@opengeni/runtime 3.0.1 → 4.0.0-canary.35585322809001

package/dist/{chunk-46BFUGFL.js → chunk-WIHICNWS.js}

@@ -1,5 +1,4 @@
 import {
-  NoopSnapshotSpec,
   applyInlineManifestEntryToState,
   applyInlineManifestToState,
   applyLocalSourceManifestEntryToState,
@@ -14,14 +13,11 @@ import {
   imageOutputFromBytes,
   isHostPathStrictlyWithinRoot,
   isHostPathWithinRoot,
-  isNoopSnapshotSpec,
   manifestContainsLocalSource,
   manifestWithMaterializedEnvironmentReferences,
   materializeLocalSourceManifest,
-  normalizeSandboxClientCreateArgs,
   relativeHostPathEscapesRoot,
   resolveSandboxAbsolutePath,
-  resolveSandboxArchiveLimits,
   resolveSandboxRelativePath,
   resolveSandboxWorkdir,
   runSandboxProcess,
@@ -29,9 +25,15 @@ import {
   toUint8Array,
   truncateOutput,
   validateCredentialPair,
-  validateRemoteSandboxPathForManifest,
+  validateRemoteSandboxPathForManifest
+} from "./chunk-SPT3PLMX.js";
+import {
+  NoopSnapshotSpec,
+  isNoopSnapshotSpec,
+  normalizeSandboxClientCreateArgs,
+  resolveSandboxArchiveLimits,
   validateSandboxArchiveLimits
-} from "./chunk-FHGLYLBL.js";
+} from "./chunk-ZG2YH25H.js";
 import {
   Environment,
   FileMode,
@@ -154,7 +156,7 @@ async function enterOperation(gate) {
     gate.activeOperations += 1;
     return false;
   }
-  await new Promise((resolve6) => gate.operationWaiters.push(resolve6));
+  await new Promise((resolve7) => gate.operationWaiters.push(resolve7));
   return true;
 }
 function leaveOperation(gate) {
@@ -175,7 +177,7 @@ async function enterCapture(gate) {
     gate.captureActive = true;
     return;
   }
-  await new Promise((resolve6) => gate.captureWaiters.push(resolve6));
+  await new Promise((resolve7) => gate.captureWaiters.push(resolve7));
 }
 function leaveCapture(gate) {
   if (!gate.captureActive) {
@@ -394,9 +396,9 @@ function stdoutFromExecResult(value) {
 function execFailureDiagnostic(value) {
   if (!value || typeof value !== "object") return "result=unstructured";
   const result = value;
-  const status = typeof result.exitCode === "number" ? `exitCode=${result.exitCode}` : typeof result.status === "number" ? `status=${result.status}` : "exitCode=unknown";
+  const status2 = typeof result.exitCode === "number" ? `exitCode=${result.exitCode}` : typeof result.status === "number" ? `status=${result.status}` : "exitCode=unknown";
   const stderr = typeof result.stderr === "string" ? result.stderr.replace(/\s+/g, " ").trim().slice(0, 240) : "";
-  return stderr.length > 0 ? `${status}, stderr=${stderr}` : status;
+  return stderr.length > 0 ? `${status2}, stderr=${stderr}` : status2;
 }
 function isTransientRootDirectoryFingerprintRace(value) {
   if (!value || typeof value !== "object") return false;
@@ -659,7 +661,7 @@ async function fingerprintRemoteWorkspace(target) {
     });
     match = stdoutFromExecResult(result).trim().match(/^OPENGENI_WORKSPACE_FINGERPRINT_V1 ([a-f0-9]{64}) ([0-9]+) ([0-9]+) ([0-9]+)$/);
     if (match || !isTransientRootDirectoryFingerprintRace(result) || attempt === 3) break;
-    await new Promise((resolve6) => setTimeout(resolve6, attempt * 25));
+    await new Promise((resolve7) => setTimeout(resolve7, attempt * 25));
   }
   if (!match) {
     throw new WorkspaceArchiveIntegrityError(
@@ -2257,8 +2259,8 @@ function trimTarString(value) {
 function decodeBytes(bytes) {
   return new TextDecoder().decode(bytes);
 }
-function joinTarName(name, prefix) {
-  return prefix ? `${prefix}/${name}` : name;
+function joinTarName(name, prefix2) {
+  return prefix2 ? `${prefix2}/${name}` : name;
 }
 function blocksEqual(left, right) {
   if (left.byteLength !== right.byteLength) {
@@ -2578,7 +2580,7 @@ function waitForPtyWebSocketOpen(socket, timeoutMs, providerName) {
   if (readyState === 1) {
     return Promise.resolve();
   }
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     let settled = false;
     let removeOpen = () => {
     };
@@ -2601,7 +2603,7 @@ function waitForPtyWebSocketOpen(socket, timeoutMs, providerName) {
       callback();
     };
     removeOpen = addPtyWebSocketListener(socket, "open", () => {
-      settle(resolve6);
+      settle(resolve7);
     });
     removeError = addPtyWebSocketListener(socket, "error", (event) => {
       settle(() => reject(new UserError(`${providerName} PTY WebSocket failed to connect: ${formatWebSocketEvent(event)}`)));
@@ -2613,7 +2615,7 @@ function waitForPtyWebSocketOpen(socket, timeoutMs, providerName) {
       settle(() => reject(new UserError(`${providerName} PTY WebSocket connection timed out.`)));
     }, timeoutMs);
     if (socket.readyState === 1) {
-      settle(resolve6);
+      settle(resolve7);
       return;
     }
   });
@@ -2708,11 +2710,11 @@ function consumePtyOutput(entry) {
   return output;
 }
 function waitForPtyNotification(entry, timeoutMs) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const done = () => {
       clearTimeout(timer);
       entry.waiters.delete(done);
-      resolve6();
+      resolve7();
     };
     const timer = setTimeout(done, timeoutMs);
     entry.waiters.add(done);
@@ -2885,9 +2887,9 @@ function readProviderErrorRetryability(value, seen, depth) {
   if (typed !== null) {
     return typed;
   }
-  const status = readProviderStatus(value);
-  if (status !== void 0) {
-    const retryable = retryabilityForHttpStatus(status);
+  const status2 = readProviderStatus(value);
+  if (status2 !== void 0) {
+    const retryable = retryabilityForHttpStatus(status2);
     if (retryable !== null) {
       return retryable;
     }
@@ -2946,21 +2948,21 @@ function retryabilityForErrorType(value) {
 }
 function readProviderStatus(value) {
   for (const key of ["status", "statusCode", "httpStatus", "httpStatusCode"]) {
-    const status = value[key];
-    if (typeof status === "number" && Number.isInteger(status)) {
-      return status;
+    const status2 = value[key];
+    if (typeof status2 === "number" && Number.isInteger(status2)) {
+      return status2;
     }
-    if (typeof status === "string" && /^\d+$/u.test(status)) {
-      return Number(status);
+    if (typeof status2 === "string" && /^\d+$/u.test(status2)) {
+      return Number(status2);
     }
   }
   return void 0;
 }
-function retryabilityForHttpStatus(status) {
-  if ([408, 425, 429, 500, 502, 503, 504].includes(status)) {
+function retryabilityForHttpStatus(status2) {
+  if ([408, 425, 429, 500, 502, 503, 504].includes(status2)) {
     return true;
   }
-  if ([400, 401, 403, 404, 409, 422].includes(status)) {
+  if ([400, 401, 403, 404, 409, 422].includes(status2)) {
     return false;
   }
   return null;
@@ -3740,7 +3742,7 @@ var NATIVE_SNAPSHOT_PREFIXES = {
   vercel: "UC_VERCEL_SNAPSHOT_V1\n"
 };
 function encodeNativeSnapshotRef2(ref) {
-  const prefix = NATIVE_SNAPSHOT_PREFIXES[ref.provider];
+  const prefix2 = NATIVE_SNAPSHOT_PREFIXES[ref.provider];
   const body = JSON.stringify({
     snapshot_id: ref.snapshotId,
     ...ref.workspacePersistence ? { workspace_persistence: ref.workspacePersistence } : {}
@@ -3748,16 +3750,16 @@ function encodeNativeSnapshotRef2(ref) {
     snapshot_id: ref.snapshotId,
     workspace_persistence: ref.workspacePersistence
   }).sort());
-  return new TextEncoder().encode(`${prefix}${body}`);
+  return new TextEncoder().encode(`${prefix2}${body}`);
 }
 function decodeNativeSnapshotRef3(data) {
   const text = new TextDecoder().decode(toWorkspaceArchiveBytes(data));
-  for (const [provider, prefix] of Object.entries(NATIVE_SNAPSHOT_PREFIXES)) {
-    if (!text.startsWith(prefix)) {
+  for (const [provider, prefix2] of Object.entries(NATIVE_SNAPSHOT_PREFIXES)) {
+    if (!text.startsWith(prefix2)) {
       continue;
     }
     try {
-      const payload = JSON.parse(text.slice(prefix.length));
+      const payload = JSON.parse(text.slice(prefix2.length));
       if (typeof payload.snapshot_id !== "string" || !payload.snapshot_id) {
         return void 0;
       }
@@ -4409,8 +4411,8 @@ async function runRequiredMountCommand(options, command) {
 function joinShellArgs(args) {
   return args.map(shellQuote).join(" ");
 }
-function joinRemotePath(base, prefix) {
-  const normalizedPrefix = prefix?.replace(/^\/+|\/+$/gu, "");
+function joinRemotePath(base, prefix2) {
+  const normalizedPrefix = prefix2?.replace(/^\/+|\/+$/gu, "");
   return normalizedPrefix ? `${base}/${normalizedPrefix}` : base;
 }
 function resolveRcloneRemoteName(pattern, options) {
@@ -4665,12 +4667,12 @@ function buildBlaxelDriveMountConfig(entry, mountPath) {
 }
 function buildS3FuseMountScript(config) {
   const credentialPath = s3fsCredentialPath(config.mountPath, config.artifactScope);
-  const credentials = config.accessKeyId && config.secretAccessKey ? `${config.accessKeyId}:${config.secretAccessKey}${config.sessionToken ? `:${config.sessionToken}` : ""}` : void 0;
+  const credentials2 = config.accessKeyId && config.secretAccessKey ? `${config.accessKeyId}:${config.secretAccessKey}${config.sessionToken ? `:${config.sessionToken}` : ""}` : void 0;
   const bucket = config.prefix ? `${config.bucket}:/${config.prefix.replace(/^\/+|\/+$/gu, "")}` : config.bucket;
   const options = [
     "allow_other",
     "nonempty",
-    credentials ? `passwd_file=${credentialPath}` : "public_bucket=1",
+    credentials2 ? `passwd_file=${credentialPath}` : "public_bucket=1",
     ...config.endpointUrl ? [`url=${config.endpointUrl}`] : [],
     ...!config.endpointUrl && config.region ? [
       `url=https://s3.${config.region}.amazonaws.com`,
@@ -4682,7 +4684,7 @@ function buildS3FuseMountScript(config) {
   const command = [
     ensureBlaxelToolCommand("s3fs"),
     `mkdir -p -- ${shellQuote(config.mountPath)}`,
-    ...credentials ? [`chmod 600 ${shellQuote(credentialPath)}`] : [],
+    ...credentials2 ? [`chmod 600 ${shellQuote(credentialPath)}`] : [],
     [
       "s3fs",
       shellQuote(bucket),
@@ -4691,7 +4693,7 @@ function buildS3FuseMountScript(config) {
       shellQuote(options.join(","))
     ].join(" ")
   ].join(" && ");
-  if (!credentials) {
+  if (!credentials2) {
     return command;
   }
   return `${command}; status=$?; rm -f -- ${shellQuote(credentialPath)}; exit $status`;
@@ -4846,12 +4848,12 @@ function gcsCredentialPath(mountPath, artifactScope) {
   return `/tmp/gcs-creds-${safeId(`${artifactScope}:${mountPath}`)}.json`;
 }
 function gcsAccessTokenArtifactPaths(mountPath, artifactScope) {
-  const prefix = `/tmp/gcs-access-token-${safeId(`${artifactScope}:${mountPath}`)}`;
+  const prefix2 = `/tmp/gcs-access-token-${safeId(`${artifactScope}:${mountPath}`)}`;
   return {
-    serverPath: `${prefix}.py`,
-    socketPath: `${prefix}.sock`,
-    pidPath: `${prefix}.pid`,
-    payloadPath: `${prefix}.json`
+    serverPath: `${prefix2}.py`,
+    socketPath: `${prefix2}.sock`,
+    pidPath: `${prefix2}.pid`,
+    payloadPath: `${prefix2}.json`
   };
 }
 function usesGcsAccessTokenSecret(config) {
@@ -5687,8 +5689,8 @@ function generateBlaxelSandboxName() {
   return `openai-agents-${Math.random().toString(16).slice(2, 10)}`;
 }
 function isBlaxelSandboxNonResumable(sandbox) {
-  const status = sandbox.status?.trim().toUpperCase();
-  return status ? BLAXEL_NON_RESUMABLE_SANDBOX_STATUSES.has(status) : false;
+  const status2 = sandbox.status?.trim().toUpperCase();
+  return status2 ? BLAXEL_NON_RESUMABLE_SANDBOX_STATUSES.has(status2) : false;
 }
 function assertBlaxelSandboxReusable(sandbox, sandboxName) {
   if (!isBlaxelSandboxNonResumable(sandbox)) {
@@ -5853,8 +5855,8 @@ function buildShellCommand(command, environment) {
 }
 function remoteWriteTempPath(path) {
   const dir = posixDirname(path);
-  const prefix = dir === "/" ? "" : dir;
-  return `${prefix}/.openai-agents-write-${randomUUID()}`;
+  const prefix2 = dir === "/" ? "" : dir;
+  return `${prefix2}/.openai-agents-write-${randomUUID()}`;
 }
 function resolveBlaxelTimeouts(options) {
   return {
@@ -6303,8 +6305,8 @@ function isR2Mount(entry) {
 function isGCSMount(entry) {
   return entry.type === "gcs_mount";
 }
-function normalizePrefix(prefix) {
-  return prefix;
+function normalizePrefix(prefix2) {
+  return prefix2;
 }
 function buildCredentials(args) {
   validateCredentialPair4(args);
@@ -6565,7 +6567,7 @@ var CloudflareSandboxSession = class {
   async materializeEntry(args) {
     assertSandboxEntryMetadataSupported("CloudflareSandboxClient", args.path, args.entry, MOUNT_MANIFEST_METADATA_SUPPORT);
     if (entryContainsLocalSource(args.entry)) {
-      const { applyLocalSourceManifestEntryToState: applyLocalSourceManifestEntryToState2 } = await import("./localSources-PVFCAPN2.js");
+      const { applyLocalSourceManifestEntryToState: applyLocalSourceManifestEntryToState2 } = await import("./localSources-TWHTEKGO.js");
       await applyLocalSourceManifestEntryToState2(this.state, args.path, args.entry, "cloudflare", this.writer(), this.remotePathResolver, this.manifestMaterializationOptions(args.runAs));
       return;
     }
@@ -6576,7 +6578,7 @@ var CloudflareSandboxSession = class {
     assertSandboxManifestMetadataSupported("CloudflareSandboxClient", manifest, MOUNT_MANIFEST_METADATA_SUPPORT);
     assertCloudflareManifestMountsSupported(manifest);
     if (manifestContainsLocalSource(manifest)) {
-      const { applyLocalSourceManifestToState: applyLocalSourceManifestToState2 } = await import("./localSources-PVFCAPN2.js");
+      const { applyLocalSourceManifestToState: applyLocalSourceManifestToState2 } = await import("./localSources-TWHTEKGO.js");
       await applyLocalSourceManifestToState2(this.state, manifest, "cloudflare", this.writer(), this.remotePathResolver, this.manifestMaterializationOptions(runAs));
       return;
     }
@@ -7214,11 +7216,11 @@ async function cloudflareProviderHttpErrorWithBody(operation, response, context
     ...cause ? { cause } : {}
   });
 }
-function cloudflareRetryabilityForStatus(status) {
-  if (status === 500 || status === 503) {
+function cloudflareRetryabilityForStatus(status2) {
+  if (status2 === 500 || status2 === 503) {
     return true;
   }
-  if (status === 400) {
+  if (status2 === 400) {
     return false;
   }
   return null;
@@ -7256,7 +7258,7 @@ function truncateCloudflareErrorBody(body) {
   return body.length > 500 ? `${body.slice(0, 497)}...` : body;
 }
 function waitForCloudflarePtyReady(socket) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     let removeMessage = () => {
     };
     let removeClose = () => {
@@ -7278,7 +7280,7 @@ function waitForCloudflarePtyReady(socket) {
       if (isRecord(payload)) {
         if (payload.type === "ready") {
           cleanup();
-          resolve6();
+          resolve7();
           return;
         }
         if (payload.type === "error") {
@@ -7447,8 +7449,8 @@ function shouldParseStreamedPayloadAsSse(body, headers) {
   if (contentType.split(";", 1)[0]?.trim() === "text/event-stream") {
     return true;
   }
-  const prefix = body.subarray(0, Math.min(body.byteLength, STREAMED_PAYLOAD_SSE_SNIFF_BYTES));
-  return startsWithSseFrame(new TextDecoder().decode(prefix));
+  const prefix2 = body.subarray(0, Math.min(body.byteLength, STREAMED_PAYLOAD_SSE_SNIFF_BYTES));
+  return startsWithSseFrame(new TextDecoder().decode(prefix2));
 }
 function startsWithSseFrame(text) {
   const trimmed = text.trimStart();
@@ -8344,7 +8346,7 @@ async function deleteDaytonaSandboxWithRetry(deleteSandbox) {
         throw error;
       }
       attempt += 1;
-      await new Promise((resolve6) => setTimeout(resolve6, delayMs));
+      await new Promise((resolve7) => setTimeout(resolve7, delayMs));
     }
   }
 }
@@ -8578,12 +8580,12 @@ function assertLocalWorkspaceEntryMetadataSupported(providerName, logicalPath, e
     assertLocalWorkspaceEntryMetadataSupported(providerName, joinLogicalPath(logicalPath, childPath), childEntry, options);
   }
 }
-async function materializeEntries(workspaceRootPath, entries, prefix = "", options = {}) {
+async function materializeEntries(workspaceRootPath, entries, prefix2 = "", options = {}) {
   await runLimited(Object.entries(entries), resolveManifestEntryConcurrency(options.concurrencyLimits), async ([path, entry]) => {
     if (options.skipMountEntries && isMount(entry)) {
       return;
     }
-    const logicalPath = prefix ? `${prefix}/${normalizeRelativePath(path)}` : normalizeRelativePath(path);
+    const logicalPath = prefix2 ? `${prefix2}/${normalizeRelativePath(path)}` : normalizeRelativePath(path);
     await materializeLocalWorkspaceManifestEntry(workspaceRootPath, logicalPath, entry, options);
   });
 }
@@ -10280,13 +10282,13 @@ var UnixLocalSandboxSession = class {
   trackChildProcess(child, options = {}) {
     let resolveDone = () => {
     };
