@agenthippo-ai/agenthippo 1.110.9 → 1.110.11

package/out/sandbox/sandboxRunner.js

@@ -5,30 +5,58 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createSandboxRunner = createSandboxRunner;
 const remoteEngine_1 = require("../runner/remoteEngine");
+const paths_1 = require("../agentpack/paths");
+const credential_context_1 = require("../cli/credential-context");
 function createSandboxRunner(opts) {
     const sandboxes = new Map();
-    const sandboxFor = async (sessionKey) => {
-        const existing = sandboxes.get(sessionKey);
-        if (existing && !existing.dead) {
-            return existing;
-        }
-        if (existing?.dead) {
-            sandboxes.delete(sessionKey);
+    /**
+     * Creations in flight, keyed by sandbox key.
+     *
+     * Two turns arriving together must not each build a sandbox. `sandboxes.get` → `driver.create`
+     * → `sandboxes.set` spans two awaits, so without this both callers miss, both create, and the
+     * loser is a LIVE container that no longer appears in the map: destroy, revoke and the TTL
+     * bookkeeping all miss it, so it keeps its model warrant and answers turns nothing can stop.
+     * That is a kill-switch hole, not a leak. Reachable today — the turn gate caps concurrency
+     * process-wide but never serializes one key.
+     */
+    const creating = new Map();
+    /**
+     * sessionKey → sandboxKey, so callers may keep naming a session while a sandbox holds several.
+     *
+     * Bounded for the reason governor.ts bounds `sessionUsers`: a long-lived serve sees unbounded
+     * distinct session keys (every anonymous gateway sender gets a fresh uuid), and this must never
+     * be the reason an instance falls over. Entries are never purged on teardown — a stale one
+     * resolves to a sandbox that is gone, which the lookups already treat as "nothing to do", and
+     * the next turn overwrites it.
+     */
+    const sessionToSandbox = new Map();
+    const MAX_TRACKED_SESSIONS = 10_000;
+    const rememberSession = (sessionKey, sandboxKey) => {
+        if (sessionToSandbox.size >= MAX_TRACKED_SESSIONS && !sessionToSandbox.has(sessionKey)) {
+            const oldest = sessionToSandbox.keys().next();
+            if (!oldest.done) {
+                sessionToSandbox.delete(oldest.value);
+            }
         }
+        sessionToSandbox.set(sessionKey, sandboxKey);
+    };
+    /** Accepts a session key or a sandbox key; unknown keys pass through as sandbox keys. */
+    const resolveSandboxKey = (key) => sessionToSandbox.get(key) ?? key;
+    const createSandbox = async (sandboxKey, sessionKey) => {
         // Admission first: no lease ⇒ no sandbox. This is the kill switch and the commercial gate,
         // deliberately the same mechanism.
-        await opts.admit?.(sessionKey);
+        await opts.admit?.({ sandboxKey, sessionKey });
         const handle = await opts.driver.create({
-            sessionKey,
+            sandboxKey,
             image: opts.image,
             tier: opts.tier,
             routes: opts.routes,
-            fs: (await opts.fsFor?.(sessionKey)) ?? opts.fs ?? { readonly: [], writable: [] },
-            ...(opts.stateDirFor ? { stateDir: await opts.stateDirFor(sessionKey) } : {}),
+            fs: (await opts.fsFor?.(sandboxKey)) ?? opts.fs ?? { readonly: [], writable: [] },
+            ...(opts.stateDirFor ? { stateDir: await opts.stateDirFor(sandboxKey) } : {}),
             limits: opts.limits ?? { ttlSeconds: 30 * 60 },
             env: { ...(opts.env ?? {}), ...(opts.provenanceEnv?.() ?? {}) },
         });
-        const modelToken = await opts.mintModelToken?.(handle.id, sessionKey);
+        const modelToken = await opts.mintModelToken?.(handle.id, sandboxKey);
         const channel = handle.connect();
