@opengeni/runtime 0.13.3 → 0.13.10

package/src/index.ts

@@ -23,6 +23,7 @@ import {
   normalizeResourceMountPath,
   prefixedMcpToolName as sharedPrefixedMcpToolName,
   resourceMountPath,
+  redactSensitiveText,
   sessionEventMediaPreview,
   sessionEventMediaPreviewFromDataUrl,
   signDelegatedAccessToken,
@@ -186,6 +187,14 @@ import {
 } from "./sandbox/turn-tool-cancellation";
 import { computerUse, type ComputerToolMode } from "./sandbox-computer";
 import type { RuntimeMetricsHooks } from "./metrics";
+
+// The Agents SDK's debug namespaces can otherwise serialize complete model
+// inputs/outputs and tool arguments/results. These getters read process.env on
+// every log call, so keep the process-global guard permanently enabled rather
+// than toggling it around concurrent turns.
+process.env.OPENAI_AGENTS_DONT_LOG_MODEL_DATA = "1";
+process.env.OPENAI_AGENTS_DONT_LOG_TOOL_DATA = "1";
+
 export {
   getSkillLibraryEntry,
   isSkillLibraryEntryId,
@@ -1621,6 +1630,35 @@ export function appendToolspaceInstructions(composed: string, toolspaceAvailable
   return toolspaceAvailable ? `${composed} ${TOOLSPACE_PROGRAMMATIC_DIRECTIVE}` : composed;
 }
 
+const GIT_BINDING_DISCOVERY_DIRECTIVE =
+  "This managed sandbox has multiple credential bindings for at least one Git provider. Native Git selects credentials from the repository remote. For gh, glab, or az, run inside the intended attached repository so its origin selects the binding; when running elsewhere, inspect $HOME/.opengeni/git-bindings.json and set OPENGENI_GIT_BINDING to the listed credentialBindingId. The inventory contains identifiers and repository routes, never credential values. A binding marked git_http_broker is Git-only, so use the configured provider MCP tools for provider API operations on it.";
+
+/**
+ * Make multi-account provider-CLI selection discoverable to the model.
+ *
+ * Binding ids are opaque routing identifiers, not credentials. The detailed,
+ * secret-free repository mapping is materialized in the sandbox by the Git
+ * setup hook so prompts stay compact.
+ */
+export function appendGitCredentialBindingInstructions(
+  composed: string,
+  bindings: GitCredentialBindingSeed[] | undefined,
+  activeSandboxBackend?: Settings["sandboxBackend"],
+): string {
+  if (activeSandboxBackend === "selfhosted" || !bindings?.length) {
+    return composed;
+  }
+  const bindingsByProvider = new Map<GitCredentialProvider, Set<string>>();
+  for (const binding of bindings) {
+    const ids = bindingsByProvider.get(binding.provider) ?? new Set<string>();
+    ids.add(binding.credentialBindingId);
+    bindingsByProvider.set(binding.provider, ids);
+  }
+  return [...bindingsByProvider.values()].some((ids) => ids.size > 1)
+    ? `${composed} ${GIT_BINDING_DISCOVERY_DIRECTIVE}`
+    : composed;
+}
+
 /**
  * Appends the one-shot genesis title directive (genesis turn only), joined by
  * " " and always LAST so a white-label persona template or a per-session
@@ -1687,7 +1725,7 @@ export function mcpToolErrorOutput(error: unknown): {
   isError: true;
   content: [{ type: "text"; text: string }];
 } {
-  const details = error instanceof Error ? error.message : String(error);
+  const details = redactSensitiveText(error instanceof Error ? error.message : String(error));
   return {
     isError: true,
     content: [
@@ -1776,12 +1814,14 @@ export function buildOpenGeniAgent(
     //      when a toolspace token was minted for this turn (feature enabled + a
     //      per-turn seed — the mint gate, which includes selfhosted turns since
     //      they now receive the token too) — appendToolspaceInstructions,
-    //   3. + workspace memory working set, ONLY when the workspace setting is on
+    //   3. + managed-sandbox Git binding discovery, ONLY when one provider has
+    //      multiple credential bindings,
+    //   4. + workspace memory working set, ONLY when the workspace setting is on
     //      and the worker resolved a nonblank block — appendWorkspaceMemory,
-    //   4. + the per-session persona instructions (session-specific, so it
+    //   5. + the per-session persona instructions (session-specific, so it
     //      refines both the workspace persona and the substrate note),
-    //   5. + host context for this exact turn, when supplied,
-    //   6. + durable session-setting state (title present + child notification
+    //   6. + host context for this exact turn, when supplied,
+    //   7. + durable session-setting state (title present + child notification
     //      mode), when supplied by the worker,
     // The genesis title directive is deliberately NOT part of this persistent
     // string. runAgentStream injects it into the first model call only.
@@ -1789,13 +1829,17 @@ export function buildOpenGeniAgent(
       appendTurnInstructions(
         appendSessionInstructions(
           appendWorkspaceMemory(
-            appendToolspaceInstructions(
-              composeAgentInstructions(
-                options.instructionsTemplate ?? settings.agentInstructionsTemplate,
-                options.workspaceEnvironment,
-                options.rig,
+            appendGitCredentialBindingInstructions(
+              appendToolspaceInstructions(
+                composeAgentInstructions(
+                  options.instructionsTemplate ?? settings.agentInstructionsTemplate,
+                  options.workspaceEnvironment,
+                  options.rig,
+                ),
+                settings.toolspaceEnabled && Boolean(options.toolspaceTokenSeed),
               ),
-              settings.toolspaceEnabled && Boolean(options.toolspaceTokenSeed),
+              options.gitCredentialBindings,
+              options.activeSandboxBackend,
             ),
             options.workspaceMemory,
           ),
@@ -1938,13 +1982,13 @@ export function buildOpenGeniAgent(
 }
 