-    const donePromise = new Promise((resolve6) => {
-      resolveDone = resolve6;
+    const donePromise = new Promise((resolve7) => {
+      resolveDone = resolve7;
     });
     let resolveOutputClosed = () => {
     };
-    const outputClosedPromise = new Promise((resolve6) => {
-      resolveOutputClosed = resolve6;
+    const outputClosedPromise = new Promise((resolve7) => {
+      resolveOutputClosed = resolve7;
     });
     const activeProcess = {
       child,
@@ -10568,13 +10570,13 @@ function buildCommandEnvironment(args) {
   };
 }
 function translateRootManifestCommandInput(command, workspaceRootPath) {
-  return command.replace(/(^|[\s"'=<>])\/([^\s"'|&;<>(){}]*)/g, (_match, prefix, pathSuffix) => `${prefix}${workspaceRootPath}/${pathSuffix}`);
+  return command.replace(/(^|[\s"'=<>])\/([^\s"'|&;<>(){}]*)/g, (_match, prefix2, pathSuffix) => `${prefix2}${workspaceRootPath}/${pathSuffix}`);
 }
 function translateManifestRootCommandInput(command, manifestRoot, workspaceRootPath) {
   const escapedManifestRoot = escapeRegExp(manifestRoot);
   const pathPrefix = String.raw`(^|[\s"'=<>])`;
   const pathSuffix = String.raw`(?=$|[\/\s"'|&;<>(){}])`;
-  return command.replace(new RegExp(`${pathPrefix}${escapedManifestRoot}${pathSuffix}`, "g"), (_match, prefix) => `${prefix}${workspaceRootPath}`);
+  return command.replace(new RegExp(`${pathPrefix}${escapedManifestRoot}${pathSuffix}`, "g"), (_match, prefix2) => `${prefix2}${workspaceRootPath}`);
 }
 function translateRootManifestCommandOutput(output, workspaceRootPath) {
   return translateWorkspaceRootCommandOutput(output, "/", workspaceRootPath);
@@ -10665,7 +10667,7 @@ async function waitForProcessOrTimeout(activeProcess, timeoutMs) {
   }
   await Promise.race([
     activeProcess.donePromise,
-    new Promise((resolve6) => setTimeout(resolve6, timeoutMs))
+    new Promise((resolve7) => setTimeout(resolve7, timeoutMs))
   ]);
   if (activeProcess.done) {
     await activeProcess.outputClosedPromise;
@@ -11754,13 +11756,13 @@ async function runDockerProcess(args, input) {
   child.stderr.on("data", (chunk) => {
     stderrChunks.push(chunk);
   });
-  const closed = new Promise((resolve6) => {
+  const closed = new Promise((resolve7) => {
     child.on("close", (code) => {
-      resolve6(code ?? 1);
+      resolve7(code ?? 1);
     });
     child.on("error", (error) => {
       stderrChunks.push(Buffer.from(error.message));
-      resolve6(1);
+      resolve7(1);
     });
   });
   if (input !== void 0) {
@@ -12952,8 +12954,8 @@ function dockerRcloneBoxOptions(entry) {
     "box-owned-by": entry.ownedBy
   });
 }
-function joinRemotePath2(base, prefix) {
-  const normalizedPrefix = prefix?.replace(/^\/+|\/+$/gu, "");
+function joinRemotePath2(base, prefix2) {
+  const normalizedPrefix = prefix2?.replace(/^\/+|\/+$/gu, "");
   return normalizedPrefix ? `${base}/${normalizedPrefix}` : base;
 }
 function normalizeBoxRemotePath2(path) {
@@ -13984,17 +13986,17 @@ function buildModalCloudBucketMountConfig(mount, options = {}) {
       sessionToken,
       mountType: mount.type
     });
-    const credentials = compactCredentials({
+    const credentials2 = compactCredentials({
       AWS_ACCESS_KEY_ID: accessKeyId,
       AWS_SECRET_ACCESS_KEY: secretAccessKey,
       AWS_SESSION_TOKEN: sessionToken
     });
-    assertNoInlineCredentialsWithSecret(mount, credentials, options.secretName);
+    assertNoInlineCredentialsWithSecret(mount, credentials2, options.secretName);
     return {
       bucketName: mount.bucket,
       bucketEndpointUrl: mount.endpointUrl,
       keyPrefix: mount.prefix,
-      credentials,
+      credentials: credentials2,
       secretName: options.secretName,
       secretEnvironmentName: options.secretEnvironmentName,
       readOnly: mount.readOnly ?? true
@@ -14008,11 +14010,11 @@ function buildModalCloudBucketMountConfig(mount, options = {}) {
       secretAccessKey,
       mountType: mount.type
     });
-    const credentials = compactCredentials({
+    const credentials2 = compactCredentials({
       AWS_ACCESS_KEY_ID: accessKeyId,
       AWS_SECRET_ACCESS_KEY: secretAccessKey
     });
-    assertNoInlineCredentialsWithSecret(mount, credentials, options.secretName);
+    assertNoInlineCredentialsWithSecret(mount, credentials2, options.secretName);
     const customDomain = readOptionalString(mount, "customDomain");
     if (!customDomain && !mount.accountId) {
       throw new SandboxMountError("Modal R2 bucket mounts require accountId or customDomain.", {
@@ -14024,7 +14026,7 @@ function buildModalCloudBucketMountConfig(mount, options = {}) {
       bucketName: mount.bucket,
       bucketEndpointUrl: customDomain ?? `https://${mount.accountId}.r2.cloudflarestorage.com`,
       keyPrefix: mount.prefix,
-      credentials,
+      credentials: credentials2,
       secretName: options.secretName,
       secretEnvironmentName: options.secretEnvironmentName,
       readOnly: mount.readOnly ?? true
@@ -14045,16 +14047,16 @@ function buildModalCloudBucketMountConfig(mount, options = {}) {
         mountType: mount.type
       });
     }
-    const credentials = accessId && secretAccessKey ? {
+    const credentials2 = accessId && secretAccessKey ? {
       GOOGLE_ACCESS_KEY_ID: accessId,
       GOOGLE_ACCESS_KEY_SECRET: secretAccessKey
     } : void 0;
-    assertNoInlineCredentialsWithSecret(mount, credentials, options.secretName);
+    assertNoInlineCredentialsWithSecret(mount, credentials2, options.secretName);
     return {
       bucketName: mount.bucket,
       bucketEndpointUrl: endpointUrl ?? "https://storage.googleapis.com",
       keyPrefix: mount.prefix,
-      credentials,
+      credentials: credentials2,
       secretName: options.secretName,
       secretEnvironmentName: options.secretEnvironmentName,
       readOnly: mount.readOnly ?? true
@@ -14089,16 +14091,16 @@ function validateSecretOptions(mount, options) {
     });
   }
 }
-function assertNoInlineCredentialsWithSecret(mount, credentials, secretName) {
-  if (secretName && credentials && Object.keys(credentials).length > 0) {
+function assertNoInlineCredentialsWithSecret(mount, credentials2, secretName) {
+  if (secretName && credentials2 && Object.keys(credentials2).length > 0) {
     throw new SandboxMountError("Modal cloud bucket mounts do not support both inline credentials and secretName.", {
       provider: "modal",
       mountType: mount.type
     });
   }
 }
-function compactCredentials(credentials) {
-  const compact = Object.fromEntries(Object.entries(credentials).filter(([, value]) => value !== void 0));
+function compactCredentials(credentials2) {
+  const compact = Object.fromEntries(Object.entries(credentials2).filter(([, value]) => value !== void 0));
   return Object.keys(compact).length > 0 ? compact : void 0;
 }
 function validateCredentialPair6(args) {
@@ -14337,9 +14339,9 @@ var ModalSandboxSession = class {
             stderr += chunk;
           });
           try {
-            const status = await process2.wait();
+            const status2 = await process2.wait();
             await stderrPump.promise;
-            return { status, stderr };
+            return { status: status2, stderr };
           } catch (error) {
             await stderrPump.cancel();
             throw error;
@@ -15475,8 +15477,8 @@ async function waitForProcessOrTimeout2(activeProcess, timeoutMs) {
   try {
     await Promise.race([
       activeProcess.donePromise,
-      new Promise((resolve6) => {
-        timeout = setTimeout(resolve6, timeoutMs);
+      new Promise((resolve7) => {
+        timeout = setTimeout(resolve7, timeoutMs);
         unrefTimer(timeout);
       })
     ]);
@@ -15652,9 +15654,9 @@ function normalizeWindowsAbsolutePath(value) {
     throw new TypeError("Connected Machine device-namespace paths are not supported");
   }
   if (WINDOWS_DRIVE_ABSOLUTE.test(portable)) {
-    const prefix = `${portable[0].toUpperCase()}:/`;
+    const prefix2 = `${portable[0].toUpperCase()}:/`;
     const normalized = normalizeSegments(portable.slice(3).split("/"), 0).join("/");
-    return normalized ? `${prefix}${normalized}` : prefix;
+    return normalized ? `${prefix2}${normalized}` : prefix2;
   }
   if (WINDOWS_UNC_ABSOLUTE.test(portable)) {
     const segments = portable.slice(2).split("/").filter(Boolean);
@@ -15770,22 +15772,22 @@ function parseExecResponseBanner(raw) {
   }
   if (delimiter.index > EXEC_BANNER_HEADER_MAX_CHARS) return { kind: "invalid" };
   const header = raw.slice(0, delimiter.index);
-  const status = [];
+  const status2 = [];
   for (const line of header.split(/\r?\n/u)) {
     const running = RUNNING_LINE.exec(line);
     if (running) {
-      status.push({ kind: "running", value: running[1] });
+      status2.push({ kind: "running", value: running[1] });
       continue;
     }
     const exited = EXITED_LINE.exec(line);
     if (exited) {
-      status.push({ kind: "exited", value: exited[1] });
+      status2.push({ kind: "exited", value: exited[1] });
       continue;
     }
     if (PROCESS_STATUS_PREFIX.test(line)) return { kind: "invalid" };
   }
-  if (status.length !== 1) return { kind: "invalid" };
-  const terminal = status[0];
+  if (status2.length !== 1) return { kind: "invalid" };
+  const terminal = status2[0];
   const value = Number(terminal.value);
   if (!Number.isSafeInteger(value)) return { kind: "invalid" };
   if (terminal.kind === "running") {
@@ -15846,9 +15848,42 @@ function notifyDurableOpOwnershipTransferred(opId) {
   storage.getStore()?.onDurableOpOwnershipTransferred?.(opId);
 }
 
+// src/sandbox/routing/routing-session.ts
+import { isDeepStrictEqual } from "util";
+
 // src/sandbox/provider-command-session.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+var ProviderCommandStartRejectedError = class extends Error {
+  constructor(cause) {
+    super("Provider rejected command before start", { cause });
+    this.name = "ProviderCommandStartRejectedError";
+  }
+};
 var admission = new AsyncLocalStorage2();
+var pendingSupervision = new AsyncLocalStorage2();
+function withPendingCommandSupervision(state, fn) {
+  return state ? pendingSupervision.run(state, fn) : fn();
+}
+function markPendingCommandSupervised() {
+  const state = pendingSupervision.getStore();
+  if (state) state.managed = true;
+}
+var supervisionReady = new AsyncLocalStorage2();
+var supervisedLaunch = new AsyncLocalStorage2();
+function withSupervisedLaunchReservation(reservation, fn) {
+  return supervisedLaunch.run(reservation, fn);
+}
+async function reserveSupervisedLaunch(command) {
+  const reservation = supervisedLaunch.getStore();
+  if (!reservation) throw new Error("Supervised launch requires durable pre-dispatch reservation");
+  await reservation.reserve(command);
+}
+function withCommandSupervisionReady(ready, fn) {
+  return supervisionReady.run(ready, fn);
+}
+function admittedCommandSupervisionReady() {
+  return supervisionReady.getStore() === true;
+}
 var MAX_PROVIDER_COMMAND_HANDLE = 2147483647;
 function withProviderCommandHandle(handle, fn) {
   if (handle === void 0) return fn();
@@ -15860,6 +15895,36 @@ function admittedProviderCommandHandle() {
   return admission.getStore();
 }
 
+// src/sandbox/materialization-verification-error.ts
+var EXPLANATIONS = {
+  path_not_visible: "the provider could not see the destination path",
+  command_failed: "the visibility-check command exited unsuccessfully",
+  command_pending: "the visibility-check command was still running; path visibility is unconfirmed",
+  invalid_response: "the visibility check returned no valid success confirmation",
+  command_error: "the provider could not complete the visibility-check command"
+};
+var SandboxMaterializationVerificationError = class extends Error {
+  constructor(diagnostic, options) {
+    super(
+      `Sandbox materialization verification failed: ${EXPLANATIONS[diagnostic.reason]}: ${diagnostic.path}`,
+      options
+    );
+    this.diagnostic = diagnostic;
+    this.name = "SandboxMaterializationVerificationError";
+  }
+  code = "sandbox_materialization_verification_failed";
+};
+var providerDiagnostics = /* @__PURE__ */ new WeakMap();
+function retainMaterializationVerificationDiagnostic(error, diagnostic) {
+  if (error !== null && (typeof error === "object" || typeof error === "function")) {
+    providerDiagnostics.set(error, diagnostic);
+  }
+}
+function materializationVerificationDiagnostic(error) {
+  if (error instanceof SandboxMaterializationVerificationError) return error.diagnostic;
+  return error !== null && (typeof error === "object" || typeof error === "function") ? providerDiagnostics.get(error) : void 0;
+}
+
 // src/sandbox/routing/routing-session.ts
 import { CAPABILITY_DESCRIPTORS as CAPABILITY_DESCRIPTORS2 } from "@opengeni/contracts";
 
@@ -16295,6 +16360,11 @@ function renderSelfhostedFault(error) {
 }
 
 // src/sandbox/routing/routing-session.ts
+function eligibleForSupervision(args) {
+  return Boolean(
+    args && typeof args === "object" && !args.tty && !args.runAs
+  );
+}
 function recordFirstOperationPhase(timing, phase, durationMs, outcome) {
   if (!timing) return;
   const prior = timing.phases[phase];
@@ -16491,6 +16561,7 @@ var RoutingSandboxSession = class {
   cachedEpoch;
   cachedSandboxId;
   cached;
+  homeResolutions = /* @__PURE__ */ new Map();
   // The last-resolved backend, exposed via the `state` getter (a method-free read
   // of the active backend's `state`). Updated on every resolve.
   lastResolved;
@@ -16573,6 +16644,18 @@ var RoutingSandboxSession = class {
     if (this.cachedEpoch === pointer.activeEpoch && this.cachedSandboxId === pointer.activeSandboxId && this.cached) {
       return this.cached;
     }
+    if (pointer.activeSandboxId !== null) return await this.resolvePointer(pointer);
+    const pending = this.homeResolutions.get(pointer.activeEpoch);
+    if (pending) return await pending;
+    const resolution = this.resolvePointer(pointer);
+    this.homeResolutions.set(pointer.activeEpoch, resolution);
+    try {
+      return await resolution;
+    } finally {
+      this.homeResolutions.delete(pointer.activeEpoch);
+    }
+  }
+  async resolvePointer(pointer) {
     const fromEpoch = this.cachedEpoch ?? pointer.activeEpoch;
     const resolved = await this.deps.resolveActiveBackend(pointer);
     if (resolved.session === this) {
@@ -16934,6 +17017,15 @@ var RoutingSandboxSession = class {
     const providerSessionId = providerSessionIdFromArgs(args);
     if (providerSessionId === null) throw new RoutingRetainedProcessNotFoundError(-1);
     const record = this.retainedProcess(providerSessionId);
+    if (!modelVisible && args && typeof args === "object" && args.chars === "" && record.process.providerCommand?.kind === "modal-router-v1" && record.process.providerCommand.supervision) {
+      await this.ensureParentPromotion(record);
+      if (!await record.backend.session.cancelSupervisedCommand?.(
+        providerSessionId,
+        "explicit_stop"
+      ))
+        throw new Error("Supervised command cancellation is unavailable");
+      args = { ...args, chars: "" };
+    }
     await this.captureRetainedOutput(record);
     const priorTerminal = await this.flushPendingProcessMutation(record);
     if (priorTerminal !== null) {
@@ -16965,6 +17057,23 @@ var RoutingSandboxSession = class {
   }
   async captureRetainedOutput(record, result) {
     if (!this.deps.captureProcessOutput) return;
+    const atomicReceipt = record.pendingProviderReceipt ?? (typeof result === "string" ? result : void 0);
+    if (atomicReceipt && record.backend.session.captureCommandOutput && record.backend.session.getProviderCommandOutput?.(atomicReceipt)?.command.kind === "modal-router-v1") {
+      record.pendingProviderReceipt = atomicReceipt;
+      try {
+        if (await record.backend.session.captureCommandOutput(atomicReceipt)) {
+          delete record.pendingProviderReceipt;
+          return;
+        }
+      } catch (error) {
+        throw new RoutingMutationOutcomeUnknownError(
+          "captureProcessOutput",
+          "Provider output atomic capture remains pending; the provider operation was not replayed",
+          { cause: error, retainedProcess: record.process }
+        );
+      }
+      delete record.pendingProviderReceipt;
+    }
     const providerPage = record.backend.session.getProviderCommandOutput?.(result);
     const structured = result && typeof result === "object" ? result : null;
     if (providerPage) {
@@ -17038,17 +17147,29 @@ var RoutingSandboxSession = class {
    * A non-fence error propagates immediately (it is a real op failure, not a swap
    * race).
