@opengeni/worker-bundle 2.2.0 → 2.2.1-canary.36927100590001

package/src/activities/agent-turn/errors.ts

@@ -18,8 +18,10 @@ import {
   isMcpRequestTimeoutError,
   isMcpTransportConnectivityError,
   isModalTaskExecStartPreDispatchUnavailableError,
+  isModalCommandStartOutcomeUnknownError,
   isRoutingMutationOutcomeUnknownError,
   RoutingWorkspaceRootChangedError,
+  ResponsesStreamingTerminalError,
   SandboxMaterializationVerificationError,
   materializationVerificationDiagnostic,
   type MaterializationVerificationDiagnostic,
@@ -729,6 +731,7 @@ export function shouldRecoverCompactionProviderFailure(error: unknown): boolean
 export function classifyContextWindowOverflowError(
   error: unknown,
 ): { message: string; code?: string; detail?: string } | null {
+  if (isProviderSafetyRefusal(error)) return null;
   const fields = collectErrorStrings(error);
   const matched = fields.find(
     (value) =>
@@ -795,6 +798,9 @@ export function collectErrorStrings(value: unknown, seen = new WeakSet<object>()
   }
   seen.add(value);
   const out: string[] = [];
+  // This diagnostic is already provider-owned and byte-bounded. Do not widen
+  // generic detail traversal to arbitrary application payloads.
+  if (value instanceof ResponsesStreamingTerminalError) out.push(value.detail);
   const record = value as Record<string, unknown>;
   for (const key of ["message", "code", "type", "name", "param"]) {
     const field = record[key];
@@ -857,6 +863,9 @@ export function isExactStatuslessUpstreamConnectivityMessage(message: string): b
 }
 
 function providerSafetyRefusalDiagnostic(error: unknown): string | undefined {
+  if (error instanceof ResponsesStreamingTerminalError) {
+    return error.category === "safety" ? error.detail : undefined;
+  }
   return collectErrorStrings(error).find(
     (value) =>
       /^(?:content_policy_violation|content_filter|safety_violation|bio_policy|cyber_policy)$/.test(
@@ -870,6 +879,9 @@ function isProviderSafetyRefusal(error: unknown): boolean {
 }
 
 export function isTransientProviderError(error: unknown): boolean {
+  if (error instanceof ResponsesStreamingTerminalError) {
+    return error.category === "unavailable";
+  }
   // A semantic refusal can arrive inside a 5xx transport envelope.
   if (isProviderSafetyRefusal(error)) return false;
   const status =
@@ -1068,6 +1080,41 @@ function baseAgentRunFailurePayload(
       detail: safetyRefusalDiagnostic,
     };
   }
+  if (error instanceof ResponsesStreamingTerminalError) {
+    const quota =
+      error.category === "unknown" || error.category === "rate_limit"
+        ? classifyProviderQuotaExhaustionError({
+            code: error.code,
+            error: { code: error.code, type: error.type, message: error.detail },
+            retryAfterSeconds: error.retryAfterSeconds,
+          })
+        : null;
+    if (quota) {
+      return {
+        error: providerQuotaExhaustedMessage(quota.scope),
+        code: PROVIDER_QUOTA_EXHAUSTED_CODE,
+        retryable: false,
+        quotaScope: quota.scope,
+        detail: error.detail,
+      };
+    }
+    return {
+      error:
+        error.category === "rate_limit"
+          ? "Model provider rate limit hit. Try again in a minute or lower the reasoning effort."
+          : error.category === "unavailable"
+            ? "The model provider is temporarily unavailable. The same turn will retry after a short delay."
+            : "The model provider rejected the response. Automatic retries stopped.",
+      code:
+        error.category === "rate_limit"
+          ? "provider_rate_limited"
+          : error.category === "unavailable"
+            ? "provider_unavailable"
+            : "provider_request_rejected",
+      retryable: error.category === "rate_limit" || error.category === "unavailable",
+      detail: error.detail,
+    };
+  }
   const message = error instanceof Error ? error.message : String(error);
   const status =
     typeof error === "object" && error !== null
@@ -1106,6 +1153,14 @@ function baseAgentRunFailurePayload(
       retryable: true,
     };
   }
+  if (isModalCommandStartOutcomeUnknownError(error)) {
+    return {
+      error:
+        "A managed sandbox command may have started, but its acknowledgement was lost. Automatic replay is disabled; inspect the sandbox state before retrying.",
+      code: "sandbox_command_start_outcome_unknown",
+      retryable: false,
+    };
+  }
   if (
     !isRoutingMutationOutcomeUnknownError(error) &&
     isModalTaskExecStartPreDispatchUnavailableError(error)

