-                consecutiveFailures = 0;
+            try {
+                const shipper = await getShipper();
+                const ok = await shipper.drain({ sessions: stagingDir, heartbeat: false });
+                if (ok) {
+                    const state = await loadCursor();
+                    state.pending.shipped += unshippedRecords;
+                    totals.shipped += unshippedRecords;
+                    unshippedRecords = 0;
+                    lastOkAt = Date.now();
+                    consecutiveFailures = 0;
+                }
+                else {
+                    consecutiveFailures++;
+                    warn(`[evidence-ship] drain failed (${consecutiveFailures} in a row); ` +
+                        `${unshippedRecords} record(s) still unshipped`);
+                }
             }
-            else {
+            catch (shipErr) {
                 consecutiveFailures++;
-                warn(`[evidence-ship] drain failed (${consecutiveFailures} in a row); ` +
-                    `${unshippedRecords} record(s) still unshipped`);
+                warn(`[evidence-ship] ${shipErr instanceof Error ? shipErr.message : String(shipErr)}`);
             }
-            await postHeartbeat();
         }
         catch (err) {
             consecutiveFailures++;
             warn(`[evidence-ship] ${err instanceof Error ? err.message : String(err)}`);
         }
         finally {
+            // R-13: heartbeat runs every tick even when drain/shipper fails, so gap detection
+            // sees window bounds and staged-vs-shipped counts instead of silence.
+            try {
+                await postHeartbeat();
+            }
+            catch (hbErr) {
+                warn(`[evidence-ship] heartbeat failed: ${hbErr instanceof Error ? hbErr.message : String(hbErr)}`);
+            }
             inFlight = false;
             setStatus({
                 lastOkAt,

package/out/headless/index.js

@@ -373,7 +373,11 @@ function createHeadlessRunner(config) {
                 // the key for the engine's destination — passing the collapsed key here would let
                 // it win over the correct provider key (the original bug). Back-compat single-key
                 // callers keep options.apiKey.
-                apiKey: hasSplitKeys ? undefined : config.apiKey,
+                //
+                // A per-run `modelToken` outranks both. That is safe precisely where it is used:
+                // inside a sandbox there are no provider keys to lose a precedence fight with
+                // (the credential invariant), and the warrant IS the only route to a model.
+                apiKey: options.modelToken ?? (hasSplitKeys ? undefined : config.apiKey),
                 baseUrl: config.baseUrl,
                 useLiteLLM: config.useLiteLLM,
                 agentPackId: packId,
@@ -384,6 +388,9 @@ function createHeadlessRunner(config) {
                 tier: provenance?.tier,
                 instanceId: provenance?.instanceId,
                 permissions: options.permissions,
+                // Only ever set by a sandbox child. In serve's own process the engine reads the
+                // credential frame directly and this is undefined.
+                engineHomeUserKey: options.engineHomeUserKey,
                 requestId, // Same requestId used by ObservableStreamEmitter for Layer 1/2 correlation
             };
             // Emit turn_start event