    */
-  async dispatch(op, mutatesWorkspace, fn) {
+  async dispatch(op, mutatesWorkspace, fn, supervisionEligible = false) {
     const firstOperationObserver = this.deps.onFirstOperation;
     if (this.firstOperationClaimed || !firstOperationObserver) {
-      return await this.dispatchWithRetries(op, mutatesWorkspace, fn);
+      return await this.dispatchWithRetries(
+        op,
+        mutatesWorkspace,
+        fn,
+        void 0,
+        supervisionEligible
+      );
     }
     this.firstOperationClaimed = true;
     const startedAt = performance.now();
     const timing = { phases: {} };
     let outcome = "failed";
     try {
-      const result = await this.dispatchWithRetries(op, mutatesWorkspace, fn, timing);
+      const result = await this.dispatchWithRetries(
+        op,
+        mutatesWorkspace,
+        fn,
+        timing,
+        supervisionEligible
+      );
       outcome = "completed";
       return result;
     } finally {
@@ -17063,7 +17184,24 @@ var RoutingSandboxSession = class {
       }
     }
   }
-  async dispatchWithRetries(op, mutatesWorkspace, fn, firstOperationTiming) {
+  /** Classify loss on the copied backend, including read-only preflight. This
+   * path never admits work or retries the failed operation on a new route. */
+  async throwProviderError(op, backend, error) {
+    if (!isFenceError(error) && backend.sandboxId === null && this.deps.onDefaultBackendError) {
+      const loss = await this.deps.onDefaultBackendError({
+        op,
+        error,
+        kind: backend.kind,
+        backend
+      });
+      if (loss) {
+        this.invalidate(backend);
+        throw new RoutingBackendRecoveryRequiredError(op, loss.leaseEpoch, loss.recovery);
+      }
+    }
+    throw error;
+  }
+  async dispatchWithRetries(op, mutatesWorkspace, fn, firstOperationTiming, supervisionEligible = false) {
     let attempt = 0;
     let lastError;
     while (attempt <= this.maxFenceRetries) {
@@ -17081,7 +17219,23 @@ var RoutingSandboxSession = class {
           resolutionOutcome
         );
       }
+      const supervisionReady2 = supervisionEligible && backend.kind === "modal" && (await this.deps.providerSupervisionReady?.() ?? false);
+      let verifiedSupervision;
+      if (supervisionReady2) {
+        if (!backend.session.verifyCommandSupervisionCapability || !this.deps.afterMutation || !this.deps.providerCommandPersistence)
+          throw new Error(
+            "Supervised command requires exact-instance verification and durable reservation wiring"
+          );
+        try {
+          verifiedSupervision = await backend.session.verifyCommandSupervisionCapability();
+        } catch (error) {
+          return await this.throwProviderError(op, backend, error);
+        }
+        if (backend.providerInstanceId && verifiedSupervision.sandboxId !== backend.providerInstanceId)
+          throw new Error("Supervision capability does not match the admitted provider instance");
+      }
       let admission2;
+      let reservedProcess;
       if (mutatesWorkspace && this.deps.beforeMutation) {
         const admissionStartedAt = performance.now();
         let admissionWaitMs = 0;
@@ -17090,17 +17244,16 @@ var RoutingSandboxSession = class {
           admission2 = await this.deps.beforeMutation({
             op,
             backend,
-            ...firstOperationTiming ? {
-              onCaptureWait: (observation) => {
-                admissionWaitMs += Math.max(0, observation.durationMs);
-                recordFirstOperationPhase(
-                  firstOperationTiming,
-                  "snapshotWait",
-                  observation.durationMs,
-                  observation.outcome
-                );
-              }
-            } : {}
+            onCaptureWait: (observation) => {
+              admissionWaitMs += Math.max(0, observation.durationMs);
+              recordFirstOperationPhase(
+                firstOperationTiming,
+                "snapshotWait",
+                observation.durationMs,
+                observation.outcome
+              );
+              this.observeCaptureWait(op, backend, "admission", observation);
+            }
           });
           admissionOutcome = "completed";
         } finally {
@@ -17123,9 +17276,50 @@ var RoutingSandboxSession = class {
             backend,
             () => withProviderCommandHandle(
               this.deps.providerCommandHandle?.(admission2),
-              () => fn(backend.session, backend)
+              () => withCommandSupervisionReady(
+                supervisionReady2,
+                () => withSupervisedLaunchReservation(
+                  {
+                    reserve: async (command) => {
+                      const handle = this.deps.providerCommandHandle?.(admission2);
+                      if (!supervisionReady2 || !handle || reservedProcess || !command.supervision)
+                        throw new Error("Invalid supervised launch reservation");
+                      if (command.sandboxId !== verifiedSupervision?.sandboxId || command.taskId !== verifiedSupervision.taskId)
+                        throw new Error(
+                          "Modal task changed after supervision capability verification"
+                        );
+                      const process2 = {
+                        id: crypto.randomUUID(),
+                        providerSessionId: handle,
+                        providerCommand: command
+                      };
+                      reservedProcess = process2;
+                      const reservationResult = await this.deps.afterMutation({
+                        op,
+                        backend,
+                        admission: admission2,
+                        outcome: "resolved",
+                        retainedProcess: process2
+                      });
+                      if (reservationResult)
+                        throw new RoutingMutationOutcomeUnknownError(
+                          op,
+                          "Supervised launch reservation lost authority before dispatch",
+                          { retainedProcess: process2 }
+                        );
+                      const persisted = await this.deps.providerCommandPersistence(process2).load();
+                      if (!persisted || !isDeepStrictEqual(persisted, command))
+                        throw new Error(
+                          "Supervised launch reservation did not retain the exact invocation"
+                        );
+                      this.registerRetainedProcess(process2, backend).durable = true;
+                    }
+                  },
+                  () => fn(backend.session, backend)
+                )
+              )
             ),
-            firstOperationTiming ? (observation) => {
+            (observation) => {
               providerWaitMs += Math.max(0, observation.durationMs);
               recordFirstOperationPhase(
                 firstOperationTiming,
@@ -17133,7 +17327,8 @@ var RoutingSandboxSession = class {
                 observation.durationMs,
                 observation.outcome
               );
-            } : void 0
+              this.observeCaptureWait(op, backend, "provider", observation);
+            }
           );
           providerOutcome = "completed";
         } finally {
@@ -17145,6 +17340,29 @@ var RoutingSandboxSession = class {
           );
         }
       } catch (error) {
+        if (reservedProcess) {
+          if (error instanceof ProviderCommandStartRejectedError && reservedProcess.providerCommand?.kind === "modal-router-v1") {
+            const persistence = this.deps.providerCommandPersistence?.(reservedProcess);
+            if (persistence?.rejectSupervisedLaunch) {
+              try {
+                await persistence.rejectSupervisedLaunch(reservedProcess.providerCommand);
+              } catch (cause) {
+                throw new RoutingMutationOutcomeUnknownError(
+                  op,
+                  "Never-started provider rejection could not settle its exact reservation",
+                  { cause, retainedProcess: reservedProcess }
+                );
+              }
+              this.retainedProcesses.delete(reservedProcess.providerSessionId);
+              throw error;
+            }
+          }
+          throw new RoutingMutationOutcomeUnknownError(
+            op,
+            "Reserved supervised launch did not return; exact invocation retained and not replayed",
+            { cause: error, retainedProcess: reservedProcess }
+          );
+        }
         const partialMutation = error instanceof ChannelAPartialMutationError;
         if (mutatesWorkspace && this.deps.afterMutation) {
           const settlementStartedAt = performance.now();
@@ -17181,19 +17399,7 @@ var RoutingSandboxSession = class {
           );
         }
         if (!isFenceError(error)) {
-          if (backend.sandboxId === null && this.deps.onDefaultBackendError) {
-            const loss = await this.deps.onDefaultBackendError({
-              op,
-              error,
-              kind: backend.kind,
-              backend
-            });
-            if (loss) {
-              this.invalidate(backend);
-              throw new RoutingBackendRecoveryRequiredError(op, loss.leaseEpoch, loss.recovery);
-            }
-          }
-          throw error;
+          return await this.throwProviderError(op, backend, error);
         }
         this.invalidate(backend);
         if (mutatesWorkspace) {
@@ -17209,13 +17415,13 @@ var RoutingSandboxSession = class {
       }
       const yieldedSessionId = mutatesWorkspace && (op === "exec" || op === "execCommand") ? providerSessionIdFromResult(result) : null;
       const providerCommand = yieldedSessionId === null ? null : backend.session.getProviderCommand?.(yieldedSessionId);
-      const retainedProcess = yieldedSessionId === null ? void 0 : {
+      const retainedProcess = reservedProcess ?? (yieldedSessionId === null ? void 0 : {
         id: crypto.randomUUID(),
         providerSessionId: yieldedSessionId,
         ...providerCommand ? { providerCommand } : {}
-      };
-      const retainedRecord = retainedProcess ? this.registerRetainedProcess(retainedProcess, backend) : null;
-      if (mutatesWorkspace && this.deps.afterMutation) {
+      });
+      const retainedRecord = retainedProcess ? reservedProcess ? this.retainedProcess(reservedProcess.providerSessionId) : this.registerRetainedProcess(retainedProcess, backend) : null;
+      if (mutatesWorkspace && this.deps.afterMutation && !reservedProcess) {
         const settlement = {
           op,
           backend,
@@ -17270,6 +17476,17 @@ var RoutingSandboxSession = class {
       }
       if (retainedRecord) {
         await this.captureRetainedOutput(retainedRecord, result);
+        try {
+          await backend.session.releaseSupervisedCommand?.(
+            retainedRecord.process.providerSessionId
+          );
+        } catch (cause) {
+          throw new RoutingMutationOutcomeUnknownError(
+            op,
+            "Supervisor release is unresolved after durable retention; the exact command remains tracked and was not replayed",
+            { cause, retainedProcess: retainedRecord.process }
+          );
+        }
         return result;
       }
       let current;
@@ -17302,14 +17519,28 @@ var RoutingSandboxSession = class {
     }
     throw lastError ?? new Error(`routing op "${op}" exhausted fence retries`);
   }
+  observeCaptureWait(op, backend, captureWaitStage, observation) {
+    try {
+      this.deps.onCaptureWait?.({
+        backend: backend.kind,
+        op,
+        outcome: observation.outcome === "completed" ? "ok" : "failed",
+        durationMs: observation.durationMs,
+        captureWaitStage
+      });
+    } catch {
+    }
+  }
   async invokeProviderOperation(op, backend, fn, onCaptureWait) {
     const startedAt = performance.now();
     let outcome = "failed";
+    let materializationFailureReason;
     try {
       const result = await withSandboxProviderOperation(backend.session, fn, onCaptureWait);
       outcome = "ok";
       return result;
     } catch (error) {
+      materializationFailureReason = materializationVerificationDiagnostic(error)?.reason;
       if ((op === "readFile" || op === "listDir" || op === "pathExists" || op === "viewImage") && isDefinitePathNotFoundError(error)) {
         outcome = "not_found";
       }
@@ -17320,7 +17551,8 @@ var RoutingSandboxSession = class {
           backend: backend.kind,
           op,
           outcome,
-          durationMs: Math.max(0, performance.now() - startedAt)
+          durationMs: Math.max(0, performance.now() - startedAt),
+          ...materializationFailureReason ? { materializationFailureReason } : {}
         });
       } catch {
       }
@@ -17355,28 +17587,38 @@ var RoutingSandboxSession = class {
   // dispatches to the active backend at call-time. A missing backend method
   // degrades via the natural fallback or RoutingUnsupportedError.
   async exec(args) {
-    return this.dispatch("exec", true, async (s) => {
-      if (s.exec) {
-        return s.exec(args);
-      }
-      if (s.execCommand) {
-        return structuredExecResultFromBanner(await s.execCommand(args));
-      }
-      throw new RoutingUnsupportedError("exec", this.cached?.kind ?? "unknown");
-    });
+    return this.dispatch(
+      "exec",
+      true,
+      async (s) => {
+        if (s.exec) {
+          return s.exec(args);
+        }
+        if (s.execCommand) {
+          return structuredExecResultFromBanner(await s.execCommand(args));
+        }
+        throw new RoutingUnsupportedError("exec", this.cached?.kind ?? "unknown");
+      },
+      eligibleForSupervision(args)
+    );
   }
   async execCommand(args) {
     try {
-      return await this.dispatch("execCommand", true, async (s) => {
-        if (s.execCommand) {
-          return s.execCommand(args);
-        }
-        if (s.exec) {
-          const r = await s.exec(args);
-          return r.stdout ?? r.output ?? "";
-        }
-        throw new RoutingUnsupportedError("execCommand", this.cached?.kind ?? "unknown");
-      });
+      return await this.dispatch(
+        "execCommand",
+        true,
+        async (s) => {
+          if (s.execCommand) {
+            return s.execCommand(args);
+          }
+          if (s.exec) {
+            const r = await s.exec(args);
+            return r.stdout ?? r.output ?? "";
+          }
+          throw new RoutingUnsupportedError("execCommand", this.cached?.kind ?? "unknown");
+        },
+        eligibleForSupervision(args)
+      );
     } catch (error) {
       return this.renderSelfhostedFaultOrThrow(error);
     }
@@ -17439,7 +17681,10 @@ var RoutingSandboxSession = class {
       await this.writeStdinForProcessControl({
         sessionId: record.process.providerSessionId,
         chars: "",
-        yieldTimeMs: 1
+        // A near-zero provider long-poll can expire before even an already
+        // completed command's terminal batch is delivered. Use the ordinary
+        // bounded command-read window; never infer completion from silence.
+        yieldTimeMs: 250
       });
       return true;
     }
@@ -17495,6 +17740,15 @@ var RoutingSandboxSession = class {
   async writeStdinForProcessControl(args) {
     return await this.dispatchProcessControl(args);
   }
+  async cancelSupervisedCommand(providerSessionId, reason) {
+    const record = this.retainedProcesses.get(providerSessionId);
+    if (!record || record.process.providerCommand?.kind !== "modal-router-v1" || !record.process.providerCommand.supervision)
+      return false;
+    await this.ensureParentPromotion(record);
+    if (!record.backend.session.cancelSupervisedCommand)
+      throw new Error("Supervised command control is unavailable");
+    return await record.backend.session.cancelSupervisedCommand(providerSessionId, reason);
+  }
   /** Empty-input eager reads belong to the model's foreground wait, while
    * cancellation/drain reads use the non-observing control method above. */
   async writeStdinForProcessRead(args) {
@@ -17511,6 +17765,10 @@ var RoutingSandboxSession = class {
     const exactProviderSessionId = positiveProviderSessionId(providerSessionId);
     if (exactProviderSessionId === null) throw new RoutingRetainedProcessNotFoundError(-1);
     const record = this.retainedProcess(exactProviderSessionId);
+    if (record.process.providerCommand?.kind === "modal-router-v1" && record.process.providerCommand.supervision)
+      throw new Error(
+        "Legacy process helpers are unavailable for a supervised command; use its native control protocol"
+      );
     const priorTerminal = await this.flushPendingProcessMutation(record);
     if (priorTerminal !== null) return priorTerminal;
     if (record.pendingTerminal) {
@@ -17793,6 +18051,9 @@ var RoutingSandboxSession = class {
 };
 var MATERIALIZED_PATH_MARKER = "__OPENGENI_MATERIALIZED_PATH_VISIBLE__";
 async function assertProviderCanSeeMaterializedPath(session, path) {
+  if (session.verifyMaterializedPath) {
+    return session.verifyMaterializedPath(path, providerManifestRoot(session) ?? "/workspace");
+  }
   const command = `test -e ${shellSingleQuote(path)} && printf %s ${shellSingleQuote(
     MATERIALIZED_PATH_MARKER
   )}`;
@@ -17804,18 +18065,56 @@ async function assertProviderCanSeeMaterializedPath(session, path) {
     tty: false
   };
   let output;
-  if (session.execCommand) {
-    output = await session.execCommand(args);
-  } else if (session.exec) {
-    output = formatExecResult(await session.exec(args));
-  } else {
+  let result;
+  if (!session.execCommand && !session.exec) {
     throw new RoutingUnsupportedError("materializeEntry.verify", "unknown");
   }
-  if (!output.includes(MATERIALIZED_PATH_MARKER)) {
-    throw new Error(
-      `Sandbox materialization completed but the provider cannot read the destination path: ${path}`
-    );
+  try {
+    result = session.execCommand ? await session.execCommand(args) : await session.exec(args);
+  } catch (cause) {
+    retainMaterializationVerificationDiagnostic(cause, {
+      reason: "command_error",
+      path,
+      workdir: args.workdir,
+      command,
+      output: null,
+      exitCode: null,
+      providerSessionId: null,
+      causeMessage: cause instanceof Error ? cause.message : String(cause)
+    });
+    throw cause;
+  }
+  try {
+    output = formatExecResult(result);
+  } catch (cause) {
+    const record = result && typeof result === "object" ? result : {};
+    const returnedOutput = [record.output, record.stderr, record.stdout].filter((value) => typeof value === "string").join("\n");
+    throw new SandboxMaterializationVerificationError({
+      reason: "invalid_response",
+      path,
+      workdir: args.workdir,
+      command,
+      output: returnedOutput || null,
+      exitCode: null,
+      providerSessionId: null,
+      causeMessage: cause instanceof Error ? cause.message : String(cause)
+    });
+  }
+  const status2 = parseExecResponseBanner(output);
+  const markerPresent = stripExecBanner(output).includes(MATERIALIZED_PATH_MARKER);
+  if (markerPresent && (status2.kind === "absent" || status2.kind === "exited" && status2.exitCode === 0)) {
+    return;
   }
+  const reason = status2.kind === "running" ? "command_pending" : status2.kind === "exited" && status2.exitCode === 1 ? "path_not_visible" : status2.kind === "exited" && status2.exitCode !== 0 ? "command_failed" : "invalid_response";
+  throw new SandboxMaterializationVerificationError({
+    reason,
+    path,
+    workdir: args.workdir,
+    command,
+    output,
+    exitCode: status2.kind === "exited" ? status2.exitCode : null,
+    providerSessionId: status2.kind === "running" ? status2.sessionId : null
+  });
 }
 function providerManifestRoot(session) {
   const root = session.state?.manifest?.root;
@@ -17959,7 +18258,7 @@ var SHELL_MARKER_DIR = "/tmp/opengeni-turn-shell";
 var RETAINED_SHELL_MARKER_PENDING_EXIT_CODE = 74;
 var RETAINED_SHELL_GROUP_LIVE_EXIT_CODE = 75;
 var RETAINED_SHELL_PROOF_INCONCLUSIVE_EXIT_CODE = 76;
-var delay = async (milliseconds) => await new Promise((resolve6) => setTimeout(resolve6, milliseconds));
+var delay = async (milliseconds) => await new Promise((resolve7) => setTimeout(resolve7, milliseconds));
 async function usesRemoteOperationCancellation(session) {
   const resolved = await session?.commandCancellationTransport?.();
   if (resolved !== void 0) {
@@ -18441,7 +18740,10 @@ var TurnToolCancellationControllerImpl = class {
       try {
         initialNative = await runWithToolCallCorrelation(
           correlationId,
-          async () => await invokeExecNative(commandInput),
+          async () => await withPendingCommandSupervision(
+            pendingStart?.supervision,
+            () => invokeExecNative(commandInput)
+          ),
           {
             onDurableOpOwnershipTransferStarted: (opId) => remoteExec?.releaseCancellationAuthority(opId)
           }
@@ -18692,7 +18994,10 @@ var TurnToolCancellationControllerImpl = class {
           try {
             output = await runWithToolCallCorrelation(
               correlationId,
-              async () => await tool.invoke(runContext, cancellableInput, details),
+              async () => await withPendingCommandSupervision(
+                pendingStart?.supervision,
+                () => tool.invoke(runContext, cancellableInput, details)
+              ),
               {
                 onDurableOpOwnershipTransferStarted: (opId) => remoteExec?.releaseCancellationAuthority(opId)
               }
@@ -19005,11 +19310,12 @@ This process is turn-scoped; it will stop when this turn ends or is interrupted.
   }
   registerPendingShellStart(input) {
     let resolveSettled;
-    const settledPromise = new Promise((resolve6) => {
-      resolveSettled = resolve6;
+    const settledPromise = new Promise((resolve7) => {
+      resolveSettled = resolve7;
     });
     const entry = {
       ...input,
+      supervision: { managed: false },
       cancellationPath: shellCancellationPath(input.markerPath),
       settled: false,
       settledPromise,
@@ -19041,6 +19347,10 @@ This process is turn-scoped; it will stop when this turn ends or is interrupted.
         }
       }
     }
+    if (state.supervision.managed) {
+      await state.settledPromise;
+      return;
+    }
     while (true) {
       try {
         const output = await this.invokePendingShellCancellationCommand(state);
@@ -19080,8 +19390,8 @@ This process is turn-scoped; it will stop when this turn ends or is interrupted.
   }
   registerRemoteExec(session, opId) {
     let resolveSettled;
-    const settledPromise = new Promise((resolve6) => {
-      resolveSettled = resolve6;
+    const settledPromise = new Promise((resolve7) => {
+      resolveSettled = resolve7;
     });
     let cancellation = null;
     const entry = {
@@ -19118,6 +19428,17 @@ This process is turn-scoped; it will stop when this turn ends or is interrupted.
     return state.cancellation;
   }
   async cancelShellSessionOnce(state) {
+    if (await state.processSession?.cancelSupervisedCommand?.(state.sessionId, "explicit_stop")) {
+      while (state.processSession?.hasRetainedProcess?.(state.sessionId) === true) {
+        if (await this.rawWrite(state, "", SHELL_POLL_MS)) {
+          await this.forgetShellSessionAfterExactSettlement(state);
+          return;
+        }
+        await delay(SHELL_POLL_MS);
+      }
+      this.shellSessions.delete(state.sessionId);
+      return;
+    }
     if (!state.markerPath) {
       while (true) {
         if ((state.writeInvoke || state.processSession?.writeStdinForProcessControl) && await this.rawWrite(state, "", SHELL_POLL_MS)) {
@@ -19756,15 +20077,15 @@ var SandboxChannelAService = class {
     if (stdout.includes("__OPENGENI_FS_NOT_FOUND__") || exitCode === 66) {
       throw new ChannelANotFoundError(`file not found: ${path}`);
     }
-    const prefix = "__OPENGENI_FS_READ_OK__\n";
-    const successIndex = stdout.indexOf(prefix);
+    const prefix2 = "__OPENGENI_FS_READ_OK__\n";
+    const successIndex = stdout.indexOf(prefix2);
     if (successIndex < 0 || exitCode !== null && exitCode !== 0) {
       throw new ChannelAUnavailableError(
         "Workspace files are temporarily unavailable. Retry the file read."
       );
     }
     const bytes = Buffer.from(
-      stdout.slice(successIndex + prefix.length).replace(/\n/g, ""),
+      stdout.slice(successIndex + prefix2.length).replace(/\n/g, ""),
       "base64"
     );
     return this.shapeRead(path, bytes, req);
@@ -20114,12 +20435,12 @@ var SandboxChannelAService = class {
     if (result.stdout.includes(integrityMarker) || result.exitCode === 74) {
       throw new ChannelAUnavailableError("Workspace file source failed integrity verification.");
     }
-    const prefix = `${okMarker}	`;
-    const markerIndex = result.stdout.indexOf(prefix);
+    const prefix2 = `${okMarker}	`;
+    const markerIndex = result.stdout.indexOf(prefix2);
     if (markerIndex < 0 || result.exitCode !== null && result.exitCode !== 0 || result.stdout.includes(unavailableMarker)) {
       throw new ChannelAUnavailableError("Workspace file import is temporarily unavailable.");
     }
-    const outcome = result.stdout.slice(markerIndex + prefix.length).trim();
+    const outcome = result.stdout.slice(markerIndex + prefix2.length).trim();
     if (outcome !== "created" && outcome !== "replaced" && outcome !== "replayed") {
       throw new ChannelAUnavailableError("Workspace file import returned an invalid receipt.");
     }
@@ -20487,19 +20808,19 @@ var SandboxChannelAService = class {
   }
   async gitStatus(req) {
     const repo = assertSafeRelPathOrRoot(req.path, this.workspaceRoot);
-    const status = await this.readConfinedCommandBytes(
+    const status2 = await this.readConfinedCommandBytes(
       repo,
       `if [ "$(git rev-parse --is-inside-work-tree 2>/dev/null)" = true ]; then printf '${GIT_STATUS_REPO_FRAME}\\0'; git status --porcelain=v2 --branch -z; else printf '${GIT_STATUS_REPO_FRAME}not-repo\\0'; fi`,
       GIT_METADATA_MAX_BYTES
     );
-    if (status.truncated) {
+    if (status2.truncated) {
       throw new ChannelAUnavailableError(
         "Workspace Git metadata exceeded the safe capture limit. Retry with a narrower path."