package/src/activities/agent-turn/failure-settlement.ts

@@ -16,7 +16,10 @@ import {
   type CodexLeaseAccountStatus,
 } from "@opengeni/db";
 import { publishDurableSessionEvents } from "@opengeni/events";
-import { maxTurnsExceededRunState } from "@opengeni/runtime";
+import {
+  maxTurnsExceededRunState,
+  isModalTaskExecStartPreDispatchUnavailableError,
+} from "@opengeni/runtime";
 import { ApplicationFailure, CancelledFailure } from "@temporalio/activity";
 import {
   authoritativeCodexCapacityResetAt,
@@ -1536,12 +1539,16 @@ export async function settleTurnFailure(deps: TurnFailureDeps): Promise<RunAgent
     if (
       !(await eventing.settle!({
         events: [
+          ...(error.allowance
+            ? [{ type: "usage.exhausted" as const, payload: error.allowance }]
+            : []),
           {
             type: "turn.completed",
             payload: {
               output: "",
               segmentLimit: "budget_exhausted",
               detail: error.message,
+              ...(error.allowance ?? {}),
             },
           },
           { type: "session.status.changed", payload: { status: "idle" } },
@@ -1549,6 +1556,7 @@ export async function settleTurnFailure(deps: TurnFailureDeps): Promise<RunAgent
         turnStatus: "completed",
         sessionStatus: "idle",
         activeTurnId: null,
+        ...(error.allowance ? { allowanceGoalPause: { rationale: error.allowance.message } } : {}),
       }))
     ) {
       return claimedResult({ status: "cancelled" });
@@ -1655,6 +1663,14 @@ export async function settleTurnFailure(deps: TurnFailureDeps): Promise<RunAgent
     !!attempt.turnId &&
     !!attempt.triggerEventId &&
     attempt.executionGeneration > 0;
+  const earlyCommandStartUnavailable =
+    isModalTaskExecStartPreDispatchUnavailableError(error) &&
+    !attempt.modelRequestStarted &&
+    !eventing.turnStartedPublished &&
+    !!attempt.turnId &&
+    !!attempt.triggerEventId &&
+    attempt.executionGeneration > 0;
+  const earlyRecoverableSetup = earlyDefinitionMismatch || earlyCommandStartUnavailable;
   let failure = (
     earlyDefinitionMismatch
       ? { error: error.message, code: error.code, retryable: true }
@@ -1665,7 +1681,7 @@ export async function settleTurnFailure(deps: TurnFailureDeps): Promise<RunAgent
   ) as ReturnType<typeof agentRunFailurePayload>;
   if (
     attempt.turnId &&
-    (earlyDefinitionMismatch ||
+    (earlyRecoverableSetup ||
       (failure.retryable && eventing.publish && eventing.turnStartedPublished))
   ) {
     const nextProviderRecoveryCount = attempt.providerRecoveryCount + 1;
@@ -1676,7 +1692,7 @@ export async function settleTurnFailure(deps: TurnFailureDeps): Promise<RunAgent
     });
     try {
       if (recoveryResult.status === "recovering") {
-        if (!earlyDefinitionMismatch) {
+        if (!earlyRecoverableSetup) {
           await flushRuntimeBatcher();
           await historySink.reconcileConversationTruth({ requireDurable: true });
         }
@@ -1707,15 +1723,19 @@ export async function settleTurnFailure(deps: TurnFailureDeps): Promise<RunAgent
         return claimedResult(recoveryResult);
       }
       failure = providerRecoveryExhaustedFailure(failure, recoveryResult);
-      if (earlyDefinitionMismatch) {
+      if (earlyRecoverableSetup) {
         // Setup has no eventing sink yet. Carry only the fixed, safe diagnostic
         // through Temporal into exact-attempt workflow failure settlement.
         control.activityStatus = "failed";
         control.turnMetricOutcome = "failed";
         control.activityError = error;
         throw ApplicationFailure.create({
-          message: `${error.message}. Automatic same-turn configuration recovery exhausted after ${recoveryResult.providerRecoveryCount} retries.`,
-          type: "TurnExecutionPolicyDefinitionMismatchError",
+          message: earlyDefinitionMismatch
+            ? `${error.message}. Automatic same-turn configuration recovery exhausted after ${recoveryResult.providerRecoveryCount} retries.`
+            : failure.error,
+          type: earlyDefinitionMismatch
+            ? "TurnExecutionPolicyDefinitionMismatchError"
+            : "SandboxCommandStartUnavailableError",
           nonRetryable: true,
         });
       }

