@tangle-network/agent-app 0.60.213 → 0.60.215

package/dist/chat-routes/index.js

@@ -40,7 +40,7 @@ import {
   flattenHistory,
   readSandboxBinaryBytes,
   statSandboxFileSize
-} from "../chunk-N7FGEWZU.js";
+} from "../chunk-QA2CBATZ.js";
 import "../chunk-4LBCTFBP.js";
 import {
   ModelFailoverExhaustedError,
@@ -80,7 +80,7 @@ import {
   rowIdOf,
   storeSupportsDraftPersistence,
   streamChatRouteAsSandboxEvents
-} from "../chunk-IHLO2DN5.js";
+} from "../chunk-WLH4DEB2.js";
 import "../chunk-Q7WEEN7P.js";
 import "../chunk-UTAIRVOK.js";
 import "../chunk-RN4WPTBH.js";

package/dist/chat-routes/turn-routes.d.ts

@@ -24,7 +24,9 @@
  * instead of hand-rolling a generator — each omittable to the exact behavior
  * above: `turnLock` (single-flight acquire/release around the turn),
  * `contextGate` (pre-producer domain-readiness short-circuit), `beforeTurn`
- * (observe + augment the producer input), `lifecycle` (deterministic
+ * (observe + augment the producer input), `afterAuthorize` (start the box, keys
+ * and session the turn will need the moment the caller is admitted, so they
+ * overlap the lock and the user-row insert), `lifecycle` (deterministic
  * start/complete/error telemetry), `heartbeat` (keepalive during silent
  * producer waits), and `onRawEvent` (the raw producer events, for telemetry) —
  * plus the `authorize` result's `insertUserMessage` flag (suppress the user row
@@ -230,6 +232,21 @@ export type ChatTurnPrepareResult = {
     ok: false;
     response: Response;
 };
+/** What `afterAuthorize` receives: the admitted turn, before the conversation loads and before any lock, read or write. */
+export interface ChatTurnAfterAuthorizeArgs<TContext> {
+    request: Request;
+    /** Parsed, validated POST body. */
+    body: ChatTurnRequestPayload;
+    tenantId: string;
+    userId: string;
+    threadId: string;
+    /** The context `authorize` returned. Keep what the seam starts on it: `prepareTurn`, every later seam and `produce` receive the same object. */
+    context: TContext;
+    /** The turn's trace, for the spans of the work the seam starts. */
+    trace: TurnTrace;
+}
+/** Frees what `afterAuthorize` started, for a turn that ends before `produce` takes it. */
+export type ChatTurnAfterAuthorizeRelease = () => void | Promise<void>;
 /** Trusted per-turn limits supplied by a server adapter, never by the body. */
 export interface ChatTurnExecutionLimits {
     maxInputTokens?: number;
@@ -510,6 +527,22 @@ export interface CreateChatTurnRoutesOptions<TContext = void> {
      *  a plain response without the progress header, a `turn.response` event
      *  with it. Omit → nothing to prepare. */
     prepareTurn?(args: ChatTurnPrepareArgs<TContext>): ChatTurnPrepareResult | Promise<ChatTurnPrepareResult>;
+    /** Start the work this turn will need, the moment `authorize` and `modelPolicy` have admitted it, so that work overlaps
+     *  `prepareTurn`, the history read, the lock, the history recheck and the user-row insert instead of following them: the
+     *  workspace box, the keys a producer mints, a session ensure. Keep what it starts on `args.context`; `produce` receives
+     *  that object and awaits it.
+     *
+     *  Admission has not finished, so the seam must start only work that the turn's refusal leaves harmless: a held lock
+     *  (409), a changed history, a gate's answer or a throw all end the turn without `produce`, and the work already
+     *  started runs on. Start nothing a second request for the same thread could not safely repeat, and nothing that
+     *  writes product state.