package/out/pack/governor.js

@@ -98,7 +98,7 @@ function createGovernor(opts) {
     const killAll = async (reason) => {
         const live = opts.sandboxes.sandboxes();
         for (const c of live) {
-            await opts.sandboxes.destroySession(c.sessionKey).catch(() => undefined);
+            await opts.sandboxes.destroySession(c.sandboxKey).catch(() => undefined);
             // The meter deliberately SURVIVES the kill, for exactly the reason `enforce` gives when
             // it destroys a sandbox on a cap breach: a cap that renews when the sandbox goes away is
             // not a cap. `meter.forget` here meant a kill-then-restore (a billing hold lifted, a
@@ -159,22 +159,39 @@ function createGovernor(opts) {
             // `kill` rules end work already running. `drain` deliberately does not — it lets the
             // in-flight turn finish and only refuses the next one.
             for (const sandbox of opts.sandboxes.sandboxes()) {
-                const v = (0, lease_1.denyVerdict)(lease, {
-                    sessionKey: sandbox.sessionKey,
-                    pack: opts.pack ?? '',
-                    userHash: opts.userHash,
-                    // Remembered from this session's turns, so a `user`-scoped kill reaches a
-                    // gateway session whose key carries no `u<hash>--` prefix to read it off.
-                    userId: sessionUsers.get(sandbox.sessionKey),
-                    followedUsers,
-                });
-                if (v.denied && effectiveDenyMode(v.mode, canTerminateInFlight) === 'kill') {
-                    await opts.sandboxes.destroySession(sandbox.sessionKey).catch(() => undefined);
-                    sessionUsers.delete(sandbox.sessionKey);
+                // Per SESSION, not per sandbox: under user scope one sandbox carries several, and a
+                // rule naming any one of them ends the sandbox they share.
+                const matched = sandbox.sessionKeys
+                    .map((sessionKey) => ({
+                    sessionKey,
+                    v: (0, lease_1.denyVerdict)(lease, {
+                        sessionKey,
+                        pack: opts.pack ?? '',
+                        userHash: opts.userHash,
+                        // Remembered from this session's turns, so a `user`-scoped kill reaches a
+                        // gateway session whose key carries no `u<hash>--` prefix to read it off.
+                        userId: sessionUsers.get(sessionKey),
+                        followedUsers,
+                    }),
+                }))
+                    .find(({ v }) => v.denied && effectiveDenyMode(v.mode, canTerminateInFlight) === 'kill');
+                if (matched) {
+                    await opts.sandboxes.destroySession(sandbox.sandboxKey).catch(() => undefined);
+                    for (const sessionKey of sandbox.sessionKeys) {
+                        sessionUsers.delete(sessionKey);
+                    }
                     // The meter survives, same rule as `killAll` and `enforce`: a stop order must not
                     // hand the session a fresh budget when it is lifted.
-                    opts.logger?.warn(`[Governor] deny(kill) destroyed ${sandbox.sandboxId} — ${v.reason}`);
-                    audit('session_killed', { sessionKey: sandbox.sessionKey, sandboxId: sandbox.sandboxId, reason: v.reason });
+                    opts.logger?.warn(`[Governor] deny(kill) destroyed ${sandbox.sandboxId} — ${matched.v.reason}`);
+                    // The sessions that were NOT named are recorded too: under user scope a rule
+                    // aimed at one conversation stops the others sharing its sandbox, and an
+                    // operator reading the audit must be able to see that.
+                    audit('session_killed', {
+                        sessionKey: matched.sessionKey,
+                        sandboxId: sandbox.sandboxId,
+                        reason: matched.v.reason,
+                        collateralSessions: sandbox.sessionKeys.filter((s) => s !== matched.sessionKey),
+                    });
                 }
             }
             const verdict = (0, lease_1.leaseIsDead)(lease);

package/out/pack/lease-schema.js

@@ -233,7 +233,10 @@ function parseLease(raw) {
         }
         lease[key] = v;
     }
-    for (const key of ['requireSignedPack', 'requireSignedLease']) {
+    // Strict booleans, never coerced — `"false"` is truthy in JavaScript, and for every flag here
+    // that would flip the safe answer to the unsafe one. `allowServiceTurns` joins the same loop
+    // so it inherits that property for free (PLAN/agent-identity.md §5.6).
+    for (const key of ['requireSignedPack', 'requireSignedLease', 'allowServiceTurns']) {
         const v = raw[key];
         if (v === undefined || v === null) {
             continue;