         const engine = new remoteEngine_1.RemoteEngine({
             id: 'sandbox',
@@ -41,24 +69,26 @@ function createSandboxRunner(opts) {
                 // its TTL. Binding the sandbox's identity here (handle.id) keeps the warrant
                 // non-transferable while letting its lifetime stay honest.
                 ...(opts.mintModelToken
-                    ? { mintToken: async () => opts.mintModelToken(handle.id, sessionKey) }
+                    ? { mintToken: async () => opts.mintModelToken(handle.id, sandboxKey) }
                     : {}),
             },
             logger: opts.logger,
         });
-        const sandbox = { handle, engine, dead: false };
+        const sandbox = {
+            handle, engine, dead: false, sessionKeys: new Set([sessionKey]), queue: Promise.resolve(),
+        };
         // A sandbox dies on TTL reap, OOM, or node loss. Mark it so the next turn recreates rather
         // than dialing a socket that is gone — otherwise the first message after a reap fails.
         const onClosed = (err) => {
             sandbox.dead = true;
             // Still registered ⇒ the channel died on its own. destroySession, dispose and
             // revoke('all') remove their entry first and have already torn the sandbox down.
-            const unexpected = sandboxes.get(sessionKey) === sandbox;
+            const unexpected = sandboxes.get(sandboxKey) === sandbox;
             if (unexpected) {
-                sandboxes.delete(sessionKey);
+                sandboxes.delete(sandboxKey);
             }
             const why = err instanceof Error ? `: ${err.message}` : '';
-            opts.logger?.info(`[Sandbox] ${handle.id} closed${why}; session ${sessionKey} will rehydrate on next message`);
+            opts.logger?.info(`[Sandbox] ${handle.id} closed${why}; ${sandboxKey} will rehydrate on next message`);
             // Forgetting a sandbox is not the same as destroying it. A channel that dies while the
             // CONTAINER is healthy (a failed dial, a dropped socket) used to leave that container
             // running forever — observed live: four orphans still answering `ready` eight hours
@@ -70,12 +100,74 @@ function createSandboxRunner(opts) {
         // Both arms: the channel REJECTS with the socket-level reason (see unixSocketChannel), and
         // a one-armed `.then` would turn that into an unhandled rejection.
         void channel.closed?.then(() => onClosed(), onClosed);
-        sandboxes.set(sessionKey, sandbox);
-        opts.logger?.info(`[Sandbox] created ${handle.id} for session ${sessionKey} (tier ${handle.tier})`);
+        sandboxes.set(sandboxKey, sandbox);
+        opts.logger?.info(`[Sandbox] created ${handle.id} for ${sandboxKey} (tier ${handle.tier})`);
         return sandbox;
     };
+    /**
+     * The one place a sandbox is looked up or built. NOT async, deliberately: `creating.set` must
+     * run in the same synchronous step as the misses above it, and an `async` wrapper invites
+     * someone to add an await between them, which silently reopens the create race.
+     */
+    const sandboxFor = (sandboxKey, sessionKey) => {
+        const existing = sandboxes.get(sandboxKey);
+        if (existing && !existing.dead) {
+            return Promise.resolve(existing);
+        }
+        if (existing?.dead) {
+            sandboxes.delete(sandboxKey);
+        }
+        const inFlight = creating.get(sandboxKey);
+        if (inFlight) {
+            return inFlight;
+        }
+        // `finally`, not `then`: a failed admission or a driver error must evict the entry, or the
+        // rejected promise is cached forever and every later turn replays a stale refusal.
+        const started = createSandbox(sandboxKey, sessionKey)