+     *
+     *  Not awaited, and it must return synchronously: start the work and return, never wait for it. It may return a release
+     *  function; the route calls it once, only if the turn ends without `produce` (the chain above, or a throw before the
+     *  engine took the turn), so a product frees credentials or leases the unused work holds. Once `produce` runs, the
+     *  work belongs to `produce` and the route never calls the release. A throw is logged and the turn goes on without
+     *  the early work. Omit → nothing starts early. */
+    afterAuthorize?(args: ChatTurnAfterAuthorizeArgs<TContext>): void | ChatTurnAfterAuthorizeRelease;
     /** Product admission policy over the model a turn NAMES. When the request
      *  body carries a `model`, it is checked here — after `authorize`, before
      *  the conversation loads, the lock is taken, or any row is written — and a

package/dist/{chunk-N7FGEWZU.js → chunk-QA2CBATZ.js}

@@ -971,12 +971,13 @@ async function runForegroundSandboxSingleFlight(options) {
     } catch {
     }
   };
+  const timed = (name, work) => options.trace ? options.trace.measure(name, "sandbox", () => work(), void 0, options.traceParent) : work();
   const provisionAsOwner = async (lease) => {
     try {
       return await options.provision();
     } finally {
       try {
-        await options.claim.releaseLease(lease);
+        await timed("sandbox.lease.release", () => options.claim.releaseLease(lease));
       } catch (error) {
         emit({
           type: "release-failed",
@@ -987,7 +988,17 @@ async function runForegroundSandboxSingleFlight(options) {
       }
     }
   };
-  const initialLease = await options.claim.acquireLease(key, ttlSeconds);
+  if (options.reuse) {
+    const [state, reused] = await Promise.allSettled([
+      timed("sandbox.lease.inspect", () => options.claim.inspect(key)),
+      options.reuse()
+    ]);
+    if (reused.status === "rejected") throw reused.reason;
+    if (reused.value !== void 0 && state.status === "fulfilled" && state.value.status !== "held") {
+      return reused.value;
+    }
+  }
+  const initialLease = await timed("sandbox.lease.acquire", () => options.claim.acquireLease(key, ttlSeconds));
   if (initialLease) return provisionAsOwner(initialLease);
   emit({ type: "waiting", key, workspaceId: options.workspaceId });
   while (true) {
@@ -1531,8 +1542,46 @@ var DEFAULT_SANDBOX_RESOURCES = {
   idleTimeoutSeconds: 3600
 };
 var _cached = null;
-var livenessVerifiedAt = /* @__PURE__ */ new Map();
-var verifiedEgress = /* @__PURE__ */ new Map();
+var TRUSTED_REUSE_TTL_MS = 10 * 6e4;
+var REUSE_CHECKS_MAX = 1e3;
+var reuseChecks = /* @__PURE__ */ new Map();
+var runningBoxIds = /* @__PURE__ */ new Map();
+var trustedBoxes = /* @__PURE__ */ new WeakSet();
+function boxStartedAt(box) {
+  const startedAt = box.startedAt instanceof Date ? box.startedAt.getTime() : Number.NaN;
+  return Number.isFinite(startedAt) ? startedAt : void 0;
+}
+function checksFor(box) {
+  const checks = reuseChecks.get(box.id);
+  if (!checks) return void 0;
+  if (checks.startedAt !== boxStartedAt(box)) {
+    reuseChecks.delete(box.id);
+    return void 0;
+  }
+  return checks;
+}
+function recordCheck(box, patch) {
+  const startedAt = boxStartedAt(box);
+  if (startedAt === void 0 || !box.id) return;
+  const current = checksFor(box) ?? { startedAt };
+  reuseChecks.delete(box.id);
+  reuseChecks.set(box.id, { ...current, ...patch });
+  while (reuseChecks.size > REUSE_CHECKS_MAX) {
+    const oldest = reuseChecks.keys().next().value;
+    if (oldest === void 0) break;
+    reuseChecks.delete(oldest);
+  }
+}
+function forgetBox(boxId) {
+  reuseChecks.delete(boxId);
+}
+function isRecent(at, ttlMs, now = Date.now()) {
+  return at !== void 0 && Number.isFinite(ttlMs) && ttlMs > 0 && now - at < ttlMs;
+}
+function dropTrustedBox(box) {