package/out/pack/lease.js

@@ -8,6 +8,8 @@ exports.resolveLeasePollSeconds = resolveLeasePollSeconds;
 exports.leaseCacheSecondsFor = leaseCacheSecondsFor;
 exports.effectiveKillLatencySeconds = effectiveKillLatencySeconds;
 exports.leaseMaxStalenessFromEnv = leaseMaxStalenessFromEnv;
+exports.resolveAllowServiceTurns = resolveAllowServiceTurns;
+exports.describeServiceTurnGate = describeServiceTurnGate;
 exports.denyVerdict = denyVerdict;
 exports.resolveFollowedUsers = resolveFollowedUsers;
 exports.leaseIsDead = leaseIsDead;
@@ -104,6 +106,46 @@ function leaseMaxStalenessFromEnv(env = process.env) {
     }
     return Math.floor(n);
 }
+/**
+ * May this deployment run turns with no human behind them (PLAN/agent-identity.md §5.6)?
+ *
+ * **Polarity note, because it is the opposite of every other flag here.** `requireSignedPack` and
+ * friends are TIGHTEN-ONLY: absent means "nobody asked for the restriction", so absent is
+ * permissive and that is safe. This flag GRANTS a standing unattended identity, so the same
+ * treatment would be exactly backwards — a control plane that has not been taught the field would
+ * silently authorise unsupervised runs across the fleet. Absent therefore means DENY wherever a
+ * control plane exists to have said otherwise.
+ *
+ * Unmanaged deployments (no lease URL configured at all) keep the existing local-first philosophy:
+ * there is no control plane to ask, so the operator's env is the whole answer. serve says so at
+ * boot rather than leaving it implicit.
+ */
+function resolveAllowServiceTurns(opts) {
+    if (!opts.managed) {
+        return { allowed: true, gate: 'unmanaged_no_lease' };
+    }
+    if (opts.lease === true) {
+        return { allowed: true, gate: 'lease_allows' };
+    }
+    // `undefined` and `false` are deliberately NOT distinguished in the outcome, only in the
+    // reason: both deny, so a control plane too old to emit the field is exactly as safe as one
+    // that emitted `false`.
+    return { allowed: false, gate: opts.lease === false ? 'lease_denies' : 'lease_absent_field' };
+}
+/** Operator-facing explanation for a `service_turn_denied` audit row and the boot banner. */
+function describeServiceTurnGate(gate) {
+    switch (gate) {
+        case 'lease_allows':
+            return 'permitted by the control plane (lease.allowServiceTurns)';
+        case 'unmanaged_no_lease':
+            return 'permitted: no control plane configured, so AGENTHIPPO_SERVICE_USER is the only gate';
+        case 'lease_denies':
+            return 'refused: the control plane set lease.allowServiceTurns=false';
+        case 'lease_absent_field':
+            return 'refused: this is a managed deployment and the lease does not set allowServiceTurns '
+                + '(absent means deny — enable it in the console)';
+    }
+}
 /**
  * Does any live rule name this session?
  *

package/out/runner/host.js

@@ -78,7 +78,7 @@ function startRunnerHost(opts) {
         }
         const controller = new AbortController();
         inflight.set(id, controller);
-        const emitter = makeEmitter(send);
+        const emitter = makeEmitter(send, id);
         try {
             // `options` crossed the boundary already scrubbed of apiKey (see toWireOptions); the
             // engine reaches models via baseUrl + modelToken, both sandbox-scoped.
@@ -96,29 +96,39 @@ function startRunnerHost(opts) {
             inflight.delete(id);
         }
     }
-    // The runner is live once the engine is constructed and the loop is wired.
-    send({ type: 'ready' });
+    // The runner is live once the engine is constructed and the loop is wired. `demux: true` tells
+    // serve this host tags streamed events with their run id, so it may run several turns here at
+    // once; a serve talking to an older image never sees it and serializes instead.
+    send({ type: 'ready', demux: true });
     return { done, close: () => finish() };
 }
-/** Bridges `StreamEmitter` calls onto the wire, 1:1 with the existing worker event union. */
-function makeEmitter(send) {
+/**
+ * Bridges `StreamEmitter` calls onto the wire, 1:1 with the existing worker event union.
+ *
+ * Every event is tagged with the run it came from. One sandbox may host several of a user's
+ * sessions, and an untagged event can only be broadcast to every in-flight turn — which wrote one
+ * session's tokens and tool calls into another's transcript.
+ */
+function makeEmitter(send, id) {
+    const emit = (event) => send({ id, event });
     return {
-        async thinking(delta) { send({ type: 'thinking', delta }); },
-        async text(delta) { send({ type: 'text', delta }); },
+        async thinking(delta) { emit({ type: 'thinking', delta }); },
+        async text(delta) { emit({ type: 'text', delta }); },
         async toolStart(toolName, input, toolCallId) {
-            send({ type: 'toolStart', toolName, ...(input !== undefined ? { input } : {}), ...(toolCallId ? { toolCallId } : {}) });
+            emit({ type: 'toolStart', toolName, ...(input !== undefined ? { input } : {}), ...(toolCallId ? { toolCallId } : {}) });
         },
         async toolEnd(toolName, toolCallId, result, isError) {
-            send({ type: 'toolEnd', toolName, toolCallId, ...(result !== undefined ? { result } : {}), ...(isError !== undefined ? { isError } : {}) });
+            emit({ type: 'toolEnd', toolName, toolCallId, ...(result !== undefined ? { result } : {}), ...(isError !== undefined ? { isError } : {}) });
         },
-        async progress(message) { send({ type: 'progress', message }); },
+        async progress(message) { emit({ type: 'progress', message }); },
         async question(payload) {
-            // One-way: forwarded for visibility, answered here. No answer frame exists.
-            send({ type: 'question', payload });
+            // One-way: forwarded for visibility, answered here. No answer frame exists, but it
+            // still reaches a client stream, so it carries the run id like any other event.
+            send({ type: 'question', payload, id });
             return DECLINED;
         },
-        async error(message) { send({ type: 'error', message }); },
-        async done() { send({ type: 'done' }); },
+        async error(message) { emit({ type: 'error', message }); },
+        async done() { emit({ type: 'done' }); },
     };
 }
 function errText(err) {