 /**
- * Enable Codex-CLI-style progressive connector disclosure on a codex turn when the
+ * Enable Codex-CLI-style progressive MCP disclosure on a Codex turn when the
  * flag is on. Gated on `structuredToolTransport === false` — the same signal that
- * identifies a codex-subscription turn (the ChatGPT backend that rejects hosted
- * tools) — so no non-codex turn is ever touched. On qualifying turns it wraps
+ * identifies a Codex-subscription turn (the ChatGPT backend that rejects hosted
+ * tools) — so no non-Codex turn is ever touched. On qualifying turns it wraps
  * `getAllTools` (clone-survivingly — see {@link installCodexToolSearch}) to defer
- * codex_apps schemas + add the client tool_search tool, whose description renders
- * the live connector namespaces threaded from prepareAgentTools.
+ * selected non-mandatory MCP schemas and add the client tool_search tool. The
+ * description combines live connector namespaces with selected server identities.
  */
 function maybeInstallCodexToolSearch(
   agent: Agent<any, any>,
@@ -1952,9 +1996,23 @@ function maybeInstallCodexToolSearch(
   options: BuildAgentOptions,
 ): void {
   if (settings.codexToolSearchEnabled && options.structuredToolTransport === false) {
+    const mcpServers = options.mcpServers ?? [];
+    // `defer_loading:true` removes these MCP schemas from provider context until
+    // tool_search discloses a bounded match. Keep the compaction estimator on
+    // that same wire truth; otherwise a large deferred catalog can falsely trip
+    // compaction before the first real model request. OpenGeni remains eager.
+    for (const server of mcpServers) {
+      if (server.name === "opengeni") continue;
+      (
+        server as MCPServer & {
+          deferModelToolSchemaAccounting?: () => void;
+        }
+      ).deferModelToolSchemaAccounting?.();
+    }
     installCodexToolSearch(
       agent as unknown as Parameters<typeof installCodexToolSearch>[0],
       options.codexConnectorNamespaces ?? new Set<string>(),
+      new Set(mcpServers.map((server) => server.name)),
     );
   }
 }
@@ -2408,7 +2466,13 @@ export async function prepareAgentTools(
   }
   const registry = new Map(settings.mcpServers.map((server) => [server.id, server]));
   const aggregateToolBudget = new McpAggregateToolListBudget();
-  const mcpFetchImpl = options.mcpFetchImpl ?? undiciFetch;
+  // npm Undici's dispatcher transport can hang indefinitely under Bun even
+  // after an AbortSignal fires. Bun's native fetch is the supported runtime
+  // transport there; destination policy validation still runs before every
+  // credential-bearing MCP request.
+  const useBunNativeFetch = options.mcpFetchImpl === undefined && !!process.versions.bun;
+  const mcpFetchImpl =
+    options.mcpFetchImpl ?? (useBunNativeFetch ? globalThis.fetch.bind(globalThis) : undiciFetch);
   const servers = await boundedParallelMap(
     tools,
     MCP_MAX_CONCURRENT_SERVER_OPERATIONS,
@@ -2425,7 +2489,10 @@ export async function prepareAgentTools(
       const guardedFetch = guardedMcpFetch(
         firstParty ? { ...settings, integrationsAllowPrivateNetworkTargets: true } : settings,
         baseFetch,
-        firstParty ? { requireHttpsOutsideLocalTest: false } : {},
+        {
+          ...(firstParty ? { requireHttpsOutsideLocalTest: false } : {}),
+          ...(useBunNativeFetch ? { pinResolvedDestination: false } : {}),
+        },
       );
       const fetchImpl = config.connectionRef
         ? connectionBrokerFetch(guardedFetch, config, options)
@@ -2459,6 +2526,10 @@ export async function prepareAgentTools(
           url,
           name: config.name ?? config.id,
           cacheToolsList: config.cacheToolsList,
+          // The upstream transport logger receives raw thrown errors, whose
+          // messages may contain response bodies, URLs, headers, or echoed
+          // credentials. Keep its diagnostic surface structural only.
+          logger: safeMcpTransportLogger(config.id),
           // codex_apps returns connector tools with empty `outputSchema: {}` that the
           // MCP SDK's strict Tool schema rejects (fails the turn during tools/list);
           // sanitize the response on the wire before validation. The namespace Set
@@ -2525,7 +2596,7 @@ export async function prepareAgentTools(
       const error = connectedBestEffort.errors.get(failed);
       console.warn(
         `[mcp] optional server "${failed.name}" failed to connect/list tools; skipping it for this turn`,
-        error instanceof Error ? error.message : error,
+        safeMcpErrorFields(error),
       );
     }
   }
@@ -2939,6 +3010,46 @@ function safeMcpErrorFields(error: unknown): {
   return { errorClass, status };
 }
 
