@opengeni/runtime 0.14.1 → 0.14.15

package/dist/{chunk-HHWIZHQM.js → chunk-GNEGANUF.js}

@@ -28,7 +28,7 @@ import {
   validateCredentialPair,
   validateRemoteSandboxPathForManifest,
   validateSandboxArchiveLimits
-} from "./chunk-4YJ5Z52Z.js";
+} from "./chunk-7E2ZSCZK.js";
 import {
   FileMode,
   Manifest,
@@ -129,7 +129,7 @@ function assertDescriptorRegistryInvariants() {
   }
 }
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/shared/editor.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/shared/editor.mjs
 var RemoteSandboxEditor = class {
   io;
   constructor(io) {
@@ -184,7 +184,7 @@ var RemoteSandboxEditor = class {
   }
 };
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/shared/archive.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/shared/archive.mjs
 var TAR_BLOCK_SIZE = 512;
 var ZERO_BLOCK = new Uint8Array(TAR_BLOCK_SIZE);
 function assertTarWorkspacePersistence(providerName, workspacePersistence) {
@@ -624,7 +624,7 @@ function tarError(member, reason) {
   });
 }
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/shared/metadata.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/shared/metadata.mjs
 var MOUNT_MANIFEST_METADATA_SUPPORT = {
   mounts: true
 };
@@ -705,7 +705,7 @@ function joinSandboxPath(parent, child) {
   return `${parent.replace(/\/+$/u, "")}/${normalizedChild}`;
 }
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/shared/ports.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/shared/ports.mjs
 function assertConfiguredExposedPort(args) {
   const port = normalizeExposedPort(args.port);
   if (args.allowOnDemand) {
@@ -768,7 +768,7 @@ function parseExposedPortEndpoint(value, args) {
   };
 }
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/shared/pty.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/shared/pty.mjs
 var PTY_YIELD_TIME_MS_MIN = 250;
 var PTY_EMPTY_YIELD_TIME_MS_MIN = 5e3;
 var PTY_YIELD_TIME_MS_MAX = 3e4;
@@ -1085,7 +1085,7 @@ function formatWebSocketEvent(event) {
   return "unknown error";
 }
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/shared/session.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/shared/session.mjs
 async function closeRemoteSessionOnManifestError(providerName, session, manifestError) {
   try {
     await session.close();
@@ -1434,7 +1434,7 @@ function isNotFoundErrorMessage(message) {
   return /\b(sandbox|sandbox instance|instance|devbox)\b.*\b(not found|missing|does not exist|no such)\b/iu.test(text) || /\b(not found|missing|does not exist|no such)\b.*\b(sandbox|sandbox instance|instance|devbox)\b/iu.test(text);
 }
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/shared/runAs.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/shared/runAs.mjs
 function sandboxUserShellCommand(command, user) {
   if (!user) {
     return command;
@@ -1566,7 +1566,7 @@ function randomId() {
   return (globalThis.crypto?.randomUUID?.() ?? Math.random().toString(16).slice(2)).replace(/-/gu, "");
 }
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/shared/sessionBase.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/shared/sessionBase.mjs
 import { randomUUID as randomUUID2 } from "crypto";
 var RemoteSandboxSessionBase = class {
   state;
@@ -2004,7 +2004,7 @@ function joinRemoteCommandOutput(result) {
   return [result.stdout ?? "", result.stderr ?? ""].filter((value) => value.trim().length > 0).join("\n");
 }
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/shared/sessionState.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/shared/sessionState.mjs
 function serializeRemoteSandboxSessionState(state) {
   return {
     ...state,
@@ -2034,7 +2034,7 @@ function deserializeRemotePersistedEnvironmentForRuntime(manifest, environment,
   };
 }
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/shared/snapshots.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/shared/snapshots.mjs
 var NATIVE_SNAPSHOT_PREFIXES = {
   e2b: "E2B_SANDBOX_SNAPSHOT_V1\n",
   modal_snapshot_directory: "MODAL_SANDBOX_DIR_SNAPSHOT_V1\n",
@@ -2076,10 +2076,10 @@ function decodeNativeSnapshotRef(data) {
   return void 0;
 }
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/blaxel/mounts.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/blaxel/mounts.mjs
 import { createHash } from "crypto";
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/shared/inContainerMounts.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/shared/inContainerMounts.mjs
 var DEFAULT_PACKAGE_MANAGERS = ["apt"];
 var SAFE_PIDFILE_KILL_FUNCTION = String.raw`openai_agents_kill_pidfile() {
   pidfile=$1
@@ -2699,7 +2699,7 @@ function normalizeBoxRemotePath(path) {
   return path?.replace(/^\/+/gu, "") ?? "";
 }
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/blaxel/mounts.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/blaxel/mounts.mjs
 var GCSFUSE_VERSION = "3.4.4";
 var GCSFUSE_AMD64_DEB_SHA256 = "406945ecc736e8cf0eee92a617fd4a038d138c9c31e48980b99862a5f1f55bb5";
 var GCSFUSE_ARM64_DEB_SHA256 = "8587fe2ee274075d8ec5a363e32761bc523a72c531922a69dd35035a371fdf3a";
@@ -3157,7 +3157,7 @@ function safeId(value) {
   return createHash("sha256").update(value).digest("hex");
 }
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/blaxel/sandbox.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/blaxel/sandbox.mjs
 var BLAXEL_AUTOGENERATED_NAME_CREATE_ATTEMPTS = 5;
 var BLAXEL_NON_RESUMABLE_SANDBOX_STATUSES = /* @__PURE__ */ new Set([
   "DEACTIVATING",
@@ -4292,7 +4292,7 @@ var blaxelProvider = {
   }
 };
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/cloudflare/mounts.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/cloudflare/mounts.mjs
 function buildCloudflareBucketMountConfig(mount) {
   if (isS3Mount(mount)) {
     const accessKeyId = readOptionalString(mount, "accessKeyId");
@@ -4428,7 +4428,7 @@ function validateCredentialPair4(args) {
   });
 }
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/cloudflare/sandbox.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/cloudflare/sandbox.mjs
 var CloudflareSandboxSession = class {
   state;
   apiKey;
@@ -4651,7 +4651,7 @@ var CloudflareSandboxSession = class {
   async materializeEntry(args) {
     assertSandboxEntryMetadataSupported("CloudflareSandboxClient", args.path, args.entry, MOUNT_MANIFEST_METADATA_SUPPORT);
     if (entryContainsLocalSource(args.entry)) {
-      const { applyLocalSourceManifestEntryToState: applyLocalSourceManifestEntryToState2 } = await import("./localSources-T3HZ6KY4.js");
+      const { applyLocalSourceManifestEntryToState: applyLocalSourceManifestEntryToState2 } = await import("./localSources-BXHBKGF4.js");
       await applyLocalSourceManifestEntryToState2(this.state, args.path, args.entry, "cloudflare", this.writer(), this.remotePathResolver, this.manifestMaterializationOptions(args.runAs));
       return;
     }
@@ -4662,7 +4662,7 @@ var CloudflareSandboxSession = class {
     assertSandboxManifestMetadataSupported("CloudflareSandboxClient", manifest, MOUNT_MANIFEST_METADATA_SUPPORT);
     assertCloudflareManifestMountsSupported(manifest);
     if (manifestContainsLocalSource(manifest)) {
-      const { applyLocalSourceManifestToState: applyLocalSourceManifestToState2 } = await import("./localSources-T3HZ6KY4.js");
+      const { applyLocalSourceManifestToState: applyLocalSourceManifestToState2 } = await import("./localSources-BXHBKGF4.js");
       await applyLocalSourceManifestToState2(this.state, manifest, "cloudflare", this.writer(), this.remotePathResolver, this.manifestMaterializationOptions(runAs));
       return;
     }
@@ -5581,12 +5581,12 @@ var cloudflareProvider = {
   }
 };
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/daytona/mounts.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/daytona/mounts.mjs
 function isDaytonaCloudBucketMountEntry(entry) {
   return isRcloneCloudBucketMountEntry(entry, "daytona_cloud_bucket");
 }
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/daytona/sandbox.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/daytona/sandbox.mjs
 var DEFAULT_WORKSPACE_ROOT = "/home/daytona/workspace";
 var DEFAULT_EXPOSED_PORT_URL_TTL_S = 60;
 var DAYTONA_DELETE_RETRY_DELAYS_MS = [1e3, 2e3, 4e3];
@@ -10647,27 +10647,37 @@ function getHostDockerUser() {
 }
 
 // src/sandbox/providers/docker.ts
+import { isAbsolute as isAbsolute4 } from "path";
 var dockerProvider = {
   backend: "docker",
   descriptor: CAPABILITY_DESCRIPTORS.docker,
   // Local dev container — no credentials. (The dockerNetwork decoration is
   // applied by the factory, not here: it wraps the constructed client.)
-  validateCredentials() {
+  validateCredentials(settings) {
+    const workspaceBaseDir = settings.dockerWorkspaceBaseDir?.trim();
+    if (workspaceBaseDir && !isAbsolute4(workspaceBaseDir)) {
+      throw new SandboxConfigError(
+        "docker",
+        "OPENGENI_DOCKER_WORKSPACE_BASE_DIR must be an absolute path"
+      );
+    }
   },
   build({ settings, exposedPorts }) {
+    const workspaceBaseDir = settings.dockerWorkspaceBaseDir?.trim();
     return new DockerSandboxClient({
       image: settings.dockerImage,
-      exposedPorts
+      exposedPorts,
+      ...workspaceBaseDir ? { workspaceBaseDir } : {}
     });
   }
 };
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/e2b/mounts.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/e2b/mounts.mjs
 function isE2BCloudBucketMountEntry(entry) {
   return isRcloneCloudBucketMountEntry(entry, "e2b_cloud_bucket");
 }
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/e2b/sandbox.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/e2b/sandbox.mjs
 var E2BSandboxSession = class extends RemoteSandboxSessionBase {
   sandbox;
   ptyProcesses = new PtyProcessRegistry();
@@ -11449,10 +11459,10 @@ var localProvider = {
   }
 };
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/modal/sandbox.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/modal/sandbox.mjs
 import { posix as pathPosix } from "path";
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/modal/mounts.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/modal/mounts.mjs
 var ModalCloudBucketMountStrategy = class {
   type = "modal_cloud_bucket";
   secretName;
@@ -11636,7 +11646,7 @@ function isGCSMount2(entry) {
   return entry.type === "gcs_mount";
 }
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/modal/sandbox.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/modal/sandbox.mjs
 var DEFAULT_MODAL_IMAGE_TAG = "debian:bookworm-slim";
 var DEFAULT_EXEC_YIELD_TIME_MS2 = 1e4;
 var DEFAULT_WRITE_STDIN_YIELD_TIME_MS2 = 250;
@@ -13058,7 +13068,11 @@ async function terminateModalSandboxAfterTimeout(sandbox) {
 
 // src/sandbox/providers/modal.ts
 import { effectiveModalIdleTimeoutSeconds } from "@opengeni/config";
+import {
+  canonicalModalCheckpointProviderBinding
+} from "@opengeni/contracts";
 var MODAL_ORPHAN_SWEEP_LIMIT = 50;
+var OPENGENI_MODAL_SDK_VERSION = "0.9.0";
 var MODAL_UNATTRIBUTED_ORPHAN_GRACE_MS = 2 * 6e4;
 function modalSandboxAttributionEnvironment(input) {
   return {
@@ -13075,6 +13089,113 @@ function modalSandboxAttributionTags(input) {
     opengeni_sandbox_group_id: input.sandboxGroupId
   };
 }
+var modalRetentionWrappedSessions = /* @__PURE__ */ new WeakSet();
+var modalFilesystemRetentionWrappedSandboxes = /* @__PURE__ */ new WeakSet();
+var modalDirectoryRetentionWrappedSandboxes = /* @__PURE__ */ new WeakSet();
+var MODAL_EXEC_STDIN_WRITE_PATH = "/modal.task_command_router.TaskCommandRouter/TaskExecStdinWrite";
+var MODAL_EXEC_ALREADY_COMPLETED_DETAILS = /^Exec has already completed; stdin is no longer accepting writes(?: \(Error code: [A-Z0-9]+\))?$/;
+function isModalExecAlreadyCompletedError(error) {
+  if (!error || typeof error !== "object") return false;
+  const record = error;
+  return record.name === "ClientError" && record.path === MODAL_EXEC_STDIN_WRITE_PATH && record.code === 9 && typeof record.details === "string" && MODAL_EXEC_ALREADY_COMPLETED_DETAILS.test(record.details);
+}
+function assertPinnedModalSdk(session) {
+  const actualVersion = session.modal?.version?.();
+  if (actualVersion !== OPENGENI_MODAL_SDK_VERSION) {
+    throw new Error(
+      `OpenGeni Modal snapshot compatibility requires modal@${OPENGENI_MODAL_SDK_VERSION}; the active session reported ${actualVersion ?? "no version"}`
+    );
+  }
+}
+function installModalNativeSnapshotRetention(session) {
+  const persistence = session.state?.workspacePersistence;
+  if (persistence !== "snapshot_filesystem" && persistence !== "snapshot_directory") {
+    return;
+  }
+  const sandbox = session.sandbox;
+  if (!sandbox || typeof sandbox !== "object") {
+    throw new Error(`Modal ${persistence} persistence has no active provider sandbox`);
+  }
+  if (persistence === "snapshot_filesystem") {
+    if (modalFilesystemRetentionWrappedSandboxes.has(sandbox)) return;
+    const snapshotFilesystem = sandbox.snapshotFilesystem;
+    if (typeof snapshotFilesystem !== "function") {
+      throw new Error("Modal snapshot_filesystem persistence is unavailable");
+    }
+    sandbox.snapshotFilesystem = async (legacyParams) => {
+      if (legacyParams !== void 0 && typeof legacyParams !== "number") {
+        throw new Error("Unexpected Modal snapshot_filesystem adapter call shape");
+      }
+      return await snapshotFilesystem.call(sandbox, {
+        ...legacyParams === void 0 ? {} : { timeoutMs: legacyParams },
+        ttlMs: null
+      });
+    };
+    modalFilesystemRetentionWrappedSandboxes.add(sandbox);
+    return;
+  }
+  if (modalDirectoryRetentionWrappedSandboxes.has(sandbox)) return;
+  const snapshotDirectory = sandbox.snapshotDirectory;
+  if (typeof snapshotDirectory !== "function") {
+    throw new Error("Modal snapshot_directory persistence is unavailable");
+  }
+  sandbox.snapshotDirectory = async (path, legacyParams) => {
+    if (typeof path !== "string" || legacyParams !== void 0) {
+      throw new Error("Unexpected Modal snapshot_directory adapter call shape");
+    }
+    return await snapshotDirectory.call(sandbox, path, {
+      ...session.state?.snapshotFilesystemTimeoutMs === void 0 ? {} : { timeoutMs: session.state.snapshotFilesystemTimeoutMs },
+      ttlMs: null
+    });
+  };
+  modalDirectoryRetentionWrappedSandboxes.add(sandbox);
+}
+function installModalExecCompletionRecovery(session) {
+  const writeStdin = session.writeStdin;
+  if (typeof writeStdin !== "function") return;
+  session.writeStdin = async (args) => {
+    try {
+      return await writeStdin.call(session, args);
+    } catch (error) {
+      if (!isModalExecAlreadyCompletedError(error) || !Number.isSafeInteger(args.sessionId) || args.sessionId <= 0) {
+        throw error;
+      }
+      try {
+        return await writeStdin.call(session, { ...args, chars: "" });
+      } catch {
+        return `write_stdin failed: session not found: ${args.sessionId}`;
+      }
+    }
+  };
+}
+function installOpenGeniModalSnapshotPolicy(session) {
+  const mutable = session;
+  if (modalRetentionWrappedSessions.has(session)) return session;
+  if (typeof mutable.persistWorkspace !== "function") {
+    throw new Error("Modal session does not expose workspace persistence");
+  }
+  assertPinnedModalSdk(mutable);
+  installModalNativeSnapshotRetention(mutable);
+  installModalExecCompletionRecovery(mutable);
+  const persistWorkspace = mutable.persistWorkspace.bind(session);
+  mutable.persistWorkspace = async () => {
+    assertPinnedModalSdk(mutable);
+    installModalNativeSnapshotRetention(mutable);
+    return await persistWorkspace();
+  };
+  modalRetentionWrappedSessions.add(session);
+  return session;
+}
+var OpenGeniModalSandboxClient = class extends ModalSandboxClient {
+  async create(args, manifestOptions) {
+    const session = await super.create(args, manifestOptions);
+    return installOpenGeniModalSnapshotPolicy(session);
+  }
+  async resume(state) {
+    const session = await super.resume(state);
+    return installOpenGeniModalSnapshotPolicy(session);
+  }
+};
 var modalProvider = {
   backend: "modal",
   descriptor: CAPABILITY_DESCRIPTORS.modal,
@@ -13119,7 +13240,7 @@ var modalProvider = {
     if (settings.modalEnvironment) {
       options.environment = settings.modalEnvironment;
     }
-    return new ModalSandboxClient(options);
+    return new OpenGeniModalSandboxClient(options);
   }
 };
 var defaultModalLoader = () => import("modal");
@@ -13177,14 +13298,148 @@ function modalClientOptions(settings) {
   return {
     ...settings.modalTokenId ? { tokenId: settings.modalTokenId } : {},
     ...settings.modalTokenSecret ? { tokenSecret: settings.modalTokenSecret } : {},
-    ...settings.modalEnvironment ? { environment: settings.modalEnvironment } : {},
-    ...settings.modalTimeoutSeconds ? { timeoutMs: settings.modalTimeoutSeconds * 1e3 } : {}
+    ...settings.modalEnvironment ? { environment: settings.modalEnvironment } : {}
   };
 }
 async function createModalClient(settings) {
   const modal = await import("modal");
   return new modal.ModalClient(modalClientOptions(settings));
 }
+function isModalNotFoundError(error) {
+  const candidate = error;
+  return candidate?.name === "NotFoundError" || candidate?.code === 5;
+}
+async function modalCheckpointProviderBindingForClient(settings, modal) {
+  const identity = await modal.cpClient.workspaceNameLookup({});
+  const workspaceName = identity.workspaceName || identity.username;
+  if (!workspaceName) {
+    throw new Error("Modal credential resolved no workspace identity");
+  }
+  const resolved = canonicalModalCheckpointProviderBinding({
+    version: 1,
+    serverUrl: modal.profile.serverUrl,
+    workspaceName,
+    // Resolve through the authenticated client, not the optional OpenGeni
+    // override alone. When the override is absent Modal may select a profile
+    // environment; persisting "" would fail to fence a later profile change.