package/src/activities/agent-turn/final-reply.ts

@@ -0,0 +1,46 @@
+/** One durable, same-logical-turn handoff, not a retry of model/tool effects. */
+export function finalReplyNudge(turnId: string) {
+  return {
+    type: "message" as const,
+    role: "developer" as const,
+    content: [
+      {
+        type: "input_text" as const,
+        text: `[Runtime final-reply handoff for turn ${turnId}]\nYour final user-facing answer was empty. Reply to the user now with the requested deliverable or a concise outcome and its retained artifact link. Goal evidence is a short ledger proof, not the answer, and goal_complete does not deliver a chat reply. Use the completed work and tool results already in history; do not repeat completed tools or restart the task. If this is a late child result after goal completion, integrate material new findings and deliver any still-missing handoff. Do not change the completed goal or invent a result.`,
+      },
+    ],
+  };
+}
+
+export function hasFinalReplyNudge(history: readonly unknown[], turnId: string): boolean {
+  const text = finalReplyNudge(turnId).content[0]!.text;
+  return history.some((item) => {
+    const message = item as { role?: unknown; content?: unknown } | null;
+    return (
+      message?.role === "developer" &&
+      Array.isArray(message.content) &&
+      message.content.some(
+        (part: { type?: unknown; text?: unknown }) =>
+          part?.type === "input_text" && part.text === text,
+      )
+    );
+  });
+}
+
+export function needsFinalReply(input: {
+  output: unknown;
+  inputWaitYielded: boolean;
+  interrupted: boolean;
+  maintenance: boolean;
+  toolsExecuted: boolean;
+  completedGoal: boolean;
+}): boolean {
+  return (
+    typeof input.output === "string" &&
+    input.output.trim().length === 0 &&
+    !input.inputWaitYielded &&
+    !input.interrupted &&
+    !input.maintenance &&
+    (input.toolsExecuted || input.completedGoal)
+  );
+}

package/src/activities/agent-turn/governance-model.ts

@@ -48,6 +48,7 @@ import { WorkspaceModelPolicyBlockedError } from "@opengeni/runtime";
 import {
   evaluateWorkspaceModelPolicy,
   resolveWorkspaceAgentHumanInputEnabled,
+  resolveWorkspaceDefaultAgentIdentity,
   type MediaGenerationResult,
 } from "@opengeni/contracts";
 import { codeSearchEnabledForTurn } from "@opengeni/contracts/code-search";
@@ -97,6 +98,12 @@ export type GovernanceModelOk = {
   /** Deployment and workspace allow the Jev-backed code_search tool. */
   codeSearchEnabled: boolean;
   workspaceAgentInstructions: string | null | undefined;
+  /**
+   * Modular composer identity tier: the explicit workspace default identity,
+   * else the frozen legacy persona without `{{core}}`. Never dropped by
+   * instruction policies (only read for sessions with an agent configuration).
+   */
+  workspaceAgentIdentity: string | null;
   workspaceGovernance: ReturnType<typeof renderWorkspaceGovernanceContext>;
   structuredWorkspacePolicyActive: boolean;
   workspaceMemory: string | null | undefined;
@@ -247,6 +254,10 @@ export async function prepareGovernanceAndModel(
   );
   const contextSelection = await resolveCompanyBrainContextSelection(db, governanceClaims);
   const workspaceAgentInstructions = contextSelection.legacyWorkspaceInstructions;
+  const workspaceAgentIdentity = resolveWorkspaceDefaultAgentIdentity(
+    workspace.settings,
+    workspaceAgentInstructions,
+  ).identity;
   const memoryPromptMode = contextSelection.receipt.memoryPromptMode;
   assertWorkspaceHumanInputAllowed(agentHumanInputEnabled, "resume", humanInputResume !== null);
   const companyProfileIncluded = contextSelection.receipt.companyProfileIncluded;
@@ -482,6 +493,7 @@ export async function prepareGovernanceAndModel(
       agentHumanInputEnabled,
       codeSearchEnabled,
       workspaceAgentInstructions,
+      workspaceAgentIdentity,
       workspaceGovernance,
       structuredWorkspacePolicyActive,
       workspaceMemory,