+function safeMcpTransportError(error: unknown): Error & { status?: number; code?: number } {
+  const fields = safeMcpErrorFields(error);
+  const safeError = new Error(
+    `MCP transport operation failed (${mcpErrorReason(fields)})`,
+  ) as Error & {
+    status?: number;
+    code?: number;
+  };
+  safeError.name = "McpTransportError";
+  if (fields.status !== undefined) {
+    safeError.status = fields.status;
+    safeError.code = fields.status;
+  }
+  return safeError;
+}
+
+function safeMcpTransportLogger(serverId: string) {
+  const logFailure = (_message: string, ...args: unknown[]) => {
+    let error: unknown;
+    for (let index = args.length - 1; index >= 0; index -= 1) {
+      if (args[index] instanceof Error) {
+        error = args[index];
+        break;
+      }
+    }
+    console.warn("[mcp] transport operation failed", {
+      serverId,
+      ...safeMcpErrorFields(error),
+    });
+  };
+  return {
+    namespace: "opengeni:mcp-transport",
+    debug: () => undefined,
+    error: logFailure,
+    warn: logFailure,
+    dontLogModelData: true,
+    dontLogToolData: true,
+  };
+}
+
 // Compose the safe model/log reason string ("StreamableHTTPError 401", or just
 // the class when no numeric status is available). Never carries the raw body.
 function mcpErrorReason(fields: { errorClass: string; status?: number }): string {
@@ -3197,6 +3308,7 @@ class PrefixedMcpServer implements MCPServer {
   private readonly bestEffort: boolean;
   private loggedListToolsFailure = false;
   private listedToolSchemaTokens = 0;
+  private modelToolSchemaAccountingDeferred = false;
 