+    environment: modal.environmentName(settings.modalEnvironment)
+  });
+  if (!resolved) {
+    throw new Error("Modal credential resolved an invalid checkpoint provider identity");
+  }
+  return resolved.binding;
+}
+var modalSessionCheckpointBindings = /* @__PURE__ */ new WeakMap();
+async function resolveModalCheckpointProviderBindingForSession(settings, session) {
+  if (!session || typeof session !== "object") {
+    throw new Error("Modal checkpoint session identity is unavailable");
+  }
+  const cached = modalSessionCheckpointBindings.get(session);
+  if (cached) return await cached;
+  const modal = session.modal;
+  if (!modal || typeof modal.cpClient?.workspaceNameLookup !== "function" || typeof modal.profile?.serverUrl !== "string" || typeof modal.environmentName !== "function") {
+    throw new Error("Pinned Modal session no longer exposes its authenticated checkpoint identity");
+  }
+  const pending = modalCheckpointProviderBindingForClient(settings, modal).then(
+    (binding) => canonicalModalCheckpointProviderBinding(binding)
+  );
+  modalSessionCheckpointBindings.set(session, pending);
+  try {
+    return await pending;
+  } catch (error) {
+    modalSessionCheckpointBindings.delete(session);
+    throw error;
+  }
+}
+async function modalSessionMatchesCheckpointProviderBinding(settings, session, expectedBindingKey) {
+  const identity = await resolveModalCheckpointProviderBindingForSession(settings, session);
+  return identity.key === expectedBindingKey;
+}
+async function resolveModalCheckpointProviderBinding(settings, createClient = createModalClient) {
+  const modal = await createClient(settings);
+  try {
+    const binding = await modalCheckpointProviderBindingForClient(settings, modal);
+    return canonicalModalCheckpointProviderBinding(binding);
+  } finally {
+    modal.close();
+  }
+}
+async function resolveModalCheckpointProviderBindingForLiveSandbox(settings, sandboxId, createClient = createModalClient) {
+  if (!sandboxId) throw new Error("Modal live-sandbox identity requires a sandbox id");
+  const modal = await createClient(settings);
+  try {
+    const binding = await modalCheckpointProviderBindingForClient(settings, modal);
+    const sandbox = await modal.sandboxes.fromId(sandboxId);
+    const exitCode = await sandbox.poll();
+    if (exitCode !== null) {
+      throw new Error(`Modal sandbox ${sandboxId} is no longer running`);
+    }
+    return canonicalModalCheckpointProviderBinding(binding);
+  } finally {
+    modal.close();
+  }
+}
+async function inspectModalSandboxLifecycle(settings, sandboxId, expectedBindingKey, createClient = createModalClient) {
+  if (!sandboxId) throw new Error("Modal lifecycle inspection requires a sandbox id");
+  const modal = await createClient(settings);
+  try {
+    const binding = canonicalModalCheckpointProviderBinding(
+      await modalCheckpointProviderBindingForClient(settings, modal)
+    );
+    if (expectedBindingKey && binding.key !== expectedBindingKey) {
+      throw new Error(
+        "Modal lifecycle inspection refused because the configured credential workspace changed"
+      );
+    }
+    try {
+      const sandbox = await modal.sandboxes.fromId(sandboxId);
+      const exitCode = await sandbox.poll();
+      return exitCode === null ? {
+        status: "running",
+        providerBindingKey: binding.key,
+        providerBinding: binding.binding
+      } : {
+        status: "terminated",
+        exitCode,
+        providerBindingKey: binding.key,
+        providerBinding: binding.binding
+      };
+    } catch (error) {
+      if (isModalNotFoundError(error)) {
+        return {
+          status: "not_found",
+          providerBindingKey: binding.key,
+          providerBinding: binding.binding
+        };
+      }
+      throw error;
+    }
+  } finally {
+    modal.close();
+  }
+}
+async function deleteModalCheckpointSnapshot(settings, expectedBindingKey, snapshotId, createClient = createModalClient) {
+  if (!snapshotId) throw new Error("Modal checkpoint deletion requires a snapshot id");
+  const modal = await createClient(settings);
+  try {
+    const binding = await modalCheckpointProviderBindingForClient(settings, modal);
+    const identity = canonicalModalCheckpointProviderBinding(binding);
+    if (expectedBindingKey !== identity.key) {
+      throw new Error(
+        "Modal checkpoint deletion refused because the configured credential workspace changed"
+      );
+    }
+    try {
+      await modal.images.delete(snapshotId);
+      return "deleted";
+    } catch (error) {
+      if (isModalNotFoundError(error)) return "not_found";
+      throw error;
+    }
+  } finally {
+    modal.close();
+  }
+}
 async function tagModalSandbox(settings, sandboxId, attribution) {
   if (!sandboxId) {
     return false;
@@ -13359,15 +13614,15 @@ var noneProvider = {
   }
 };
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/runloop/sandbox.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/runloop/sandbox.mjs
 import { posix as pathPosix2 } from "path";
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/runloop/mounts.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/runloop/mounts.mjs
 function isRunloopCloudBucketMountEntry(entry) {
   return isRcloneCloudBucketMountEntry(entry, "runloop_cloud_bucket");
 }
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/runloop/sandbox.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/runloop/sandbox.mjs
 var DEFAULT_RUNLOOP_WORKSPACE_ROOT = "/home/user";
 var DEFAULT_RUNLOOP_ROOT_WORKSPACE_ROOT = "/root";
 var UNKNOWN_RUNLOOP_EXIT_CODE = 1;
@@ -15950,10 +16205,11 @@ var SelfhostedSession = class {
       }
     }
   }
-  /** The clamped exec process deadline (ms): the exec-specific budget when threaded,
-   *  else the control timeout. Shared by `exec()` (the wire deadline) and
-   *  `execCommand()` (the timed-out hint's "N-second limit"), so the two never drift. */
-  execDeadlineMs() {
+  /** The effective clamped exec process deadline (ms): the exec-specific budget
+   *  when threaded, else the control timeout. Public so adapters that project a
+   *  structured command receipt can report the exact deadline the agent enforces
+   *  instead of repeating (and potentially drifting from) this normalization. */
+  get effectiveExecDeadlineMs() {
     return Math.max(
       1,
       Math.min(Math.trunc(this.execTimeoutMs ?? this.timeoutMs), SELFHOSTED_MAX_EXEC_TIMEOUT_MS)
@@ -15961,7 +16217,7 @@ var SelfhostedSession = class {
   }
   /** Channel-A `exec`: run a command on the machine and return its output. */
   async exec(args) {
-    const executionTimeoutMs = this.execDeadlineMs();
+    const executionTimeoutMs = this.effectiveExecDeadlineMs;
     const execReq = {
       // The agent does NOT shell-interpret unless `shell` — Channel-A passes a
       // single shell command string, so run it through the platform shell.
@@ -16090,7 +16346,7 @@ var SelfhostedSession = class {
   async execCommand(args) {
     const result = await this.exec({ cmd: args.cmd, workdir: args.workdir, runAs: args.runAs });
     if (result.timedOut) {
-      const hint = execDeadlineHint(Math.round(this.execDeadlineMs() / 1e3));
+      const hint = execDeadlineHint(Math.round(this.effectiveExecDeadlineMs / 1e3));
       return result.output ? `${result.output}
 ${hint}` : hint;
     }
@@ -16606,7 +16862,7 @@ var selfhostedProvider = {
   }
 };
 
-// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+d7f081875ac70c34/node_modules/@openai/agents-extensions/dist/sandbox/vercel/sandbox.mjs
+// ../../node_modules/.bun/@openai+agents-extensions@0.13.3+b8edd3968b3469c2/node_modules/@openai/agents-extensions/dist/sandbox/vercel/sandbox.mjs
 var DEFAULT_VERCEL_WORKSPACE_ROOT = "/vercel/sandbox";
 var VercelSandboxSession = class _VercelSandboxSession extends RemoteSandboxSessionBase {
   sandbox;
@@ -17602,7 +17858,99 @@ function isProviderSandboxTransientError(backendId, error) {
 
 // src/sandbox/workspace-archive.ts
 import { createHash as createHash4 } from "crypto";
-var WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION = 1;
+import {
+  WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,
+  decodeNativeSnapshotRef as decodeNativeSnapshotRef2,
+  parseWorkspaceArchiveDescriptor
+} from "@opengeni/contracts";
+
+// src/sandbox/provider-operation-gate.ts
+var providerOperationGates = /* @__PURE__ */ new WeakMap();
+function sessionIdentity(session) {
+  const identityType = typeof session;
+  if (!["object", "function"].includes(identityType) || session === null) {
+    throw new Error("Sandbox provider operation has no session identity");
+  }
+  return session;
+}
+function gateFor(session) {
+  const existing = providerOperationGates.get(session);
+  if (existing) return existing;
+  const created = {
+    activeOperations: 0,
+    captureActive: false,
+    operationWaiters: [],
+    captureWaiters: []
+  };
+  providerOperationGates.set(session, created);
+  return created;
+}
+async function enterOperation(gate) {
+  if (!gate.captureActive && gate.captureWaiters.length === 0) {
+    gate.activeOperations += 1;
+    return;
+  }
+  await new Promise((resolve5) => gate.operationWaiters.push(resolve5));
+}
+function leaveOperation(gate) {
+  gate.activeOperations -= 1;
+  if (gate.activeOperations < 0) {
+    throw new Error("Sandbox provider operation gate underflow");
+  }
+  if (gate.activeOperations === 0) {
+    const nextCapture = gate.captureWaiters.shift();
+    if (nextCapture) {
+      gate.captureActive = true;
+      nextCapture();
+    }
+  }
+}
+async function enterCapture(gate) {
+  if (!gate.captureActive && gate.activeOperations === 0) {
+    gate.captureActive = true;
+    return;
+  }
+  await new Promise((resolve5) => gate.captureWaiters.push(resolve5));
+}
+function leaveCapture(gate) {
+  if (!gate.captureActive) {
+    throw new Error("Sandbox provider capture gate was not held");
+  }
+  const nextCapture = gate.captureWaiters.shift();
+  if (nextCapture) {
+    nextCapture();
+    return;
+  }
+  gate.captureActive = false;
+  const operations = gate.operationWaiters.splice(0);
+  gate.activeOperations += operations.length;
+  for (const operation of operations) operation();
+}
+async function withSandboxProviderOperation(session, operation) {
+  const gate = gateFor(sessionIdentity(session));
+  await enterOperation(gate);
+  try {
+    return await operation();
+  } finally {
+    leaveOperation(gate);
+  }
+}
+async function withSandboxProviderCapture(session, capture) {
+  const gate = gateFor(sessionIdentity(session));
+  await enterCapture(gate);
+  try {
+    return await capture();
+  } finally {
+    leaveCapture(gate);
+  }
+}
+
+// src/sandbox/workspace-archive.ts
+import {
+  WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION as WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION2,
+  decodeNativeSnapshotRef as decodeNativeSnapshotRef3,
+  parseWorkspaceArchiveDescriptor as parseWorkspaceArchiveDescriptor2
+} from "@opengeni/contracts";
 var WorkspaceArchiveIntegrityError = class extends Error {
   constructor(code, message, options = {}) {
     super(message);
@@ -17612,23 +17960,9 @@ var WorkspaceArchiveIntegrityError = class extends Error {
   name = "WorkspaceArchiveIntegrityError";
   retryable;
 };
-var SHA256 = /^[a-f0-9]{64}$/;
-var REVISION = /^wa1:[0-9]{13}:[a-f0-9]{64}$/;
 function sha256(bytes) {
   return createHash4("sha256").update(bytes).digest("hex");
 }
-function nonnegativeInteger(value) {
-  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
-}
-function parseWorkspaceArchiveDescriptor(value) {
-  if (!value || typeof value !== "object") return null;
-  const candidate = value;
-  const workspace = candidate.workspace;
-  if (candidate.version !== WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION || typeof candidate.revision !== "string" || !REVISION.test(candidate.revision) || typeof candidate.archiveSha256 !== "string" || !SHA256.test(candidate.archiveSha256) || !nonnegativeInteger(candidate.archiveBytes) || candidate.archiveBytes === 0 || typeof candidate.capturedAt !== "string" || !Number.isFinite(Date.parse(candidate.capturedAt)) || !workspace || workspace.algorithm !== "sha256" || typeof workspace.sha256 !== "string" || !SHA256.test(workspace.sha256) || !nonnegativeInteger(workspace.entryCount) || !nonnegativeInteger(workspace.fileCount) || !nonnegativeInteger(workspace.totalFileBytes)) {
-    return null;
-  }
-  return candidate;
-}
 function decodeBase64Strict(value) {
   if (value.length === 0 || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(value)) {
     return null;
@@ -17636,6 +17970,29 @@ function decodeBase64Strict(value) {
   const bytes = Uint8Array.from(Buffer.from(value, "base64"));
   return Buffer.from(bytes).toString("base64") === value ? bytes : null;
 }
+function describeNativeSnapshotArchive(bytes, capturedAtMs = Date.now()) {
+  const native = decodeNativeSnapshotRef2(bytes);
+  if (!native) return null;
+  const archiveSha256 = sha256(bytes);
+  return {
+    version: WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,
+    kind: "provider_snapshot",
+    revision: `wa2:${String(capturedAtMs).padStart(13, "0")}:${archiveSha256}`,
+    archiveSha256,
+    archiveBytes: bytes.length,
+    capturedAt: new Date(capturedAtMs).toISOString(),
+    provider: native.provider,
+    snapshotId: native.snapshotId,