       );
     }
     const repoFrame = Buffer.from(`${GIT_STATUS_REPO_FRAME}${NUL}`);
     const notRepoFrame = Buffer.from(`${GIT_STATUS_REPO_FRAME}not-repo${NUL}`);
-    if (status.bytes.equals(notRepoFrame)) {
+    if (status2.bytes.equals(notRepoFrame)) {
       return {
         isRepo: false,
         head: null,
@@ -20512,13 +20833,13 @@ var SandboxChannelAService = class {
         revision: this.revision
       };
     }
-    if (!status.bytes.subarray(0, repoFrame.byteLength).equals(repoFrame)) {
+    if (!status2.bytes.subarray(0, repoFrame.byteLength).equals(repoFrame)) {
       throw new ChannelAUnavailableError(
         "Workspace Git data is temporarily unavailable. Retry the operation."
       );
     }
     return {
-      ...parsePorcelainV2(decodeGitMetadataUtf8(status.bytes.subarray(repoFrame.byteLength))),
+      ...parsePorcelainV2(decodeGitMetadataUtf8(status2.bytes.subarray(repoFrame.byteLength))),
       revision: this.revision
     };
   }
@@ -20903,11 +21224,11 @@ var SandboxChannelAService = class {
       });
       const statusLine = stdout.split("\n").find((line) => line.startsWith(REPOSITORY_DISCOVERY_STATUS_PREFIX));
       const embeddedStatus = statusLine ? Number.parseInt(statusLine.slice(REPOSITORY_DISCOVERY_STATUS_PREFIX.length), 10) : null;
-      const status = Number.isInteger(embeddedStatus) ? embeddedStatus : null;
-      if (status === 124) {
+      const status2 = Number.isInteger(embeddedStatus) ? embeddedStatus : null;
+      if (status2 === 124) {
         return { repos: [], complete: false, degradedReason: "command_timed_out" };
       }
-      if (status !== 0) {
+      if (status2 !== 0) {
         return { repos: [], complete: false, degradedReason: "command_failed" };
       }
       const lines = stdout.split("\n").map((l) => l.trim()).filter((line) => Boolean(line) && !line.startsWith(REPOSITORY_DISCOVERY_STATUS_PREFIX));
@@ -21252,13 +21573,13 @@ var SandboxChannelAService = class {
    *  worker agent-turn side after FS-mutating tools). */
   async emitGitChanged(repoPath, reason) {
     try {
-      const status = await this.gitStatus({ path: repoPath });
+      const status2 = await this.gitStatus({ path: repoPath });
       const payload = {
-        head: status.head,
-        dirty: status.files.length > 0,
-        ahead: status.ahead,
-        behind: status.behind,
-        changedFileCount: status.files.length,
+        head: status2.head,
+        dirty: status2.files.length > 0,
+        ahead: status2.ahead,
+        behind: status2.behind,
+        changedFileCount: status2.files.length,
         reason,
         revision: this.revision,
         leaseEpoch: this.leaseEpoch
@@ -21685,14 +22006,14 @@ function readNulFrameField(bytes, cursor) {
   return { value: bytes.subarray(cursor, end), cursor: end + 1 };
 }
 function parseCombinedUntrackedSnapshots(bytes) {
-  const prefix = Buffer.from(`${GIT_UNTRACKED_CAPTURE_FRAME}${NUL}`);
-  if (!bytes.subarray(0, prefix.byteLength).equals(prefix)) {
+  const prefix2 = Buffer.from(`${GIT_UNTRACKED_CAPTURE_FRAME}${NUL}`);
+  if (!bytes.subarray(0, prefix2.byteLength).equals(prefix2)) {
     throw new ChannelAUnavailableError(
       "Workspace Git data is temporarily unavailable. Retry the operation."
     );
   }
   const snapshots = [];
-  let cursor = prefix.byteLength;
+  let cursor = prefix2.byteLength;
   while (cursor < bytes.byteLength) {
     const kindField = readNulFrameField(bytes, cursor);
     cursor = kindField.cursor;
@@ -21743,14 +22064,14 @@ function splitUnifiedPatchFiles(patch) {
 function parseUnifiedPatch(patch) {
   const lines = patch.split("\n");
   const hunks = [];
-  let status = "modified";
+  let status2 = "modified";
   let current = null;
   let oldNo = 0;
   let newNo = 0;
   for (const line of lines) {
-    if (line.startsWith("new file mode")) status = "added";
-    else if (line.startsWith("deleted file mode")) status = "deleted";
-    else if (line.startsWith("rename from") || line.startsWith("rename to")) status = "renamed";
+    if (line.startsWith("new file mode")) status2 = "added";
+    else if (line.startsWith("deleted file mode")) status2 = "deleted";
+    else if (line.startsWith("rename from") || line.startsWith("rename to")) status2 = "renamed";
     if (line.startsWith("@@")) {
       const m = line.match(/^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(.*)$/);
       if (m) {
@@ -21788,13 +22109,107 @@ function parseUnifiedPatch(patch) {
       newNo++;
     }
   }
-  return { hunks, status };
+  return { hunks, status: status2 };
 }
 
 // src/sandbox/providers/modal-command-session.ts
 import { randomUUID as randomUUID5 } from "crypto";
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+
+// src/sandbox/providers/modal-materialization-verification.ts
+var MARKER = "__OPENGENI_MATERIALIZED_PATH_VISIBLE__";
+var OUTPUT_LIMIT = 16 * 1024;
+async function verifyModalMaterializedPath(control, path, workdir, pending, observationTimeoutMs = 3e4) {
+  const quote2 = (value) => `'${value.replaceAll("'", `'"'"'`)}'`;
+  const command = `test -e ${quote2(path)} && printf %s ${quote2(MARKER)}`;
+  const cancellation = new AbortController();
+  const deadlineReason = new Error("Materialization visibility observation deadline exceeded");
+  let providerCommand;
+  let stdout = "";
+  let stderr = "";
+  const diagnostic = (reason, exitCode = null) => ({
+    reason,
+    path,
+    workdir,
+    command,
+    output: (stdout + stderr).slice(0, OUTPUT_LIMIT),
+    exitCode,
+    providerSessionId: null,
+    ...providerCommand ? {
+      providerExecution: {
+        sandboxId: providerCommand.sandboxId,
+        taskId: providerCommand.taskId,
+        execId: providerCommand.execId
+      }
+    } : {}
+  });
+  const timer = setTimeout(() => {
+    cancellation.abort(deadlineReason);
+  }, observationTimeoutMs);
+  timer.unref();
+  pending.add(cancellation);
+  try {
+    providerCommand = await control.start(
+      { cmd: command, workdir, shell: "sh", login: false, tty: false },
+      cancellation.signal
+    );
+    for (; ; ) {
+      cancellation.signal.throwIfAborted();
+      const page = await control.readProbe(providerCommand, 1e3, cancellation);
+      cancellation.signal.throwIfAborted();
+      if (page.command.sandboxId !== providerCommand.sandboxId || page.command.taskId !== providerCommand.taskId || page.command.execId !== providerCommand.execId) {
+        throw new SandboxMaterializationVerificationError(diagnostic("invalid_response"));
+      }
+      providerCommand = page.command;
+      for (const chunk of page.chunks) {
+        if (chunk.stream === "stdout") stdout += chunk.text;
+        else stderr += chunk.text;
+      }
+      if (stdout.length + stderr.length > OUTPUT_LIMIT) {
+        throw new SandboxMaterializationVerificationError(diagnostic("invalid_response"));
+      }
+      if (page.exitCode === null) {
+        await new Promise((resolve7) => setImmediate(resolve7));
+        continue;
+      }
+      if (page.exitCode === 0 && stdout === MARKER) return;
+      throw new SandboxMaterializationVerificationError(
+        diagnostic(
+          page.exitCode === 1 ? "path_not_visible" : page.exitCode === 0 ? "invalid_response" : "command_failed",
+          page.exitCode
+        )
+      );
+    }
+  } catch (error) {
+    if (cancellation.signal.reason === deadlineReason) {
+      throw new SandboxMaterializationVerificationError(
+        {
+          ...diagnostic("command_pending"),
+          causeMessage: "Observation deadline exceeded; provider process completion is unconfirmed"
+        },
+        { cause: error }
+      );
+    }
+    if (!(error instanceof SandboxMaterializationVerificationError)) {
+      retainMaterializationVerificationDiagnostic(error, {
+        ...diagnostic("command_error"),
+        causeMessage: error instanceof Error ? error.message : String(error)
+      });
+    }
+    throw error;
+  } finally {
+    cancellation.abort(new Error("Materialization visibility observation finished"));
+    clearTimeout(timer);
+    pending.delete(cancellation);
+  }
+}
+
+// src/sandbox/providers/modal-command-session.ts
 function sameExecution(a, b) {
-  return a.sandboxId === b.sandboxId && a.taskId === b.taskId && a.execId === b.execId && Boolean(a.pty) === Boolean(b.pty);
+  return a.kind === b.kind && a.sandboxId === b.sandboxId && a.taskId === b.taskId && a.execId === b.execId && isDeepStrictEqual2(
+    "supervision" in a ? a.supervision : void 0,
+    "supervision" in b ? b.supervision : void 0
+  ) && Boolean(a.pty) === Boolean(b.pty);
 }
 function installModalCommandSession(session, control) {
   markTypedExecHandleLoss(session);
@@ -21802,10 +22217,48 @@ function installModalCommandSession(session, control) {
   const originalWrite = session.writeStdin?.bind(session);
   const cancelLegacyStart = session.cancelPendingExecCommand?.bind(session);
   const pendingStarts = /* @__PURE__ */ new Set();
+  session.verifyCommandSupervisionCapability = async () => {
+    if (!control.verifySupervisionCapability)
+      throw new Error("Modal instance lacks supervised command capability verification");
+    return await control.verifySupervisionCapability();
+  };
+  session.verifyMaterializedPath = (path, workdir) => verifyModalMaterializedPath(control, path, workdir, pendingStarts);
   const entries = /* @__PURE__ */ new Map();
   const setupHandles = /* @__PURE__ */ new Map();
   let nextSetupHandle = MAX_PROVIDER_COMMAND_HANDLE + 1;
   const receipts = /* @__PURE__ */ new Map();
+  const atomicallyCaptured = /* @__PURE__ */ new WeakSet();
+  const supervise = async (entry, release = false) => {
+    if (entry.command.kind !== "modal-router-v1" || !entry.command.supervision) return;
+    const persistence = entry.persistence;
+    if (!persistence?.recordSupervisionReceipt || !persistence.loadSupervisionReceipt || !persistence.cancellationRequested || !control.supervisionControl)
+      throw new Error("Supervised command requires durable control persistence");
+    let receipt = await persistence.loadSupervisionReceipt();
+    if (!receipt) {
+      const action = await persistence.cancellationRequested() ? "cancel" : release ? "release" : "status";
+      const observation = await control.supervisionControl(entry.command, action);
+      receipt = observation.receipt ?? null;
+      if (receipt) await persistence.recordSupervisionReceipt(receipt);
+    }
+    if (receipt) {
+      await control.supervisionControl(entry.command, "ack", receipt.receiptId).catch(() => void 0);
+    }
+  };
+  const captureRouterPage = async (entry, page) => {
+    if (page.command.kind !== "modal-router-v1" || !page.expected || !entry.persistence?.captureRouterPage)
+      throw new Error("Modal byte-offset output requires atomic retained capture");
+    const result = await entry.persistence.captureRouterPage({
+      expected: page.expected,
+      command: page.command,
+      stdout: page.chunks.filter((chunk) => chunk.stream === "stdout").map((chunk) => chunk.text).join(""),
+      stderr: page.chunks.filter((chunk) => chunk.stream === "stderr").map((chunk) => chunk.text).join("")
+    });
+    if (!sameExecution(entry.command, result.command))
+      throw new Error("Modal output capture changed execution identity");
+    entry.command = result.command;
+    if (result.captured) atomicallyCaptured.add(page);
+    return result.captured;
+  };
   const setupPage = (raw, handle, sdkHandle) => {
     const banner = parseExecResponseBanner(raw);
     if (banner.kind === "exited") {
@@ -21839,8 +22292,24 @@ function installModalCommandSession(session, control) {
       if (!retained || !sameExecution(entry.command, retained))
         throw new Error("Original Modal command identity is unavailable");
       entry.command = retained;
+      await supervise(entry).catch(() => void 0);
+    }
+    let page = await control.read(entry.command, yieldTimeMs, signal);
+    if (entry.persistence && page.command.kind === "modal-router-v1") {
+      let captured = false;
+      for (let attempt = 0; attempt < 3; attempt++) {
+        if (await captureRouterPage(entry, page)) {
+          captured = true;
+          break;
+        }
+        if (attempt < 2) page = await control.read(entry.command, yieldTimeMs, signal);
+      }
+      if (!captured) throw new Error("Modal command output cursor changed during bounded capture");
+    }
+    if (page.command.kind === "modal-router-v1" && page.command.supervision) {
+      const receipt = await entry.persistence?.loadSupervisionReceipt?.();
+      page = { ...page, exitCode: receipt && page.exitCode === 0 ? receipt.leaderExitCode : null };
     }
-    const page = await control.read(entry.command, yieldTimeMs, signal);
     return formatPage(handle, page, maxOutputTokens);
   };
   session.execCommand = async (args) => {
@@ -21859,8 +22328,14 @@ function installModalCommandSession(session, control) {
     const cancellation = new AbortController();
     pendingStarts.add(cancellation);
     try {
-      const entry = { command: await control.start(args, cancellation.signal) };
+      const command = await control.start(args, cancellation.signal);
+      const entry = entries.get(handle) ?? { command };
+      if (!sameExecution(entry.command, command))
+        throw new Error("Reserved Modal command changed during dispatch");
       entries.set(handle, entry);
+      if (entry.command.kind === "modal-router-v1" && entry.command.supervision) {
+        return formatPage(handle, { command: entry.command, chunks: [], exitCode: null });
+      }
       try {
         return await read(
           handle,
@@ -21891,6 +22366,25 @@ function installModalCommandSession(session, control) {
     const entry = entries.get(handle);
     return entry ? structuredClone(entry.command) : null;
   };
+  session.releaseSupervisedCommand = async (handle) => {
+    const entry = entries.get(handle);
+    if (!entry || entry.command.kind !== "modal-router-v1" || !entry.command.supervision) return;
+    const retained = await entry.persistence?.load();
+    if (!retained || !sameExecution(entry.command, retained))
+      throw new Error("Supervisor release requires committed initial retention");
+    entry.command = retained;
+    await supervise(entry, true);
+  };
+  session.cancelSupervisedCommand = async (handle, reason) => {
+    const entry = entries.get(handle);
+    if (!entry || entry.command.kind !== "modal-router-v1" || !entry.command.supervision)
+      return false;
+    if (!entry.persistence?.requestCancellation)
+      throw new Error("Supervisor cancellation requires durable intent");
+    await entry.persistence.requestCancellation(reason);
+    await supervise(entry);
+    return true;
+  };
   session.bindProviderCommand = (handle, command, persistence) => {
     if (!Number.isSafeInteger(handle) || handle <= 0 || handle > MAX_PROVIDER_COMMAND_HANDLE)
       throw new Error("Invalid retained Modal command handle");
@@ -21900,6 +22394,39 @@ function installModalCommandSession(session, control) {
     entries.set(handle, { command: structuredClone(command), persistence });
   };
   session.getProviderCommandOutput = (result) => typeof result === "string" ? receipts.get(result)?.page ?? null : null;
+  session.captureCommandOutput = async (result) => {
+    const receipt = receipts.get(result);
+    if (!receipt || receipt.page.command.kind !== "modal-router-v1") return false;
+    if (receipt.page.command.supervision && !receipt.page.expected && receipt.page.exitCode === null && receipt.page.chunks.length === 0) {
+      receipts.delete(result);
+      return true;
+    }
+    if (atomicallyCaptured.has(receipt.page)) {
+      receipts.delete(result);
+      return true;
+    }
+    const entry = entries.get(receipt.handle);
+    if (!entry?.persistence?.captureRouterPage || !receipt.page.expected)
+      throw new Error("Modal byte-offset output requires atomic retained capture");
+    if (!await captureRouterPage(entry, receipt.page)) {
+      const target = receipt.page.command;
+      const covered = () => entry.command.kind === "modal-router-v1" && ["stdout", "stderr"].every((stream) => {
+        const current = entry.command.streams[stream];
+        if (!("byteOffset" in current)) return false;
+        const wanted = target.streams[stream];
+        return current.byteOffset >= wanted.byteOffset && (!wanted.eof || current.eof) && (wanted.exitCode === null || current.exitCode === wanted.exitCode);
+      });
+      for (let attempt = 0; !covered() && attempt < 3; attempt++) {
+        const refreshedReceipt = await read(receipt.handle, entry, 250);
+        const refreshed = receipts.get(refreshedReceipt);
+        if (refreshed && atomicallyCaptured.has(refreshed.page)) receipts.delete(refreshedReceipt);
+      }
+      if (!covered())
+        throw new Error("Initial Modal output tail remains uncommitted after bounded capture");
+    }
+    receipts.delete(result);
+    return true;
+  };
   session.acknowledgeCommandOutput = async (result) => {
     const receipt = receipts.get(result);
     if (!receipt) return;
@@ -21927,7 +22454,7 @@ function installModalCommandSession(session, control) {
       const retained = await entry.persistence.load();
       if (!retained || !sameExecution(entry.command, retained))
         throw new Error("Original Modal command identity is unavailable");
-      const index = await entry.persistence.reserveInput();
+      const index = await entry.persistence.reserveInput(Buffer.byteLength(args.chars));
       await control.write(retained, args.chars, index);
     }
     return read(args.sessionId, entry, args.yieldTimeMs ?? 250, args.maxOutputTokens);
@@ -21935,9 +22462,17 @@ function installModalCommandSession(session, control) {
 }
 
 // src/sandbox/providers/modal-command-control.ts
+import { randomUUID as randomUUID6, randomBytes } from "crypto";
+import { posix as posix3 } from "path";
+import {
+  SandboxProviderCommand,
+  CommandSupervisionReceipt
+} from "@opengeni/contracts";
+
+// src/sandbox/providers/modal-legacy-command-control.ts
 import { posix as posix2 } from "path";
 import { ModalClient } from "modal";
-import { SandboxProviderCommand } from "@opengeni/contracts";
+import { ModalLegacyProviderCommand } from "@opengeni/contracts";
 var modalCommandAbortMiddleware = async function* (call, options) {
   options.signal?.throwIfAborted();
   return yield* call.next(call.request, options);
@@ -22074,49 +22609,76 @@ var ModalCommandControl = class _ModalCommandControl {
     };
   }
   async read(command, yieldTimeMs, signal) {
+    return this.readOutput(command, yieldTimeMs, signal);
+  }
+  /** Fixed internal probes own their cancellation controller and must drain
+   * both reads before relinquishing the surrounding provider-operation gate.
+   * Retained-command readers keep their existing signal/receipt contract.