   constructor(
     private readonly inner: MCPServer,
@@ -3214,7 +3326,11 @@ class PrefixedMcpServer implements MCPServer {
   }
 
   connect(): Promise<void> {
-    return this.inner.connect();
+    return this.inner.connect().catch((error: unknown) => {
+      // connectMcpServers has its own global logger and logs the thrown Error.
+      // Never let a raw transport response body cross that logging boundary.
+      throw safeMcpTransportError(error);
+    });
   }
 
   close(): Promise<void> {
@@ -3274,7 +3390,16 @@ class PrefixedMcpServer implements MCPServer {
 
   /** Latest exact tools/list projection used to build the model request. */
   modelToolSchemaTokens(): number {
-    return this.listedToolSchemaTokens;
+    return this.modelToolSchemaAccountingDeferred ? 0 : this.listedToolSchemaTokens;
+  }
+
+  /**
+   * Keep model-input accounting aligned with Codex `defer_loading`: the full
+   * schema is not provider context until a tool_search_output discloses it.
+   * Instances are turn-local, so this cannot leak into a non-Codex turn.
+   */
+  deferModelToolSchemaAccounting(): void {
+    this.modelToolSchemaAccountingDeferred = true;
   }
 
   async callTool(
@@ -5337,6 +5462,7 @@ function sandboxFileDownloadCommand(download: SandboxFileDownload, targetPath: s
   const targetDir = posixPath.dirname(targetPath);
   const tmpPath = `${targetPath}.opengeni-download-$$`;
   return [
+    "set +x",
     "set -eu",
     `mkdir -p -- ${shellQuote(targetDir)}`,
     `if [ ! -f ${shellQuote(targetPath)} ]; then`,
@@ -5759,6 +5885,7 @@ type RuntimeGitBindingDescriptor = {
   host: string;
   path: string;
   uri: string;
+  mountPath: string;
 };
 
 type RuntimeGitHttpBrokerRouteDescriptor = {
@@ -5811,10 +5938,61 @@ function runtimeGitBindingDescriptors(
       host: url.host.toLowerCase(),
       path,
       uri: resource.uri,
+      mountPath: `/workspace/${resourceMountPath(resource)}`,
     };
   });
 }
 