+    ...native.workspacePersistence ? { workspacePersistence: native.workspacePersistence } : {}
+  };
+}
+function describeLegacyNativeSnapshotArchive(base642, observedAtMs = Date.now()) {
+  if (typeof base642 !== "string") return null;
+  const bytes = decodeBase64Strict(base642);
+  if (!bytes) return null;
+  const descriptor = describeNativeSnapshotArchive(bytes, observedAtMs);
+  return descriptor ? { archiveBase64: base642, descriptor } : null;
+}
 function readVerifiedWorkspaceArchive(base642, metadata) {
   if (base642 === void 0 || base642 === null || base642 === "") return null;
   if (typeof base642 !== "string") {
@@ -17671,7 +18028,27 @@ function readVerifiedWorkspaceArchive(base642, metadata) {
       `workspace archive revision ${descriptor.revision} failed SHA-256/size verification`
     );
   }
-  return { bytes, base64: base642, descriptor };
+  const nativeSnapshot = decodeNativeSnapshotRef2(bytes);
+  if (descriptor.version === WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION) {
+    if (!nativeSnapshot || nativeSnapshot.provider !== descriptor.provider || nativeSnapshot.snapshotId !== descriptor.snapshotId || nativeSnapshot.workspacePersistence !== descriptor.workspacePersistence) {
+      throw new WorkspaceArchiveIntegrityError(
+        "native_snapshot_reference_invalid",
+        `native snapshot receipt does not match descriptor revision ${descriptor.revision}`
+      );
+    }
+  } else if (nativeSnapshot) {
+    throw new WorkspaceArchiveIntegrityError(
+      "native_snapshot_reference_invalid",
+      `legacy native snapshot receipt ${descriptor.revision} was not durably upgraded to a v2 provider descriptor`
+    );
+  }
+  return {
+    bytes,
+    base64: base642,
+    descriptor,
+    kind: descriptor.version === WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION ? "provider_snapshot" : "tar",
+    ...descriptor.version === WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION && nativeSnapshot ? { nativeSnapshot } : {}
+  };
 }
 function stdoutFromExecResult(value) {
   if (typeof value === "string") {
@@ -17682,15 +18059,33 @@ function stdoutFromExecResult(value) {
   const output = value;
   return typeof output.stdout === "string" ? output.stdout : typeof output.output === "string" ? output.output : "";
 }
-var WORKSPACE_FINGERPRINT_COMMAND = String.raw`bash -o pipefail -c '
-set -eu
+function shellQuote3(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function workspaceFingerprintExcludes(session) {
+  const paths = session.state?.manifest?.ephemeralPersistencePaths?.();
+  if (!paths) return [];
+  return [...paths].filter((path) => typeof path === "string" && path.length > 0).sort((left, right) => left.localeCompare(right));
+}
+function workspaceFingerprintCommand(excludedPaths) {
+  const tarExcludes = excludedPaths.flatMap((path) => [
+    shellQuote3(`--exclude=${path}`),
+    shellQuote3(`--exclude=./${path}`)
+  ]);
+  const findExcludes = excludedPaths.flatMap((path) => [
+    `-path ${shellQuote3(`./${path}`)}`,
+    `-path ${shellQuote3(`./${path}/*`)}`
+  ]);
+  const findPrefix = findExcludes.length === 0 ? "" : `\\( ${findExcludes.join(" -o ")} \\) -prune -o `;
+  const script = String.raw`set -eu
 cd /workspace
-digest=$(LC_ALL=C tar --sort=name --mtime="@0" --owner=0 --group=0 --numeric-owner --format=gnu -cf - . | sha256sum | awk "{print \$1}")
-entries=$(find . -xdev -mindepth 1 -printf x | wc -c | tr -d " ")
-files=$(find . -xdev -type f -printf x | wc -c | tr -d " ")
-bytes=$(find . -xdev -type f -printf "%s\n" | awk "{s+=\$1} END {printf \"%.0f\", s+0}")
-printf "OPENGENI_WORKSPACE_FINGERPRINT_V1 %s %s %s %s\n" "$digest" "$entries" "$files" "$bytes"
-'`;
+digest=$(LC_ALL=C tar ${tarExcludes.join(" ")} --sort=name --mtime="@0" --owner=0 --group=0 --numeric-owner --hard-dereference --format=gnu -cf - . | sha256sum | awk "{print \$1}")
+entries=$(find . -xdev -mindepth 1 ${findPrefix}-printf x | wc -c | tr -d " ")
+files=$(find . -xdev ${findPrefix}-type f -printf x | wc -c | tr -d " ")
+bytes=$(find . -xdev ${findPrefix}-type f -printf "%s\n" | awk "{s+=\$1} END {printf \"%.0f\", s+0}")
+printf "OPENGENI_WORKSPACE_FINGERPRINT_V1 %s %s %s %s\n" "$digest" "$entries" "$files" "$bytes"`;
+  return `bash -o pipefail -c ${shellQuote3(script)}`;
+}
 async function fingerprintSandboxWorkspace(session) {
   const target = session;
   const run2 = target.exec ?? target.execCommand;
@@ -17701,7 +18096,7 @@ async function fingerprintSandboxWorkspace(session) {
     );
   }
   const result = await run2.call(target, {
-    cmd: WORKSPACE_FINGERPRINT_COMMAND,
+    cmd: workspaceFingerprintCommand(workspaceFingerprintExcludes(target)),
     yieldTimeMs: 12e4,
     maxOutputTokens: 1e3
   });
@@ -17734,6 +18129,11 @@ function fingerprintsEqual(a, b) {
   return a.sha256 === b.sha256 && a.entryCount === b.entryCount && a.fileCount === b.fileCount && a.totalFileBytes === b.totalFileBytes;
 }
 async function captureVerifiedWorkspaceArchive(session, capturedAtMs = Date.now()) {
+  return await withSandboxProviderCapture(session, async () => {
+    return await captureVerifiedWorkspaceArchiveExclusive(session, capturedAtMs);
+  });
+}
+async function captureVerifiedWorkspaceArchiveExclusive(session, capturedAtMs) {
   const target = session;
   if (typeof target.persistWorkspace !== "function") {
     throw new WorkspaceArchiveIntegrityError(
@@ -17741,7 +18141,10 @@ async function captureVerifiedWorkspaceArchive(session, capturedAtMs = Date.now(
       "sandbox session does not support workspace persistence"
     );
   }
-  const before = await fingerprintSandboxWorkspace(target);
+  const configuredPersistence = target.state?.workspacePersistence;
+  const configuredTarFallback = workspaceFingerprintExcludes(target).length > 0;
+  const expectsNativeSnapshot = typeof configuredPersistence === "string" && configuredPersistence !== "tar" && !configuredTarFallback;
+  const before = expectsNativeSnapshot ? null : await fingerprintSandboxWorkspace(target);
   const bytes = await target.persistWorkspace();
   if (!bytes || bytes.length === 0) {
     throw new WorkspaceArchiveIntegrityError(
@@ -17750,8 +18153,25 @@ async function captureVerifiedWorkspaceArchive(session, capturedAtMs = Date.now(
       { retryable: true }
     );
   }
+  const nativeSnapshot = decodeNativeSnapshotRef2(bytes);
+  if (nativeSnapshot) {
+    const descriptor2 = describeNativeSnapshotArchive(bytes, capturedAtMs);
+    return {
+      bytes,
+      base64: Buffer.from(bytes).toString("base64"),
+      descriptor: descriptor2,
+      kind: "provider_snapshot",
+      nativeSnapshot
+    };
+  }
+  if (expectsNativeSnapshot) {
+    throw new WorkspaceArchiveIntegrityError(
+      "native_snapshot_fallback_unverified",
+      `sandbox configured for ${String(configuredPersistence)} returned a tar archive instead of a native snapshot receipt`
+    );
+  }
   const after = await fingerprintSandboxWorkspace(target);
-  if (!fingerprintsEqual(before, after)) {
+  if (!before || !fingerprintsEqual(before, after)) {
     throw new WorkspaceArchiveIntegrityError(
       "workspace_changed_during_capture",
       "workspace changed while its durable archive was being captured",
@@ -17760,7 +18180,7 @@ async function captureVerifiedWorkspaceArchive(session, capturedAtMs = Date.now(
   }
   const archiveSha256 = sha256(bytes);
   const descriptor = {
-    version: WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,
+    version: 1,
     revision: `wa1:${String(capturedAtMs).padStart(13, "0")}:${archiveSha256}`,
     archiveSha256,
     archiveBytes: bytes.length,
@@ -17770,10 +18190,14 @@ async function captureVerifiedWorkspaceArchive(session, capturedAtMs = Date.now(
   return {
     bytes,
     base64: Buffer.from(bytes).toString("base64"),
-    descriptor
+    descriptor,
+    kind: "tar"
   };
 }
 async function verifyRestoredWorkspace(session, descriptor) {
+  if (descriptor.version === WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION) {
+    return null;
+  }
   const actual = await fingerprintSandboxWorkspace(session);
   if (!fingerprintsEqual(actual, descriptor.workspace)) {
     throw new WorkspaceArchiveIntegrityError(
@@ -18136,7 +18560,7 @@ function buildDisplayStackScript(options = {}) {
   const port = options.port ?? DESKTOP_STREAM_PORT4;
   const env = `DESKTOP_W=${geometry.width} DESKTOP_H=${geometry.height} DESKTOP_DPI=${geometry.dpi} STREAM_PORT=${port}`;
   const lockedLauncher = `ds_started=$1; fw=$2; ds_class=cold; ds_stage() { ds_now=$(date +%s%3N); echo "OPENGENI_DISPLAY_STAGE stage=$1 elapsed_ms=$((ds_now-ds_started)) classification=$ds_class"; }; fa=$(date +%s%3N); fd=$((fa-fw)); [ "$fd" -ge 50 ] && ds_class=contention; ds_stage outer_flock_acquired; ds_stage launcher_issued; env ${env} opengeni-desktop-up; urc=$?; ds_stage launcher_complete; exit "$urc"`;
-  const bringUp = `if nc -z 127.0.0.1 ${port} >/dev/null 2>&1 && nc -z 127.0.0.1 5900 >/dev/null 2>&1; then ds_class=already_ready; ds_stage precheck_ready; echo "OPENGENI_DESKTOP_UP port=${port} geometry=${geometry.width}x${geometry.height} dpi=${geometry.dpi} (precheck)"; else ds_class=cold; ds_stage precheck_miss; mkdir -p /tmp/opengeni-desktop; ds_stage outer_flock_wait; fw=$(date +%s%3N); flock --close --conflict-exit-code 75 --wait 45 /tmp/opengeni-desktop/up.outer.lock bash -c ${shellQuote3(lockedLauncher)} _ "$ds_started" "$fw"; frc=$?; if [ "$frc" -eq 75 ]; then ds_stage outer_flock_timeout; echo "OPENGENI_DESKTOP_LOCK_TIMEOUT"; exit 15; fi; if [ "$frc" -ne 0 ]; then exit "$frc"; fi; fi`;
+  const bringUp = `if nc -z 127.0.0.1 ${port} >/dev/null 2>&1 && nc -z 127.0.0.1 5900 >/dev/null 2>&1; then ds_class=already_ready; ds_stage precheck_ready; echo "OPENGENI_DESKTOP_UP port=${port} geometry=${geometry.width}x${geometry.height} dpi=${geometry.dpi} (precheck)"; else ds_class=cold; ds_stage precheck_miss; mkdir -p /tmp/opengeni-desktop; ds_stage outer_flock_wait; fw=$(date +%s%3N); flock --close --conflict-exit-code 75 --wait 45 /tmp/opengeni-desktop/up.outer.lock bash -c ${shellQuote4(lockedLauncher)} _ "$ds_started" "$fw"; frc=$?; if [ "$frc" -eq 75 ]; then ds_stage outer_flock_timeout; echo "OPENGENI_DESKTOP_LOCK_TIMEOUT"; exit 15; fi; if [ "$frc" -ne 0 ]; then exit "$frc"; fi; fi`;
   const paintProbe = `ds_stage paint_probe_started; p=/tmp/opengeni-desktop/paint-probe.png; prev=0; for i in $(seq 1 ${PAINT_PROBE_ATTEMPTS}); do if DISPLAY=:0 scrot -o "$p" >/dev/null 2>&1; then sz=$(wc -c < "$p" 2>/dev/null || echo 0); else sz=0; fi; rm -f "$p"; if [ "$sz" -ge ${PAINT_MIN_BYTES} ] && [ "$prev" -ge ${PAINT_MIN_BYTES} ]; then d=$((sz-prev)); [ "$d" -lt 0 ] && d=$((0-d)); if [ "$d" -le ${PAINT_SETTLE_DELTA_BYTES} ]; then ds_stage paint_ready; break; fi; fi; prev=$sz; if [ "$i" = "${PAINT_PROBE_ATTEMPTS}" ]; then ds_stage paint_failed; echo "OPENGENI_DESKTOP_NOT_PAINTING scrot below ${PAINT_MIN_BYTES}B or unsettled after warmup (last=$sz)"; exit 14; fi; sleep ${PAINT_PROBE_INTERVAL_S}; done`;
   const trace = `ds_started=$(date +%s%3N); ds_class=unknown; ds_stage() { ds_now=$(date +%s%3N); echo "OPENGENI_DISPLAY_STAGE stage=$1 elapsed_ms=$((ds_now-ds_started)) classification=$ds_class"; }; ds_stage script_entry`;
   return `${trace}; mkdir -p /tmp/opengeni-desktop; { ${bringUp} ; } && { ${paintProbe} ; }`;
@@ -18163,7 +18587,7 @@ function execResultSessionId(result) {
   const value = result.sessionId ?? result.session_id;
   return typeof value === "number" ? value : null;
 }
-function shellQuote3(value) {
+function shellQuote4(value) {
   return `'${value.replaceAll("'", `'"'"'`)}'`;
 }
 function boundedDisplayStackCommand(command, timeoutMs, markerPath, markerToken) {
@@ -18175,13 +18599,13 @@ function boundedDisplayStackCommand(command, timeoutMs, markerPath, markerToken)
   const killAfterMs = Math.max(1, Math.floor(graceMs / 2));
   const commandTimeoutSeconds = (commandTimeoutMs / 1e3).toFixed(3);
   const killAfterSeconds = (killAfterMs / 1e3).toFixed(3);
-  const managedCommand = `marker=${shellQuote3(markerPath)}; token=${shellQuote3(markerToken)}; cancel="$marker.cancelled"; if [ -e "$cancel" ]; then echo "OPENGENI_DISPLAY_CANCELLED"; exit 124; fi; pid=$$; pgid=$(ps -o pgid= -p "$pid" 2>/dev/null | tr -d ' '); start=$(awk '{print $22}' "/proc/$pid/stat" 2>/dev/null || true); printf '%s %s %s %s\\n' "$pid" "$pgid" "$start" "$token" >"$marker"; if [ -e "$cancel" ]; then rm -f "$marker"; echo "OPENGENI_DISPLAY_CANCELLED"; exit 124; fi; bash -c ${shellQuote3(command)}; rc=$?; rm -f "$marker"; exit "$rc"`;
+  const managedCommand = `marker=${shellQuote4(markerPath)}; token=${shellQuote4(markerToken)}; cancel="$marker.cancelled"; if [ -e "$cancel" ]; then echo "OPENGENI_DISPLAY_CANCELLED"; exit 124; fi; pid=$$; pgid=$(ps -o pgid= -p "$pid" 2>/dev/null | tr -d ' '); start=$(awk '{print $22}' "/proc/$pid/stat" 2>/dev/null || true); printf '%s %s %s %s\\n' "$pid" "$pgid" "$start" "$token" >"$marker"; if [ -e "$cancel" ]; then rm -f "$marker"; echo "OPENGENI_DISPLAY_CANCELLED"; exit 124; fi; bash -c ${shellQuote4(command)}; rc=$?; rm -f "$marker"; exit "$rc"`;
   return (
     // Do not use timeout --foreground here. The display command contains flock
     // supervisors and launcher children; default process-group mode is required
     // so a deadline cannot leave a waiter alive to acquire the lock and launch
     // after the caller has already failed.