+  forgetBox(box.id);
+  return trustedBoxes.delete(box);
+}
 function getClientFromCreds(creds) {
   const fingerprint = `${creds.apiKey} ${creds.baseUrl}`;
   if (_cached && _cached.fingerprint === fingerprint) return _cached.client;
@@ -1550,8 +1599,8 @@ function getClient(shell) {
 }
 function resetClientCache() {
   _cached = null;
-  livenessVerifiedAt.clear();
-  verifiedEgress.clear();
+  reuseChecks.clear();
+  runningBoxIds.clear();
 }
 function buildAppToolMcpServers(options) {
   const entries = {};
@@ -1985,9 +2034,17 @@ async function materializeDeferredFilesForExistingBox(shell, client, box, stage,
   const corpusHash = deferredCorpusHash(deferredFiles);
   const stampedHash = box.metadata?.[DEFERRED_CORPUS_HASH_KEY];
   if (typeof stampedHash === "string" && stampedHash === corpusHash) return ok(box);
-  if (corpusMarker && await corpusMarker === corpusHash) return ok(box);
+  const found = checksFor(box)?.corpus;
+  if (isRecent(found?.at, TRUSTED_REUSE_TTL_MS) && found?.hash === corpusHash) return ok(box);
+  if (await (corpusMarker ?? readDeferredCorpusMarker(box)) === corpusHash) {
+    recordCheck(box, { corpus: { hash: corpusHash, at: Date.now() } });
+    return ok(box);
+  }
   const written = await writeDeferredFilesWithRuntimeAuthRefresh(client, box, deferredFiles, stage, name);
-  if (written.succeeded) await writeDeferredCorpusMarker(written.value, corpusHash);
+  if (written.succeeded) {
+    await writeDeferredCorpusMarker(written.value, corpusHash);
+    recordCheck(written.value, { corpus: { hash: corpusHash, at: Date.now() } });
+  }
   return written;
 }
 var DEFERRED_CORPUS_MARKER_PATH = ".agent-app/deferred-corpus-hash";
@@ -2016,6 +2073,26 @@ async function listRunning(client, name) {
     return fail(err);
   }
 }
+function rememberRunningBox(name, box) {
+  runningBoxIds.delete(name);
+  runningBoxIds.set(name, box.id);
+  while (runningBoxIds.size > REUSE_CHECKS_MAX) {
+    const oldest = runningBoxIds.keys().next().value;
+    if (oldest === void 0) break;
+    runningBoxIds.delete(oldest);
+  }
+  return box;
+}
+async function getRunningBox(client, id, name) {
+  try {
+    const box = await client.get(id);
+    if (!box || box.name !== name || box.status !== "running") return null;
+    if (typeof box.metadata?.harness !== "string") return null;
+    return box;
+  } catch {
+    return null;
+  }
+}
 async function listStopped(client, name) {
   try {
     const stopped = await client.list({ status: "stopped" });
@@ -2027,7 +2104,7 @@ async function listStopped(client, name) {
 async function deleteBox(box) {
   try {
     const acknowledgement = await box.delete({ until: "removed" });
-    livenessVerifiedAt.delete(box.id);
+    forgetBox(box.id);
     if (acknowledgement.removal === "pending") {
       return fail(new Error(`sandbox ${box.id} removal is still pending; retry replacement after removal completes`));
     }
@@ -2086,14 +2163,8 @@ async function isBoxAlive(box, probe) {
     return fail(new Error("alive check failed", { cause }));
   }
 }
-var DEFAULT_LIVENESS_CACHE_TTL_MS = 5e3;
 function hasRecentLivenessVerification(box, probe, now = Date.now()) {
-  const ttlMs = probe.cacheTtlMs ?? DEFAULT_LIVENESS_CACHE_TTL_MS;
-  if (!Number.isFinite(ttlMs) || ttlMs <= 0) return false;
-  const verifiedAt = livenessVerifiedAt.get(box.id);
-  if (verifiedAt !== void 0 && now - verifiedAt < ttlMs) return true;
-  livenessVerifiedAt.delete(box.id);
-  return false;
+  return isRecent(checksFor(box)?.alive, probe.cacheTtlMs ?? TRUSTED_REUSE_TTL_MS, now);
 }
 var RUNTIME_CONNECTION_WAIT_MS = 3e4;
 var RUNTIME_CONNECTION_POLL_MS = 1e3;
@@ -2218,14 +2289,17 @@ async function writeDeferredFilesWithRuntimeAuthRefresh(client, box, files, stag
 }
 async function isReusableBox(box, probe) {
   if (sandboxEdgeFailed(box) || !sandboxRuntimeUrl(box)) {
-    livenessVerifiedAt.delete(box.id);