+   */
+  async readProbe(command, yieldTimeMs, cancellation) {
+    return this.readOutput(
+      command,
+      yieldTimeMs,
+      cancellation.signal,
+      (error) => cancellation.abort(error)
+    );
+  }
+  async readOutput(command, yieldTimeMs, signal, cancelSiblings) {
     signal?.throwIfAborted();
     this.assertIdentity(command);
     const next = structuredClone(command);
-    const pages = await Promise.all(
-      ["stdout", "stderr"].map(async (stream) => {
-        const cursor = command.streams[stream];
-        if (cursor.exitCode !== null) return null;
-        const descriptor = stream === "stdout" ? 1 : 2;
-        for await (const batch of this.client.containerExecGetOutput(
-          {
-            execId: command.execId,
-            timeout: Math.max(0, yieldTimeMs) / 1e3,
-            lastBatchIndex: cursor.batchIndex,
-            fileDescriptor: descriptor,
-            getRawBytes: true
-          },
-          signal ? { signal } : void 0
-        )) {
-          if (batch.batchIndex <= cursor.batchIndex) continue;
-          if (!Number.isSafeInteger(batch.batchIndex))
-            throw new Error("Invalid Modal output cursor");
-          const terminal = batch.exitCode !== void 0;
-          if (terminal && !Number.isSafeInteger(batch.exitCode))
-            throw new Error("Invalid Modal exit status");
-          const decoded = decodePage(
-            cursor.utf8Remainder,
-            batch.items.filter((item) => item.fileDescriptor === descriptor).map((item) => item.messageBytes),
-            terminal
-          );
-          next.streams[stream] = {
-            batchIndex: batch.batchIndex,
-            utf8Remainder: decoded.remainder,
-            exitCode: terminal ? batch.exitCode : null
-          };
-          return {
-            stream,
-            chunkId: `modal:${command.execId}:${stream}:${cursor.batchIndex}:${batch.batchIndex}`,
-            text: decoded.text
-          };
-        }
-        return null;
+    let failure;
+    const reads = ["stdout", "stderr"].map(async (stream) => {
+      const cursor = command.streams[stream];
+      if (cursor.exitCode !== null) return null;
+      const descriptor = stream === "stdout" ? 1 : 2;
+      for await (const batch of this.client.containerExecGetOutput(
+        {
+          execId: command.execId,
+          timeout: Math.max(0, yieldTimeMs) / 1e3,
+          lastBatchIndex: cursor.batchIndex,
+          fileDescriptor: descriptor,
+          getRawBytes: true
+        },
+        signal ? { signal } : void 0
+      )) {
+        if (batch.batchIndex <= cursor.batchIndex) continue;
+        if (!Number.isSafeInteger(batch.batchIndex))
+          throw new Error("Invalid Modal output cursor");
+        const terminal = batch.exitCode !== void 0;
+        if (terminal && !Number.isSafeInteger(batch.exitCode))
+          throw new Error("Invalid Modal exit status");
+        const decoded = decodePage(
+          cursor.utf8Remainder,
+          batch.items.filter((item) => item.fileDescriptor === descriptor).map((item) => item.messageBytes),
+          terminal
+        );
+        next.streams[stream] = {
+          batchIndex: batch.batchIndex,
+          utf8Remainder: decoded.remainder,
+          exitCode: terminal ? batch.exitCode : null
+        };
+        return {
+          stream,
+          chunkId: `modal:${command.execId}:${stream}:${cursor.batchIndex}:${batch.batchIndex}`,
+          text: decoded.text
+        };
+      }
+      return null;
+    }).map(
+      (read) => !cancelSiblings ? read : read.catch((error) => {
+        failure ??= { error };
+        cancelSiblings(error);
+        throw error;
       })
     );
+    const pages = cancelSiblings ? await Promise.allSettled(reads).then((results) => {
+      if (failure) throw failure.error;
+      return results.map((result) => {
+        if (result.status === "rejected") throw result.reason;
+        return result.value;
+      });
+    }) : await Promise.all(reads);
     const stdoutExit = next.streams.stdout.exitCode;
     const stderrExit = next.streams.stderr.exitCode;
     if (stdoutExit !== null && stderrExit !== null && stdoutExit !== stderrExit)
@@ -22142,12 +22704,549 @@ var ModalCommandControl = class _ModalCommandControl {
     );
   }
   assertIdentity(command) {
-    SandboxProviderCommand.parse(command);
+    ModalLegacyProviderCommand.parse(command);
     if (command.kind !== "modal-control-v1" || command.sandboxId !== this.sandboxId || !command.taskId || !command.execId)
       throw new Error("Modal command locator does not match the original sandbox");
   }
 };
 
+// src/sandbox/providers/modal-command-router-wire.ts
+import { Client, Metadata, credentials, status } from "@grpc/grpc-js";
+import protobuf from "protobufjs";
+var modalRouterWire = protobuf.parse(`syntax = "proto3";
+message Identity { string task_id = 1; string exec_id = 2; }
+message Pty {
+  bool enabled = 1; uint32 winsz_rows = 2; uint32 winsz_cols = 3;
+  string env_term = 4; string env_colorterm = 5; string env_term_program = 6;
+  int32 pty_type = 7; bool no_terminate_on_idle_stdin = 8;
+}
+message Start {
+  string task_id = 1; string exec_id = 2; repeated string command_args = 3;
+  int32 stdout_config = 4; int32 stderr_config = 5;
+  optional uint32 timeout_secs = 6; optional string workdir = 7;
+  repeated string secret_ids = 8; optional Pty pty_info = 9;
+  bool runtime_debug = 10; string container_id = 11; map<string,string> env = 12;
+}
+message Read {
+  string task_id = 1; string exec_id = 2; uint64 offset = 3; int32 file_descriptor = 4;
+}
+message Data { bytes data = 1; }
+message Poll { optional int32 code = 1; optional int32 signal = 2; }
+message Write {
+  string task_id = 1; string exec_id = 2; uint64 offset = 3; bytes data = 4; bool eof = 5;
+}
+message Empty {}
+`).root;
+var prefix = "/modal.task_command_router.TaskCommandRouter/";
+var maxPageBytes = 64 * 1024;
+var maxWireBytes = 4 * 1024 * 1024;
+var ModalCommandStartRejectedError = class extends ProviderCommandStartRejectedError {
+  constructor(code, cause) {
+    super(cause);
+    this.code = code;
+    this.name = "ModalCommandStartRejectedError";
+  }
+};
+function encode(type, value) {
+  const codec = modalRouterWire.lookupType(type);
+  return Buffer.from(codec.encode(codec.fromObject(value)).finish());
+}
+var ModalCommandRouterWire = class {
+  client;
+  metadata;
+  closed = false;
+  constructor(access, trustedRoots) {
+    const url = new URL(access.url);
+    if (url.protocol !== "https:" || url.username || url.password || !access.jwt)
+      throw new Error("Modal command router requires authenticated TLS");
+    this.client = new Client(url.host, credentials.createSsl(trustedRoots), {
+      "grpc.max_receive_message_length": maxWireBytes,
+      "grpc.max_send_message_length": maxWireBytes,
+      "grpc.enable_retries": 0
+    });
+    this.metadata = new Metadata();
+    this.metadata.set("authorization", `Bearer ${access.jwt}`);
+  }
+  close() {
+    this.closed = true;
+    this.client.close();
+  }
+  async unary(method, requestType, responseType, request, signal) {
+    signal?.throwIfAborted();
+    if (this.closed) throw new Error("Modal command router is closed");
+    return await new Promise((resolve7, reject) => {
+      const call = this.client.makeUnaryRequest(
+        prefix + method,
+        (value) => encode(requestType, value),
+        (bytes) => modalRouterWire.lookupType(responseType).decode(bytes),
+        request,
+        this.metadata,
+        { deadline: Date.now() + 3e4 },
+        (error, result) => {
+          signal?.removeEventListener("abort", abort);
+          if (signal?.aborted) reject(signal.reason);
+          else if (error) reject(error);
+          else if (result) resolve7(result);
+          else reject(new Error("Modal command router returned no response"));
+        }
+      );
+      const abort = () => call.cancel();
+      signal?.addEventListener("abort", abort, { once: true });
+      if (signal?.aborted) abort();
+    });
+  }
+  async start(request, signal) {
+    try {
+      await this.unary(
+        "TaskExecStart",
+        "Start",
+        "Empty",
+        {
+          ...request,
+          stdoutConfig: 1,
+          stderrConfig: 1
+        },
+        signal
+      );
+    } catch (error) {
+      const code = error?.code;
+      if (typeof code === "number" && [
+        status.INVALID_ARGUMENT,
+        status.NOT_FOUND,
+        status.PERMISSION_DENIED,
+        status.UNAUTHENTICATED,
+        status.UNIMPLEMENTED
+      ].includes(code))
+        throw new ModalCommandStartRejectedError(code, error);
+      throw error;
+    }
+  }
+  async write(identity, offset, data, signal) {
+    if (!Number.isSafeInteger(offset) || offset < 0)
+      throw new Error("Invalid Modal stdin byte offset");
+    await this.unary(
+      "TaskExecStdinWrite",
+      "Write",
+      "Empty",
+      { ...identity, offset, data, eof: false },
+      signal
+    );
+  }
+  async poll(identity, signal) {
+    const value = await this.unary("TaskExecPoll", "Identity", "Poll", identity, signal);
+    const decoded = modalRouterWire.lookupType("Poll").toObject(value);
+    if (decoded.code !== void 0) return decoded.code;
+    if (decoded.signal !== void 0) return 128 + decoded.signal;
+    return null;
+  }
+  async read(identity, stream, offset, waitMs, signal) {
+    signal?.throwIfAborted();
+    if (this.closed) throw new Error("Modal command router is closed");
+    if (!Number.isSafeInteger(offset) || offset < 0 || !Number.isFinite(waitMs) || waitMs < 0 || waitMs > 5e4)
+      throw new Error("Invalid Modal output read bounds");
+    const chunks = [];
+    let length = 0;
+    let limited = false;
+    return await new Promise((resolve7, reject) => {
+      const call = this.client.makeServerStreamRequest(
+        prefix + "TaskExecStdioRead",
+        (value) => encode("Read", value),
+        (bytes) => modalRouterWire.lookupType("Data").decode(bytes),
+        { ...identity, offset, fileDescriptor: stream === "stdout" ? 0 : 1 },
+        this.metadata,
+        { deadline: Date.now() + Math.max(1, waitMs) }
+      );
+      const abort = () => call.cancel();
+      const finish = (eof, error) => {
+        signal?.removeEventListener("abort", abort);
+        if (signal?.aborted) reject(signal.reason);
+        else if (error) reject(error);
+        else resolve7({ bytes: Buffer.concat(chunks, length), eof });
+      };
+      call.on("data", (value) => {
+        if (limited) return;
+        const part = Buffer.from(value.data).subarray(0, maxPageBytes - length);
+        if (part.length) {
+          chunks.push(part);
+          length += part.length;
+        }
+        if (length === maxPageBytes) {
+          limited = true;
+          call.cancel();
+        }
+      });
+      call.once("error", (error) => {
+        if (limited && error.code === status.CANCELLED || error.code === status.DEADLINE_EXCEEDED)
+          finish(false);
+        else finish(false, error);
+      });
+      call.once("end", () => finish(!limited));
+      signal?.addEventListener("abort", abort, { once: true });
+      if (signal?.aborted) abort();
+    });
+  }
+};
+
+// src/sandbox/providers/modal-command-control.ts
+var ModalCommandControl2 = class _ModalCommandControl {
+  constructor(client, sandboxIdentity, root, environment) {
+    this.sandboxIdentity = sandboxIdentity;
+    this.root = root;
+    this.environment = environment;
+    this.client = commandControlPlane(client);
+    this.legacy = ModalCommandControl.forSandbox(client, sandboxIdentity, root, environment);
+  }
+  routers = /* @__PURE__ */ new Map();
+  client;
+  legacy;
+  closed = false;
+  static forSandbox(client, sandboxId, root, environment = {}) {
+    if (client.version() !== "0.9.0")
+      throw new Error("Modal command control requires the verified 0.9.0 SDK contract");
+    return new _ModalCommandControl(client, sandboxId, root, environment);
+  }
+  get sandboxId() {
+    return typeof this.sandboxIdentity === "function" ? this.sandboxIdentity() : this.sandboxIdentity;
+  }
+  async withRouter(taskId, signal, run2) {
+    signal?.throwIfAborted();
+    if (this.closed) throw new Error("Modal command control is closed");
+    let pending = this.routers.get(taskId);
+    const reused = Boolean(pending);
+    if (!pending) {
+      pending = (async () => {
+        const access = await this.client.taskGetCommandRouterAccess(
+          { taskId },
+          signal ? { signal } : void 0
+        );
+        let refreshAt = Date.now() + 6e4;
+        try {
+          const payload = JSON.parse(
+            Buffer.from(access.jwt.split(".")[1] ?? "", "base64url").toString()
+          );
+          if (typeof payload.exp === "number" && Number.isFinite(payload.exp))
+            refreshAt = Math.min(refreshAt, payload.exp * 1e3 - 15e3);
+        } catch {
+        }
+        return { router: new ModalCommandRouterWire(access), users: 0, refreshAt };
+      })();
+      this.routers.set(taskId, pending);
+      void pending.catch(() => {
+        if (this.routers.get(taskId) === pending) this.routers.delete(taskId);
+      });
+    }
+    const entry = await pending;
+    if (reused && !entry.users && Date.now() > entry.refreshAt) {
+      clearTimeout(entry.idle);
+      entry.router.close();
+      this.routers.delete(taskId);
+      return await this.withRouter(taskId, signal, run2);
+    }
+    clearTimeout(entry.idle);
+    entry.users++;
+    try {
+      signal?.throwIfAborted();
+      return await run2(entry.router);
+    } finally {
+      entry.users--;
+      if (!entry.users) {
+        entry.idle = setTimeout(() => {
+          if (this.routers.get(taskId) === pending && !entry.users) {
+            this.routers.delete(taskId);
+            entry.router.close();
+          }
+        }, 3e4);
+        entry.idle.unref?.();
+      }
+    }
+  }
+  async close() {
+    this.closed = true;
+    const entries = await Promise.allSettled(this.routers.values());
+    this.routers.clear();
+    for (const entry of entries)
+      if (entry.status === "fulfilled") {
+        clearTimeout(entry.value.idle);
+        entry.value.router.close();
+      }
+  }
+  async start(args, signal) {
+    signal?.throwIfAborted();
+    const supervised = admittedCommandSupervisionReady() && !args.tty && !args.runAs;
+    if (supervised) markPendingCommandSupervised();
+    const sandboxId = this.sandboxId;
+    const workdir = posix3.resolve(this.root, args.workdir ?? this.root);
+    if (workdir !== this.root && !workdir.startsWith(`${this.root.replace(/\/$/u, "")}/`))
+      throw new Error("Command workdir is outside the sandbox workspace");
+    const task = await this.client.sandboxGetTaskId({ sandboxId }, signal ? { signal } : void 0);
+    if (!task.taskId || task.taskResult) throw new Error("Modal command task is unavailable");
+    const taskId = task.taskId;
+    if (this.sandboxId !== sandboxId)
+      throw new Error("Modal sandbox changed during command preparation");
+    const execId = randomUUID6();
+    const invocationId = randomUUID6();
+    const supervision = supervised ? {
+      protocol: "native-subreaper-v1",
+      invocationId,
+      nonce: randomBytes(32).toString("hex"),
+      controlPath: `/tmp/opengeni-supervision/${invocationId}.sock`
+    } : void 0;
+    let commandArgs = [
+      args.shell ?? "/bin/sh",
+      args.shell && (args.login ?? true) ? "-lc" : "-c",
+      args.cmd
+    ];
+    if (args.runAs) {
+      const user = shellQuote(args.runAs), invocation = commandArgs.map(shellQuote).join(" ");
+      commandArgs = [
+        "/bin/sh",
+        "-c",
+        `if [ "$(id -u)" = ${user} ] || [ "$(id -un 2>/dev/null)" = ${user} ]; then exec ${invocation}; elif [ "$(id -u)" = 0 ]; then exec su -s /bin/sh ${user} -c ${shellQuote(`exec ${invocation}`)}; else exec sudo -n -u ${user} -- ${invocation}; fi`
+      ];
+    }
+    const env = typeof this.environment === "function" ? this.environment() : this.environment;
+    if (supervision)
+      commandArgs = [
+        "/usr/local/bin/opengeni-command-supervisor",
+        "launch",
+        "--invocation",
+        supervision.invocationId,
+        "--nonce",
+        supervision.nonce,
+        "--socket",
+        supervision.controlPath,
+        "--",
+        ...commandArgs
+      ];
+    const command = {
+      kind: "modal-router-v1",
+      sandboxId,
+      taskId,
+      execId,
+      ...args.tty ? { pty: true } : {},
+      ...supervision ? { supervision } : {},
+      streams: {
+        stdout: { byteOffset: 0, utf8Remainder: "", eof: false, exitCode: null },
+        stderr: { byteOffset: 0, utf8Remainder: "", eof: false, exitCode: null }
+      }
+    };
+    if (supervision) await reserveSupervisedLaunch(command);
+    try {
+      await this.withRouter(
+        taskId,
+        signal,
+        (router) => router.start(
+          {
+            taskId,
+            execId,
+            commandArgs,
+            workdir,
+            env,
+            ...args.tty ? {
+              ptyInfo: {
+                enabled: true,
+                winszRows: 24,
+                winszCols: 80,
+                envTerm: "xterm",
+                ptyType: 1,
+                noTerminateOnIdleStdin: true
+              }
+            } : {}
+          },
+          signal
+        )
+      );
+    } catch (error) {
+      if (!supervision || error instanceof ModalCommandStartRejectedError) throw error;
+    }
+    return command;
+  }
+  /** Read-only, authenticated control execution on this exact instance. Never
+   * inferred from a fleet image selector or user command stdout. No cache: warm
+   * instances and route/task replacement must each pass before admission. */
+  async verifySupervisionCapability() {
+    const sandboxId = this.sandboxId;
+    const signal = AbortSignal.timeout(5e3);
+    const task = await this.client.sandboxGetTaskId({ sandboxId }, { signal });
+    if (!task.taskId || task.taskResult) throw new Error("Modal command task is unavailable");
+    await this.withRouter(task.taskId, signal, async (router) => {
+      const identity = { taskId: task.taskId, execId: randomUUID6() };
+      await router.start(
+        {
+          ...identity,
+          commandArgs: ["/usr/local/bin/opengeni-command-supervisor", "capabilities"],
+          workdir: "/tmp",
+          env: {}
+        },
+        signal
+      );
+      let offset = 0;
+      let output = "";
+      let eof = false;
+      let exit = null;
+      while (!eof || exit === null) {
+        signal.throwIfAborted();
+        const page = await router.read(identity, "stdout", offset, 250, signal);
+        offset += page.bytes.length;
+        if (offset > 128) throw new Error("Modal supervision capability response exceeds bound");
+        output += page.bytes.toString("utf8");
+        eof = page.eof;
+        exit = await router.poll(identity, signal);
+      }
+      if (exit !== 0 || output !== "native-subreaper-v1")
+        throw new Error(
+          "Exact Modal instance lacks compatible native supervision; command not admitted"
+        );
+    });
+    if (sandboxId !== this.sandboxId)
+      throw new Error("Modal instance changed during supervision capability verification");
+    return { sandboxId, taskId: task.taskId };
+  }
+  /** Separate authenticated provider execution of the installed control helper.