-    `timeout --signal=TERM --kill-after=${killAfterSeconds}s ${commandTimeoutSeconds}s bash -c ${shellQuote3(managedCommand)}; rc=$?; if [ "$rc" -eq 124 ]; then echo "OPENGENI_DISPLAY_TIMEOUT elapsed_ms=${commandTimeoutMs}"; fi; exit "$rc"`
+    `timeout --signal=TERM --kill-after=${killAfterSeconds}s ${commandTimeoutSeconds}s bash -c ${shellQuote4(managedCommand)}; rc=$?; if [ "$rc" -eq 124 ]; then echo "OPENGENI_DISPLAY_TIMEOUT elapsed_ms=${commandTimeoutMs}"; fi; exit "$rc"`
   );
 }
 var DisplayStackWallTimeoutError = class extends Error {
@@ -18416,10 +18840,10 @@ async function beforeDeadline(promise, deadline, now = monotonicNow) {
   }
 }
 function displayStackCleanupCommand(markerPath, markerToken) {
-  const marker = shellQuote3(markerPath);
-  const token = shellQuote3(markerToken);
+  const marker = shellQuote4(markerPath);
+  const token = shellQuote4(markerToken);
   const script = `marker=${marker}; token=${token}; cancel="$marker.cancelled"; : >"$cancel" || { echo "OPENGENI_DISPLAY_CLEANUP status=invalid"; exit 75; }; if [ ! -r "$marker" ]; then echo "OPENGENI_DISPLAY_CLEANUP status=stopped"; exit 0; fi; read -r pid pgid start actual <"$marker" || { echo "OPENGENI_DISPLAY_CLEANUP status=invalid"; exit 75; }; [ "$actual" = "$token" ] || { echo "OPENGENI_DISPLAY_CLEANUP status=invalid"; exit 75; }; case "$pid" in ''|*[!0-9]*) echo "OPENGENI_DISPLAY_CLEANUP status=invalid"; exit 75;; esac; case "$pgid" in ''|*[!0-9]*) echo "OPENGENI_DISPLAY_CLEANUP status=invalid"; exit 75;; esac; case "$start" in ''|*[!0-9]*) echo "OPENGENI_DISPLAY_CLEANUP status=invalid"; exit 75;; esac; current=$(awk '{print $22}' "/proc/$pid/stat" 2>/dev/null || true); if [ -z "$current" ] || [ "$current" != "$start" ]; then rm -f "$marker"; echo "OPENGENI_DISPLAY_CLEANUP status=stopped"; exit 0; fi; kill -TERM -- "-$pgid" 2>/dev/null || true; for i in $(seq 1 10); do if ! kill -0 -- "-$pgid" 2>/dev/null; then rm -f "$marker"; echo "OPENGENI_DISPLAY_CLEANUP status=stopped"; exit 0; fi; sleep 0.05; done; kill -KILL -- "-$pgid" 2>/dev/null || true; for i in $(seq 1 20); do if ! kill -0 -- "-$pgid" 2>/dev/null; then rm -f "$marker"; echo "OPENGENI_DISPLAY_CLEANUP status=stopped"; exit 0; fi; sleep 0.05; done; echo "OPENGENI_DISPLAY_CLEANUP status=alive"; exit 75`;
-  return `timeout --signal=TERM --kill-after=0.2s 1.5s bash -c ${shellQuote3(script)}`;
+  return `timeout --signal=TERM --kill-after=0.2s 1.5s bash -c ${shellQuote4(script)}`;
 }
 async function runProviderCommandToDeadline(session, command, deadline) {
   const controller = new AbortController();
@@ -19163,7 +19587,7 @@ function runCredentialRoot(sessionId) {
 function runCredentialPointerFile(sessionId) {
   return `${runCredentialRoot(sessionId)}/current`;
 }
-function shellQuote4(value) {
+function shellQuote5(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
 function base64(value) {
@@ -19181,8 +19605,8 @@ function portableBase64DecodeCommand() {
   ].join("\n");
 }
 function pointerLockAcquireCommands(root) {
-  const lockFile = shellQuote4(`${root}/.pointer.lock`);
-  const lockDirectory = shellQuote4(`${root}/.pointer.lockdir`);
+  const lockFile = shellQuote5(`${root}/.pointer.lock`);
+  const lockDirectory = shellQuote5(`${root}/.pointer.lockdir`);
   return [
     `if command -v flock >/dev/null 2>&1; then`,
     `  exec 9>${lockFile}`,
@@ -19228,7 +19652,7 @@ ${cmd}
 printf '\\n${COMMAND_OK_MARKER}\\n'`;
   const args = {
     cmd: `set +x
-env -u BASH_ENV bash --noprofile --norc -c ${shellQuote4(marked)}`,
+env -u BASH_ENV bash --noprofile --norc -c ${shellQuote5(marked)}`,
     yieldTimeMs: 12e4,
     maxOutputTokens: 4e3
   };
@@ -19238,19 +19662,19 @@ env -u BASH_ENV bash --noprofile --norc -c ${shellQuote4(marked)}`,
   }
 }
 async function writeCredentialFile(session, path, content, commandRunner) {
-  await runCredentialCommand(session, `: > ${shellQuote4(path)}`, commandRunner);
+  await runCredentialCommand(session, `: > ${shellQuote5(path)}`, commandRunner);
   const encoded = base64(content);
   for (let offset = 0; offset < encoded.length; offset += WRITE_CHUNK_BYTES) {
     const chunk = encoded.slice(offset, offset + WRITE_CHUNK_BYTES);
     await runCredentialCommand(
       session,
-      `printf %s ${shellQuote4(chunk)} | ${portableBase64DecodeCommand()} >> ${shellQuote4(path)}`,
+      `printf %s ${shellQuote5(chunk)} | ${portableBase64DecodeCommand()} >> ${shellQuote5(path)}`,
       commandRunner
     );
   }
   await runCredentialCommand(
     session,
-    `[ "$(wc -c < ${shellQuote4(path)} | tr -d '[:space:]')" = ${shellQuote4(String(byteLength(content)))} ]`,
+    `[ "$(wc -c < ${shellQuote5(path)} | tr -d '[:space:]')" = ${shellQuote5(String(byteLength(content)))} ]`,
     commandRunner
   );
 }
@@ -19275,19 +19699,19 @@ async function materializeRunCredentials(session, material, options) {
     session,
     [
       "umask 077",
-      `mkdir -p -- ${shellQuote4(`${root}/versions`)}`,
-      `chmod 0700 -- ${shellQuote4(root)} ${shellQuote4(`${root}/versions`)}`,
-      `rm -rf -- ${shellQuote4(stage)}`,
-      `mkdir -p -- ${shellQuote4(`${stage}/files`)}`
+      `mkdir -p -- ${shellQuote5(`${root}/versions`)}`,
+      `chmod 0700 -- ${shellQuote5(root)} ${shellQuote5(`${root}/versions`)}`,
+      `rm -rf -- ${shellQuote5(stage)}`,
+      `mkdir -p -- ${shellQuote5(`${stage}/files`)}`
     ].join("\n"),
     options.commandRunner
   );
   const environmentLines = [
     ...Object.entries(material.environment).map(
-      ([name, value]) => `export ${name}=${shellQuote4(value)}`
+      ([name, value]) => `export ${name}=${shellQuote5(value)}`
     ),
     ...Object.entries(material.fileEnvironment).map(
-      ([name, path]) => `export ${name}=${shellQuote4(`${version}/files/${path}`)}`
+      ([name, path]) => `export ${name}=${shellQuote5(`${version}/files/${path}`)}`
     )
   ];
   await writeCredentialFile(
@@ -19299,17 +19723,17 @@ async function materializeRunCredentials(session, material, options) {
   );
   await runCredentialCommand(
     session,
-    `chmod 0600 -- ${shellQuote4(`${stage}/env`)}`,
+    `chmod 0600 -- ${shellQuote5(`${stage}/env`)}`,
     options.commandRunner
   );
   for (const file of material.files) {
     const target = `${stage}/files/${file.path}`;
     const parent = target.slice(0, target.lastIndexOf("/"));
-    await runCredentialCommand(session, `mkdir -p -- ${shellQuote4(parent)}`, options.commandRunner);
+    await runCredentialCommand(session, `mkdir -p -- ${shellQuote5(parent)}`, options.commandRunner);
     await writeCredentialFile(session, target, file.content, options.commandRunner);
     await runCredentialCommand(
       session,
-      `chmod ${shellQuote4(file.mode ?? "0600")} -- ${shellQuote4(target)}`,
+      `chmod ${shellQuote5(file.mode ?? "0600")} -- ${shellQuote5(target)}`,
       options.commandRunner
     );
   }
@@ -19317,19 +19741,19 @@ async function materializeRunCredentials(session, material, options) {
     session,
     [
       ...pointerLockAcquireCommands(root),
-      `previous=$(cat -- ${shellQuote4(`${root}/current`)} 2>/dev/null || :)`,
-      `mv -- ${shellQuote4(stage)} ${shellQuote4(version)}`,
-      `printf '%s\\n' ${shellQuote4(versionName)} > ${shellQuote4(`${root}/.next`)}`,
-      `mv -f -- ${shellQuote4(`${root}/.next`)} ${shellQuote4(`${root}/current`)}`,
+      `previous=$(cat -- ${shellQuote5(`${root}/current`)} 2>/dev/null || :)`,
+      `mv -- ${shellQuote5(stage)} ${shellQuote5(version)}`,
+      `printf '%s\\n' ${shellQuote5(versionName)} > ${shellQuote5(`${root}/.next`)}`,
+      `mv -f -- ${shellQuote5(`${root}/.next`)} ${shellQuote5(`${root}/current`)}`,
       ...options.prunePreviousGenerations ? [
-        `find ${shellQuote4(`${root}/versions`)} -mindepth 1 -maxdepth 1 ! -name ${shellQuote4(versionName)} -exec rm -rf -- {} +`
+        `find ${shellQuote5(`${root}/versions`)} -mindepth 1 -maxdepth 1 ! -name ${shellQuote5(versionName)} -exec rm -rf -- {} +`
       ] : options.pruneOtherAttempts ? [
-        `find ${shellQuote4(`${root}/versions`)} -mindepth 1 -maxdepth 1 ! -name ${shellQuote4(`${attemptId}-${options.executionGeneration}-*`)} -exec rm -rf -- {} +`
+        `find ${shellQuote5(`${root}/versions`)} -mindepth 1 -maxdepth 1 ! -name ${shellQuote5(`${attemptId}-${options.executionGeneration}-*`)} -exec rm -rf -- {} +`
       ] : options.pruneSupersededGenerations ? [
-        `for candidate in ${shellQuote4(`${root}/versions`)}/${prefix}*; do`,
+        `for candidate in ${shellQuote5(`${root}/versions`)}/${prefix}*; do`,
         `  [ -e "$candidate" ] || continue`,
         `  name=\${candidate##*/}`,
-        `  [ "$name" = ${shellQuote4(versionName)} ] || [ "$name" = "$previous" ] || rm -rf -- "$candidate"`,
+        `  [ "$name" = ${shellQuote5(versionName)} ] || [ "$name" = "$previous" ] || rm -rf -- "$candidate"`,
         "done"
       ] : [],
       ...pointerLockReleaseCommands()
@@ -19342,10 +19766,10 @@ async function clearRunCredentials(session, sessionId, commandRunner) {
   await runCredentialCommand(
     session,
     [
-      `if [ -d ${shellQuote4(root)} ]; then`,
+      `if [ -d ${shellQuote5(root)} ]; then`,
       ...pointerLockAcquireCommands(root).map((line) => `  ${line}`),
-      `  rm -f -- ${shellQuote4(`${root}/current`)} ${shellQuote4(`${root}/.next`)}`,
-      `  rm -rf -- ${shellQuote4(`${root}/versions`)}`,
+      `  rm -f -- ${shellQuote5(`${root}/current`)} ${shellQuote5(`${root}/.next`)}`,
+      `  rm -rf -- ${shellQuote5(`${root}/versions`)}`,
       ...pointerLockReleaseCommands().map((line) => `  ${line}`),
       "fi"
     ].join("\n"),
@@ -19362,15 +19786,15 @@ async function clearRunCredentialsForAttempt(session, options, commandRunner) {
   await runCredentialCommand(
     session,
     [
-      `if [ -d ${shellQuote4(root)} ]; then`,
+      `if [ -d ${shellQuote5(root)} ]; then`,
       ...pointerLockAcquireCommands(root).map((line) => `  ${line}`),
-      `  if [ -r ${shellQuote4(`${root}/current`)} ]; then`,
-      `    current=$(cat -- ${shellQuote4(`${root}/current`)} 2>/dev/null || :)`,
-      `    case "$current" in ${shellQuote4(prefix)}*) rm -f -- ${shellQuote4(`${root}/current`)} ;; esac`,
+      `  if [ -r ${shellQuote5(`${root}/current`)} ]; then`,
+      `    current=$(cat -- ${shellQuote5(`${root}/current`)} 2>/dev/null || :)`,
+      `    case "$current" in ${shellQuote5(prefix)}*) rm -f -- ${shellQuote5(`${root}/current`)} ;; esac`,
       "  fi",
-      `  if [ -d ${shellQuote4(`${root}/versions`)} ]; then`,
-      `    find ${shellQuote4(`${root}/versions`)} -mindepth 1 -maxdepth 1 -name ${shellQuote4(`${prefix}*`)} -exec rm -rf -- {} +`,
-      `    find ${shellQuote4(`${root}/versions`)} -mindepth 1 -maxdepth 1 -name ${shellQuote4(`.stage-${prefix}*`)} -exec rm -rf -- {} +`,