+    forgetBox(box.id);
     return fail(new Error(sandboxEdgeFailed(box) ? "runtime edge readiness failed" : "runtime URL is missing"));
   }
   if (!probe) return ok(void 0);
-  if (hasRecentLivenessVerification(box, probe)) return ok(void 0);
+  if (hasRecentLivenessVerification(box, probe)) {
+    trustedBoxes.add(box);
+    return ok(void 0);
+  }
   const alive = await isBoxAlive(box, probe);
-  if (alive.succeeded) livenessVerifiedAt.set(box.id, Date.now());
-  else livenessVerifiedAt.delete(box.id);
+  if (alive.succeeded) recordCheck(box, { alive: Date.now() });
+  else forgetBox(box.id);
   return alive;
 }
 function stoppedBoxResumeError(box, cause) {
@@ -2253,7 +2327,7 @@ async function resumeStoppedBox(box, timeoutMs, runtimeEnv, onProgress) {
     }
   };
   try {
-    livenessVerifiedAt.delete(box.id);
+    forgetBox(box.id);
     report("started", "Resuming the stopped sandbox");
     await resumeWithRequiredRuntimeEnv(box, timeoutMs, runtimeEnv);
     await box.waitFor("running", { timeoutMs, ...onProgress ? { onProgress } : {} });
@@ -2368,57 +2442,59 @@ async function resolveWorkspaceRuntimeEnv(shell, scope) {
   assertEnvWithinLimits(env);
   return env;
 }
-function prefetchExistingBoxReads(shell, box, runtimeEnv, measure) {
-  const prefetch = {};
-  if (shell.egressPolicy && hasVerifiedEgress(box, shell.egressPolicy)) {
-    prefetch.egressVerified = true;
-  } else if (shell.egressPolicy) {
-    prefetch.egress = measure("egress", async () => {
-      try {
-        return ok(await box.egress.get());
-      } catch (cause) {
-        return fail(cause);
-      }
-    });
-  }
-  if (shell.deferProfileFiles) prefetch.corpusMarker = readDeferredCorpusMarker(box);
-  if (!egressGatesCredentials(shell.egressPolicy)) {
-    prefetch.runtimeEnv = runtimeEnv.then(
-      (env) => Object.keys(env).length === 0 ? ok(void 0) : measure("runtime_env_push", () => box.setRuntimeEnv(env)).then(() => ok(void 0), (cause) => fail(cause)),
-      () => ok(void 0)
-    );
+function runtimeEnvDigest(env) {
+  return createHash("sha256").update(JSON.stringify(canonicalizeJson(env)), "utf8").digest("hex");
+}
+function hasDeliveredEnv(box, env) {
+  const delivered = checksFor(box)?.env;
+  return isRecent(delivered?.at, TRUSTED_REUSE_TTL_MS) && delivered?.digest === runtimeEnvDigest(env);
+}
+function hasRecentEgress(box, desired) {
+  const verified = checksFor(box)?.egress;
+  return isRecent(verified?.at, TRUSTED_REUSE_TTL_MS) && verified?.key === normalizedEgressPolicy(desired);
+}
+async function pushRuntimeEnv(box, env, measure) {
+  try {
+    await (measure ? measure("runtime_env_push", () => box.setRuntimeEnv(env)) : box.setRuntimeEnv(env));
+    recordCheck(box, { env: { digest: runtimeEnvDigest(env), at: Date.now() } });
+    return ok(void 0);
+  } catch (cause) {
+    return fail(cause);
   }
+}
+function prefetchExistingBoxReads(shell, box, runtimeEnv, measure) {
+  const desired = shell.egressPolicy;
+  const readEgress = () => measure("egress", async () => {
+    try {
+      return ok(await box.egress.get());
+    } catch (cause) {
+      return fail(cause);
+    }
+  });
+  const egressRecent = desired !== void 0 && hasRecentEgress(box, desired);
+  const prefetch = { decided: Promise.resolve() };
+  if (desired && !egressRecent) prefetch.egress = readEgress();
+  if (shell.deferProfileFiles && !isRecent(checksFor(box)?.corpus?.at, TRUSTED_REUSE_TTL_MS)) {
+    prefetch.corpusMarker = readDeferredCorpusMarker(box);
+  }
+  prefetch.decided = runtimeEnv.then((env) => {
+    const delivered = Object.keys(env).length === 0 || hasDeliveredEnv(box, env);
+    prefetch.envDelivered = delivered;
+    if (desired && egressRecent) {
+      if (desired.mode === "open" || delivered && !shell.bootstrap) prefetch.egressVerified = true;
+      else prefetch.egress = readEgress();
+    }