+            .finally(() => { creating.delete(sandboxKey); });
+        creating.set(sandboxKey, started);
+        return started;
+    };
+    /**
+     * Runs one turn, serialized when the peer cannot tag streamed events with their run id.
+     *
+     * An untagged peer's events are broadcast to every in-flight turn (see `RemoteEngine.dispatch`),
+     * so overlapping turns would write one session's tokens into another's transcript. The sandbox
+     * image is pinned by digest and upgrades independently of serve, so an older peer is a normal
+     * state, not an error — it just runs one turn at a time.
+     */
+    const exclusive = async (sandbox, fn) => {
+        if (sandbox.engine.supportsDemux()) {
+            return fn(sandbox);
+        }
+        const prior = sandbox.queue;
+        let release;
+        sandbox.queue = new Promise((resolve) => { release = resolve; });
+        await prior;
+        // The sandbox can be reaped or killed while a turn waits its place in line; running now
+        // would dial a socket that is gone. Phrased so the caller's retry recognises it.
+        if (sandbox.dead) {
+            release();
+            throw new Error('sandbox channel closed');
+        }
+        try {
+            return await fn(sandbox);
+        }
+        finally {
+            // In `finally` so a thrown turn cannot wedge every later turn on this sandbox.
+            release();
+        }
+    };
     const run = async (options) => {
         const sessionKey = options.sessionId ?? 'default';
+        // Which sandbox owns this turn. Absent ⇒ the session IS the sandbox, which is the historical
+        // behaviour and what any caller that does not thread the key keeps getting.
+        const sandboxKey = options.sandboxKey ?? sessionKey;
+        const join = (sandbox) => {
+            sandbox.sessionKeys.add(sessionKey);
+            rememberSession(sessionKey, sandboxKey);
+            return sandbox;
+        };
         const collected = { text: '', thinking: '', toolCalls: [] };
         // Collect for the JSON response while forwarding to serve's SSE emitter when present —
         // both paths get the same events.
@@ -94,6 +186,11 @@ function createSandboxRunner(opts) {
                 // attribution (evidence), the per-turn data-plane nonce (OBO), and the
                 // bound gateway session.
                 analyticsUserId: options.analyticsUserId,
+                // Computed HERE, not in the child: this runs inside serve's own
+                // runWithCredential frame, and the child has none. Without it every user's
+                // engine home inside a sandbox resolved to the same unscoped directory, so
+                // tier 0 was strictly worse for transcript separation than no sandbox at all.
+                engineHomeUserKey: (0, paths_1.engineHomeUserKey)((0, credential_context_1.currentCredential)()?.userId),
                 turnEnv: options.turnEnv,
                 gatewaySessionKey: options.gatewaySessionKey,
                 // No nativeSessionId on purpose: the in-sandbox runner resumes from its own
@@ -104,21 +201,25 @@ function createSandboxRunner(opts) {
             }, emitter, opts.runtime, options.signal);
         };
         try {
-            let sandbox = await sandboxFor(sessionKey);
+            const sandbox = join(await sandboxFor(sandboxKey, sessionKey));
             try {
-                await attempt(sandbox);
+                await exclusive(sandbox, attempt);
             }
             catch (err) {
-                // The sandbox died mid-turn (TTL reap, OOM, kill). Recreate and retry ONCE — but only
-                // if nothing has been emitted yet, so a streaming client never sees duplicates.
+                // The sandbox died mid-turn (TTL reap, OOM, kill) or before this turn reached the