+      `  if [ -d ${shellQuote5(`${root}/versions`)} ]; then`,
+      `    find ${shellQuote5(`${root}/versions`)} -mindepth 1 -maxdepth 1 -name ${shellQuote5(`${prefix}*`)} -exec rm -rf -- {} +`,
+      `    find ${shellQuote5(`${root}/versions`)} -mindepth 1 -maxdepth 1 -name ${shellQuote5(`.stage-${prefix}*`)} -exec rm -rf -- {} +`,
       "  fi",
       ...pointerLockReleaseCommands().map((line) => `  ${line}`),
       "fi"
@@ -19382,12 +19806,12 @@ function withRunCredentialEnvironment(cmd, sessionId) {
   const root = runCredentialRoot(sessionId);
   const pointerFile = runCredentialPointerFile(sessionId);
   return [
-    `if [ -r ${shellQuote4(pointerFile)} ]; then`,
-    `  _opengeni_credential_version=$(cat -- ${shellQuote4(pointerFile)} 2>/dev/null || :)`,
+    `if [ -r ${shellQuote5(pointerFile)} ]; then`,
+    `  _opengeni_credential_version=$(cat -- ${shellQuote5(pointerFile)} 2>/dev/null || :)`,
     '  case "$_opengeni_credential_version" in',
     "    ''|*[!A-Za-z0-9_-]*) ;;",
     "    *)",
-    `      _opengeni_credential_env=${shellQuote4(`${root}/versions`)}/"$_opengeni_credential_version/env"`,
+    `      _opengeni_credential_env=${shellQuote5(`${root}/versions`)}/"$_opengeni_credential_version/env"`,
     '      if [ -r "$_opengeni_credential_env" ]; then',
     "        set -a",
     '        . "$_opengeni_credential_env"',
@@ -19465,7 +19889,7 @@ var ToolspaceTokenPathError = class extends Error {
     this.name = "ToolspaceTokenPathError";
   }
 };
-function shellQuote5(value) {
+function shellQuote6(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
 function assertToolspaceSessionId(sessionId) {
@@ -19490,7 +19914,7 @@ function assertToolspaceFilePath(value, label) {
 }
 function shellToolspacePath(value) {
   const validated = assertToolspaceFilePath(value, "Toolspace token file");
-  return isHomeRelativeToolspacePath(validated) ? `"${validated}"` : shellQuote5(validated);
+  return isHomeRelativeToolspacePath(validated) ? `"${validated}"` : shellQuote6(validated);
 }
 function toolspaceTokenFileForSession(manifestTokenFile, sessionId) {
   const normalizedManifestFile = assertToolspaceFilePath(
@@ -20161,7 +20585,10 @@ var RoutingSandboxSession = class {
     if (!write) throw new RoutingUnsupportedError(op, record.backend.kind);
     let result;
     try {
-      result = await write.call(record.backend.session, args);
+      result = await withSandboxProviderOperation(
+        record.backend.session,
+        () => write.call(record.backend.session, args)
+      );
     } catch (error) {
       if (this.deps.afterProcessMutation) {
         const pending = {
@@ -20222,7 +20649,10 @@ var RoutingSandboxSession = class {
     await this.ensureParentPromotion(record);
     const write = record.backend.session.writeStdin;
     if (!write) throw new RoutingUnsupportedError("writeStdin", record.backend.kind);
-    const result = await write.call(record.backend.session, args);
+    const result = await withSandboxProviderOperation(
+      record.backend.session,
+      () => write.call(record.backend.session, args)
+    );
     const proof = retainedProcessTerminalProof(result, providerSessionId);
     if (proof) await this.settleRetainedProcess(record, proof, result);
     return result;
@@ -20246,7 +20676,7 @@ var RoutingSandboxSession = class {
       const admission = mutatesWorkspace ? await this.deps.beforeMutation?.({ op, backend }) : void 0;
       let result;
       try {
-        result = await fn(backend.session);
+        result = await withSandboxProviderOperation(backend.session, () => fn(backend.session));
       } catch (error) {
         if (mutatesWorkspace && this.deps.afterMutation) {
           try {
@@ -20466,11 +20896,21 @@ var RoutingSandboxSession = class {
       return terminal.result;
     }
     await this.ensureParentPromotion(record);
-    if (record.backend.session.execCommand) {
-      return await record.backend.session.execCommand(args);
+    const execCommand = record.backend.session.execCommand;
+    if (execCommand) {
+      return await withSandboxProviderOperation(
+        record.backend.session,
+        () => execCommand.call(record.backend.session, args)
+      );
     }
-    if (record.backend.session.exec) {
-      return formatExecResult(await record.backend.session.exec(args));
+    const exec = record.backend.session.exec;
+    if (exec) {
+      return formatExecResult(
+        await withSandboxProviderOperation(
+          record.backend.session,
+          () => exec.call(record.backend.session, args)
+        )
+      );
     }
     throw new RoutingUnsupportedError("execCommand", record.backend.kind);
   }
@@ -20525,7 +20965,11 @@ var RoutingSandboxSession = class {
       if (!s.materializeEntry) {
         throw new RoutingUnsupportedError("materializeEntry", this.cached?.kind ?? "unknown");
       }
-      return s.materializeEntry(args);
+      await s.materializeEntry(args);
+      const path = args && typeof args === "object" && typeof args.path === "string" ? args.path : null;
+      if (path) {
+        await assertProviderCanSeeMaterializedPath(s, path);
+      }
     });
   }
   /** PTY support reflects the LAST-resolved backend (a synchronous probe; the SDK
@@ -20589,6 +21033,39 @@ var RoutingSandboxSession = class {
     return this.resolve();
   }
 };
+var MATERIALIZED_PATH_MARKER = "__OPENGENI_MATERIALIZED_PATH_VISIBLE__";
+async function assertProviderCanSeeMaterializedPath(session, path) {
+  const command = `test -e ${shellSingleQuote(path)} && printf %s ${shellSingleQuote(
+    MATERIALIZED_PATH_MARKER
+  )}`;
+  const args = {
+    cmd: command,
+    workdir: providerManifestRoot(session) ?? "/workspace",
+    shell: "sh",
+    login: false,
+    tty: false
+  };
+  let output;
+  if (session.execCommand) {
+    output = await session.execCommand(args);
+  } else if (session.exec) {
+    output = formatExecResult(await session.exec(args));
+  } else {
+    throw new RoutingUnsupportedError("materializeEntry.verify", "unknown");
+  }
+  if (!output.includes(MATERIALIZED_PATH_MARKER)) {
+    throw new Error(
+      `Sandbox materialization completed but the provider cannot read the destination path: ${path}`
+    );
+  }
+}
+function providerManifestRoot(session) {
+  const root = session.state?.manifest?.root;
+  return typeof root === "string" && root.length > 0 ? root : null;
+}
+function shellSingleQuote(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
 
 // src/sandbox/turn-tool-cancellation.ts
 var TURN_EXEC_YIELD_MS = 250;
@@ -20692,15 +21169,52 @@ function singleQuote(value) {
 function shellMarkerPath(token) {
   return `${SHELL_MARKER_DIR}/${token}`;
 }
+function processInspectionCommandLines() {
+  return [
+    "__opengeni_process_group_id() {",
+    '  __opengeni_lookup_pid="$1"',
+    '  __opengeni_lookup_pgid=""',
+    "  if command -v ps >/dev/null 2>&1; then",
+    `    __opengeni_lookup_pgid="$(command ps -o pgid= -p "$__opengeni_lookup_pid" 2>/dev/null | command tr -d '[:space:]')"`,
+    "  fi",
+    '  case "$__opengeni_lookup_pgid" in',
+    '    ""|*[!0-9]*) ;;',
+    `    *) command printf '%s\\n' "$__opengeni_lookup_pgid"; return 0 ;;`,
+    "  esac",
+    '  [ -r "/proc/$__opengeni_lookup_pid/stat" ] || return 1',
+    '  IFS= read -r __opengeni_lookup_stat < "/proc/$__opengeni_lookup_pid/stat" || return 1',
+    '  __opengeni_lookup_tail="${__opengeni_lookup_stat##*) }"',
+    '  [ "$__opengeni_lookup_tail" != "$__opengeni_lookup_stat" ] || return 1',
+    "  set -- $__opengeni_lookup_tail",
+    '  [ "$#" -ge 3 ] || return 1',
+    '  case "$3" in ""|*[!0-9]*) return 1 ;; esac',
+    `  command printf '%s\\n' "$3"`,
+    "}",
+    "__opengeni_process_args() {",
+    '  __opengeni_lookup_pid="$1"',
+    '  __opengeni_lookup_args=""',
+    "  if command -v ps >/dev/null 2>&1; then",
+    '    __opengeni_lookup_args="$(command ps -ww -o args= -p "$__opengeni_lookup_pid" 2>/dev/null)"',
+    "  fi",
+    '  if [ -n "$__opengeni_lookup_args" ]; then',
+    `    command printf '%s\\n' "$__opengeni_lookup_args"`,
+    "    return 0",
+    "  fi",
+    '  [ -r "/proc/$__opengeni_lookup_pid/cmdline" ] || return 1',
+    `  command tr '\\000' ' ' < "/proc/$__opengeni_lookup_pid/cmdline"`,
+    "}"
+  ];
+}
 function cancellableGroupLeaderCommand(command, markerPath) {
   const marker = singleQuote(markerPath);
   const markerDir = singleQuote(SHELL_MARKER_DIR);
   return [
+    ...processInspectionCommandLines(),
     `__opengeni_marker=${marker}`,
     "umask 077",
     `command mkdir -p ${markerDir} || exit 125`,
     '__opengeni_pid="$$"',
-    `__opengeni_pgid="$(command ps -o pgid= -p "$__opengeni_pid" 2>/dev/null | command tr -d '[:space:]')"`,
+    '__opengeni_pgid="$(__opengeni_process_group_id "$__opengeni_pid")"',
     'case "$__opengeni_pid:$__opengeni_pgid" in *[!0-9:]*|*:|:*) exit 125 ;; esac',
     '[ "$__opengeni_pid" -gt 1 ] && [ "$__opengeni_pgid" -gt 1 ] || exit 125',
     // Never signal a provider/container-wide process group. A cancellable PTY
@@ -20718,8 +21232,9 @@ function cancellableGroupLeaderCommand(command, markerPath) {
 function cancellableShellCommand(command, markerPath) {
   const groupLeaderCommand = cancellableGroupLeaderCommand(command, markerPath);
   return [
+    ...processInspectionCommandLines(),
     '__opengeni_outer_pid="$$"',
-    `__opengeni_outer_pgid="$(command ps -o pgid= -p "$__opengeni_outer_pid" 2>/dev/null | command tr -d '[:space:]')"`,
+    '__opengeni_outer_pgid="$(__opengeni_process_group_id "$__opengeni_outer_pid")"',
     'case "$__opengeni_outer_pid:$__opengeni_outer_pgid" in *[!0-9:]*|*:|:*) exit 125 ;; esac',
     'if [ "$__opengeni_outer_pid" != "$__opengeni_outer_pgid" ]; then',
     '  __opengeni_setsid="$(command -v setsid 2>/dev/null)"',
@@ -20764,15 +21279,16 @@ function identityGuardScript(state, body, missingIdentityExitCode) {
   if (!identity || !state.token) return `exit ${missingIdentityExitCode}`;
   const token = singleQuote(state.token);
   return [
+    ...processInspectionCommandLines(),
     `__opengeni_pid=${identity.pid}`,
     `__opengeni_pgid=${identity.processGroupId}`,
     `__opengeni_token=${token}`,
-    // The randomized token lands late in the wrapped command line. Procps
-    // otherwise truncates `args` to the terminal width, which can make a live
-    // group look stale and open the quiescence fence without signalling it.
-    '__opengeni_args="$(command ps -ww -o args= -p "$__opengeni_pid" 2>/dev/null)"',
+    // The randomized token lands late in the wrapped command line. Procps needs
+    // `-ww` to avoid terminal-width truncation; minimal Linux images may omit ps,
+    // so the same exact command line is read from /proc instead.