+    if (!delivered && !egressGatesCredentials(desired)) {
+      prefetch.runtimeEnv = pushRuntimeEnv(box, env, measure);
+    }
+  }, () => void 0);
   return prefetch;
 }
 function egressGatesCredentials(desired) {
   return desired !== void 0 && desired.mode !== "open";
 }
-var VERIFIED_EGRESS_TTL_MS = 10 * 6e4;
-var VERIFIED_EGRESS_MAX = 1e3;
-function verifiedEgressKey(box, desired) {
-  if (desired.mode !== "open" || !box.id) return null;
-  const startedAt = box.startedAt instanceof Date ? box.startedAt.getTime() : Number.NaN;
-  if (!Number.isFinite(startedAt)) return null;
-  return `${box.id}|${startedAt}|${normalizedEgressPolicy(desired)}`;
-}
-function hasVerifiedEgress(box, desired, now = Date.now()) {
-  const key = verifiedEgressKey(box, desired);
-  if (!key) return false;
-  const verifiedAt = verifiedEgress.get(key);
-  if (verifiedAt !== void 0 && now - verifiedAt < VERIFIED_EGRESS_TTL_MS) return true;
-  verifiedEgress.delete(key);
-  return false;
-}
 function recordVerifiedEgress(box, desired) {
-  const key = verifiedEgressKey(box, desired);
-  if (!key) return;
-  verifiedEgress.delete(key);
-  verifiedEgress.set(key, Date.now());
-  while (verifiedEgress.size > VERIFIED_EGRESS_MAX) {
-    const oldest = verifiedEgress.keys().next().value;
-    if (oldest === void 0) break;
-    verifiedEgress.delete(oldest);
-  }
+  recordCheck(box, { egress: { key: normalizedEgressPolicy(desired), at: Date.now() } });
 }
 async function finalizeExistingBox(shell, client, box, stage, name, workspaceId, userId, harness, scope, runtimeEnv, prefetch = {}) {
   if (!prefetch.egressVerified) {
@@ -2442,8 +2518,9 @@ async function finalizeExistingBox(shell, client, box, stage, name, workspaceId,
   if (prefetch.runtimeEnv) {
     const renewed = await prefetch.runtimeEnv;
     if (!renewed.succeeded) throw renewed.error;
-  } else if (Object.keys(runtimeEnv).length > 0) {
-    await finalBox.setRuntimeEnv(runtimeEnv);
+  } else if (!prefetch.envDelivered && Object.keys(runtimeEnv).length > 0) {
+    const renewed = await pushRuntimeEnv(finalBox, runtimeEnv);
+    if (!renewed.succeeded) throw renewed.error;
   }
   if (shell.bootstrap) {
     const boot = await shell.bootstrap(finalBox, scope);
@@ -2531,11 +2608,37 @@ async function assertExistingBoxEgress(box, desired, migrate, stage, name, prefe
   );
 }
 async function ensureWorkspaceSandbox(shell, options) {
-  await options.spend?.beforeProvision?.({
-    workspaceId: options.workspaceId,
-    ...options.userId ? { userId: options.userId } : {}
-  });
+  const box = await claimWorkspaceSandbox(shell, options, false);
+  if (!box) throw new Error("ensureWorkspaceSandbox: a claim that may provision returned no box");
+  return box;
+}
+async function reuseWorkspaceSandbox(shell, options) {
+  if (options.forceNew || !hasRecentProbe(shell, options)) return void 0;
+  return claimWorkspaceSandbox(shell, options, true);
+}
+function hasRecentProbe(shell, options) {
+  const probe = shell.livenessProbe;
+  if (!probe || options.forceNew) return false;
+  const scope = { workspaceId: options.workspaceId, ...options.userId ? { userId: options.userId } : {} };
+  const id = runningBoxIds.get(shell.boxKey ? shell.boxKey(scope) : shell.name(options.workspaceId));
+  return isRecent(id === void 0 ? void 0 : reuseChecks.get(id)?.alive, probe.cacheTtlMs ?? TRUSTED_REUSE_TTL_MS);
+}
+function spendGate(options) {
+  let gated;
+  return () => {
+    const before = options.spend?.beforeProvision;
+    if (!before) return Promise.resolve();
+    const run = () => before({
+      workspaceId: options.workspaceId,
+      ...options.userId ? { userId: options.userId } : {}
+    });
+    return gated ??= Promise.resolve(options.trace ? options.trace.measure("sandbox.spend.before_provision", "sandbox", run, void 0, options.traceParent) : run());
+  };
+}