+function gitCredentialBindingInventoryCommandLines(
+  resources: Extract<ResourceRef, { kind: "repository" }>[],
+  bindings: GitCredentialBindingSeed[],
+): string[] {
+  type GitBindingInventoryTransport = "direct_token" | "git_http_broker";
+  type GitBindingInventoryEntry = {
+    credentialBindingId: string;
+    provider: GitCredentialProvider;
+    transport: GitBindingInventoryTransport;
+    repositories: Array<{ uri: string; mountPath: string }>;
+  };
+  const bindingTransports = new Map<string, GitBindingInventoryTransport>(
+    bindings.map((binding) => [
+      gitCredentialBindingKey(binding.provider, binding.credentialBindingId),
+      binding.transport?.kind === "http_broker" ? "git_http_broker" : "direct_token",
+    ]),
+  );
+  const entries = new Map<string, GitBindingInventoryEntry>();
+  for (const descriptor of runtimeGitBindingDescriptors(resources)) {
+    const key = gitCredentialBindingKey(descriptor.provider, descriptor.credentialBindingId);
+    const transport = bindingTransports.get(key);
+    if (!transport) continue;
+    const entry: GitBindingInventoryEntry = entries.get(key) ?? {
+      credentialBindingId: descriptor.credentialBindingId,
+      provider: descriptor.provider,
+      transport,
+      repositories: [],
+    };
+    entry.repositories.push({ uri: descriptor.uri, mountPath: descriptor.mountPath });
+    entries.set(key, entry);
+  }
+  const inventory = `${JSON.stringify(
+    {
+      version: 1,
+      bindings: [...entries.values()],
+    },
+    null,
+    2,
+  )}\n`;
+  return [
+    'git_binding_inventory="${OPENGENI_GIT_BINDINGS_FILE:-$HOME/.opengeni/git-bindings.json}"',
+    'mkdir -p "$(dirname "$git_binding_inventory")"',
+    'inventory_umask="$(umask)"',
+    "umask 077",
+    `printf '%s' ${shellQuote(inventory)} > "$git_binding_inventory.tmp.$$"`,
+    'mv -f "$git_binding_inventory.tmp.$$" "$git_binding_inventory"',
+    'umask "$inventory_umask"',
+  ];
+}
+
 function gitCredentialBindingKey(
   provider: GitCredentialProvider,
   credentialBindingId: string,
@@ -6166,6 +6344,7 @@ function gitCredentialHelperCommandLines(
     .map(([provider]) => provider);
   return [
     ...gitCredentialTokenWriterCommandLines(bindings),
+    ...gitCredentialBindingInventoryCommandLines(resources, bindings),
     // Provision git/provider-CLI helpers at SETUP (runtime) before any clone
     // runs. Renewal updates only token files and deliberately leaves these
     // repository-specific host mappings intact.
@@ -6328,7 +6507,7 @@ function gitCredentialHelperCommandLines(
     '      *" $provider "*) printf \'%s\\n\' "$tool provider API authentication is host-brokered for this session; use the configured provider MCP tools" >&2; exit 2 ;;',
     "    esac",
     '    case " $multi_binding_providers " in',
-    '      *" $provider "*) printf \'%s\\n\' "Unable to select one of multiple $provider credentials; run inside an attached repository or set OPENGENI_GIT_BINDING" >&2; exit 2 ;;',
+    '      *" $provider "*) printf \'%s\\n\' "Unable to select one of multiple $provider credentials; run inside an attached repository, or inspect ${OPENGENI_GIT_BINDINGS_FILE:-$HOME/.opengeni/git-bindings.json} and set OPENGENI_GIT_BINDING" >&2; exit 2 ;;',
     "    esac",
     '    case "$provider" in',
     '      github) token_file="${OPENGENI_GIT_TOKEN_FILE:-$HOME/.opengeni/git-token}" ;;',
@@ -6382,6 +6561,7 @@ export function gitProviderTokenRefreshCommand(seeds: GitTokenSeeds): string {
     return "";
   }
   return [
+    "set +x",
     seedPrefix,
     "set -eu",
     'export HOME="${HOME:-/workspace}"',
@@ -6395,6 +6575,7 @@ export function gitCredentialBindingTokenRefreshCommand(
   const seedPrefix = gitCredentialBindingSeedExportPrefix(bindings);
   if (!seedPrefix) return "";
   return [
+    "set +x",
     seedPrefix,
     "set -eu",
     'export HOME="${HOME:-/workspace}"',
@@ -6450,6 +6631,7 @@ export function repositoryCloneCommand(
 ): string {
   assertUniqueResourceMountPaths(resources);
   const commands = [
+    "set +x",
     "set -eu",
     'export HOME="${HOME:-/workspace}"',
     'export GIT_TERMINAL_PROMPT="${GIT_TERMINAL_PROMPT:-0}"',
@@ -6559,6 +6741,7 @@ export function toolspaceTokenSeedCommand(
   options: { tokenFile?: string; legacyTokenFile?: string } = {},
 ): string {
   return [
+    "set +x",
     "set -eu",
     'export HOME="${HOME:-/workspace}"',
     'if [ -n "${OPENGENI_TOOLSPACE_TOKEN_SEED:-}" ]; then',
@@ -6588,7 +6771,7 @@ export async function runToolspaceTokenSeedHook(
   if (!context.toolspaceTokenSeed) {
     return;
   }
-  const command = `export OPENGENI_TOOLSPACE_TOKEN_SEED=${shellQuote(context.toolspaceTokenSeed)}\n${toolspaceTokenSeedCommand(
+  const command = `set +x\nexport OPENGENI_TOOLSPACE_TOKEN_SEED=${shellQuote(context.toolspaceTokenSeed)}\n${toolspaceTokenSeedCommand(
     {
       ...(context.toolspaceTokenFile ? { tokenFile: context.toolspaceTokenFile } : {}),
       ...(context.toolspaceTokenFile && context.environment.OPENGENI_TOOLSPACE_TOKEN_FILE
@@ -6620,7 +6803,7 @@ export async function refreshToolspaceTokenFile(
     legacyTokenFile?: string;
   } = {},
 ): Promise<void> {
-  const command = `export OPENGENI_TOOLSPACE_TOKEN_SEED=${shellQuote(token)}\n${toolspaceTokenSeedCommand(
+  const command = `set +x\nexport OPENGENI_TOOLSPACE_TOKEN_SEED=${shellQuote(token)}\n${toolspaceTokenSeedCommand(
     {
       ...(options.tokenFile ? { tokenFile: options.tokenFile } : {}),
       ...(options.legacyTokenFile ? { legacyTokenFile: options.legacyTokenFile } : {}),
@@ -6833,7 +7016,7 @@ export async function runRepositoryCloneHook(
       .filter(Boolean)
       .join("\n");
     const cloneCommand = repositoryCloneCommand(resources, gitCredentialBindings);
-    const command = seedPrefix ? `${seedPrefix}\n${cloneCommand}` : cloneCommand;
+    const command = seedPrefix ? `set +x\n${seedPrefix}\n${cloneCommand}` : cloneCommand;
     const result = await runSandboxLifecycleCommand(
       session,
       {
@@ -6864,6 +7047,7 @@ export async function runRepositoryCloneHook(
 