+    `__opengeni_args="$(__opengeni_process_args "$__opengeni_pid")" || exit ${missingIdentityExitCode}`,
     'case "$__opengeni_args" in *"$__opengeni_token"*) ;; *) exit 0 ;; esac',
-    `__opengeni_live_pgid="$(command ps -o pgid= -p "$__opengeni_pid" 2>/dev/null | command tr -d '[:space:]')"`,
+    `__opengeni_live_pgid="$(__opengeni_process_group_id "$__opengeni_pid")" || exit ${missingIdentityExitCode}`,
     '[ "$__opengeni_live_pgid" = "$__opengeni_pgid" ] || exit 0',
     body
   ].join("\n");
@@ -21445,6 +21961,42 @@ var FS_LIST_TRUNCATED_MARKER = "__OPENGENI_FS_LIST_TRUNCATED__";
 var FS_LIST_MAX_OUTPUT_BYTES = 768 * 1024;
 var GIT_COMMAND_CHUNK_BYTES = 512 * 1024;
 var GIT_METADATA_MAX_BYTES = 2 * 1024 * 1024;
+var GIT_MEASURE_FRAME = "__OPENGENI_GIT_MEASURE_V1__";
+var GIT_CHUNK_FRAME = "__OPENGENI_GIT_CHUNK_V1__";
+var GIT_CHUNK_FRAME_END = "__OPENGENI_GIT_CHUNK_END_V1__";
+var PORTABLE_SHA256_FILE_FUNCTION = [
+  "opengeni_sha256_file() {",
+  `  if command -v sha256sum >/dev/null 2>&1 && digest=$(sha256sum -- "$1" 2>/dev/null); then printf "%s\\n" "$digest" | awk '{print $1}'; return; fi`,
+  `  if command -v shasum >/dev/null 2>&1 && digest=$(shasum -a 256 "$1" 2>/dev/null); then printf "%s\\n" "$digest" | awk '{print $1}'; return; fi`,
+  `  if command -v openssl >/dev/null 2>&1 && digest=$(openssl dgst -sha256 "$1" 2>/dev/null); then printf "%s\\n" "$digest" | sed 's/^.*= //'; return; fi`,
+  "  return 127",
+  "}"
+].join("\n");
+var PORTABLE_DESCRIPTOR_FUNCTIONS = [
+  "opengeni_set_fd_path() {",
+  '  fd="$1"',
+  "  opengeni_fd_path=",
+  '  if opengeni_fd_path=$(readlink -f -- "/proc/$$/fd/$fd" 2>/dev/null); then [ -n "$opengeni_fd_path" ]; return; fi',
+  "  lsof_bin=",
+  "  if [ -x /usr/sbin/lsof ]; then lsof_bin=/usr/sbin/lsof; elif command -v lsof >/dev/null 2>&1; then lsof_bin=$(command -v lsof); else return 127; fi",
+  `  while IFS= read -r -d '' field; do case "$field" in n*) opengeni_fd_path=\${field#n} ;; esac; done < <("$lsof_bin" -a -p "$$" -d "$fd" -Fn0 2>/dev/null)`,
+  '  [ -n "$opengeni_fd_path" ]',
+  "}",
+  "opengeni_fd_identity() {",
+  '  fd="$1"',
+  '  if identity=$(stat -Lc "%d:%i" -- "/proc/$$/fd/$fd" 2>/dev/null); then printf "%s" "$identity"; return; fi',
+  '  stat -f "%d:%i" "/dev/fd/$fd" 2>/dev/null',
+  "}",
+  "opengeni_path_identity() {",
+  '  if identity=$(stat -c "%d:%i" -- "$1" 2>/dev/null); then printf "%s" "$identity"; return; fi',
+  '  stat -f "%d:%i" "$1" 2>/dev/null',
+  "}",
+  "opengeni_fd_size() {",
+  '  fd="$1"',
+  '  if size=$(stat -Lc "%s" -- "/proc/$$/fd/$fd" 2>/dev/null); then printf "%s" "$size"; return; fi',
+  '  stat -f "%z" "/dev/fd/$fd" 2>/dev/null',
+  "}"
+].join("\n");
 var US = String.fromCharCode(31);
 var RS = String.fromCharCode(30);
 var SELFHOSTED_VIRTUAL_ROOT2 = "/workspace";
@@ -21534,11 +22086,11 @@ var SandboxChannelAService = class {
     const depthArg = Math.max(1, req.depth);
     const maxCommandEntries = req.maxEntries + 1;
     const gnuPrint = `-printf '%y\\t%s\\t%T@\\t%m\\t%p\\0'`;
-    const gnuSelector = pruneNames.length ? `\\( -type d \\( ${pruneNames.map((name) => `-name ${shellQuote6(name)}`).join(" -o ")} \\) ${gnuPrint} -prune \\) -o ${gnuPrint}` : gnuPrint;
+    const gnuSelector = pruneNames.length ? `\\( -type d \\( ${pruneNames.map((name) => `-name ${shellQuote7(name)}`).join(" -o ")} \\) ${gnuPrint} -prune \\) -o ${gnuPrint}` : gnuPrint;
     const gnuVisibleSelector = req.includeHidden ? gnuSelector : `\\( -path '*/.*' -prune \\) -o \\( ${gnuSelector} \\)`;
     const gnuFind = `find ${findRoot} -mindepth 1 -maxdepth ${depthArg} \\( ${gnuVisibleSelector} \\) 2>/dev/null`;
     const portableHiddenGuard = req.includeHidden ? "" : `if [[ "$base" == .* ]]; then continue; fi;`;
-    const portablePruneCase = pruneNames.length ? `case "$base" in ${pruneNames.map(shellQuote6).join("|")}) pruned=1 ;; *) pruned=0 ;; esac;` : "pruned=0;";
+    const portablePruneCase = pruneNames.length ? `case "$base" in ${pruneNames.map(shellQuote7).join("|")}) pruned=1 ;; *) pruned=0 ;; esac;` : "pruned=0;";
     const portableWalk = [
       "shopt -s nullglob dotglob; count=0; stop=0;",
       'walk() { local dir="$1" level="$2" p base t size mtime mode pruned;',
@@ -21567,12 +22119,12 @@ var SandboxChannelAService = class {
       `if [ "$records" -ge ${req.maxEntries} ] || [ $((bytes + record_bytes + 1)) -gt ${FS_LIST_MAX_OUTPUT_BYTES} ]; then truncated=1; break; fi;`,
       `printf '%s\\0' "$record"; bytes=$((bytes + record_bytes + 1)); records=$((records + 1));`,
       "done;",
-      `if [ "$truncated" -eq 1 ]; then printf '%s\\0' ${shellQuote6(FS_LIST_TRUNCATED_MARKER)}; fi`
+      `if [ "$truncated" -eq 1 ]; then printf '%s\\0' ${shellQuote7(FS_LIST_TRUNCATED_MARKER)}; fi`
     ].join(" ");
     const findCommand = [
       `{ ${rawFindCommand}; } | { ${boundedOutput}; };`,
       "producer_status=${PIPESTATUS[0]};",
-      `if [ "$producer_status" -ne 0 ] && [ "$producer_status" -ne 141 ]; then printf '%s\\0' ${shellQuote6(FS_LIST_TRUNCATED_MARKER)}; fi`
+      `if [ "$producer_status" -ne 0 ] && [ "$producer_status" -ne 141 ]; then printf '%s\\0' ${shellQuote7(FS_LIST_TRUNCATED_MARKER)}; fi`
     ].join(" ");
     const { stdout, exitCode } = await this.runInConfinedDirectory(root, {
       cmd: internalBashCommand(findCommand),
@@ -21665,11 +22217,11 @@ var SandboxChannelAService = class {
   async assertConfinedExistingDirectory(path) {
     const root = this.workspaceRoot || ".";
     const abs = this.joinRoot(path);
-    const rejectLink = path ? `test ! -L ${shellQuote6(abs)} || { printf '__OPENGENI_FS_SYMLINK__'; exit 68; }` : ":";
+    const rejectLink = path ? `test ! -L ${shellQuote7(abs)} || { printf '__OPENGENI_FS_SYMLINK__'; exit 68; }` : ":";
     const script = [
-      `root=$(realpath -e -- ${shellQuote6(root)}) || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
+      `root=$(realpath -e -- ${shellQuote7(root)}) || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
       rejectLink,
-      `target=$(realpath -e -- ${shellQuote6(abs)}) || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
+      `target=$(realpath -e -- ${shellQuote7(abs)}) || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
       `case "$target" in "$root"|"$root"/*) ;; *) printf '__OPENGENI_FS_ESCAPE__'; exit 67 ;; esac`,
       `test -d "$target" || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
       `printf '__OPENGENI_FS_CONFINED_OK__'`
@@ -21680,13 +22232,13 @@ var SandboxChannelAService = class {
   async assertConfinedMutationParent(path, options) {
     const root = this.workspaceRoot || ".";
     const abs = this.joinRoot(path);
-    const rejectLink = options.rejectFinalSymlink ? `test ! -L ${shellQuote6(abs)} || { printf '__OPENGENI_FS_SYMLINK__'; exit 68; }` : ":";
+    const rejectLink = options.rejectFinalSymlink ? `test ! -L ${shellQuote7(abs)} || { printf '__OPENGENI_FS_SYMLINK__'; exit 68; }` : ":";
     const locateParent = options.allowMissingParents ? 'probe="$parent"; while [ ! -e "$probe" ] && [ ! -L "$probe" ]; do next=$(dirname -- "$probe"); [ "$next" != "$probe" ] || break; probe="$next"; done' : 'probe="$parent"';
     const requireParent = options.allowMissingParents ? ":" : 'test -d "$parent" || { printf "__OPENGENI_FS_NOT_FOUND__"; exit 66; }';
     const script = [
-      `root=$(realpath -e -- ${shellQuote6(root)}) || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
+      `root=$(realpath -e -- ${shellQuote7(root)}) || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
       rejectLink,
-      `parent=$(dirname -- ${shellQuote6(abs)})`,
+      `parent=$(dirname -- ${shellQuote7(abs)})`,
       locateParent,
       `target=$(realpath -e -- "$probe") || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
       `case "$target" in "$root"|"$root"/*) ;; *) printf '__OPENGENI_FS_ESCAPE__'; exit 67 ;; esac`,
@@ -21723,8 +22275,8 @@ var SandboxChannelAService = class {
     const root = this.workspaceRoot || ".";
     const abs = this.joinRoot(path);
     const script = [
-      `root=$(realpath -e -- ${shellQuote6(root)}) || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
-      `exec 3<${shellQuote6(abs)} || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
+      `root=$(realpath -e -- ${shellQuote7(root)}) || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
+      `exec 3<${shellQuote7(abs)} || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
       `target=$(readlink -f -- "/proc/$$/fd/3") || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
       `case "$target" in "$root"|"$root"/*) ;; *) printf '__OPENGENI_FS_ESCAPE__'; exit 67 ;; esac`,
       `test -f "$target" || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
@@ -21793,7 +22345,7 @@ var SandboxChannelAService = class {
     });
     if (!req.overwrite) {
       const { exitCode: exitCode2 } = await this.run({
-        cmd: `test -e ${shellQuote6(abs)} || test -L ${shellQuote6(abs)}`
+        cmd: `test -e ${shellQuote7(abs)} || test -L ${shellQuote7(abs)}`
       });
       if (exitCode2 === 0) {
         throw new ChannelAConflictError(`path exists and overwrite is false: ${path}`);
@@ -21801,7 +22353,7 @@ var SandboxChannelAService = class {
     }
     if (req.createParents) {
       const dir = dirnameAbs(abs);
-      if (dir) await this.run({ cmd: `mkdir -p ${shellQuote6(dir)}` });
+      if (dir) await this.run({ cmd: `mkdir -p ${shellQuote7(dir)}` });
       await this.assertConfinedMutationParent(path, {
         allowMissingParents: false,
         rejectFinalSymlink: true
@@ -21809,7 +22361,7 @@ var SandboxChannelAService = class {
     }
     const b64 = bytes.toString("base64");
     const { exitCode, stderr } = await this.run({
-      cmd: `printf %s ${shellQuote6(b64)} | base64 -d > ${shellQuote6(abs)}`
+      cmd: `printf %s ${shellQuote7(b64)} | base64 -d > ${shellQuote7(abs)}`
     });
     if (exitCode !== null && exitCode !== 0) {
       if (req.encoding !== "base64" && this.session.createEditor) {
@@ -21850,7 +22402,7 @@ var SandboxChannelAService = class {
       rejectFinalSymlink: false
     });
     const flag = req.recursive ? "-rf" : "-f";
-    const { exitCode, stderr } = await this.run({ cmd: `rm ${flag} ${shellQuote6(abs)}` });
+    const { exitCode, stderr } = await this.run({ cmd: `rm ${flag} ${shellQuote7(abs)}` });
     if (exitCode !== null && exitCode !== 0) {
       throw new ChannelAValidationError(
         `failed to delete ${path}: ${stderr || `exit ${exitCode}`}`
@@ -21875,7 +22427,7 @@ var SandboxChannelAService = class {
     });
     if (!req.overwrite) {
       const { exitCode: exitCode2 } = await this.run({
-        cmd: `test -e ${shellQuote6(newAbs)} || test -L ${shellQuote6(newAbs)}`
+        cmd: `test -e ${shellQuote7(newAbs)} || test -L ${shellQuote7(newAbs)}`
       });
       if (exitCode2 === 0) {
         throw new ChannelAConflictError(`destination exists and overwrite is false: ${newPath}`);
@@ -21883,7 +22435,7 @@ var SandboxChannelAService = class {
     }
     if (req.createParents) {
       const dir = dirnameAbs(newAbs);
-      if (dir) await this.run({ cmd: `mkdir -p ${shellQuote6(dir)}` });
+      if (dir) await this.run({ cmd: `mkdir -p ${shellQuote7(dir)}` });
       await this.assertConfinedMutationParent(newPath, {
         allowMissingParents: false,
         rejectFinalSymlink: true
@@ -21891,7 +22443,7 @@ var SandboxChannelAService = class {
     }
     const flag = req.overwrite ? "-f " : "";
     const { exitCode, stderr } = await this.run({
-      cmd: `mv ${flag}${shellQuote6(abs)} ${shellQuote6(newAbs)}`
+      cmd: `mv ${flag}${shellQuote7(abs)} ${shellQuote7(newAbs)}`
     });
     if (exitCode !== null && exitCode !== 0) {
       throw new ChannelAValidationError(
@@ -21916,7 +22468,7 @@ var SandboxChannelAService = class {
       rejectFinalSymlink: true
     });
     const flag = req.recursive ? "-p " : "";
-    const { exitCode, stderr } = await this.run({ cmd: `mkdir ${flag}${shellQuote6(abs)}` });
+    const { exitCode, stderr } = await this.run({ cmd: `mkdir ${flag}${shellQuote7(abs)}` });
     if (exitCode !== null && exitCode !== 0) {
       throw new ChannelAValidationError(`failed to mkdir ${path}: ${stderr || `exit ${exitCode}`}`);
     }
@@ -21931,44 +22483,60 @@ var SandboxChannelAService = class {
   async measureConfinedCommandBytes(repo, command) {
     const measured = await this.runInConfinedDirectory(repo, {
       cmd: [
-        "set -o pipefail",
-        `{ ${command}; } 2>/dev/null | { bytes=$(wc -c | tr -d ' \\n'); printf '%s' "$bytes"; }`,
-        "producer_status=${PIPESTATUS[0]}",
-        `printf '\\t%s\\n' "$producer_status"`
+        PORTABLE_SHA256_FILE_FUNCTION,
+        "tmp=$(mktemp) || exit 70",
+        `trap 'rm -f "$tmp"' EXIT`,
+        `/bin/bash --noprofile --norc -c ${shellQuote7(command)} >"$tmp" 2>/dev/null`,
+        "producer_status=$?",
+        `bytes=$(wc -c <"$tmp" | tr -d ' \\n')`,
+        `sha256=$(opengeni_sha256_file "$tmp") || exit 71`,
+        `printf '${GIT_MEASURE_FRAME}\\t%s\\t%s\\t%s' "$producer_status" "$bytes" "$sha256"`
       ].join("; "),
       maxOutputTokens: 1024
     });
-    const match = measured.stdout.match(/^(\d+)\t(\d+)\n?$/);
-    if (!match || measured.exitCode !== null && measured.exitCode !== 0 || Number(match[2]) !== 0) {
+    const match = measured.stdout.match(
+      new RegExp(`^${GIT_MEASURE_FRAME}\\t(\\d+)\\t(\\d+)\\t([0-9a-f]{64})$`)
+    );
+    if (!match || measured.exitCode !== null && measured.exitCode !== 0 || Number(match[1]) !== 0) {
       throw new ChannelAUnavailableError(
         "Workspace Git data is temporarily unavailable. Retry the operation."
       );
     }
-    const size = Number(match[1]);
+    const size = Number(match[2]);
     if (!Number.isSafeInteger(size) || size < 0) {
       throw new ChannelAUnavailableError(
         "Workspace Git data is temporarily unavailable. Retry the operation."