+                // front of its queue. Recreate and retry ONCE — but only if nothing has been emitted
+                // yet, so a streaming client never sees duplicates.
                 const message = errText(err);
                 if (!/channel closed/i.test(message) || !nothingEmitted()) {
                     throw err;
                 }
-                sandboxes.delete(sessionKey);
+                // Only if it is still the dead one: a concurrent turn may already have replaced it,
+                // and deleting that would strand a live container the same way the create race did.
+                if (sandboxes.get(sandboxKey) === sandbox) {
+                    sandboxes.delete(sandboxKey);
+                }
                 opts.logger?.info(`[Sandbox] session ${sessionKey} lost its sandbox mid-turn; recreating and retrying once`);
-                sandbox = await sandboxFor(sessionKey);
-                await attempt(sandbox);
+                await exclusive(join(await sandboxFor(sandboxKey, sessionKey)), attempt);
             }
             return { success: true, text: collected.text, thinking: collected.thinking, toolCalls: collected.toolCalls };
         }
@@ -134,28 +235,30 @@ function createSandboxRunner(opts) {
                 sandboxes.delete(key);
             }
         },
-        sandboxes: () => [...sandboxes.entries()].map(([sessionKey, c]) => ({
-            sessionKey, sandboxId: c.handle.id, tier: c.handle.tier,
+        sandboxes: () => [...sandboxes.entries()].map(([sandboxKey, c]) => ({
+            sandboxKey, sandboxId: c.handle.id, tier: c.handle.tier, sessionKeys: [...c.sessionKeys],
         })),
-        async destroySession(sessionKey) {
-            const sandbox = sandboxes.get(sessionKey);
+        async destroySession(key) {
+            const sandboxKey = resolveSandboxKey(key);
+            const sandbox = sandboxes.get(sandboxKey);
             if (!sandbox) {
                 return;
             }
-            sandboxes.delete(sessionKey);
+            sandboxes.delete(sandboxKey);
             await opts.driver.destroy(sandbox.handle);
-            opts.logger?.info(`[Sandbox] destroyed ${sandbox.handle.id} (session ${sessionKey})`);
+            opts.logger?.info(`[Sandbox] destroyed ${sandbox.handle.id} (${sandboxKey}${describeSessions(sandbox, key)})`);
         },
-        async revokeRoute(sessionKey, what) {
-            const sandbox = sandboxes.get(sessionKey);
+        async revokeRoute(key, what) {
+            const sandboxKey = resolveSandboxKey(key);
+            const sandbox = sandboxes.get(sandboxKey);
             if (!sandbox) {
                 return;
             }
             await opts.driver.revoke(sandbox.handle, what);
             if (what === 'all') {
-                sandboxes.delete(sessionKey);
+                sandboxes.delete(sandboxKey);
             }
-            opts.logger?.info(`[Sandbox] revoked ${what} on ${sandbox.handle.id} (session ${sessionKey})`);
+            opts.logger?.info(`[Sandbox] revoked ${what} on ${sandbox.handle.id} (${sandboxKey}${describeSessions(sandbox, key)})`);
         },
     };
 }
@@ -189,3 +292,12 @@ function teeEmitter(downstream, into) {
 function errText(err) {
     return err instanceof Error ? err.message : String(err);
 }
+/**
+ * Names the OTHER sessions a teardown ends. Under user scope an order aimed at one session stops
+ * that user's other conversations too, and a stop wider than the order that caused it must not be
+ * silent in the log.
+ */
+function describeSessions(sandbox, requested) {
+    const others = [...sandbox.sessionKeys].filter((s) => s !== requested);
+    return others.length === 0 ? '' : `, also ending ${others.length}: ${others.join(', ')}`;
+}