 export function azureCliLoginCommand(): string {
   return [
+    "set +x",
     'export HOME="${HOME:-/workspace}"',
     'mkdir -p "$HOME/.azure"',
     'CLIENT_ID="${AZURE_CLIENT_ID:-${ARM_CLIENT_ID:-}}"',

package/src/mcp-network.ts

@@ -212,16 +212,28 @@ export function guardedMcpFetch<TInput extends string | URL | Request>(
   options: {
     maxResponseBytes?: number;
     dnsLookup?: DnsLookup;
+    pinResolvedDestination?: boolean;
     requireHttpsOutsideLocalTest?: boolean;
   } = {},
 ): (input: TInput, init?: RequestInit) => Promise<Response> {
   return async (input: TInput, init?: RequestInit) => {
-    const response = await pinnedFetch(input, init, settings, {
-      fetchImpl: fetchImpl as FetchLike,
+    const destinationOptions = {
       ...(options.dnsLookup ? { dnsLookup: options.dnsLookup } : {}),
       label: "MCP endpoint",
       requireHttpsOutsideLocalTest: options.requireHttpsOutsideLocalTest ?? true,
-    });
+    };
+    let response: Response;
+    if (options.pinResolvedDestination === false) {
+      await resolvePinnedDestination(input instanceof Request ? input.url : input, settings, {
+        ...destinationOptions,
+      });
+      response = await fetchImpl(input, { ...init, redirect: "manual" });
+    } else {
+      response = await pinnedFetch(input, init, settings, {
+        fetchImpl: fetchImpl as FetchLike,
+        ...destinationOptions,
+      });
+    }
     return boundMcpResponseBody(response, options.maxResponseBytes ?? MCP_MAX_RESPONSE_BYTES);
   };
 }

package/src/sandbox/index.ts

@@ -379,6 +379,7 @@ export {
   type DefaultBackendLossResult,
   type RoutableBackendSession,
   type ResolvedActiveBackend,
+  type RoutingMutationSettlementResult,
   type RoutingRetainedProcess,
   type RoutingRetainedProcessAdoption,
   type RoutingRetainedProcessTerminalProof,

package/src/sandbox/routing/routing-session.ts

@@ -115,6 +115,15 @@ export type RoutingRetainedProcess = {
   providerSessionId: number;
 };
 