package/out/runner/protocol.js

@@ -4,6 +4,7 @@
  *--------------------------------------------------------------------------------------------*/
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isTerminalFrame = isTerminalFrame;
+exports.isTaggedEvent = isTaggedEvent;
 exports.encodeRunnerFrame = encodeRunnerFrame;
 exports.encodeClientFrame = encodeClientFrame;
 exports.parseRunnerFrame = parseRunnerFrame;
@@ -11,7 +12,11 @@ exports.parseClientFrame = parseClientFrame;
 exports.splitFrames = splitFrames;
 exports.toWireOptions = toWireOptions;
 function isTerminalFrame(frame) {
-    return frame.type === 'result' || frame.type === 'failed';
+    return 'type' in frame && (frame.type === 'result' || frame.type === 'failed');
+}
+/** A streamed event that names its turn — the only shape safe to route to a single emitter. */
+function isTaggedEvent(frame) {
+    return 'event' in frame;
 }
 function encodeRunnerFrame(frame) {
     return `${JSON.stringify(frame)}\n`;
@@ -27,7 +32,18 @@ function parseRunnerFrame(line) {
     }
     const type = parsed.type;
     if (type === 'ready') {
-        return { type: 'ready' };
+        return { type: 'ready', ...(parsed.demux === true ? { demux: true } : {}) };
+    }
+    // Tagged streamed event. Checked before the untagged branch below because this envelope
+    // carries no top-level `type` — the inner event holds it. Validating that inner type here
+    // keeps a malformed envelope from becoming an event the emitter switch silently ignores,
+    // which would look like a turn that streamed nothing.
+    if (typeof parsed.id === 'string' && parsed.event && typeof parsed.event === 'object') {
+        const inner = parsed.event.type;
+        if (typeof inner === 'string' && RUNNER_EVENT_TYPES.has(inner)) {
+            return { id: parsed.id, event: parsed.event };
+        }
+        return undefined;
     }
     if (type === 'result' && typeof parsed.id === 'string') {
         return {
@@ -44,9 +60,13 @@ function parseRunnerFrame(line) {
         };
     }
     if (type === 'question' && parsed.payload && typeof parsed.payload === 'object') {
-        return { type: 'question', payload: parsed.payload };
+        return {
+            type: 'question',
+            payload: parsed.payload,
+            ...(typeof parsed.id === 'string' ? { id: parsed.id } : {}),
+        };
     }
-    // Streamed engine events keep the existing union — validated by shape, not re-listed here.
+    // Untagged streamed event (legacy peer) — validated by shape, not re-listed here.
     if (typeof type === 'string' && RUNNER_EVENT_TYPES.has(type)) {
         return parsed;
     }