package/src/activities/agent-turn/model-call-admission.ts

@@ -0,0 +1,94 @@
+import type { StreamEvent } from "@openai/agents";
+
+/** SDK producer/consumer rendezvous. Usage stays on the sole consumer writer. */
+export function createModelCallAdmission(input: {
+  signal: AbortSignal;
+  admit: () => Promise<void>;
+}) {
+  type Receipt = {
+    promise: Promise<void>;
+    resolve: () => void;
+    reject: (error: unknown) => void;
+  };
+  const receipts = new WeakMap<object, Receipt>();
+  const responseReceipts = new Map<string, Receipt>();
+  const pending = new Set<Receipt>();
+  const responseId = (event: unknown): string | null => {
+    const id = (event as { response?: { id?: unknown } } | null)?.response?.id;
+    return typeof id === "string" && id.length > 0 ? id : null;
+  };
+  let latest: Promise<void> = Promise.resolve();
+  let failure: unknown;
+  let failed = false;
+  let rejectHalted!: (error: unknown) => void;
+  const halted = new Promise<never>((_, reject) => {
+    rejectHalted = reject;
+  });
+  void halted.catch(() => undefined);
+  const fail = (error: unknown) => {
+    if (failed) return;
+    failed = true;
+    failure = error;
+    rejectHalted(error);
+    for (const receipt of pending) receipt.reject(error);
+    pending.clear();
+    responseReceipts.clear();
+  };
+  const abort = () => fail(input.signal.reason ?? new Error("Model stream cancelled"));
+  input.signal.addEventListener("abort", abort, { once: true });
+  if (input.signal.aborted) abort();
+  return {
+    beforeModelRequest: async () => {
+      await Promise.race([latest, halted]);
+      if (failed) throw failure;
+      // Even a settled predecessor does not grant admission to the next call.
+      await Promise.race([input.admit(), halted]);
+      if (failed) throw failure;
+    },
+    onModelResponse: (event: StreamEvent): Promise<void> => {
+      if (failed) return Promise.reject(failure);
+      const id = responseId(event);
+      const existing =
+        receipts.get(event) ??
+        (id ? responseReceipts.get(id) : undefined) ??
+        (!id && pending.size === 1 ? pending.values().next().value : undefined);
+      if (existing) return existing.promise;
+      let resolve!: () => void;
+      let reject!: (error: unknown) => void;
+      const promise = new Promise<void>((yes, no) => {
+        resolve = yes;
+        reject = no;
+      });
+      // The next model entry awaits this receipt; rejection can happen sooner.
+      void promise.catch(() => undefined);
+      const receipt = { promise, resolve, reject };
+      receipts.set(event, receipt);
+      if (id) responseReceipts.set(id, receipt);
+      pending.add(receipt);
+      latest = promise;
+      return promise;
+    },
+    settle: (event: { type: string; data?: unknown }) => {
+      if (event.type !== "raw_model_stream_event" || !event.data || typeof event.data !== "object")
+        return;
+      if ((event.data as { type?: unknown }).type !== "response_done") return;
+      const id = responseId(event.data);
+      // Runner retry normalization copies response_done. It cannot create a
+      // second response before this receipt permits the next model entry.
+      const receipt =
+        receipts.get(event.data) ??
+        (id ? responseReceipts.get(id) : undefined) ??
+        (pending.size === 1 ? pending.values().next().value : undefined);
+      if (!receipt) return;
+      pending.delete(receipt);
+      if (id) responseReceipts.delete(id);
+      receipt.resolve();
+    },
+    fail,
+    close: () => {
+      input.signal.removeEventListener("abort", abort);
+      if (pending.size > 0) fail(new Error("Model stream closed before response settlement"));
+      responseReceipts.clear();
+    },
+  };
+}