+   * User command streams are never inspected for control evidence. */
+  async supervisionControl(command, action, receiptId) {
+    SandboxProviderCommand.parse(command);
+    const descriptor = command.supervision;
+    if (!descriptor || command.sandboxId !== this.sandboxId)
+      throw new Error("Supervised command identity is unavailable");
+    const identity = { taskId: command.taskId, execId: randomUUID6() };
+    const signal = AbortSignal.timeout(5e3);
+    return await this.withRouter(command.taskId, signal, async (router) => {
+      await router.start(
+        {
+          ...identity,
+          commandArgs: [
+            "/usr/local/bin/opengeni-command-supervisor",
+            "control",
+            "--invocation",
+            descriptor.invocationId,
+            "--nonce",
+            descriptor.nonce,
+            "--socket",
+            descriptor.controlPath,
+            "--action",
+            action,
+            ...receiptId ? ["--receipt", receiptId] : []
+          ],
+          workdir: "/tmp",
+          env: {}
+        },
+        signal
+      );
+      const buffers = [];
+      let offset = 0;
+      let eof = false;
+      let exit = null;
+      while (!eof || exit === null) {
+        signal.throwIfAborted();
+        const page = await router.read(identity, "stdout", offset, 250, signal);
+        offset += page.bytes.length;
+        if (offset > 4096) throw new Error("Supervisor control response exceeds its bound");
+        buffers.push(page.bytes);
+        eof = page.eof;
+        exit = await router.poll(identity, signal);
+      }
+      if (exit !== 0) throw new Error("Supervisor control is unavailable");
+      const result = JSON.parse(Buffer.concat(buffers).toString("utf8"));
+      if (!result || !["idle", "running", "quiescent"].includes(result.state))
+        throw new Error("Invalid supervisor control response");
+      if (result.receipt !== void 0) {
+        result.receipt = CommandSupervisionReceipt.parse(result.receipt);
+        if (result.receipt.invocationId !== descriptor.invocationId)
+          throw new Error("Supervisor receipt invocation mismatch");
+      }
+      if (result.state === "quiescent" !== Boolean(result.receipt))
+        throw new Error("Supervisor quiescence response lacks its receipt");
+      return result;
+    });
+  }
+  async read(command, waitMs, signal) {
+    SandboxProviderCommand.parse(command);
+    if (command.sandboxId !== this.sandboxId)
+      throw new Error("Modal command does not belong to this sandbox");
+    if (command.kind === "modal-control-v1") return await this.legacy.read(command, waitMs, signal);
+    const next = structuredClone(command);
+    const cancellation = new AbortController();
+    const abort = () => cancellation.abort(signal?.reason);
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted) abort();
+    try {
+      return await this.withRouter(command.taskId, cancellation.signal, async (router) => {
+        const operations = [
+          ...["stdout", "stderr"].map(
+            async (stream) => command.streams[stream].eof ? { bytes: Buffer.alloc(0), eof: true } : await router.read(
+              command,
+              stream,
+              command.streams[stream].byteOffset,
+              waitMs,
+              cancellation.signal
+            )
+          ),
+          router.poll(command, cancellation.signal)
+        ];
+        const results = await Promise.allSettled(
+          operations.map(
+            (operation) => operation.catch((error) => {
+              cancellation.abort(error);
+              throw error;
+            })
+          )
+        );
+        const failed = results.find((result) => result.status === "rejected");
+        if (failed?.status === "rejected") throw failed.reason;
+        const stdout = results[0].value;
+        const stderr = results[1].value;
+        const exit = results[2].value;
+        const chunks = [];
+        for (const [stream, page] of [
+          ["stdout", stdout],
+          ["stderr", stderr]
+        ]) {
+          const old = command.streams[stream];
+          const decoded = decodePage(old.utf8Remainder, [page.bytes], page.eof);
+          const byteOffset = old.byteOffset + page.bytes.length;
+          if (!Number.isSafeInteger(byteOffset)) throw new Error("Modal output offset exhausted");
+          next.streams[stream] = {
+            byteOffset,
+            utf8Remainder: decoded.remainder,
+            eof: page.eof,
+            exitCode: page.eof ? exit : null
+          };
+          if (decoded.text)
+            chunks.push({
+              stream,
+              chunkId: `modal-router:${command.execId}:${stream}:${old.byteOffset}:${byteOffset}:${page.eof ? 1 : 0}`,
+              text: decoded.text
+            });
+        }
+        return {
+          command: next,
+          expected: structuredClone(command),
+          chunks,
+          exitCode: next.streams.stdout.eof && next.streams.stderr.eof ? exit : null,
+          streamFidelity: command.pty ? "merged" : "separate"
+        };
+      });
+    } finally {
+      signal?.removeEventListener("abort", abort);
+    }
+  }
+  async readProbe(command, waitMs, cancellation) {
+    return await this.read(command, waitMs, cancellation.signal);
+  }
+  async write(command, chars, index) {
+    SandboxProviderCommand.parse(command);
+    if (command.sandboxId !== this.sandboxId)
+      throw new Error("Modal command does not belong to this sandbox");
+    if (command.kind === "modal-control-v1") return await this.legacy.write(command, chars, index);
+    await this.withRouter(
+      command.taskId,
+      void 0,
+      (router) => router.write(command, index, Buffer.from(chars))
+    );
+  }
+};
+
 // src/sandbox/providers/modal.ts
 var MODAL_ORPHAN_SWEEP_LIMIT = 50;
 var OPENGENI_MODAL_SDK_VERSION = "0.9.0";
@@ -22231,8 +23330,8 @@ var MODAL_TASK_EXEC_START_ERROR_MAX_NODES = 64;
 var MODAL_TASK_EXEC_START_ERROR_MAX_AGGREGATE_ERRORS = 32;
 function modalHttpStatus(value) {
   if (typeof value !== "number" && typeof value !== "string") return null;
-  const status = Number(value);
-  return Number.isInteger(status) && status >= 100 && status <= 599 ? status : null;
+  const status2 = Number(value);
+  return Number.isInteger(status2) && status2 >= 100 && status2 <= 599 ? status2 : null;
 }
 function hasContradictoryModalHttpStatus(record) {
   const values = [record.status, record.statusCode, record.httpStatus, record.httpStatusCode];
@@ -22471,7 +23570,7 @@ function installOpenGeniModalSnapshotPolicy(session) {
       throw new Error("Modal command control requires its original authenticated SDK profile");
     installModalCommandSession(
       mutable,
-      ModalCommandControl.forSandbox(
+      ModalCommandControl2.forSandbox(
         {
           cpClient: mutable.modal.cpClient,
           version: mutable.modal.version.bind(mutable.modal),
@@ -23055,9 +24154,9 @@ import {
   SandboxApiException,
   createDefaultAdapterFactory
 } from "@alibaba-group/opensandbox";
-import { createHash as createHash6, randomUUID as randomUUID6 } from "crypto";
+import { createHash as createHash6, randomUUID as randomUUID7 } from "crypto";
 import { lstat as lstat6, readFile as readLocalFile, readdir as readdir6 } from "fs/promises";
-import { posix as posix3 } from "path";
+import { posix as posix4 } from "path";
 
 // src/sandbox/stream-port.ts
 import { DESKTOP_STREAM_PORT as DESKTOP_STREAM_PORT3 } from "@opengeni/contracts";
@@ -23124,8 +24223,8 @@ function joinExposedPortPath(endpointPath, requestPath) {
     throw new StreamPortUnavailableError("exposed-port request path is invalid");
   }
   const raw = typeof endpointPath === "string" && endpointPath.length > 0 ? endpointPath : "/";
-  const prefix = (raw.startsWith("/") ? raw : `/${raw}`).replace(/\/+$/u, "") || "";
-  return `${prefix}${requestPath}`;
+  const prefix2 = (raw.startsWith("/") ? raw : `/${raw}`).replace(/\/+$/u, "") || "";
+  return `${prefix2}${requestPath}`;
 }
 var OPENSANDBOX_LIFECYCLE_PROXY_PATH = /\/v1\/sandboxes\/[^/]+\/proxy\/\d+(?:\/|$)/u;
 var OPENSANDBOX_SIGNED_URI_PATH = /^\/([^/]{1,128})\/(\d{1,5})\/([0-9a-z]{1,13})\/([0-9a-z]{8,64})(?:\/|$)/iu;
@@ -23376,7 +24475,7 @@ function workspacePath(path, options = {}) {
   if (raw.includes("\0") || raw.includes("\\")) {
     throw new SandboxConfigurationError(`Invalid OpenSandbox path: ${path}`);
   }
-  const absolute = raw.startsWith("/") ? posix3.normalize(raw) : posix3.join(WORKSPACE_ROOT, raw);
+  const absolute = raw.startsWith("/") ? posix4.normalize(raw) : posix4.join(WORKSPACE_ROOT, raw);
   const allowed = absolute === WORKSPACE_ROOT || absolute.startsWith(`${WORKSPACE_ROOT}/`) || options.allowPrivate === true && isAllowedPrivatePath(absolute);
   if (!allowed) {
     throw new SandboxConfigurationError(
@@ -23402,7 +24501,7 @@ function commandForArgs(args) {
   return `${shellQuote(requestedShell)}${args.login === false ? "" : " -l"} -c ${shellQuote(args.cmd)}`;
 }
 function delay2(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, Math.max(0, ms)));
+  return new Promise((resolve7) => setTimeout(resolve7, Math.max(0, ms)));
 }
 function consumeProcessOutput(process2) {
   const events = process2.events.slice(process2.cursor);
@@ -23666,10 +24765,10 @@ var OpenSandboxSession = class {
     this.state.workspaceReady = true;
   }
   beginCommand(args) {
-    const opId = nextDurableOpId() ?? `anon_${randomUUID6()}`;
+    const opId = nextDurableOpId() ?? `anon_${randomUUID7()}`;
     let resolveExecutionId;
-    const executionIdReady = new Promise((resolve6) => {
-      resolveExecutionId = resolve6;
+    const executionIdReady = new Promise((resolve7) => {
+      resolveExecutionId = resolve7;
     });
     const process2 = {
       opId,
@@ -23744,18 +24843,18 @@ var OpenSandboxSession = class {
     const provider = await this.ensureStarted();
     while (true) {
       try {
-        const status = await provider.commands.getCommandStatus(executionId);
-        if (status.running === false) {
-          if (status.error) {
-            process2.events.push({ stream: "stderr", text: `${status.error}
+        const status2 = await provider.commands.getCommandStatus(executionId);
+        if (status2.running === false) {
+          if (status2.error) {
+            process2.events.push({ stream: "stderr", text: `${status2.error}
 ` });
           }
           process2.settled = true;
           process2.transportUncertain = false;
           this.processesByOpId.delete(process2.opId);
           return {
-            exitCode: status.exitCode ?? 1,
-            ...status.error ? { error: status.error } : {}
+            exitCode: status2.exitCode ?? 1,
+            ...status2.error ? { error: status2.error } : {}
           };
         }
       } catch {
@@ -23886,14 +24985,14 @@ var OpenSandboxSession = class {
         );
       }
       const provider = await this.ensureStarted();
-      const status = await provider.commands.getCommandStatus(executionId);
-      if (status.error) {
-        process2.events.push({ stream: "stderr", text: `${status.error}
+      const status2 = await provider.commands.getCommandStatus(executionId);
+      if (status2.error) {
+        process2.events.push({ stream: "stderr", text: `${status2.error}
 ` });
       }
       const consumed2 = consumeProcessOutput(process2);
       const output2 = truncateOutput(consumed2.output, args.maxOutputTokens);
-      if (status.running !== false) {
+      if (status2.running !== false) {
         return formatExecResponse({
           output: output2.text,
           wallTimeSeconds: elapsedSeconds(startedAt),
@@ -23907,7 +25006,7 @@ var OpenSandboxSession = class {
       return formatExecResponse({
         output: output2.text,
         wallTimeSeconds: elapsedSeconds(startedAt),
-        exitCode: status.exitCode ?? 1,
+        exitCode: status2.exitCode ?? 1,
         ...output2.originalTokenCount !== void 0 ? { originalTokenCount: output2.originalTokenCount } : {}
       });
     }
@@ -23964,7 +25063,7 @@ var OpenSandboxSession = class {
     const provider = await this.ensureStarted();
     const target = workspacePath(args.path, { allowPrivate: true });
     if (args.createParents ?? true) {
-      await provider.files.createDirectories([{ path: posix3.dirname(target) }]);
+      await provider.files.createDirectories([{ path: posix4.dirname(target) }]);
     }
     await provider.files.writeFiles([{ path: target, data: args.content }]);
     return typeof args.content === "string" ? new TextEncoder().encode(args.content).byteLength : args.content.byteLength;
@@ -23993,7 +25092,7 @@ var OpenSandboxSession = class {
     return entries.map((entry) => {
       const entryPath = workspacePath(entry.path);
       return {
-        name: posix3.basename(entryPath),
+        name: posix4.basename(entryPath),
         path: absoluteOutput ? entryPath : entryPath === WORKSPACE_ROOT ? "" : entryPath.slice(WORKSPACE_ROOT.length + 1),
         type: entry.type === "directory" ? "dir" : entry.type === "file" ? "file" : "other"
       };
@@ -24082,7 +25181,7 @@ var OpenSandboxSession = class {
     const entries = await readdir6(source, { withFileTypes: true });
     for (const entry of entries) {
       const sourcePath = `${source.replace(/\/$/u, "")}/${entry.name}`;
-      const destinationPath = posix3.join(destination, entry.name);
+      const destinationPath = posix4.join(destination, entry.name);
       if (entry.isSymbolicLink()) {
         throw new SandboxUnsupportedFeatureError(
           `OpenSandbox local_dir source contains a symbolic link: ${sourcePath}`
@@ -24110,13 +25209,13 @@ var OpenSandboxSession = class {
     if (entry.type === "dir") {
       await provider.files.createDirectories([{ path: target }]);
       for (const [childPath, child] of Object.entries(entry.children ?? {})) {
-        await this.materialize(posix3.join(path, childPath), child);
+        await this.materialize(posix4.join(path, childPath), child);
       }
       await this.applyPermissions(target, entry);
       return;
     }
     if (entry.type === "file") {
-      await provider.files.createDirectories([{ path: posix3.dirname(target) }]);
+      await provider.files.createDirectories([{ path: posix4.dirname(target) }]);
       await provider.files.writeFiles([{ path: target, data: entry.content }]);
       await this.applyPermissions(target, entry);
       return;
@@ -24128,7 +25227,7 @@ var OpenSandboxSession = class {
           `OpenSandbox local_file source must be a regular non-symlink file: ${entry.src}`
         );
       }
-      await provider.files.createDirectories([{ path: posix3.dirname(target) }]);
+      await provider.files.createDirectories([{ path: posix4.dirname(target) }]);
       await provider.files.writeFiles([
         { path: target, data: new Uint8Array(await readLocalFile(entry.src)) }
       ]);
@@ -24141,7 +25240,7 @@ var OpenSandboxSession = class {
       return;
     }
     if (entry.type === "git_repo") {
-      const temp = `/tmp/opengeni-git-${randomUUID6()}`;
+      const temp = `/tmp/opengeni-git-${randomUUID7()}`;
       const subpath = entry.subpath ? normalizeRelativePath(entry.subpath) : null;
       const script = [
         "set -eu",
@@ -24207,7 +25306,7 @@ var OpenSandboxSession = class {
     );
   }
   async persistWorkspaceTar() {
-    const archivePath = `${PRIVATE_ROOT}/capture-${randomUUID6()}.tar`;
+    const archivePath = `${PRIVATE_ROOT}/capture-${randomUUID7()}.tar`;
     const excludes = [
       ...this.state.manifest.ephemeralPersistencePaths(),
       ".opengeni-old-*",
@@ -24264,9 +25363,9 @@ tar ${excludeArgs.join(" ")} --sort=name --mtime='@0' --owner=0 --group=0 --nume
         maxInputBytes: limits.maxInputBytes
       });
     }
-    const archivePath = `${PRIVATE_ROOT}/restore-${randomUUID6()}.tar`;
-    const stagingPath = `${WORKSPACE_ROOT}/.opengeni-restore-${randomUUID6()}`;
-    const backupPath = `${WORKSPACE_ROOT}/.opengeni-old-${randomUUID6()}`;
+    const archivePath = `${PRIVATE_ROOT}/restore-${randomUUID7()}.tar`;
+    const stagingPath = `${WORKSPACE_ROOT}/.opengeni-restore-${randomUUID7()}`;
+    const backupPath = `${WORKSPACE_ROOT}/.opengeni-old-${randomUUID7()}`;
     await this.writeFile({
       path: archivePath,
       content: bytes,
@@ -24365,12 +25464,12 @@ function withOpenSandboxDesktopViewerPath(endpoint, port, signedEndpoints) {
   if (signedEndpoints) return endpoint;
   if (port !== OPENSANDBOX_DESKTOP_STREAM_PORT) return endpoint;
   const rawPath = typeof endpoint.path === "string" && endpoint.path.length > 0 ? endpoint.path : "/";
-  const prefix = (rawPath.startsWith("/") ? rawPath : `/${rawPath}`).replace(/\/+$/u, "");
-  if (prefix.length === 0) return endpoint;
-  if (/\/vnc(_lite)?\.html$/u.test(prefix) || prefix.endsWith("/websockify")) {
+  const prefix2 = (rawPath.startsWith("/") ? rawPath : `/${rawPath}`).replace(/\/+$/u, "");
+  if (prefix2.length === 0) return endpoint;
+  if (/\/vnc(_lite)?\.html$/u.test(prefix2) || prefix2.endsWith("/websockify")) {
     return endpoint;
   }
-  const path = `${prefix}/vnc.html`;
+  const path = `${prefix2}/vnc.html`;
   const url = typeof endpoint.url === "string" && endpoint.url.length > 0 ? `${endpoint.url.replace(/\/+$/u, "")}/vnc.html` : endpoint.url;
   return { ...endpoint, path, ...url ? { url } : {} };
 }
@@ -25648,8 +26747,8 @@ function isRunloopConflictError(error) {
   if (!isRecord(error)) {
     return false;
   }
-  const status = error.status ?? error.statusCode;
-  if (status === 409 || status === "409") {
+  const status2 = error.status ?? error.statusCode;
+  if (status2 === 409 || status2 === "409") {
     return true;
   }
   const code = error.code;
@@ -26062,7 +27161,7 @@ function decideSelfhostedRetry(input) {
   return { action: "fail" };
 }
 var defaultSelfhostedRetryClock = {
-  sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
+  sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
   jitter: () => Math.random()
 };
 
@@ -26455,8 +27554,8 @@ var OpConsumer = class {
   }
   async run(exec, deadlineMs, wallMs, yieldOptions) {
     this.captureOnly = exec === null;
-    const settled = new Promise((resolve6, reject) => {
-      this.settleResolve = resolve6;
+    const settled = new Promise((resolve7, reject) => {
+      this.settleResolve = resolve7;
       this.settleReject = reject;
     });
     this.subscription = await this.deps.transport.subscribe(
@@ -26481,8 +27580,8 @@ var OpConsumer = class {
         const phase = await Promise.race([
           settled.then(() => "settled"),
           liveness.wall,
-          new Promise((resolve6) => {
-            yieldTimer = setTimeout(() => resolve6("yield"), yieldOptions.yieldMs);
+          new Promise((resolve7) => {
+            yieldTimer = setTimeout(() => resolve7("yield"), yieldOptions.yieldMs);
           })
         ]);
         if (phase === "yield" && this.exitSeq === void 0) {
@@ -26632,12 +27731,12 @@ var OpConsumer = class {
         if (result.$case !== "opStart") {
           throw protocolError(`op-stream start: unexpected result ${result.$case}`);
         }
-        const status = result.opStart.status;
+        const status2 = result.opStart.status;
         if (!result.opStart.accepted) {
-          throw this.refusedStart(status);
+          throw this.refusedStart(status2);
         }
-        if (status?.state === OpState2.OP_STATE_LOST) {
-          throw lostToControlError(status);
+        if (status2?.state === OpState2.OP_STATE_LOST) {
+          throw lostToControlError(status2);
         }
         return drainingRetries + blipRetries;
       } catch (error) {
@@ -26669,8 +27768,8 @@ var OpConsumer = class {
       }
     }
   }
-  refusedStart(status) {
-    if (status?.exit?.cancelled) {
+  refusedStart(status2) {
+    if (status2?.exit?.cancelled) {
       return new SelfhostedControlError({
         message: "The command was cancelled before the machine admitted it.",
         code: ErrorCode3.ERROR_CODE_TIMEOUT,