package/out/runner/remoteEngine.js

@@ -23,6 +23,12 @@ class RemoteEngine {
     buffer = '';
     seq = 0;
     wired = false;
+    /**
+     * Set from the peer's `ready` frame. Starts FALSE and stays false until the peer proves it
+     * tags streamed events: a run frame can be sent before `ready` arrives, so "not yet known"
+     * must mean "assume it cannot", or the first pair of concurrent turns races the handshake.
+     */
+    peerDemux = false;
     constructor(opts) {
         this.id = opts.id;
         this.displayName = opts.displayName;
@@ -34,7 +40,7 @@ class RemoteEngine {
         this.wire();
         const id = `r${++this.seq}`;
         const settled = new Promise((resolve, reject) => {
-            this.pending.set(id, { emitter, resolve, reject });
+            this.pending.set(id, { emitter, resolve, reject, chain: Promise.resolve() });
         });
         const onAbort = () => { this.send({ type: 'abort', id }); };
         if (signal) {
@@ -85,38 +91,68 @@ class RemoteEngine {
                     this.logger?.warn('[RemoteEngine] dropped malformed runner frame');
                     continue;
                 }
-                void this.dispatch(frame);
+                this.dispatch(frame);
             }
         });
         void this.channel.closed?.then(() => this.failAll(new Error('sandbox channel closed')), (err) => this.failAll(err instanceof Error ? err : new Error(String(err))));
     }
-    async dispatch(frame) {
+    dispatch(frame) {
+        if ((0, protocol_1.isTaggedEvent)(frame)) {
+            // Routed to exactly one turn. No entry means the turn already settled or was aborted
+            // and a late event arrived behind its terminal frame — dropping it is correct.
+            this.enqueue(this.pending.get(frame.id), (e) => (0, customEngineIpc_1.applyParsedRunnerEvent)(e.emitter, frame.event));
+            return;
+        }
         if (frame.type === 'ready') {
+            this.peerDemux = frame.demux === true;
             return;
         }
         if (frame.type === 'result') {
-            this.pending.get(frame.id)?.resolve(frame.nativeSessionId);
+            // Behind this turn's own events, so a turn never settles while its last delta is still
+            // inside an unfinished emitter call.
+            this.settle(frame.id, (entry) => entry.resolve(frame.nativeSessionId));
             return;
         }
         if (frame.type === 'failed') {
-            this.pending.get(frame.id)?.reject(new Error(frame.message));
+            this.settle(frame.id, (entry) => entry.reject(new Error(frame.message)));
             return;
         }
-        // Streamed events fan out to every in-flight emitter. In the sandbox model a runner hosts
-        // exactly one session, so in practice there is one — but the run id is not carried on
-        // streamed events (matching the existing worker protocol), so this stays a broadcast.
-        for (const entry of this.pending.values()) {
-            if (frame.type === 'question') {
-                // One-way notification; the runner already answered it `declined` locally.
-                await entry.emitter.question(frame.payload).catch(() => undefined);
-                continue;
+        if (frame.type === 'question') {
+            // One-way notification; the runner already answered it `declined` locally.
+            const targets = frame.id ? [this.pending.get(frame.id)] : [...this.pending.values()];
+            for (const entry of targets) {
+                this.enqueue(entry, (e) => e.emitter.question(frame.payload).then(() => undefined));
             }
-            await (0, customEngineIpc_1.applyParsedRunnerEvent)(entry.emitter, frame).catch((err) => {
-                this.logger?.warn(`[RemoteEngine] emitter error: ${err instanceof Error ? err.message : String(err)}`);
-                return undefined;
-            });
+            return;
+        }
+        // LEGACY peer only: untagged events carry nothing that names their turn, so the best
+        // available behaviour is to broadcast. That is only safe because a peer which has not
+        // advertised `demux` is given one turn at a time (see sandboxRunner's `exclusive`).
+        for (const entry of this.pending.values()) {
+            this.enqueue(entry, (e) => (0, customEngineIpc_1.applyParsedRunnerEvent)(e.emitter, frame).then(() => undefined));
         }
     }
+    /** Appends work to one turn's ordered chain. An emitter failure never breaks the chain. */
+    enqueue(entry, work) {
+        if (!entry) {
+            return;
+        }
+        entry.chain = entry.chain.then(() => work(entry)).then(() => undefined, (err) => {
+            this.logger?.warn(`[RemoteEngine] emitter error: ${err instanceof Error ? err.message : String(err)}`);
+        });
+    }
+    /** Settles a turn once everything already streamed for it has been applied. */
+    settle(id, finish) {
+        const entry = this.pending.get(id);
+        if (!entry) {
+            return;
+        }
+        void entry.chain.then(() => finish(entry));
+    }
+    /** True once the peer's `ready` proved it tags streamed events — see `peerDemux`. */
+    supportsDemux() {
+        return this.peerDemux;
+    }
     failAll(err) {
         for (const [id, entry] of this.pending) {
             entry.reject(err);