package/src/activities/agent-turn/run-credentials.ts

@@ -28,6 +28,8 @@ import {
   type loadWorkspaceEnvironmentForRunWithCredentials,
 } from "../environment";
 import type { mergeResourceRefs } from "../common";
+import type { withFirstPartyTools } from "../goals";
+import { expandMcpAccountRoutes } from "../mcp-account-routes";
 import { startGitCredentialRenewalLoop } from "../git-credential-renewal";
 import {
   RUN_CREDENTIAL_EXPIRY_LEAD_MS,
@@ -63,6 +65,7 @@ import {
   sandboxSettingsForRoute,
 } from "./sandbox-route";
 import type { ClaimTurnOk } from "./claim";
+import { turnCredentialRestriction } from "./credential-restriction";
 import type { GovernanceModelOk } from "./governance-model";
 import type { SandboxTurnRuntime } from "./sandbox-runtime";
 import type {
@@ -74,6 +77,7 @@ import type {
 
 export type PrepareRunCredentialsDeps = {
   localMcpServerIds?: readonly string[];
+  turnTools: ReturnType<typeof withFirstPartyTools>;
   input: RunAgentTurnInput;
   settings: Settings;
   db: ActivityServices["db"];
@@ -88,6 +92,7 @@ export type PrepareRunCredentialsDeps = {
   sandboxRuntime: SandboxTurnRuntime;
   turn: ClaimTurnOk["turn"];
   session: ClaimTurnOk["session"];
+  turnExecutionPolicy: ClaimTurnOk["turnExecutionPolicy"];
   fileAuthoritySubjectId: ClaimTurnOk["fileAuthoritySubjectId"];
   runSettings: GovernanceModelOk["runSettings"];
   workspaceVariableSet: Awaited<ReturnType<typeof loadWorkspaceEnvironmentForRunWithCredentials>>;
@@ -126,6 +131,7 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
     sandboxState,
     turn,
     session,
+    turnExecutionPolicy,
     fileAuthoritySubjectId,
     runSettings,
     workspaceVariableSet,
@@ -153,6 +159,14 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
   const platformGitResources = turnResources.filter(
     (resource) => resource.kind !== "repository" || repositoryHasExplicitGitConnection(resource),
   );
+  // Credential targets follow the same accepted-account narrowing as execution.
+  // A canonical connection without an accepted account does not execute, and
+  // account-qualified aliases never inherit an attachment's product headers.
+  const accountRoutes = expandMcpAccountRoutes({
+    settings: runSettings,
+    tools: deps.turnTools,
+    bindings: turn.mcpAccountBindings,
+  });
 
   const runCredentialResolver =
     effectiveRunCredentialBackend === "none" || effectiveRunCredentialBackend === "selfhosted"
@@ -160,10 +174,11 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
       : await waitForTurnOperation(
           bindRunCredentialResolver({
             db,
-            settings: runSettings,
+            settings: accountRoutes.settings,
             initiatingHumanSubjectId: turn.initiatingHumanSubjectId ?? null,
             connectionCredentials: connectionCredentials ?? null,
             localMcpServerIds: deps.localMcpServerIds ?? [],
+            effectiveTools: accountRoutes.tools,
             accountId: input.accountId,
             workspaceId: input.workspaceId,
             session,
@@ -214,9 +229,9 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
     : null;
   const runMcpCredentials = new RunMcpCredentials(
     selectedSessionRemoteMcpTargets(
-      runSettings,
+      accountRoutes.settings,
       session.mcpServers ?? [],
-      turn.tools ?? [],
+      accountRoutes.tools,
       (deps.localMcpServerIds ?? []).map((id) => ({ id })),
     ),
     {
@@ -334,11 +349,13 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
           turn,
         })
       : undefined;
+  const credentialRestriction = turnCredentialRestriction(turnExecutionPolicy, session.metadata);
   const codemodeAuthority = {
     sessionId: input.sessionId,
     turnId: turn.id,
     attemptId: input.attemptId,
     executionGeneration: turn.executionGeneration,
+    ...(credentialRestriction ? { credentialRestriction } : {}),
   };
   const sandboxArtifactRuntime = sandboxArtifactRuntimeAdmission(
     settings,