package/out/scripts/agentide_litellm_hooks_v1.py

@@ -24,6 +24,7 @@ PRIVACY DEFAULT (PLAN/compliance-req.md §6 "data minimization"):
 
 from __future__ import annotations
 from typing import Any
+import ast
 import hashlib
 import json
 import os
@@ -94,6 +95,72 @@ def _sha256(text: str) -> str:
     return hashlib.sha256(text.encode("utf-8", "replace")).hexdigest()
 
 
+# Correlation IDs Spotlight reads from the requester header blob (see FLEET_DATA_CONTRACT.md).
+# These are minted by AgentHippo clients and carry no user content, so with capture off the
+# blob is reduced to exactly these keys rather than dropped — unknown x-* headers from clients
+# we do not control (e.g. x-api-key) still never reach the span in plaintext.
+_METADATA_HEADERS_KEY = "metadata.requester_custom_headers"
+
+_METADATA_HEADER_ALLOWLIST = frozenset({
+    "x-litellm-metadata-session-id",
+    "x-litellm-metadata-request-id",
+    "x-litellm-metadata-user-id",
+    "x-litellm-metadata-project-id",
+    "x-litellm-metadata-agent-id",
+    "x-litellm-metadata-agent-version",
+    "x-litellm-metadata-source",
+    "x-litellm-metadata-engine",
+})
+
+
+def _parse_attr_dict(value: Any) -> Any:
+    if not isinstance(value, str):
+        return value
+    try:
+        return ast.literal_eval(value)
+    except (ValueError, SyntaxError):
+        try:
+            return json.loads(value)
+        except ValueError:
+            return None
+
+
+def _allowlisted_headers(headers: dict) -> dict:
+    return {
+        k.lower(): v for k, v in headers.items()
+        if isinstance(k, str) and k.lower() in _METADATA_HEADER_ALLOWLIST
+    }
+
+
+def _filtered_metadata_headers(value: Any) -> str | None:
+    """Reduce the header blob to allowlisted keys, keeping the str(dict) repr format that
+    the DuckDB extraction regexes parse. None when nothing allowlisted survives."""
+    headers = _parse_attr_dict(value)
+    if not isinstance(headers, dict):
+        return None
+    kept = _allowlisted_headers(headers)
+    return str(kept) if kept else None
+
+
+# LiteLLM also embeds the raw request headers as metadata.requester_metadata['headers'] on some
+# routes (observed on /v1/chat/completions; absent on /v1/messages). The attribute's scalar keys
+# (session_id, request_id, …) are a fallback landing spot the extraction chain parses, so the
+# attribute itself must survive — only its embedded header dict gets the allowlist treatment.
+_REQUESTER_METADATA_KEY = "metadata.requester_metadata"
+
+
+def _scrub_requester_metadata(value: Any) -> Any:
+    """Scrubbed value, or None (caller drops the attribute) when an embedded header dict
+    cannot be safely isolated — reprs with non-literal values defeat ast.literal_eval, and
+    passing those through unparsed would leak the very headers this exists to remove."""
+    md = _parse_attr_dict(value)
+    if isinstance(md, dict) and isinstance(md.get("headers"), dict):
+        return str({**md, "headers": _allowlisted_headers(md["headers"])})
+    if isinstance(md, dict):
+        return value
+    return None if "headers" in str(value) else value
+
+
 class _RedactingSpan:
     """
     Span proxy that drops content-bearing attributes and replaces them with a sha256 + length.
@@ -112,11 +179,20 @@ class _RedactingSpan:
         return getattr(self._span, name)
 
     def set_attribute(self, key: Any, value: Any) -> Any:
+        if key == _REQUESTER_METADATA_KEY:
+            scrubbed = _scrub_requester_metadata(value)
+            if scrubbed is None:
+                return None
+            return self._span.set_attribute(key, scrubbed)
         if isinstance(key, str) and _CONTENT_ATTR_RE.match(key):
             text = value if isinstance(value, str) else json.dumps(value, ensure_ascii=False, default=str)
             self._span.set_attribute(f"{key}.sha256", _sha256(text))
             self._span.set_attribute(f"{key}.length", len(text))
             self._span.set_attribute(f"{key}.redacted", True)
+            if key == _METADATA_HEADERS_KEY:
+                kept = _filtered_metadata_headers(value)
+                if kept is not None:
+                    self._span.set_attribute(key, kept)
             return None
         return self._span.set_attribute(key, value)
 
@@ -131,10 +207,18 @@ class _RedactingSpan:
         if isinstance(attributes, dict):
             filtered = {}
             for key, value in attributes.items():
-                if isinstance(key, str) and _CONTENT_ATTR_RE.match(key):
+                if key == _REQUESTER_METADATA_KEY:
+                    scrubbed = _scrub_requester_metadata(value)
+                    if scrubbed is not None:
+                        filtered[key] = scrubbed
+                elif isinstance(key, str) and _CONTENT_ATTR_RE.match(key):
                     text = value if isinstance(value, str) else json.dumps(value, ensure_ascii=False, default=str)
                     filtered[f"{key}.sha256"] = _sha256(text)
                     filtered[f"{key}.length"] = len(text)
+                    if key == _METADATA_HEADERS_KEY:
+                        kept = _filtered_metadata_headers(value)
+                        if kept is not None:
+                            filtered[key] = kept
                 else:
                     filtered[key] = value
             attributes = filtered