@@ -26679,8 +27778,8 @@ var OpConsumer = class {
         detail: { cancelled: "true" }
       });
     }
-    if (status?.state === OpState2.OP_STATE_LOST) {
-      return lostToControlError(status);
+    if (status2?.state === OpState2.OP_STATE_LOST) {
+      return lostToControlError(status2);
     }
     return protocolError("op-stream start: the runner refused the op without a typed reason");
   }
@@ -26916,12 +28015,12 @@ var OpConsumer = class {
       if (result.$case !== "opStatus") {
         throw protocolError(`op-stream query: unexpected result ${result.$case}`);
       }
-      const status = result.opStatus;
-      if (status.state === OpState2.OP_STATE_LOST) {
-        reject(lostToControlError(status));
+      const status2 = result.opStatus;
+      if (status2.state === OpState2.OP_STATE_LOST) {
+        reject(lostToControlError(status2));
         return;
       }
-      if (BigInt(status.nextSeq) > this.lastApplied + 1n) {
+      if (BigInt(status2.nextSeq) > this.lastApplied + 1n) {
         this.requestAttachHeal();
       }
     } catch (error) {
@@ -26989,14 +28088,14 @@ function protocolError(message) {
     retryable: false
   });
 }
-function lostToControlError(status) {
-  const reason = status.lostReason === OpLostReason.OP_LOST_REASON_EVICTED ? "its retained result was evicted before collection" : status.lostReason === OpLostReason.OP_LOST_REASON_AGENT_RESTARTED ? "the machine agent restarted and the op did not survive" : "the runner reported it lost";
+function lostToControlError(status2) {
+  const reason = status2.lostReason === OpLostReason.OP_LOST_REASON_EVICTED ? "its retained result was evicted before collection" : status2.lostReason === OpLostReason.OP_LOST_REASON_AGENT_RESTARTED ? "the machine agent restarted and the op did not survive" : "the runner reported it lost";
   return new SelfhostedControlError({
     message: `The command's result is no longer available on the machine (${reason}). Check whether its effects already took place before re-running it.`,
     code: ErrorCode3.ERROR_CODE_STREAM,
     reason: null,
     retryable: false,
-    detail: { lost_reason: String(status.lostReason) }
+    detail: { lost_reason: String(status2.lostReason) }
   });
 }
 function runnerFailureToControlError(exit) {
@@ -28475,8 +29574,8 @@ function sniffImageMediaType2(bytes, path) {
   return mediaTypeFromPath(path);
 }
 function looksLikeSvg(bytes) {
-  const prefix = decoder.decode(bytes.subarray(0, Math.min(bytes.byteLength, 512))).trimStart().toLowerCase();
-  return prefix.startsWith("<svg") || /^<\?xml[\s\S]*<svg/u.test(prefix);
+  const prefix2 = decoder.decode(bytes.subarray(0, Math.min(bytes.byteLength, 512))).trimStart().toLowerCase();
+  return prefix2.startsWith("<svg") || /^<\?xml[\s\S]*<svg/u.test(prefix2);
 }
 function mediaTypeFromPath(path) {
   const p = path?.trim().toLowerCase() ?? "";
@@ -28977,8 +30076,8 @@ var VercelMountOperationMutex = class {
   async runExclusive(operation) {
     const previous = this.tail;
     let release;
-    this.tail = new Promise((resolve6) => {
-      release = resolve6;
+    this.tail = new Promise((resolve7) => {
+      release = resolve7;
     });
     await previous;
     try {
@@ -29534,8 +30633,8 @@ var VercelSandboxSession = class _VercelSandboxSession extends RemoteSandboxSess
   }
   async replaceSandboxFromSnapshot(snapshotId, options = {}) {
     const previousSandbox = this.sandbox;
-    const credentials = await this.resolveSnapshotCredentials();
-    const sandbox = await this.createAndPrepareSandboxFromSnapshot(snapshotId, credentials);
+    const credentials2 = await this.resolveSnapshotCredentials();
+    const sandbox = await this.createAndPrepareSandboxFromSnapshot(snapshotId, credentials2);
     try {
       await stopVercelSandbox(previousSandbox);
     } catch (error) {
@@ -29578,8 +30677,8 @@ var VercelSandboxSession = class _VercelSandboxSession extends RemoteSandboxSess
   async resolveSnapshotCredentials() {
     return selectVercelSessionCredentials(this.state, this.credentials);
   }
-  async createAndPrepareSandboxFromSnapshot(snapshotId, credentials) {
-    const sandbox = await this.createSandboxFromSnapshot(snapshotId, credentials);
+  async createAndPrepareSandboxFromSnapshot(snapshotId, credentials2) {
+    const sandbox = await this.createSandboxFromSnapshot(snapshotId, credentials2);
     const resolvedCredentials = selectVercelSessionCredentials(this.state, this.credentials);
     const replacementSession = new _VercelSandboxSession({
       credentials: resolvedCredentials,
@@ -29607,9 +30706,9 @@ var VercelSandboxSession = class _VercelSandboxSession extends RemoteSandboxSess
     }
     return sandbox;
   }
-  async createSandboxFromSnapshot(snapshotId, credentials) {
+  async createSandboxFromSnapshot(snapshotId, credentials2) {
     const Sandbox = await loadVercelSandboxClass();
-    const authentication = await withProviderError("VercelSandboxClient", "vercel", "restore snapshot", async () => await runWithLegacyVercelAuthenticationFallback(this.state, credentials, async (resolvedCredentials) => await Sandbox.create({
+    const authentication = await withProviderError("VercelSandboxClient", "vercel", "restore snapshot", async () => await runWithLegacyVercelAuthenticationFallback(this.state, credentials2, async (resolvedCredentials) => await Sandbox.create({
       ...resolvedCredentials,
       source: {
         type: "snapshot",
@@ -29740,9 +30839,9 @@ var VercelSandboxClient = class {
     }, async () => {
       const Sandbox = await loadVercelSandboxClass();
       const environment = await materializeEnvironment(resolvedManifest, resolvedOptions.env);
-      const credentials = resolveVercelCredentials(createArgs.options ?? {}, this.options);
+      const credentials2 = resolveVercelCredentials(createArgs.options ?? {}, this.options);
       const sandbox = await withProviderError("VercelSandboxClient", "vercel", "create sandbox", async () => await Sandbox.create({
-        ...credentials,
+        ...credentials2,
         ...resolvedOptions.runtime ? { runtime: resolvedOptions.runtime } : {},
         ...resolvedOptions.resources ? { resources: resolvedOptions.resources } : {},
         ...resolvedOptions.exposedPorts ? { ports: resolvedOptions.exposedPorts } : {},
@@ -29753,14 +30852,14 @@ var VercelSandboxClient = class {
       }), { runtime: resolvedOptions.runtime });
       const session = new VercelSandboxSession({
         sandbox,
-        credentials,
+        credentials: credentials2,
         concurrencyLimits: createArgs.concurrencyLimits,
         archiveLimits: createArgs.archiveLimits,
         state: {
           manifest: persistentManifest,
           sandboxId: sandbox.sandboxId,
-          authenticationMode: credentials.token ? "explicit" : "sdk",
-          ...credentials,
+          authenticationMode: credentials2.token ? "explicit" : "sdk",
+          ...credentials2,
           runtime: resolvedOptions.runtime,
           resources: resolvedOptions.resources,
           configuredExposedPorts: resolvedOptions.exposedPorts,
@@ -29790,12 +30889,12 @@ var VercelSandboxClient = class {
   }
   async serializeSessionState(state, options) {
     state.manifest = sanitizeVercelMountManifest(state.manifest);
-    const credentials = selectVercelSessionCredentials(state, this.options);
-    applyVercelCredentials(state, credentials);
+    const credentials2 = selectVercelSessionCredentials(state, this.options);
+    applyVercelCredentials(state, credentials2);
     if (!hasVercelMounts(state.manifest) && state.workspacePersistence === "snapshot" && state.snapshotSupported !== false && state.snapshotSandboxId !== state.sandboxId && (options?.reuseLiveSession === false || options?.willCloseAfterSerialize)) {
       await captureVercelSnapshot(state, {
         options: {
-          ...credentials
+          ...credentials2
         }
       });
     }
@@ -29850,9 +30949,9 @@ var VercelSandboxClient = class {
       });
     }
     const Sandbox = await loadVercelSandboxClass();
-    const credentials = selectVercelSessionCredentials(state, this.options);
+    const credentials2 = selectVercelSessionCredentials(state, this.options);
     const resumeFromSnapshot = hasFreshVercelSnapshot(state);
-    const authentication = resumeFromSnapshot ? await withProviderError("VercelSandboxClient", "vercel", "resume sandbox from snapshot", async () => await runWithLegacyVercelAuthenticationFallback(state, credentials, async (resolvedCredentials2) => await Sandbox.create({
+    const authentication = resumeFromSnapshot ? await withProviderError("VercelSandboxClient", "vercel", "resume sandbox from snapshot", async () => await runWithLegacyVercelAuthenticationFallback(state, credentials2, async (resolvedCredentials2) => await Sandbox.create({
       ...resolvedCredentials2,
       source: {
         type: "snapshot",
@@ -29865,7 +30964,7 @@ var VercelSandboxClient = class {
       ...state.networkPolicy ? { networkPolicy: state.networkPolicy } : {},
       ...state.timeoutMs !== void 0 ? { timeout: state.timeoutMs } : {},
       env: state.environment
-    })), { snapshotId: state.snapshotId, sandboxId: state.sandboxId }) : await withProviderError("VercelSandboxClient", "vercel", "resume sandbox", async () => await runWithLegacyVercelAuthenticationFallback(state, credentials, async (resolvedCredentials2) => await Sandbox.get({
+    })), { snapshotId: state.snapshotId, sandboxId: state.sandboxId }) : await withProviderError("VercelSandboxClient", "vercel", "resume sandbox", async () => await runWithLegacyVercelAuthenticationFallback(state, credentials2, async (resolvedCredentials2) => await Sandbox.get({
       sandboxId: state.sandboxId,
       ...resolvedCredentials2
     })), { sandboxId: state.sandboxId });
@@ -30086,14 +31185,14 @@ function selectVercelSessionCredentials(state, ...fallbackLayers) {
   }
   return selectVercelCredentials(state, ...fallbackLayers);
 }
-async function runWithLegacyVercelAuthenticationFallback(state, credentials, operation) {
+async function runWithLegacyVercelAuthenticationFallback(state, credentials2, operation) {
   const serializedCredentials = normalizeVercelCredentials(state);
   const hasLegacySerializedCredentials = state.authenticationMode === void 0 && serializedCredentials.token !== void 0;
-  const authenticationMode = state.authenticationMode ?? (hasLegacySerializedCredentials ? void 0 : credentials.token ? "explicit" : "sdk");
+  const authenticationMode = state.authenticationMode ?? (hasLegacySerializedCredentials ? void 0 : credentials2.token ? "explicit" : "sdk");
   try {
     return {
-      value: await operation(credentials),
-      credentials,
+      value: await operation(credentials2),
+      credentials: credentials2,
       authenticationMode
     };
   } catch (error) {
@@ -30110,7 +31209,7 @@ async function runWithLegacyVercelAuthenticationFallback(state, credentials, ope
 }
 function isVercelUnauthorizedError(error) {
   const details = providerErrorDetails(error);
-  return [details.status, details.httpStatus, details.responseStatus].some((status) => status === 401 || status === "401");
+  return [details.status, details.httpStatus, details.responseStatus].some((status2) => status2 === 401 || status2 === "401");
 }
 function applyVercelAuthentication(state, authentication) {
   applyVercelCredentials(state, authentication.credentials);
@@ -30120,11 +31219,11 @@ function applyVercelAuthentication(state, authentication) {
     state.authenticationMode = authentication.authenticationMode;
   }
 }
-function applyVercelCredentials(state, credentials) {
+function applyVercelCredentials(state, credentials2) {
   delete state.projectId;
   delete state.teamId;
   delete state.token;
-  const normalized = normalizeVercelCredentials(credentials);
+  const normalized = normalizeVercelCredentials(credentials2);
   if (normalized.token) {
     state.projectId = normalized.projectId;
     state.teamId = normalized.teamId;
@@ -30144,8 +31243,8 @@ async function captureVercelSnapshot(state, args = {}) {
   }
   let sandbox = args.sandbox;
   if (!sandbox) {
-    const credentials = selectVercelSessionCredentials(state, args.options ?? {});
-    const authentication = await withProviderError("VercelSandboxClient", "vercel", "look up sandbox for snapshot", async () => await runWithLegacyVercelAuthenticationFallback(state, credentials, async (resolvedCredentials) => await (await loadVercelSandboxClass()).get({
+    const credentials2 = selectVercelSessionCredentials(state, args.options ?? {});
+    const authentication = await withProviderError("VercelSandboxClient", "vercel", "look up sandbox for snapshot", async () => await runWithLegacyVercelAuthenticationFallback(state, credentials2, async (resolvedCredentials) => await (await loadVercelSandboxClass()).get({
       sandboxId: state.sandboxId,
       ...resolvedCredentials
     })), { sandboxId: state.sandboxId });
@@ -30191,7 +31290,7 @@ async function waitForVercelSandboxRunning(session, timeoutMs = 3e4) {
     if (await session.running()) {
       return;
     }
-    await new Promise((resolve6) => setTimeout(resolve6, 250));
+    await new Promise((resolve7) => setTimeout(resolve7, 250));
   }
   throw new SandboxLifecycleError(`Vercel sandbox ${session.state.sandboxId} did not become runnable within ${timeoutMs}ms.`, {
     provider: "vercel",
@@ -30718,7 +31817,7 @@ function safeDiagnostic(signals) {
   return [code ? `code=${code}` : "", numeric !== void 0 ? `status=${numeric}` : ""].filter(Boolean).join(" ");
 }
 function hasTransientSignal(signals) {
-  return signals.codes.some((code) => TRANSIENT_CODES.has(code)) || signals.numbers.some((status) => GRPC_TRANSIENT.has(status));
+  return signals.codes.some((code) => TRANSIENT_CODES.has(code)) || signals.numbers.some((status2) => GRPC_TRANSIENT.has(status2));
 }
 function hasModalTerminalSandboxMessage(signals) {
   return signals.messages.some(
@@ -30749,7 +31848,7 @@ function classifyProviderSandboxFailure(backendId, error) {
   if (hasTransientSignal(signals)) {
     return { kind: "transient_transport", diagnostic };
   }
-  if (signals.numbers.some((status) => status === 404) || signals.codes.some((code) => NOT_FOUND_CODES.has(code))) {
+  if (signals.numbers.some((status2) => status2 === 404) || signals.codes.some((code) => NOT_FOUND_CODES.has(code))) {
     return { kind: "not_found", diagnostic };
   }
   if (backendId === "modal" && hasModalTerminalSandboxMessage(signals)) {
@@ -31231,12 +32330,12 @@ function pumpOperationWaiters(state) {
   }
 }
 function acquireOperation(state, deadline) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const waiter = {
       epoch: state.epoch,
       settled: false,
       resolve: () => {
-        resolve6(() => {
+        resolve7(() => {
           if (state.owner !== waiter) return;
           state.owner = null;
           pumpOperationWaiters(state);
@@ -31296,12 +32395,12 @@ function trackProviderCall(state, promise) {
 }
 function boundedProviderDrain(pending) {
   if (pending.length === 0) return Promise.resolve();
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let remaining = pending.length;
     let timer;
     const finish = () => {
       if (timer) clearTimeout(timer);
-      resolve6();
+      resolve7();
     };
     timer = setTimeout(finish, DISPLAY_STACK_DRAIN_GRACE_MS);
     timer.unref?.();
@@ -31421,10 +32520,10 @@ async function cleanupDisplayStackProcess(session, pending, deadline) {
       deadline
     );
     const output = execResultOutput(result);
-    const status = /OPENGENI_DISPLAY_CLEANUP status=(stopped|absent|alive|invalid)/u.exec(
+    const status2 = /OPENGENI_DISPLAY_CLEANUP status=(stopped|absent|alive|invalid)/u.exec(
       output
     )?.[1];
-    return status === "stopped";
+    return status2 === "stopped";
   } catch {
     return false;
   }
@@ -31455,13 +32554,13 @@ function telemetryReporter(options, started, now = monotonicNow) {
   const context = options.telemetryContext;
   const sink = options.onTelemetry ?? (context ? (event) => console.info(`[display-stack] ${JSON.stringify(event)}`) : void 0);
   const emittedSandboxStages = /* @__PURE__ */ new Set();
-  const emit = (stage, status, fields = {}) => {
+  const emit = (stage, status2, fields = {}) => {
     if (!sink) return;
     const event = {
       type: "display_stack.stage",
       requestId: id,
       stage,
-      status,
+      status: status2,
       elapsedMs: fields.elapsedMs ?? now() - started,
       source: fields.source ?? "host",
       classification: fields.classification ?? "unknown",
@@ -31942,7 +33041,7 @@ function shellQuote5(value) {
 }
 
 // src/sandbox/browser-control-client.ts
-import { createHash as createHash7, randomUUID as randomUUID7 } from "crypto";
+import { createHash as createHash7, randomUUID as randomUUID8 } from "crypto";
 import { posix as posixPath2 } from "path";
 import {
   BROWSER_CONTROL_MAX_JSON_BYTES,
@@ -32006,9 +33105,9 @@ var ComputerFrameEvidenceMismatchError = class extends BrowserControlProtocolErr
   }
 };
 var BrowserControlRequestError = class extends Error {
-  constructor(status, error) {
+  constructor(status2, error) {
     super(error.message);
-    this.status = status;
+    this.status = status2;
     this.error = error;
     this.retryable = error.retryable;
   }
@@ -32049,7 +33148,7 @@ async function provisionBrowserControlClient(session, input) {
     input.adminTokenFile ?? BROWSER_CONTROL_ADMIN_TOKEN_FILE,
     "browser controller admin token file"
   );
-  const temporaryTokenFile = `${adminTokenFile}.new.${randomUUID7()}`;
+  const temporaryTokenFile = `${adminTokenFile}.new.${randomUUID8()}`;
   const parent = adminTokenFile.slice(0, adminTokenFile.lastIndexOf("/")) || "/";
   try {
     await runChecked(
@@ -32477,7 +33576,7 @@ var BrowserControlClient = class {
       );
     }
     const controllerPort = await this.controllerPort();
-    const directory = `${CLIENT_ROOT}/${randomUUID7()}`;
+    const directory = `${CLIENT_ROOT}/${randomUUID8()}`;
     const configPath = `${directory}/curl.conf`;
     const requestPath = `${directory}/request.json`;
     const responsePath = `${directory}/response.json`;
@@ -32533,7 +33632,7 @@ var BrowserControlClient = class {
           `browser controller transport failed (curl exit ${curlExit})`
         );
       }
-      const status = parseHttpStatus(await readText(this.session, statusPath, 32, timeoutMs));
+      const status2 = parseHttpStatus(await readText(this.session, statusPath, 32, timeoutMs));
       const responseText = await readText(
         this.session,
         responsePath,
@@ -32543,7 +33642,7 @@ var BrowserControlClient = class {
       if (Buffer.byteLength(responseText) > BROWSER_CONTROL_MAX_JSON_BYTES) {
         throw new BrowserControlProtocolError("browser controller response is too large");
       }
-      return parseEnvelope(responseText, status);
+      return parseEnvelope(responseText, status2);
     } catch (error) {
       if (error instanceof BrowserControlRequestError || error instanceof BrowserControlProtocolError || error instanceof RangeError) {
         throw error;
@@ -32603,7 +33702,7 @@ var BrowserControlClient = class {
       );
     }
     const controllerPort = await this.controllerPort();
-    const directory = `${CLIENT_ROOT}/${randomUUID7()}`;
+    const directory = `${CLIENT_ROOT}/${randomUUID8()}`;
     const configPath = `${directory}/curl.conf`;
     const responsePath = `${directory}/response.bin`;
     const responseHeadersPath = `${directory}/response.headers`;
@@ -32650,15 +33749,15 @@ var BrowserControlClient = class {
           `browser controller transport failed (curl exit ${curlExit})`
         );
       }
-      const status = parseHttpStatus(await readText(this.session, statusPath, 32, timeoutMs));
-      if (status < 200 || status >= 300) {
+      const status2 = parseHttpStatus(await readText(this.session, statusPath, 32, timeoutMs));
+      if (status2 < 200 || status2 >= 300) {