package/src/activities/agent-turn/run.ts

@@ -3,8 +3,11 @@ import {
   readActiveSandbox,
   getWorkspaceCredentialProvider,
   loadClaudeSubscriptionUsageCredential,
+  resolveClaudeSubscriptionCredential,
+  ClaudeSubscriptionReconnectRequired,
 } from "@opengeni/db";
 import { routingEnabled } from "../../sandbox-routing";
+import { resolveAgentToolFamilies } from "@opengeni/contracts";
 import { createKnowledgeSourceSyncActivities } from "../knowledge-source-sync";
 import {
   assertModelConnectionAllowsTurn,
@@ -26,6 +29,7 @@ import {
 import {
   REMOTE_COMPACTION_V2_BETA_FEATURE,
   REMOTE_COMPACTION_V2_IMPLEMENTATION,
+  awaitModelCallAdmission,
   materializeSandboxFileDownloads,
   sandboxFileDownloadFailureNote,
   type SandboxFileDownload,
@@ -378,12 +382,14 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
       getModelRunSettings: () => eventing.modelRunSettings,
       getExecutionGeneration: () => attempt.executionGeneration,
     });
-    const checkpointBeforeProviderDispatch = () =>
-      checkpointHistoryBeforeProviderDispatch(historySink, {
+    const checkpointBeforeProviderDispatch = async () => {
+      await awaitModelCallAdmission();
+      await checkpointHistoryBeforeProviderDispatch(historySink, {
         effectiveSandboxBackend: eventing.modelRunSettings.sandboxBackend,
         routingEnabled: routingEnabled(settings),
         readActiveSandbox: () => readActiveSandbox(db, input.workspaceId, input.sessionId),
       });
+    };
 
     try {
       const claimed = await claimTurnAttempt({
@@ -554,6 +560,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             agentHumanInputEnabled,
             codeSearchEnabled,
             workspaceAgentInstructions,
+            workspaceAgentIdentity,
             workspaceGovernance,
             structuredWorkspacePolicyActive,
             workspaceMemory,
@@ -786,8 +793,12 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
               credentialId: providerTurn.effectiveXaiCredentialId,
               authoritySnapshot: turn.xaiProviderAccountAuthoritySnapshot,
               hostedSearch: {
-                webSearch: runSettings.webSearchEnabled,
-                xSearch: runSettings.webSearchEnabled,
+                webSearch: resolveAgentToolFamilies(session.agent, {
+                  webSearch: runSettings.webSearchEnabled,
+                }).webSearch,
+                xSearch: resolveAgentToolFamilies(session.agent, {
+                  webSearch: runSettings.webSearchEnabled,
+                }).webSearch,
               },
               streamIdleTimeoutMs: runSettings.supergrokResponseStreamIdleTimeoutMs,
               nextRequestId: () => `${dispatchId}:xai:${++xaiModelRequestSequence}`,
@@ -932,7 +943,30 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
               }),
           );
           const withClaudeUsage = <T>(fn: () => Promise<T>): Promise<T> =>
-            withClaudeUsageObserver(claudeUsageObserver, fn);
+            withClaudeUsageObserver(claudeUsageObserver, fn, async (providerId, headers) => {
+              const binding = claudeUsageObserver.binding(providerId);
+              if (!binding) return headers;
+              const credential = await resolveClaudeSubscriptionCredential(
+                db,
+                settings,
+                {
+                  accountId: input.accountId,
+                  workspaceId: input.workspaceId,
+                  scope: binding.scope,
+                },
+                {
+                  expectedConnectionId: binding.expectedConnectionId,
+                  expectedCredentialVersion: binding.expectedCredentialVersion,
+                },
+              );
+              if (!credential) return headers; // A replaced connection never lends its new token to this turn.
+              if ("reconnectRequired" in credential)
+                throw new ClaudeSubscriptionReconnectRequired();
+              claudeUsageObserver.renew(providerId, credential);
+              headers.set("authorization", `Bearer ${credential.token}`);
+              headers.delete("x-api-key");
+              return headers;
+            });
           const withCodex = <T>(fn: () => Promise<T>): Promise<T> =>
             codexContext ? codexRequestStorage.run(codexContext, fn) : fn();
           const withProviderRequestContext = <T>(fn: () => Promise<T>): Promise<T> =>
@@ -1004,6 +1038,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             turnExecutionPolicy,
             resolvedModel,
             workspaceAgentInstructions,
+            workspaceAgentIdentity,
             workspaceGovernance,
             structuredWorkspacePolicyActive,
             workspaceMemory,
@@ -1175,6 +1210,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
           );
 