package/out/scripts/analytics/agentide-litellm-otel.config.yaml

@@ -68,6 +68,10 @@ litellm_settings:
   #   1. set  turn_off_message_logging: false  and  callback_settings.otel.message_logging: true
   #   2. export AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE=1
   # Step 2 is enforced in agentide_litellm_hooks_v1.py at span-write time and logs loudly when on.
+  #
+  # LANES: these hardened defaults are what Dockerfile.litellm bakes into the gateway image.
+  # setup-analytics.{sh,ps1} flips both flags ON when copying this template to a local
+  # ~/.agent-hippo/litellm-otel.yaml — the IDE/Spotlight lane records prompts by default.
   turn_off_message_logging: true
 
 callback_settings:

package/out/scripts/analytics/setup-analytics.ps1

@@ -359,7 +359,14 @@ function Setup-Config {
 
     if (-not (Test-Path $litellmDest)) {
         Copy-Item $litellmSrc $litellmDest
-        Log-Success "Created LiteLLM OTEL config from template"
+        # IDE/local lane: Spotlight needs prompt content, so message logging defaults ON here.
+        # The flip happens at copy time, not in the template, because Dockerfile.litellm bakes
+        # the same template into the gateway image, which must stay metadata-only.
+        $cfg = Get-Content $litellmDest -Raw
+        $cfg = $cfg -replace '(?m)^  turn_off_message_logging: true$', '  turn_off_message_logging: false'
+        $cfg = $cfg -replace '(?m)^    message_logging: false', '    message_logging: true'
+        Set-Content -Path $litellmDest -Value $cfg -NoNewline
+        Log-Success "Created LiteLLM OTEL config from template (local Spotlight: message logging ON)"
     } else {
         Log-Success "LiteLLM OTEL config already present (user-owned)"
     }

package/out/scripts/analytics/setup-analytics.sh

@@ -456,7 +456,14 @@ setup_config() {
 
     if [[ ! -f "$litellm_config" ]]; then
         cp "$source_config" "$litellm_config"
-        log_success "Created LiteLLM OTEL config from template"
+        # IDE/local lane: Spotlight needs prompt content, so message logging defaults ON here.
+        # The flip happens at copy time, not in the template, because Dockerfile.litellm bakes
+        # the same template into the gateway image, which must stay metadata-only.
+        sed -i.bak \
+            -e 's/^  turn_off_message_logging: true$/  turn_off_message_logging: false/' \
+            -e 's/^    message_logging: false/    message_logging: true/' \
+            "$litellm_config" && rm -f "${litellm_config}.bak"
+        log_success "Created LiteLLM OTEL config from template (local Spotlight: message logging ON)"
     else
         log_success "LiteLLM OTEL config already present (user-owned)"
     fi
@@ -628,7 +635,11 @@ start_litellm_with_otel() {
     log_info "Starting LiteLLM with OTEL config..."
     log_info "Config: $otel_config"
     # Start in background
-    LITELLM_CONFIG_PATH="$otel_config" nohup "$litellm_script" > /tmp/litellm-otel.log 2>&1 &
+    # IDE/local Spotlight defaults content capture ON (operator can still export =0 to disable);
+    # hardened serve deployments do not launch through this script and stay metadata-only.
+    LITELLM_CONFIG_PATH="$otel_config" \
+        AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE="${AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE:-1}" \
+        nohup "$litellm_script" > /tmp/litellm-otel.log 2>&1 &
     local litellm_pid=$!
 