         const responseText = await readText(
           this.session,
           responsePath,
           BROWSER_CONTROL_MAX_JSON_BYTES + 1,
           timeoutMs
         );
-        parseEnvelope(responseText, status);
+        parseEnvelope(responseText, status2);
         throw new BrowserControlProtocolError("browser controller image response is invalid");
       }
       const headers = parseCurlResponseHeaders(
@@ -33300,7 +34399,7 @@ function looksLikeBrowserControlEnvelope(body) {
     return false;
   }
 }
-function parseEnvelope(body, status) {
+function parseEnvelope(body, status2) {
   let value;
   try {
     value = JSON.parse(body);
@@ -33310,10 +34409,10 @@ function parseEnvelope(body, status) {
   if (!isRecord3(value) || value.protocolVersion !== BROWSER_CONTROL_PROTOCOL_VERSION) {
     throw new BrowserControlProtocolError("browser controller protocol version is invalid");
   }
-  if (value.ok === true && status >= 200 && status < 300 && "data" in value) return value.data;
-  if (value.ok === false && status >= 400 && status <= 599) {
+  if (value.ok === true && status2 >= 200 && status2 < 300 && "data" in value) return value.data;
+  if (value.ok === false && status2 >= 400 && status2 <= 599) {
     const parsed = InteractionError.safeParse(value.error);
-    if (parsed.success) throw new BrowserControlRequestError(status, parsed.data);
+    if (parsed.success) throw new BrowserControlRequestError(status2, parsed.data);
   }
   throw new BrowserControlProtocolError("browser controller response envelope is invalid");
 }
@@ -33786,7 +34885,7 @@ async function readText(session, path, maxBytes, timeoutMs) {
     } catch {
     }
   }
-  const sizeMarker = `OPENGENI_BROWSER_PRIVATE_SIZE_${randomUUID7()}`;
+  const sizeMarker = `OPENGENI_BROWSER_PRIVATE_SIZE_${randomUUID8()}`;
   const sizeOutput = await runPrivateReadCommand(
     session,
     [
@@ -33805,7 +34904,7 @@ async function readText(session, path, maxBytes, timeoutMs) {
   for (let offset = 0; offset < requestedBytes; offset += PRIVATE_READ_CHUNK_BYTES) {
     const chunkIndex = Math.floor(offset / PRIVATE_READ_CHUNK_BYTES);
     const expectedBytes = Math.min(PRIVATE_READ_CHUNK_BYTES, requestedBytes - offset);
-    const marker = `OPENGENI_BROWSER_PRIVATE_CHUNK_${randomUUID7()}`;
+    const marker = `OPENGENI_BROWSER_PRIVATE_CHUNK_${randomUUID8()}`;
     const output = await runPrivateReadCommand(
       session,
       [
@@ -33834,7 +34933,7 @@ async function readBytes(session, path, maxBytes, timeoutMs) {
   if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > COMPUTER_SCREENSHOT_MAX_BYTES) {
     throw new RangeError("browser private binary response limit is invalid");
   }
-  const sizeMarker = `OPENGENI_BROWSER_PRIVATE_SIZE_${randomUUID7()}`;
+  const sizeMarker = `OPENGENI_BROWSER_PRIVATE_SIZE_${randomUUID8()}`;
   const sizeOutput = await runPrivateReadCommand(
     session,
     [
@@ -33856,7 +34955,7 @@ async function readBytes(session, path, maxBytes, timeoutMs) {
   for (let offset = 0; offset < size; offset += PRIVATE_READ_CHUNK_BYTES) {
     const chunkIndex = Math.floor(offset / PRIVATE_READ_CHUNK_BYTES);
     const expectedBytes = Math.min(PRIVATE_READ_CHUNK_BYTES, size - offset);
-    const marker = `OPENGENI_BROWSER_PRIVATE_CHUNK_${randomUUID7()}`;
+    const marker = `OPENGENI_BROWSER_PRIVATE_CHUNK_${randomUUID8()}`;
     const output = await runPrivateReadCommand(
       session,
       [
@@ -34067,11 +35166,11 @@ function parseUnsignedInteger(value, label) {
   return parsed;
 }
 function parseHttpStatus(value) {
-  const status = parseUnsignedInteger(value, "HTTP status");
-  if (status < 100 || status > 599) {
+  const status2 = parseUnsignedInteger(value, "HTTP status");
+  if (status2 < 100 || status2 > 599) {
     throw new BrowserControlProtocolError("HTTP status is invalid");
   }
-  return status;
+  return status2;
 }
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -34465,7 +35564,7 @@ async function materializeRunCredentials(session, material, options) {
     throw new RunCredentialValidationError("executionGeneration must be a non-negative integer");
   }
   const nonce = crypto.randomUUID();
-  const prefix = `${attemptId}-${options.executionGeneration}-`;
+  const prefix2 = `${attemptId}-${options.executionGeneration}-`;
   const versionName = `${attemptId}-${options.executionGeneration}-${nonce}`;
   const stage = `${root}/versions/.stage-${versionName}`;
   const version = `${root}/versions/${versionName}`;
@@ -34530,7 +35629,7 @@ async function materializeRunCredentials(session, material, options) {
       ] : options.pruneOtherAttempts ? [
         `find ${shellQuote7(`${root}/versions`)} -mindepth 1 -maxdepth 1 ! -name ${shellQuote7(`${attemptId}-${options.executionGeneration}-*`)} -exec rm -rf -- {} +`
       ] : options.pruneSupersededGenerations ? [
-        `for candidate in ${shellQuote7(`${root}/versions`)}/${prefix}*; do`,
+        `for candidate in ${shellQuote7(`${root}/versions`)}/${prefix2}*; do`,
         `  [ -e "$candidate" ] || continue`,
         `  name=\${candidate##*/}`,
         `  [ "$name" = ${shellQuote7(versionName)} ] || [ "$name" = "$previous" ] || rm -rf -- "$candidate"`,
@@ -34562,7 +35661,7 @@ async function clearRunCredentialsForAttempt(session, options, commandRunner) {
   if (!Number.isSafeInteger(options.executionGeneration) || options.executionGeneration < 0) {
     throw new RunCredentialValidationError("executionGeneration must be a non-negative integer");
   }
-  const prefix = `${attemptId}-${options.executionGeneration}-`;
+  const prefix2 = `${attemptId}-${options.executionGeneration}-`;
   await runCredentialCommand(
     session,
     [
@@ -34570,11 +35669,11 @@ async function clearRunCredentialsForAttempt(session, options, commandRunner) {
       ...pointerLockAcquireCommands(root).map((line) => `  ${line}`),
       `  if [ -r ${shellQuote7(`${root}/current`)} ]; then`,
       `    current=$(cat -- ${shellQuote7(`${root}/current`)} 2>/dev/null || :)`,
-      `    case "$current" in ${shellQuote7(prefix)}*) rm -f -- ${shellQuote7(`${root}/current`)} ;; esac`,
+      `    case "$current" in ${shellQuote7(prefix2)}*) rm -f -- ${shellQuote7(`${root}/current`)} ;; esac`,
       "  fi",
       `  if [ -d ${shellQuote7(`${root}/versions`)} ]; then`,
-      `    find ${shellQuote7(`${root}/versions`)} -mindepth 1 -maxdepth 1 -name ${shellQuote7(`${prefix}*`)} -exec rm -rf -- {} +`,
-      `    find ${shellQuote7(`${root}/versions`)} -mindepth 1 -maxdepth 1 -name ${shellQuote7(`.stage-${prefix}*`)} -exec rm -rf -- {} +`,
+      `    find ${shellQuote7(`${root}/versions`)} -mindepth 1 -maxdepth 1 -name ${shellQuote7(`${prefix2}*`)} -exec rm -rf -- {} +`,
+      `    find ${shellQuote7(`${root}/versions`)} -mindepth 1 -maxdepth 1 -name ${shellQuote7(`.stage-${prefix2}*`)} -exec rm -rf -- {} +`,
       "  fi",
       ...pointerLockReleaseCommands().map((line) => `  ${line}`),
       "fi"
@@ -34659,8 +35758,175 @@ function withRunCredentialsClient(client, sessionId, onSessionReady) {
 }
 
 // src/sandbox/codemode-token.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 import { posix as posixPath3 } from "path";
+
+// src/sandbox/codemode-client.ts
+import { createHash as createHash8, randomUUID as randomUUID9 } from "crypto";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname5, join as join8, posix as posix5, resolve as resolve6 } from "path";
+import { fileURLToPath } from "url";
+function managedCodemodeClientDigest(client) {
+  return createHash8("sha256").update(JSON.stringify(client)).digest("hex");
+}
+function managedCodemodeClientDirectory(client, workspaceRoot = "/workspace") {
+  if (!posix5.isAbsolute(workspaceRoot) || workspaceRoot.includes("\0")) {
+    throw new Error("Managed Codemode client workspace root must be absolute");
+  }
+  return posix5.join(
+    workspaceRoot,
+    ".opengeni/codemode-clients",
+    managedCodemodeClientDigest(client)
+  );
+}
+async function buildManagedCodemodeClient(root) {
+  const bundle = async (entry, format, banner) => {
+    const result = await Bun.build({
+      entrypoints: [join8(root, entry)],
+      target: "node",
+      format,
+      minify: true,
+      sourcemap: "none",
+      ...banner ? { banner } : {}
+    });
+    if (!result.success || result.outputs.length !== 1) {
+      throw new Error(`Managed Codemode client build failed: ${entry}`);
+    }
+    return await result.outputs[0].text();
+  };
+  return {
+    version: 1,
+    files: {
+      ogtool: await bundle("packages/ogtool/src/cli.ts", "cjs", "#!/usr/bin/env node"),
+      "client.mjs": await bundle("packages/codemode/src/index.ts", "esm"),
+      // The extensionless executable must not inherit a user's ESM workspace.
+      "package.json": '{"type":"commonjs"}\n'
+    }
+  };
+}
+var releaseClient;
+function loadManagedCodemodeClient() {
+  return releaseClient ??= (async () => {
+    const moduleDir = dirname5(fileURLToPath(import.meta.url));
+    const root = resolve6(moduleDir, "../../../..");
+    if (import.meta.url.endsWith("/src/sandbox/codemode-client.ts") && existsSync2(join8(root, "packages/ogtool/src/cli.ts"))) {
+      return await buildManagedCodemodeClient(root);
+    }
+    const candidates = [
+      join8(moduleDir, "assets/codemode-client.json"),
+      join8(moduleDir, "../assets/codemode-client.json"),
+      join8(moduleDir, "../../dist/assets/codemode-client.json")
+    ];
+    for (const path of candidates) {
+      if (!existsSync2(path)) continue;
+      const value = JSON.parse(readFileSync2(path, "utf8"));
+      if (!value || typeof value !== "object" || value.version !== 1 || Object.keys(value).sort().join(",") !== "files,version" || typeof value.files?.ogtool !== "string" || typeof value.files?.["client.mjs"] !== "string" || value.files?.["package.json"] !== '{"type":"commonjs"}\n' || Object.keys(value.files).sort().join(",") !== "client.mjs,ogtool,package.json") {
+        throw new Error(
+          "Invalid deployment-owned managed Codemode client asset; rebuild the worker release"
+        );
+      }
+      return value;
+    }
+    throw new Error(
+      "Managed Codemode client asset missing; rebuild and deploy the matching worker/runtime package (do not install latest or replace the sandbox)"
+    );
+  })();
+}
+function quote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+async function installManagedCodemodeClient(session, client, run2, runAs, workspaceRoot = "/workspace") {
+  const directory = managedCodemodeClientDirectory(client, workspaceRoot);
+  const digest = managedCodemodeClientDigest(client);
+  const verify = `
+const fs = require('node:fs'), crypto = require('node:crypto');
+const root = ${JSON.stringify(directory)};
+if (!fs.lstatSync(root).isDirectory()) process.exit(1);
+for (const name of ['ogtool', 'client.mjs', 'package.json']) {
+  if (!fs.lstatSync(root + '/' + name).isFile()) process.exit(1);
+}
+fs.accessSync(root + '/ogtool', fs.constants.X_OK);
+const files = {ogtool: fs.readFileSync(root + '/ogtool', 'utf8'), 'client.mjs': fs.readFileSync(root + '/client.mjs', 'utf8'), 'package.json': fs.readFileSync(root + '/package.json', 'utf8')};
+if (crypto.createHash('sha256').update(JSON.stringify({version: 1, files})).digest('hex') !== ${JSON.stringify(digest)}) process.exit(1);
+`;
+  if (sandboxCommandExitCode(await run2(`node -e ${quote(verify)} 2>/dev/null`)) === 0) return;
+  const editor = session.createEditor?.(runAs);
+  if (!editor)
+    throw new Error(
+      "Managed Codemode client delivery requires sandbox file ingress; update the sandbox provider adapter"
+    );
+  const stage = `${posix5.dirname(directory)}/stage-${randomUUID9()}.json`;
+  let installationFailure;
+  try {
+    await editor.createFile({
+      type: "create_file",
+      path: stage,
+      diff: `+${JSON.stringify(client)}`
+    });
+    const install = `
+const fs = require('node:fs'), crypto = require('node:crypto');
+const raw = fs.readFileSync(${JSON.stringify(stage)}, 'utf8').trim();
+if (crypto.createHash('sha256').update(raw).digest('hex') !== ${JSON.stringify(digest)}) throw Error('Codemode client transfer integrity failure');
+const data = JSON.parse(raw), root = ${JSON.stringify(directory)};
+fs.mkdirSync(root, {recursive: true});
+if (!fs.lstatSync(root).isDirectory()) throw Error('Codemode client directory must not be a symlink');
+for (const name of ['package.json', 'ogtool', 'client.mjs']) {
+  const tmp = root + '/' + name + '.' + crypto.randomUUID();
+  fs.writeFileSync(tmp, data.files[name], {mode: 0o755, flag: 'wx'});
+  fs.renameSync(tmp, root + '/' + name);
+}
+`;
+    const result = await run2(`node -e ${quote(install)} && node -e ${quote(verify)}`);
+    if (sandboxCommandExitCode(result) !== 0) {
+      throw new Error(
+        "Managed Codemode client delivery failed; verify Node and sandbox file ingress, then retry with the same worker release"
+      );
+    }
+  } catch (error) {
+    installationFailure = { error };
+  }
+  let cleanupFailure;
+  try {
+    await editor.deleteFile({ type: "delete_file", path: stage });
+  } catch (editorFailure) {
+    try {
+      const cleanup = await run2(
+        `node -e ${quote(`require('node:fs').rmSync(${JSON.stringify(stage)}, {force: true})`)}`
+      );
+      if (sandboxCommandExitCode(cleanup) !== 0) {
+        throw new Error("Staging file removal failed", { cause: editorFailure });
+      }
+    } catch (commandFailure2) {
+      cleanupFailure = new AggregateError(
+        [editorFailure, commandFailure2],
+        "Both cleanup paths failed",
+        { cause: commandFailure2 }
+      );
+    }
+  }
+  if (cleanupFailure) {
+    throw new AggregateError(
+      installationFailure ? [installationFailure.error, cleanupFailure] : [cleanupFailure],
+      "Managed Codemode client staging cleanup failed; restore sandbox file ingress/command execution before retrying",
+      { cause: installationFailure?.error ?? cleanupFailure }
+    );
+  }
+  if (installationFailure) throw installationFailure.error;
+}
+function managedCodemodeClientEnvironment(directory) {
+  return [
+    // A routing proxy can switch to a Connected Machine during the attempt.
+    // Its native client is projected by the connection-bound exec transport.
+    'if [ -z "${OPENGENI_CODEMODE_NATIVE_CLIENT:-}" ]; then',
+    `  export PATH=${quote(directory)}:"$PATH"`,
+    `  export OPENGENI_CODEMODE_CLIENT_MODULE=${quote(`${directory}/client.mjs`)}`,
+    "else",
+    "  unset OPENGENI_CODEMODE_CLIENT_MODULE",
+    "fi"
+  ];
+}
+
+// src/sandbox/codemode-token.ts
 var MAX_CODEMODE_SESSION_ID_BYTES = 512;
 var CodemodeTokenPathError = class extends Error {
   constructor(message) {
@@ -34691,21 +35957,22 @@ function codemodeTokenFileForSession(manifestTokenFile, sessionId) {
     manifestTokenFile,
     "Codemode manifest token file"
   );
-  const digest = createHash8("sha256").update(assertCodemodeSessionId(sessionId)).digest("hex");
+  const digest = createHash9("sha256").update(assertCodemodeSessionId(sessionId)).digest("hex");
   return posixPath3.join(posixPath3.dirname(normalizedManifestFile), "codemode-tokens", digest);
 }
 function codemodeTokenFileFromEnvironment(environment, sessionId) {
   const manifestTokenFile = environment.OPENGENI_CODEMODE_TOKEN_FILE ?? `${environment.HOME ?? "/workspace"}/.opengeni/codemode-token`;
   return codemodeTokenFileForSession(manifestTokenFile, sessionId);
 }
-function withCodemodeTokenEnvironment(cmd, tokenFile, codemodeUrl) {
+function withCodemodeTokenEnvironment(cmd, tokenFile, codemodeUrl, clientDirectory) {
   return [
     `export OPENGENI_CODEMODE_TOKEN_FILE=${shellCodemodePath(tokenFile)}`,
     ...codemodeUrl ? [`export OPENGENI_CODEMODE_URL=${shellQuote8(codemodeUrl)}`] : [],
+    ...clientDirectory ? managedCodemodeClientEnvironment(clientDirectory) : [],
     cmd
   ].join("\n");
 }
-function withCodemodeTokenSession(session, tokenFile, codemodeUrl) {
+function withCodemodeTokenSession(session, tokenFile, codemodeUrl, clientDirectory) {
   return new Proxy(session, {
     get(target, property, receiver) {
       if (property === "exec" || property === "execCommand") {
@@ -34713,7 +35980,7 @@ function withCodemodeTokenSession(session, tokenFile, codemodeUrl) {
         if (!command) return void 0;
         return async (args) => await command.call(target, {
           ...args,
-          cmd: withCodemodeTokenEnvironment(args.cmd, tokenFile, codemodeUrl)
+          cmd: withCodemodeTokenEnvironment(args.cmd, tokenFile, codemodeUrl, clientDirectory)
         });
       }
       const value = Reflect.get(target, property, receiver);
@@ -34721,12 +35988,12 @@ function withCodemodeTokenSession(session, tokenFile, codemodeUrl) {
     }
   });
 }
-function withCodemodeTokenClient(client, tokenFile, codemodeUrl) {
+function withCodemodeTokenClient(client, tokenFile, codemodeUrl, clientDirectory) {
   const decorated = /* @__PURE__ */ new WeakMap();
   const wrap = (session) => {
     const existing = decorated.get(session);
     if (existing) return existing;
-    const wrapped = withCodemodeTokenSession(session, tokenFile, codemodeUrl);
+    const wrapped = withCodemodeTokenSession(session, tokenFile, codemodeUrl, clientDirectory);
     decorated.set(session, wrapped);
     return wrapped;
   };
@@ -35162,11 +36429,11 @@ var MockAgentResponder = class {
         return ok(req.requestId, { $case: "fsRemove", fsRemove: {} });
       }
       case "fsList": {
-        const prefix = normalize(op.fsList.path).replace(/\/?$/, "/");
+        const prefix2 = normalize(op.fsList.path).replace(/\/?$/, "/");
         const res = {
-          entries: [...this.files.keys()].filter((p) => p.startsWith(prefix)).map((p) => {
+          entries: [...this.files.keys()].filter((p) => p.startsWith(prefix2)).map((p) => {
             const bytes = this.files.get(p);
-            const rel = p.slice(prefix.length);
+            const rel = p.slice(prefix2.length);
             return {
               name: rel.split("/").pop() ?? rel,
               path: rel,
@@ -35718,18 +36985,18 @@ function errorResponse2(requestId2, code, message) {
     result: void 0
   };
 }
-function startResponse(requestId2, status, accepted = true) {
+function startResponse(requestId2, status2, accepted = true) {
   return {
     requestId: requestId2,
     error: void 0,
-    result: { $case: "opStart", opStart: { accepted, status } }
+    result: { $case: "opStart", opStart: { accepted, status: status2 } }
   };
 }
-function statusOnly(requestId2, status) {
+function statusOnly(requestId2, status2) {
   return {
     requestId: requestId2,
     error: void 0,
-    result: { $case: "opStatus", opStatus: status }
+    result: { $case: "opStatus", opStatus: status2 }
   };
 }
 function lostStatus(opId) {
@@ -36328,7 +37595,7 @@ async function verifySandboxExecReadiness(established, timeoutMs = MODAL_EXEC_RE
     }
     const remainingMs = deadline - Date.now();
     if (remainingMs <= 0) throw timeoutError();
-    await new Promise((resolve6) => setTimeout(resolve6, Math.min(100, remainingMs)));
+    await new Promise((resolve7) => setTimeout(resolve7, Math.min(100, remainingMs)));
     result = await execProbe();
   }
 }
@@ -37040,6 +38307,8 @@ export {
   parseExecBannerSessionId,
   parseExecBannerExitCode,
   isExecSessionLostBanner,
+  SandboxMaterializationVerificationError,
+  materializationVerificationDiagnostic,
   normalizeConnectedMachineWorkspaceRoot,
   isWindowsConnectedMachinePath,
   isConnectedMachineAbsolutePath,
@@ -37236,6 +38505,9 @@ export {
   withRunCredentialEnvironment,
   withRunCredentialsSession,
   withRunCredentialsClient,
+  managedCodemodeClientDirectory,
+  loadManagedCodemodeClient,
+  installManagedCodemodeClient,
   CodemodeTokenPathError,
   shellCodemodePath,
   codemodeTokenFileForSession,
@@ -37293,4 +38565,4 @@ export {
   collectSandboxEnvironment2 as collectSandboxEnvironment,
   parseExposedPorts2 as parseExposedPorts
 };
-//# sourceMappingURL=chunk-46BFUGFL.js.map
+//# sourceMappingURL=chunk-WIHICNWS.js.map