package/out/sandbox/containerDriver.js

@@ -153,7 +153,7 @@ class ContainerSandboxDriver {
     }
     async create(spec) {
         assertPinnedByDigest(spec.image);
-        const id = `sandbox-${this.instance}-${++this.seq}-${sanitize(spec.sessionKey)}`;
+        const id = `sandbox-${this.instance}-${++this.seq}-${sanitize(spec.sandboxKey)}`;
         // One DIRECTORY per sandbox, mounted at a fixed path inside. Docker cannot bind-mount a
         // socket file that does not exist yet — it would create a directory in its place and the
         // sandbox's bind() then fails (observed live). The sandbox creates the socket inside its own
@@ -217,7 +217,9 @@ class ContainerSandboxDriver {
             // The channel: this sandbox's own socket directory and no other's.
             '--volume', `${sandboxSocketDir}:${exports.SANDBOX_SOCKET_DIR_IN_SANDBOX}`,
             '--label', `ai.agenthippo.sandbox=${id}`,
-            '--label', `ai.agenthippo.session=${spec.sessionKey}`,
+            // Kept as `session` for operators' existing greps; under user scope it names the user's
+            // sandbox rather than one conversation.
+            '--label', `ai.agenthippo.session=${spec.sandboxKey}`,
             '--label', `ai.agenthippo.tier=${spec.tier}`,
         ];
         for (const entry of spec.fs.readonly) {

package/out/sandbox/processDriver.js

@@ -171,7 +171,7 @@ class ProcessSandboxDriver {
         return this.nsWrap;
     }
     async create(spec) {
-        const id = `sandbox-${++this.seq}-${sanitize(spec.sessionKey)}`;
+        const id = `sandbox-${++this.seq}-${sanitize(spec.sandboxKey)}`;
         const spawnFn = this.opts.spawnFn ?? node_child_process_1.spawn;
         const wrap = await this.namespaceWrap();
         const command = wrap ? 'unshare' : this.opts.command;
@@ -275,6 +275,9 @@ function baseSandboxEnv(opts = {}, sourceEnv = process.env) {
         // the sandbox resolves bundled engines itself via findClaudeCodePath()/findCodexPath(),
         // which already know about .agenthippo-deps and the image's baked SDKs.
         'CLAUDE_CODE_PATH', 'CODEX_PATH', 'AGENTHIPPO_CUSTOM_ENGINES_DIR', 'AGENTHIPPO_NO_AUTO_INSTALL',
+        // Boot-stable route URLs (not credentials). Sandboxed serve resolves ${env:AGENTHIPPO_DATA_MCP_URL}
+        // when loading pack MCP configs; without these the postgres gateway entry is dropped.
+        'AGENTHIPPO_DATA_MCP_URL', 'AGENTHIPPO_LITELLM_BASE_URL',
     ];
     const out = {};
     for (const key of allow) {