+/** A yielded process was durably promoted, but the mutable authority checked
+ * after that commit was stale. The provider output must still be rejected;
+ * this result carries only the safe process identity needed to drain the exact
+ * original backend without replaying the mutation. */
+export type RoutingMutationSettlementResult = {
+  status: "retained_process_durable_output_rejected";
+  retainedProcess: RoutingRetainedProcess;
+};
+
 /** Exact copied route identity required to reconstruct an already-durable
  * retained process after the request/runtime object that opened it is gone.
  * The live session is deliberately not caller-supplied: adoption may bind only
@@ -184,7 +193,7 @@ export interface RoutingSandboxSessionDeps {
     /** Stable candidate generated before durable promotion is attempted. It is
      * supplied only when the provider returned a positive yielded-session id. */
     retainedProcess?: RoutingRetainedProcess;
-  }) => Promise<void>;
+  }) => Promise<void | RoutingMutationSettlementResult>;
   /** Admit one model/user-visible stdin mutation under the already-durable
    * retained process authority. Control polling and helper execs never call it. */
   beforeProcessMutation?: (input: {
@@ -265,13 +274,15 @@ export class RoutingBackendRecoveryRequiredError extends Error {
 export class RoutingMutationOutcomeUnknownError extends Error {
   readonly name = "RoutingMutationOutcomeUnknownError";
   readonly retryable = false;
+  readonly retainedProcess: RoutingRetainedProcess | null;
 
   constructor(
     public readonly op: string,
     message: string,
-    options?: { cause?: unknown },
+    options?: { cause?: unknown; retainedProcess?: RoutingRetainedProcess },
   ) {
     super(message, options);
+    this.retainedProcess = options?.retainedProcess ?? null;
   }
 }
 
@@ -665,7 +676,8 @@ export class RoutingSandboxSession implements RoutableBackendSession {
       );
     }
     try {
-      await this.deps.afterMutation(pending);
+      const result = await this.deps.afterMutation(pending);
+      if (result) this.confirmDurableRejectedPromotion(record, result);
       record.pendingParentPromotion = null;
       record.durable = true;
     } catch (error) {
@@ -677,6 +689,24 @@ export class RoutingSandboxSession implements RoutableBackendSession {
     }
   }
 
+  private confirmDurableRejectedPromotion(
+    record: RetainedProcessRecord,
+    result: RoutingMutationSettlementResult,
+  ): void {
+    if (
+      result.status !== "retained_process_durable_output_rejected" ||
+      result.retainedProcess.id !== record.process.id ||
+      result.retainedProcess.providerSessionId !== record.process.providerSessionId
+    ) {
+      throw new RoutingMutationOutcomeUnknownError(
+        "retainProcess",
+        `Durable promotion result did not match retained provider session ${record.process.providerSessionId}`,
+      );
+    }
+    record.pendingParentPromotion = null;
+    record.durable = true;
+  }
+
   private async settleRetainedProcess(
     record: RetainedProcessRecord,
     proof: RoutingRetainedProcessTerminalProof,
@@ -936,9 +966,24 @@ export class RoutingSandboxSession implements RoutableBackendSession {
           ...(retainedProcess ? { retainedProcess } : {}),
         };
         try {
-          await this.deps.afterMutation(settlement);
+          const settlementResult = await this.deps.afterMutation(settlement);
+          if (retainedRecord && settlementResult) {
+            this.confirmDurableRejectedPromotion(retainedRecord, settlementResult);
+            this.invalidate(backend);
+            throw new RoutingMutationOutcomeUnknownError(
+              op,
+              `Mutating sandbox operation "${op}" yielded provider session ${retainedRecord.process.providerSessionId}; durable promotion succeeded but stale authority rejected its output, and the operation was not replayed`,
+              { retainedProcess: retainedRecord.process },
+            );
+          }
           if (retainedRecord) retainedRecord.durable = true;
         } catch (error) {
+          if (
+            error instanceof RoutingMutationOutcomeUnknownError &&
+            error.retainedProcess !== null
+          ) {
+            throw error;
+          }
           if (retainedRecord) retainedRecord.pendingParentPromotion = settlement;
           this.invalidate(backend);
           throw new RoutingMutationOutcomeUnknownError(