+async function claimWorkspaceSandbox(shell, options, reuseOnly) {
   const { trace } = options;
+  const gate = spendGate(options);
+  if (!hasRecentProbe(shell, options)) await gate();
   const claim = trace?.start("sandbox.claim", "sandbox", { "workspace.harness": options.harness }, options.traceParent);
   const traced = trace && claim ? {
     ...options,
@@ -2545,9 +2648,13 @@ async function ensureWorkspaceSandbox(shell, options) {
     }
   } : options;
   try {
-    const box = await bringUpWorkspaceSandbox(shell, traced);
-    claim?.end({ "sandbox.id": box.id });
-    await observeProvisionedBox(shell, options, box);
+    const box = await bringUpWorkspaceSandbox(shell, traced, gate, reuseOnly);
+    if (!box) {
+      claim?.end({ "sandbox.reuse_declined": true });
+      return void 0;
+    }
+    claim?.end({ "sandbox.id": box.id, ...trustedBoxes.has(box) ? { "sandbox.probe_trusted": true } : {} });
+    if (!trustedBoxes.has(box)) await observeProvisionedBox(shell, options, box);
     return box;
   } catch (error) {
     claim?.end(void 0, error);
@@ -2555,10 +2662,11 @@ async function ensureWorkspaceSandbox(shell, options) {
   }
 }
 async function observeProvisionedBox(shell, options, box) {
-  if (!options.spend?.onProvisioned) return;
+  const onProvisioned = options.spend?.onProvisioned;
+  if (!onProvisioned) return;
   const resources = shell.resources ?? DEFAULT_SANDBOX_RESOURCES;
-  try {
-    await options.spend.onProvisioned({
+  const observe = async () => {
+    await onProvisioned({
       workspaceId: options.workspaceId,
       ...options.userId ? { userId: options.userId } : {},
       sandboxId: box.id,
@@ -2567,17 +2675,20 @@ async function observeProvisionedBox(shell, options, box) {
       maxLifetimeSeconds: resources.maxLifetimeSeconds,
       at: Date.now()
     });
+  };
+  try {
+    await (options.trace ? options.trace.measure("sandbox.spend.observe", "sandbox", observe, void 0, options.traceParent) : observe());
   } catch {
   }
 }
-async function bringUpWorkspaceSandbox(shell, options) {
+async function bringUpWorkspaceSandbox(shell, options, gate, reuseOnly) {
   try {
-    return await provisionWorkspaceSandbox(shell, options);
+    return await provisionWorkspaceSandbox(shell, options, gate, reuseOnly);
   } catch (err) {
     if (!shell.replaceUnbringableBox) throw err;
     if (options.forceNew) throw err;
     if (!isUnbringableBoxError(err)) throw err;
-    return await provisionWorkspaceSandbox(shell, { ...options, forceNew: true });
+    return await provisionWorkspaceSandbox(shell, { ...options, forceNew: true }, gate, reuseOnly);
   }
 }
 function isUnbringableBoxError(error) {
@@ -2611,7 +2722,7 @@ async function requestMissingSandboxReplacement(shell, failure) {
     "missing sandbox recovery"
   );
 }
-async function provisionWorkspaceSandbox(shell, options) {
+async function provisionWorkspaceSandbox(shell, options, gate, reuseOnly) {
   const execTimeoutMs = shell.livenessProbe?.execTimeoutMs;
   if (execTimeoutMs !== void 0 && (!Number.isInteger(execTimeoutMs) || execTimeoutMs < 100 || execTimeoutMs > 6e5)) {
     throw new Error("livenessProbe.execTimeoutMs must be an integer between 100 and 600000");
@@ -2625,7 +2736,17 @@ async function provisionWorkspaceSandbox(shell, options) {
   let replacementRequested = false;
   const resources = shell.resources ?? DEFAULT_SANDBOX_RESOURCES;
   const resumeTimeout = shell.provisionTimeoutMs ?? DEFAULT_PROVISION_TIMEOUT_MS;
-  let existing = await measure("list_running", () => listRunning(client, name));
+  let existing = ok(null);
+  const knownId = forceNew ? void 0 : runningBoxIds.get(name);
+  if (knownId) {
+    const known = await measure("get_running", () => getRunningBox(client, knownId, name));
+    if (known) existing = ok(known);
+    else runningBoxIds.delete(name);
+  }
+  if (reuseOnly && !(existing.succeeded && existing.value)) return void 0;