           const runCredentials = await prepareRunCredentials({
+            turnTools,
             localMcpServerIds: installedApiIntegrations.map((integration) => integration.serverId),
             input,
             settings,
@@ -1190,6 +1226,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             sandboxRuntime,
             turn,
             session,
+            turnExecutionPolicy,
             fileAuthoritySubjectId,
             runSettings,
             workspaceVariableSet,
@@ -1410,6 +1447,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             supportsImageInput,
             agentHumanInputEnabled,
             workspaceAgentInstructions,
+            workspaceAgentIdentity,
             workspaceGovernance,
             structuredWorkspacePolicyActive,
             workspaceMemory,
@@ -1539,6 +1577,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
             turnExecutionPolicy,
             resolvedModel,
             workspaceAgentInstructions,
+            workspaceAgentIdentity,
             workspaceGovernance,
             structuredWorkspacePolicyActive,
             workspaceMemory,

package/src/activities/agent-turn/sandbox-establish.ts

@@ -102,6 +102,7 @@ export type SandboxRouteOk = {
   machinePrimary: boolean;
   groupBoxBackend: Settings["sandboxBackend"];
   groupBoxImage: ReturnType<typeof rigProviderImageSourceImage>;
+  groupBoxImagePolicy: "new_creates_only";
   sandboxCreationBackend: Settings["sandboxBackend"];
   effectiveRunCredentialBackend: Settings["sandboxBackend"];
 };
@@ -299,6 +300,7 @@ export async function resolveSandboxRoute(deps: SandboxRouteDeps): Promise<Sandb
     machinePrimary,
     groupBoxBackend,
     groupBoxImage,
+    groupBoxImagePolicy: "new_creates_only",
     sandboxCreationBackend,
     effectiveRunCredentialBackend,
   };
@@ -341,6 +343,7 @@ export async function establishTurnSandbox(deps: EstablishTurnSandboxDeps): Prom
     machinePrimary,
     groupBoxBackend,
     groupBoxImage,
+    groupBoxImagePolicy,
     rigVersion,
     turnResources,
   } = deps;
@@ -665,6 +668,7 @@ export async function establishTurnSandbox(deps: EstablishTurnSandboxDeps): Prom
                 ...(groupBoxImage
                   ? {
                       image: groupBoxImage,
+                      imagePolicy: groupBoxImagePolicy,
                     }
                   : {}),
                 // The lazy acquire must enforce the same frozen rig authority
@@ -744,17 +748,17 @@ export async function establishTurnSandbox(deps: EstablishTurnSandboxDeps): Prom
                 backend: groupBoxBackend,
                 os: groupBoxOs,
                 environment: sandboxEnvironment,
-                // IMAGE IS SHARED STATE (B3): the container image
-                // this run resolves. The lease stamps it + conflicts on a live shared box
-                // running a DIFFERENT image (solo → durable rotation; N-holders →
-                // SandboxImageConflictError surfaced as an actionable turn error). Select
-                // the image for the actual group-box backend; a configured Modal image must
+                // Deployment/workspace pins select NEW creates only. The lease
+                // retains a live group's image through between-turn repins, even
+                // with other holders; only rotation/reaping elects a new image.
+                // Select the image for the actual group-box backend; a configured Modal image must
                 // never override a Docker run. The selfhosted branch
                 // (establishSelfhostedTurnSession) NEVER passes
                 // an image — B3 lives only on this managed-box branch.
                 ...(groupBoxImage
                   ? {
                       image: groupBoxImage,
+                      imagePolicy: groupBoxImagePolicy,
                     }
                   : {}),
                 // RIG IS SHARED STATE (M3): stamp the frozen rig version so the lease