       );
     }
-    return size;
+    return { sizeBytes: size, sha256: match[3] };
   }
   /** Read an exact prefix of a command's output in chunks that remain below
    * every supported execCommand retained-output ceiling. The producer is
    * intentionally rerun per chunk; turn-end capture calls this only after the
    * durable mutation authority has quiesced the workspace. */
-  async readConfinedCommandPrefix(repo, command, byteLength2) {
-    if (byteLength2 === 0) return Buffer.alloc(0);
+  async readConfinedCommandPrefix(repo, command, measurement, prefixByteLength = measurement.sizeBytes) {
+    if (!Number.isSafeInteger(prefixByteLength) || prefixByteLength < 0 || prefixByteLength > measurement.sizeBytes) {
+      throw new ChannelAUnavailableError(
+        "Workspace Git data is temporarily unavailable. Retry the operation."
+      );
+    }
+    if (prefixByteLength === 0) return Buffer.alloc(0);
     const chunks = [];
-    for (let offset = 0; offset < byteLength2; offset += GIT_COMMAND_CHUNK_BYTES) {
-      const expected = Math.min(GIT_COMMAND_CHUNK_BYTES, byteLength2 - offset);
+    for (let offset = 0; offset < prefixByteLength; offset += GIT_COMMAND_CHUNK_BYTES) {
+      const expected = Math.min(GIT_COMMAND_CHUNK_BYTES, prefixByteLength - offset);
       const chunk = await this.runInConfinedDirectory(repo, {
         cmd: [
-          `{ ${command}; } 2>/dev/null`,
-          `tail -c +${offset + 1}`,
-          `head -c ${expected}`,
-          "base64",
-          `tr -d '\\n'`
-        ].join(" | "),
+          PORTABLE_SHA256_FILE_FUNCTION,
+          "tmp=$(mktemp) || exit 70",
+          `trap 'rm -f "$tmp"' EXIT`,
+          `/bin/bash --noprofile --norc -c ${shellQuote7(command)} >"$tmp" 2>/dev/null`,
+          "producer_status=$?",
+          `bytes=$(wc -c <"$tmp" | tr -d ' \\n')`,
+          `sha256=$(opengeni_sha256_file "$tmp") || exit 71`,
+          `printf '${GIT_CHUNK_FRAME}\\t%s\\t%s\\t%s\\t%s\\t%s\\n' "$producer_status" "$bytes" "$sha256" ${offset} ${expected}`,
+          `if [ "$producer_status" -eq 0 ]; then tail -c +${offset + 1} "$tmp" | head -c ${expected} | base64 | tr -d '\\n'; fi`,
+          `printf '\\n${GIT_CHUNK_FRAME_END}'`
+        ].join("; "),
         maxOutputTokens: Math.ceil(GIT_COMMAND_CHUNK_BYTES * 4 / 3) + 1024
       });
       if (chunk.exitCode !== null && chunk.exitCode !== 0) {
@@ -21976,7 +22544,21 @@ var SandboxChannelAService = class {
           "Workspace Git data is temporarily unavailable. Retry the operation."
         );
       }
-      const encoded = chunk.stdout.replace(/\s/g, "");
+      const headerEnd = chunk.stdout.indexOf("\n");
+      const trailer = `
+${GIT_CHUNK_FRAME_END}`;
+      if (headerEnd < 0 || !chunk.stdout.endsWith(trailer)) {
+        throw new ChannelAUnavailableError(
+          "Workspace Git data is temporarily unavailable. Retry the operation."
+        );
+      }
+      const header = chunk.stdout.slice(0, headerEnd).split("	");
+      if (header.length !== 6 || header[0] !== GIT_CHUNK_FRAME || header[1] !== "0" || header[2] !== String(measurement.sizeBytes) || header[3] !== measurement.sha256 || header[4] !== String(offset) || header[5] !== String(expected)) {
+        throw new ChannelAUnavailableError(
+          "Workspace Git data changed during capture. Retry the operation."
+        );
+      }
+      const encoded = chunk.stdout.slice(headerEnd + 1, -trailer.length);
       const bytes = Buffer.from(encoded, "base64");
       if (bytes.byteLength !== expected || bytes.toString("base64") !== encoded) {
         throw new ChannelAUnavailableError(
@@ -21985,35 +22567,61 @@ var SandboxChannelAService = class {
       }
       chunks.push(bytes);
     }
-    return Buffer.concat(chunks, byteLength2);
+    return Buffer.concat(chunks, prefixByteLength);
   }
   async readConfinedCommandBytes(repo, command, maxBytes) {
-    const sizeBytes = await this.measureConfinedCommandBytes(repo, command);
-    if (sizeBytes > maxBytes) {
-      return { bytes: Buffer.alloc(0), sizeBytes, truncated: true };
+    const measurement = await this.measureConfinedCommandBytes(repo, command);
+    if (measurement.sizeBytes > maxBytes) {
+      return { bytes: Buffer.alloc(0), sizeBytes: measurement.sizeBytes, truncated: true };
     }
     return {
-      bytes: await this.readConfinedCommandPrefix(repo, command, sizeBytes),
-      sizeBytes,
+      bytes: await this.readConfinedCommandPrefix(repo, command, measurement),
+      sizeBytes: measurement.sizeBytes,
       truncated: false
     };
   }
+  /** Bind an untracked regular-file descriptor to its repository root and its
+   * lstat identity before producing bytes. The final producer reads fd 3 rather
+   * than reopening the path, so a check→read symlink swap cannot disclose a
+   * target outside the repository (or substitute another in-repository inode). */
+  confinedUntrackedRegularFileCommand(target, body) {
+    const fileArg = target.startsWith("./") ? target : `./${target}`;
+    return [
+      PORTABLE_DESCRIPTOR_FUNCTIONS,
+      `file=${shellQuote7(fileArg)}`,
+      'exec 3<"$file" || exit 66',
+      'exec 4<"$file" || exit 66',
+      "root=$(pwd -P) || exit 66",
+      "opengeni_set_fd_path 3 || exit 66",
+      'opened3="$opengeni_fd_path"',
+      "opengeni_set_fd_path 4 || exit 66",
+      'opened4="$opengeni_fd_path"',
+      'case "$opened3" in "$root"|"$root"/*) ;; *) exit 67 ;; esac',
+      'case "$opened4" in "$root"|"$root"/*) ;; *) exit 67 ;; esac',
+      'test ! -L "$file" && test -f "$file" || exit 66',
+      "opened3_identity=$(opengeni_fd_identity 3) || exit 66",
+      "opened4_identity=$(opengeni_fd_identity 4) || exit 66",
+      'path_identity=$(opengeni_path_identity "$file") || exit 66',
+      'test "$opened3_identity" = "$opened4_identity" || exit 66',
+      'test "$opened3_identity" = "$path_identity" || exit 66',
+      body
+    ].join("; ");
+  }
   /** Read a regular untracked file without routing its body through one large
    * execCommand response. Native provider reads are binary-safe; providers
    * without that surface use the same bounded chunk protocol as Git patches. */
-  async readUntrackedRegularFile(repo, target, byteLength2) {
-    if (byteLength2 === 0) return Buffer.alloc(0);
+  async readUntrackedRegularFile(repo, target, prefixByteLength, sizeBytes) {
     const path = repo ? `${repo}/${target}` : target;
     assertSafeRelPath(path);
     if (this.session.readFile) {
       try {
         const raw = await this.session.readFile({
           path: this.joinRoot(path),
-          maxBytes: byteLength2,
+          maxBytes: prefixByteLength,
           ...this.runAs ? { runAs: this.runAs } : {}
         });
         const bytes = typeof raw === "string" ? Buffer.from(raw, "utf8") : Buffer.from(raw);
-        if (bytes.byteLength !== byteLength2) {
+        if (bytes.byteLength !== prefixByteLength) {
           throw new ChannelAUnavailableError(
             "Workspace Git data changed during capture. Retry the operation."
           );
@@ -22034,12 +22642,14 @@ var SandboxChannelAService = class {
         }
       }
     }
-    const fileArg = target.startsWith("./") ? target : `./${target}`;
-    return await this.readConfinedCommandPrefix(
-      repo,
-      `file=${shellQuote6(fileArg)}; test ! -L "$file" && test -f "$file" || exit 66; cat -- "$file"`,
-      byteLength2
-    );
+    const command = this.confinedUntrackedRegularFileCommand(target, "cat <&3");
+    const measurement = await this.measureConfinedCommandBytes(repo, command);
+    if (measurement.sizeBytes !== sizeBytes) {
+      throw new ChannelAUnavailableError(
+        "Workspace Git data changed during capture. Retry the operation."
+      );
+    }
+    return await this.readConfinedCommandPrefix(repo, command, measurement, prefixByteLength);
   }
   async gitStatus(req) {
     const repo = assertSafeRelPathOrRoot(req.path);
@@ -22068,24 +22678,24 @@ var SandboxChannelAService = class {
         "Workspace Git metadata exceeded the safe capture limit. Retry with a narrower path."
       );
     }
-    return { ...parsePorcelainV2(status.bytes.toString("utf8")), revision: this.revision };
+    return { ...parsePorcelainV2(decodeGitMetadataUtf8(status.bytes)), revision: this.revision };
   }
   async gitDiff(req) {
     const repo = assertSafeRelPathOrRoot(req.path);
     const ctx = req.contextLines;
     let range = "";
-    if (req.fromRef && req.toRef) range = `${shellQuote6(req.fromRef)} ${shellQuote6(req.toRef)}`;
+    if (req.fromRef && req.toRef) range = `${shellQuote7(req.fromRef)} ${shellQuote7(req.toRef)}`;
     else if (req.fromRef) {
       if (req.fromRef === "HEAD") {
         const head = await this.runInConfinedDirectory(repo, {
           cmd: "if git rev-parse --verify --quiet HEAD >/dev/null; then printf 'present'; else printf 'unborn'; fi"
         });
-        range = head.stdout.trim() === "present" ? shellQuote6(req.fromRef) : "--cached";
+        range = head.stdout.trim() === "present" ? shellQuote7(req.fromRef) : "--cached";
       } else {
-        range = shellQuote6(req.fromRef);
+        range = shellQuote7(req.fromRef);
       }
     } else if (req.staged) range = "--cached";
-    const pathspec = req.pathspec.length ? ` -- ${req.pathspec.map(shellQuote6).join(" ")}` : "";
+    const pathspec = req.pathspec.length ? ` -- ${req.pathspec.map(shellQuote7).join(" ")}` : "";
     const numstat = await this.readConfinedCommandBytes(
       repo,
       `git -c core.quotePath=false diff --no-color -z --numstat ${range}${pathspec}`.trim(),
@@ -22096,7 +22706,7 @@ var SandboxChannelAService = class {
         "Workspace Git metadata exceeded the safe capture limit. Retry with a narrower path."
       );
     }
-    const stats = parseNumstatZ(numstat.bytes.toString("utf8"));
+    const stats = parseNumstatZ(decodeGitMetadataUtf8(numstat.bytes));
     const files = [];
     for (const stat4 of stats) {
       const target = stat4.newPath;
@@ -22117,7 +22727,7 @@ var SandboxChannelAService = class {
       }
       const patch = await this.readConfinedCommandBytes(
         repo,
-        `git -c core.quotePath=false diff --no-color -U${ctx} ${range} -- ${shellQuote6(target)}`.trim(),
+        `git -c core.quotePath=false diff --no-color -U${ctx} ${range} -- ${shellQuote7(target)}`.trim(),
         req.maxBytesPerFile
       );
       const parsed = patch.truncated ? { hunks: [], status: "modified" } : parseUnifiedPatch(patch.bytes.toString("utf8"));
@@ -22144,48 +22754,75 @@ var SandboxChannelAService = class {
           "Workspace Git metadata exceeded the safe capture limit. Retry with a narrower path."
         );
       }
-      for (const target of untracked.bytes.toString("utf8").split(NUL).filter(Boolean)) {
+      for (const target of decodeGitMetadataUtf8(untracked.bytes).split(NUL).filter(Boolean)) {
         const fileArg = target.startsWith("./") ? target : `./${target}`;
-        const read = await this.runInConfinedDirectory(repo, {
-          cmd: [
-            `file=${shellQuote6(fileArg)}`,
-            'if [ -L "$file" ]; then printf "L\\t"; readlink -z -- "$file" | base64 | tr -d "\\n"; exit; fi',
-            'size=$(wc -c < "$file") || exit 66',
-            'line_count=$(wc -l < "$file") || exit 66',
-            'if [ "$size" -gt 0 ]; then last_byte=$(tail -c 1 "$file" | od -An -tu1 | tr -d " \\n"); if [ "$last_byte" != "10" ]; then line_count=$((line_count + 1)); fi; fi',
-            'printf "F\\t%s\\t%s" "$size" "$line_count"'
-          ].join("; ")
-        });
-        if (read.exitCode !== null && read.exitCode !== 0) {
+        const kind = await this.readConfinedCommandBytes(
+          repo,
+          `file=${shellQuote7(fileArg)}; if [ -L "$file" ]; then printf L; elif [ -f "$file" ]; then printf F; else exit 66; fi`,
+          1
+        );
+        if (kind.truncated || kind.bytes[0] !== 76 && kind.bytes[0] !== 70) {
           throw new ChannelAUnavailableError(
             "Workspace Git data is temporarily unavailable. Retry the operation."
           );
         }
-        const [kind, first, second] = read.stdout.split("	");
         let sampled = Buffer.alloc(0);
         let sizeBytes;
         let lineCount;
-        if (kind === "L") {
-          const encoded = (first ?? "").replace(/\s/g, "");
-          sampled = Buffer.from(encoded, "base64");
-          if (sampled.at(-1) !== 0) continue;
+        if (kind.bytes[0] === 76) {
+          const link = await this.readConfinedCommandBytes(
+            repo,
+            `file=${shellQuote7(fileArg)}; test -L "$file" || exit 66; readlink -n "$file" || exit 66; printf '\\0'`,
+            GIT_METADATA_MAX_BYTES
+          );
+          if (link.truncated) {
+            throw new ChannelAUnavailableError(
+              "Workspace Git metadata exceeded the safe capture limit. Retry with a narrower path."
+            );
+          }
+          sampled = link.bytes;
+          if (sampled.at(-1) !== 0) {
+            throw new ChannelAUnavailableError(
+              "Workspace Git data is temporarily unavailable. Retry the operation."
+            );
+          }
           sampled = sampled.subarray(0, -1);
           sizeBytes = sampled.length;
           lineCount = addedLines(sampled).length;
         } else {
-          if (kind !== "F") continue;
-          const parsedSize = safeInt(first);
-          const parsedLineCount = safeInt(second);
-          if (parsedSize === null || parsedSize < 0 || parsedLineCount === null || parsedLineCount < 0) {
-            continue;
+          const metadata = await this.readConfinedCommandBytes(
+            repo,
+            this.confinedUntrackedRegularFileCommand(
+              target,
+              [
+                "size=$(opengeni_fd_size 3) || exit 66",
+                "line_count=$(wc -l <&3) || exit 66",
+                'if [ "$size" -gt 0 ]; then last_byte=$(tail -c 1 <&4 | od -An -tu1 | tr -d " \\n") || exit 66; if [ "$last_byte" != "10" ]; then line_count=$((line_count + 1)); fi; fi',
+                'printf "%s\\t%s" "$size" "$line_count"'
+              ].join("; ")
+            ),
+            128
+          );
+          if (metadata.truncated) {
+            throw new ChannelAUnavailableError(
+              "Workspace Git data is temporarily unavailable. Retry the operation."