     # Write PID file with OTEL flag + base URL for fast status checks

package/out/test/caps-governor.test.js

@@ -54,7 +54,12 @@ function fakeSandboxes(initial = []) {
         destroyed: [],
         revoked: [],
         failRevoke: false,
-        sandboxes() { return state.live.map((sessionKey) => ({ sessionKey, sandboxId: `sandbox-${sessionKey}` })); },
+        // Session scope: one sandbox per session, so its key IS the session key.
+        sandboxes() {
+            return state.live.map((sessionKey) => ({
+                sandboxKey: sessionKey, sandboxId: `sandbox-${sessionKey}`, sessionKeys: [sessionKey],
+            }));
+        },
         async destroySession(sessionKey) {
             state.destroyed.push(sessionKey);
             state.live = state.live.filter((s) => s !== sessionKey);

package/out/test/data-plane-engine-wiring.test.js

@@ -247,4 +247,36 @@ suite('data-plane engine wiring: loadMcpServers + claude/custom shape (no API ke
             fs.rmSync(workspace, { recursive: true, force: true });
         }
     });
+    test('the engine-home key crosses a process boundary that the credential deliberately does not', async () => {
+        const base = path.join(os.tmpdir(), 'ah-home-base');
+        // In serve: the credential frame is authoritative and no wire value is needed.
+        const inServe = await (0, credential_context_1.runWithCredential)({ userId: 'alice@corp.com' }, () => (0, paths_1.userScopedEngineHomeFromKey)(base, (0, credential_context_1.resolveEngineHomeUserKey)()));
+        assert.strictEqual(inServe, (0, paths_1.userScopedEngineHome)(base, 'alice@corp.com'));
+        // In a sandbox child: NO credential frame — which is the whole reason this regressed. The
+        // key arrives on the run frame and must land on the identical path.
+        const key = (0, paths_1.engineHomeUserKey)('alice@corp.com');
+        const inSandbox = (0, paths_1.userScopedEngineHomeFromKey)(base, (0, credential_context_1.resolveEngineHomeUserKey)(key));
+        assert.strictEqual(inSandbox, inServe, 'a sandboxed turn must resolve the same home as an in-process one');
+        // Distinct users stay distinct across the boundary — the property that was silently absent.
+        const bob = (0, paths_1.userScopedEngineHomeFromKey)(base, (0, credential_context_1.resolveEngineHomeUserKey)((0, paths_1.engineHomeUserKey)('bob@corp.com')));
+        assert.notStrictEqual(inSandbox, bob);
+        assert.ok(!inSandbox.includes('alice@corp.com'), 'the key is a hash, never the raw identity');
+    });
+    test('a credential frame outranks the wire, and a malformed key is ignored rather than trusted', async () => {
+        const base = path.join(os.tmpdir(), 'ah-home-base');
+        // A child cannot widen its own scope by sending someone else's key: where a frame exists,
+        // it wins.
+        const spoofed = await (0, credential_context_1.runWithCredential)({ userId: 'alice@corp.com' }, () => (0, credential_context_1.resolveEngineHomeUserKey)((0, paths_1.engineHomeUserKey)('bob@corp.com')));
+        assert.strictEqual(spoofed, (0, paths_1.engineHomeUserKey)('alice@corp.com'));
+        // The key is a path segment taken off the wire, so anything but the hex this produces
+        // falls back to the base dir instead of aiming an engine home elsewhere on disk.
+        for (const bad of ['../../etc', 'alice@corp.com', 'ZZZZ', '', 'abc']) {
+            assert.strictEqual((0, paths_1.userScopedEngineHomeFromKey)(base, bad), base, `rejected: ${JSON.stringify(bad)}`);
+        }
+    });
+    test('no verified user anywhere leaves the path untouched, so the IDE and single-tenant CLI are unaffected', () => {
+        const base = path.join(os.tmpdir(), 'ah-home-base');
+        assert.strictEqual((0, credential_context_1.resolveEngineHomeUserKey)(), undefined);
+        assert.strictEqual((0, paths_1.userScopedEngineHomeFromKey)(base, (0, credential_context_1.resolveEngineHomeUserKey)()), base);
+    });
 });