package/src/sandbox/run-credentials.ts

@@ -496,9 +496,9 @@ async function runCredentialCommand(
   cmd: string,
   commandRunner?: RunCredentialCommandRunner,
 ): Promise<void> {
-  const marked = `set -eu\n${cmd}\nprintf '\\n${COMMAND_OK_MARKER}\\n'`;
+  const marked = `set +x\nset -eu\n${cmd}\nprintf '\\n${COMMAND_OK_MARKER}\\n'`;
   const args: ExecCommandArgs = {
-    cmd: `env -u BASH_ENV bash --noprofile --norc -c ${shellQuote(marked)}`,
+    cmd: `set +x\nenv -u BASH_ENV bash --noprofile --norc -c ${shellQuote(marked)}`,
     yieldTimeMs: 120_000,
     maxOutputTokens: 4_000,
   };

package/src/sandbox/turn-tool-cancellation.ts

@@ -4,6 +4,7 @@ import {
   parseExecBannerExitCode,
   parseExecBannerSessionId,
 } from "./exec-banner";
+import { RoutingMutationOutcomeUnknownError } from "./routing/routing-session";
 
 const TURN_EXEC_YIELD_MS = 250;
 const TURN_WRITE_YIELD_MS = 250;
@@ -759,6 +760,34 @@ class TurnToolCancellationControllerImpl implements TurnToolCancellationControll
                 correlationId,
                 async () => await tool.invoke(runContext, cancellableInput, details),
               );
+            } catch (error) {
+              const retainedProcess =
+                !useRemoteOpCancellation && error instanceof RoutingMutationOutcomeUnknownError
+                  ? error.retainedProcess
+                  : null;
+              const processSession =
+                retainedProcess === null
+                  ? null
+                  : retainedProcessSession(cancellationSession, retainedProcess.providerSessionId);
+              if (retainedProcess && processSession) {
+                // The provider output remains rejected, but DB promotion is
+                // already durable. Preserve only the safe process locator and
+                // exact routing session so turn finalization can drain it; never
+                // invoke a helper through the mutable current route.
+                this.shellSessions.set(retainedProcess.providerSessionId, {
+                  sessionId: retainedProcess.providerSessionId,
+                  markerPath,
+                  token,
+                  runContext,
+                  execInvoke: tool.invoke,
+                  writeInvoke: this.rawWriteInvoke,
+                  processSession,
+                  identity: null,
+                  identityValidated: false,
+                  cancellation: null,
+                });
+              }
+              throw error;
             } finally {
               remoteExec?.settle();
             }

package/src/sandbox/workspace-archive.ts

@@ -151,7 +151,10 @@ export function readVerifiedWorkspaceArchive(
 }
 
 function stdoutFromExecResult(value: unknown): string {
-  if (typeof value === "string") return value;
+  if (typeof value === "string") {
+    const delimiter = /\r?\nOutput:\r?\n/u.exec(value);
+    return delimiter ? value.slice(delimiter.index + delimiter[0].length) : value;
+  }
   if (!value || typeof value !== "object") return "";
   const output = value as { stdout?: unknown; output?: unknown };
   return typeof output.stdout === "string"