+            );
+          }
+          const frame = metadata.bytes.toString("ascii").match(/^(0|[1-9]\d*)\t(0|[1-9]\d*)$/);
+          const parsedSize = safeInt(frame?.[1]);
+          const parsedLineCount = safeInt(frame?.[2]);
+          if (parsedSize === null || parsedLineCount === null) {
+            throw new ChannelAUnavailableError(
+              "Workspace Git data is temporarily unavailable. Retry the operation."
+            );
           }
           sizeBytes = parsedSize;
           lineCount = parsedLineCount;
           const truncated2 = sizeBytes > req.maxBytesPerFile;
           const sampleSize = Math.min(sizeBytes, 8192);
-          sampled = await this.readUntrackedRegularFile(repo, target, sampleSize);
+          sampled = await this.readUntrackedRegularFile(repo, target, sampleSize, sizeBytes);
           if (!sniffBinary(sampled) && !truncated2 && sampleSize < sizeBytes) {
-            sampled = await this.readUntrackedRegularFile(repo, target, sizeBytes);
+            sampled = await this.readUntrackedRegularFile(repo, target, sizeBytes, sizeBytes);
           }
         }
         const truncated = sizeBytes > req.maxBytesPerFile || sampled.length > req.maxBytesPerFile;
@@ -22219,9 +22856,9 @@ var SandboxChannelAService = class {
   async gitLog(req) {
     const repo = assertSafeRelPathOrRoot(req.path);
     const fmt = `%H${US}%h${US}%P${US}%an${US}%ae${US}%at${US}%cn${US}%ce${US}%ct${US}%s${US}%b${RS}`;
-    const pathspec = req.pathspec.length ? ` -- ${req.pathspec.map(shellQuote6).join(" ")}` : "";
+    const pathspec = req.pathspec.length ? ` -- ${req.pathspec.map(shellQuote7).join(" ")}` : "";
     const { stdout, exitCode } = await this.runInConfinedDirectory(repo, {
-      cmd: `git log --format=${shellQuote6(fmt)} -n${req.maxCount + 1} --skip=${req.skip} ${shellQuote6(req.ref)}${pathspec}`
+      cmd: `git log --format=${shellQuote7(fmt)} -n${req.maxCount + 1} --skip=${req.skip} ${shellQuote7(req.ref)}${pathspec}`
     });
     if (exitCode !== null && exitCode !== 0) {
       return { commits: [], hasMore: false };
@@ -22248,7 +22885,7 @@ var SandboxChannelAService = class {
     const repo = assertSafeRelPathOrRoot(req.path);
     if (req.filePath) {
       const { stdout, exitCode } = await this.runInConfinedDirectory(repo, {
-        cmd: `git cat-file blob ${shellQuote6(`${req.ref}:${req.filePath}`)} 2>/dev/null | base64`
+        cmd: `git cat-file blob ${shellQuote7(`${req.ref}:${req.filePath}`)} 2>/dev/null | base64`
       });
       if (exitCode !== null && exitCode !== 0 && stdout.trim() === "") {
         throw new ChannelANotFoundError(`blob not found: ${req.ref}:${req.filePath}`);
@@ -22521,19 +23158,28 @@ var SandboxChannelAService = class {
     const safe = assertSafeRelPathOrRoot(rel);
     const root = this.workspaceRoot || ".";
     const abs = this.joinRoot(safe);
-    const rejectLink = safe ? `test ! -L ${shellQuote6(abs)} || { printf '__OPENGENI_FS_SYMLINK__'; exit 68; }` : ":";
-    const script = [
-      `root=$(realpath -e -- ${shellQuote6(root)}) || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
-      rejectLink,
-      `target=$(realpath -e -- ${shellQuote6(abs)}) || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
-      `case "$target" in "$root"|"$root"/*) ;; *) printf '__OPENGENI_FS_ESCAPE__'; exit 67 ;; esac`,
-      `test -d "$target" || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
-      `cd -P -- "$target"`,
-      `printf '__OPENGENI_FS_CONFINED_OK__\\n'`,
-      args.cmd
-    ].join("; ");
-    const successPrefix = "__OPENGENI_FS_CONFINED_OK__\n";
+    const rejectLink = safe ? `test ! -L ${shellQuote7(abs)} || { printf '__OPENGENI_FS_SYMLINK__'; exit 68; }` : ":";
     for (let attempt = 0; attempt < 2; attempt += 1) {
+      const frameId = crypto.randomUUID().replaceAll("-", "");
+      const successPrefix = `__OPENGENI_FS_CONFINED_${frameId}_OK__
+`;
+      const successSuffixPrefix = `__OPENGENI_FS_CONFINED_${frameId}_END__:`;
+      const successSuffixTerminator = "__";
+      const script = [
+        `root=$(realpath -e -- ${shellQuote7(root)}) || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
+        rejectLink,
+        `target=$(realpath -e -- ${shellQuote7(abs)}) || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
+        `case "$target" in "$root"|"$root"/*) ;; *) printf '__OPENGENI_FS_ESCAPE__'; exit 67 ;; esac`,
+        `test -d "$target" || { printf '__OPENGENI_FS_NOT_FOUND__'; exit 66; }`,
+        `cd -P -- "$target"`,
+        `printf ${shellQuote7(successPrefix)}`,
+        // Keep an operation-level `exit` inside the subshell so the trusted end
+        // frame is emitted for every completed command.
+        `( ${args.cmd} )`,
+        `operation_status=$?`,
+        `printf ${shellQuote7(`${successSuffixPrefix}%s${successSuffixTerminator}`)} "$operation_status"`,
+        `exit "$operation_status"`
+      ].join("; ");
       let result;
       try {
         result = await this.run({
@@ -22555,7 +23201,24 @@ var SandboxChannelAService = class {
       }
       const successIndex = result.stdout.indexOf(successPrefix);
       if (successIndex >= 0) {
-        return { ...result, stdout: result.stdout.slice(successIndex + successPrefix.length) };
+        const payloadStart = successIndex + successPrefix.length;
+        const suffixIndex = result.stdout.lastIndexOf(successSuffixPrefix);
+        if (suffixIndex >= payloadStart) {
+          const suffixEnd = result.stdout.indexOf(
+            successSuffixTerminator,
+            suffixIndex + successSuffixPrefix.length
+          );
+          const statusText = suffixEnd < 0 ? null : result.stdout.slice(suffixIndex + successSuffixPrefix.length, suffixEnd);
+          if (statusText && /^(?:0|[1-9][0-9]{0,2})$/.test(statusText)) {
+            const operationStatus = Number(statusText);
+            if (operationStatus > 255) continue;
+            return {
+              ...result,
+              stdout: result.stdout.slice(payloadStart, suffixIndex),
+              exitCode: operationStatus
+            };
+          }
+        }
       }
       if (result.stdout.includes("__OPENGENI_FS_ESCAPE__") || result.exitCode === 67) {
         throw new ChannelAValidationError(`path resolves outside workspace: ${safe || "."}`);
@@ -22640,6 +23303,15 @@ function sniffBinary(bytes) {
   for (let i = 0; i < n; i++) if (bytes[i] === 0) return true;
   return false;
 }
+function decodeGitMetadataUtf8(bytes) {
+  const decoded = bytes.toString("utf8");
+  if (!Buffer.from(decoded, "utf8").equals(bytes)) {
+    throw new ChannelAUnavailableError(
+      "Workspace Git paths are not valid UTF-8 and cannot be captured authoritatively."
+    );
+  }
+  return decoded;
+}
 function addedLines(bytes) {
   if (bytes.length === 0) return [];
   const lines = bytes.toString("utf8").split("\n");
@@ -22668,11 +23340,11 @@ function assertSafeRelPath(p) {
   if (norm === "") throw new ChannelAValidationError("path is required");
   return norm;
 }
-function shellQuote6(s) {
+function shellQuote7(s) {
   return `'${s.replace(/'/g, `'\\''`)}'`;
 }
 function internalBashCommand(script) {
-  return `env -u BASH_ENV bash --noprofile --norc -c ${shellQuote6(script)}`;
+  return `env -u BASH_ENV bash --noprofile --norc -c ${shellQuote7(script)}`;
 }
 function assertSafePruneDirectoryName(name) {
   if (name.length > 255 || !/^[A-Za-z0-9._@+-]+$/.test(name) || name === "." || name === "..") {
@@ -23377,7 +24049,9 @@ function withDockerNetwork(client, network) {
     ...client.resume ? {
       resume: async (state) => await wrapSession(await client.resume(state))
     } : {},
-    ...client.delete ? { delete: async (state) => await client.delete(state) } : {},
+    ...client.delete ? {
+      delete: async (state) => await client.delete(state)
+    } : {},
     ...client.serializeSessionState ? {
       serializeSessionState: async (state, options) => await client.serializeSessionState(state, options)
     } : {},
@@ -23447,55 +24121,9 @@ function readWorkspaceArchiveFromEnvelopeSessionState(sessionState) {
     return void 0;
   }
 }
-var MODAL_SNAPSHOT_REF_PREFIXES = [
-  "MODAL_SANDBOX_FS_SNAPSHOT_V1\n",
-  "MODAL_SANDBOX_DIR_SNAPSHOT_V1\n"
-];
 function decodeModalSnapshotId(archive) {
-  let text;
-  try {
-    text = new TextDecoder().decode(archive);
-  } catch {
-    return void 0;
-  }
-  for (const prefix of MODAL_SNAPSHOT_REF_PREFIXES) {
-    if (!text.startsWith(prefix)) {
-      continue;
-    }
-    try {
-      const payload = JSON.parse(text.slice(prefix.length));
-      return typeof payload.snapshot_id === "string" && payload.snapshot_id.length > 0 ? payload.snapshot_id : void 0;
-    } catch {
-      return void 0;
-    }
-  }
-  return void 0;
-}
-async function deletePriorPersistedSnapshot(session, priorArchiveBase64) {
-  if (!priorArchiveBase64) {
-    return void 0;
-  }
-  let bytes;
-  try {
-    bytes = Uint8Array.from(Buffer.from(priorArchiveBase64, "base64"));
-  } catch {
-    return void 0;
-  }
-  const snapshotId = decodeModalSnapshotId(bytes);
-  if (!snapshotId) {
-    return void 0;
-  }
-  const modal = session.modal;
-  const del = modal?.images?.delete;
-  if (typeof del !== "function") {
-    return void 0;
-  }
-  try {
-    await del.call(modal.images, snapshotId);
-    return snapshotId;
-  } catch {
-    return void 0;
-  }
+  const ref = decodeNativeSnapshotRef3(archive);
+  return ref?.provider === "modal_snapshot_filesystem" || ref?.provider === "modal_snapshot_directory" ? ref.snapshotId : void 0;
 }
 async function deserializeSandboxSessionStateEnvelope(client, envelope) {
   if (!envelope || typeof envelope !== "object") {
@@ -23609,7 +24237,11 @@ async function establishSandboxSessionFromEnvelope(settings, envelope, opts) {
   const envelopeBackend = typeof envelope?.backendId === "string" ? envelope.backendId : void 0;
   const backend = opts.backendOverride ?? envelopeBackend ?? settings.sandboxBackend;
   const environment = opts.environment ?? collectSandboxEnvironment(settings);
-  const client = createSandboxClientForBackend(backend, settings, environment);
+  const client = (opts.clientFactory ?? createSandboxClientForBackend)(
+    backend,
+    settings,
+    environment
+  );
   if (!client) {
     throw new SandboxConfigError(
       backend,
@@ -23702,20 +24334,22 @@ async function establishSandboxSessionFromEnvelope(settings, envelope, opts) {
           throw error;
         }
       }
-      try {
-        await verifyRestoredWorkspace(restored, workspaceArchive.descriptor);
-      } catch (error) {
-        await terminateCreatedSandbox(client, restored, restored.state);
-        if (error instanceof WorkspaceArchiveIntegrityError) throw error;
-        throw new WorkspaceArchiveIntegrityError(
-          "workspace_fingerprint_unavailable",
-          `failed to verify selected workspace archive revision ${workspaceArchive.descriptor.revision}`,
-          { retryable: true }
-        );
+      if (workspaceArchive.kind === "tar") {
+        try {
+          await verifyRestoredWorkspace(restored, workspaceArchive.descriptor);
+        } catch (error) {
+          await terminateCreatedSandbox(client, restored, restored.state);
+          if (error instanceof WorkspaceArchiveIntegrityError) throw error;
+          throw new WorkspaceArchiveIntegrityError(
+            "workspace_fingerprint_unavailable",
+            `failed to verify selected workspace archive revision ${workspaceArchive.descriptor.revision}`,
+            { retryable: true }
+          );
+        }
       }
       hydrationApplied = true;
       console.info(
-        `[sandbox] cold-restore verified workspace archive revision ${workspaceArchive.descriptor.revision}`
+        `[sandbox] cold-restore applied ${workspaceArchive.kind === "provider_snapshot" ? "native snapshot receipt" : "verified tar archive"} revision ${workspaceArchive.descriptor.revision}`
       );
     }
     restoredState = restored.state;
@@ -23898,6 +24532,12 @@ export {
   modalSandboxAttributionEnvironment,
   modalSandboxAttributionTags,
   ensureModalRegistryImage,
+  resolveModalCheckpointProviderBindingForSession,
+  modalSessionMatchesCheckpointProviderBinding,
+  resolveModalCheckpointProviderBinding,
+  resolveModalCheckpointProviderBindingForLiveSandbox,
+  inspectModalSandboxLifecycle,
+  deleteModalCheckpointSnapshot,
   tagModalSandbox,
   terminateModalSandboxById,
   sweepModalOrphanSandboxes,
@@ -23956,13 +24596,16 @@ export {
   isProviderSandboxNotFoundError2 as isProviderSandboxNotFoundError,
   isProviderSandboxGoneDuringRoutedOperation,
   isProviderSandboxTransientError,
-  WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,
   WorkspaceArchiveIntegrityError,
-  parseWorkspaceArchiveDescriptor,
+  describeNativeSnapshotArchive,
+  describeLegacyNativeSnapshotArchive,
   readVerifiedWorkspaceArchive,
   fingerprintSandboxWorkspace,
   captureVerifiedWorkspaceArchive,
   verifyRestoredWorkspace,
+  WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION2 as WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION,
+  decodeNativeSnapshotRef3 as decodeNativeSnapshotRef,
+  parseWorkspaceArchiveDescriptor2 as parseWorkspaceArchiveDescriptor,
   selectBackend,
   backendSupportsOs,
   desktopCapableBackend,
@@ -24052,7 +24695,6 @@ export {
   restoredSandboxSessionStateFromEntry,
   readWorkspaceArchiveFromEnvelopeSessionState,
   decodeModalSnapshotId,
-  deletePriorPersistedSnapshot,
   deserializeSandboxSessionStateEnvelope,
   SandboxExecReadinessError,
   verifySandboxExecReadiness,
@@ -24065,4 +24707,4 @@ export {
   collectSandboxEnvironment2 as collectSandboxEnvironment,
   parseExposedPorts2 as parseExposedPorts
 };
-//# sourceMappingURL=chunk-HHWIZHQM.js.map
+//# sourceMappingURL=chunk-GNEGANUF.js.map