+  if (!(existing.succeeded && existing.value)) {
+    existing = await measure("list_running", () => listRunning(client, name));
+  }
   if (forceNew && existing.succeeded && !existing.value) {
     existing = await listStopped(client, name);
   }
@@ -2645,13 +2766,29 @@ async function provisionWorkspaceSandbox(shell, options) {
         measure("refresh", () => refreshRuntimeConnection(client, found))
       ]);
       if (envResult.status === "rejected") throw envResult.reason;
+      await prefetch.decided;
       const runtimeEnv2 = envResult.value;
+      const refusal = { refused: false };
+      const gateBeforeUse = async () => {
+        try {
+          await gate();
+        } catch (error) {
+          refusal.refused = true;
+          refusal.error = error;
+          throw error;
+        }
+      };
       try {
         if (readyResult.status === "rejected") throw readyResult.reason;
         const ready = readyResult.value;
         if ((await measure("liveness", () => isReusableBox(ready, shell.livenessProbe))).succeeded) {
-          return await measure("finalize", () => finalizeExistingBox(shell, client, ready, "reused", name, workspaceId, userId, harness, scope, runtimeEnv2, prefetch));
+          if (!trustedBoxes.has(ready)) await gateBeforeUse();
+          const finalBox = await measure("finalize", () => finalizeExistingBox(shell, client, ready, "reused", name, workspaceId, userId, harness, scope, runtimeEnv2, prefetch));
+          if (trustedBoxes.has(ready)) trustedBoxes.add(finalBox);
+          return rememberRunningBox(name, finalBox);
         }
+        if (reuseOnly) return void 0;
+        await gateBeforeUse();
         const recovered = await recoverUnresponsiveBox(
           client,
           ready,
@@ -2662,8 +2799,10 @@ async function provisionWorkspaceSandbox(shell, options) {
           runtimeEnv2,
           onProgress
         );
-        return await finalizeExistingBox(shell, client, recovered, "reused", name, workspaceId, userId, harness, scope, runtimeEnv2);
+        return rememberRunningBox(name, await finalizeExistingBox(shell, client, recovered, "reused", name, workspaceId, userId, harness, scope, runtimeEnv2));
       } catch (cause) {
+        if (refusal.refused) throw refusal.error;
+        if (reuseOnly) return void 0;
         const error = cause instanceof Error ? cause : new Error(String(cause));
         const recovery = await requestMissingSandboxReplacement(shell, {
           box: found,
@@ -2677,6 +2816,8 @@ async function provisionWorkspaceSandbox(shell, options) {
         replacementRequested = true;
       }
     } else {
+      if (reuseOnly) return void 0;
+      await gate();
       const dropped = await deleteBox(found);
       if (!dropped.succeeded) {
         throw new Error(
@@ -2686,6 +2827,8 @@ async function provisionWorkspaceSandbox(shell, options) {
       }
     }
   }
+  if (reuseOnly) return void 0;
+  await gate();
   if (!replacementRequested && !forceNew && shell.resumeStopped !== false) {
     const stopped = await measure("list_stopped", () => listStopped(client, name));
     if (!stopped.succeeded) throw stopped.error;
@@ -2705,7 +2848,7 @@ async function provisionWorkspaceSandbox(shell, options) {
         try {
           const box2 = await refreshRuntimeConnection(client, resumed.value);
           if ((await isReusableBox(box2, shell.livenessProbe)).succeeded) {
-            return await finalizeExistingBox(shell, client, box2, "resumed", name, workspaceId, userId, harness, scope, runtimeEnv2);
+            return rememberRunningBox(name, await finalizeExistingBox(shell, client, box2, "resumed", name, workspaceId, userId, harness, scope, runtimeEnv2));
           }
           const recovered = await recoverUnresponsiveBox(
             client,
@@ -2717,7 +2860,7 @@ async function provisionWorkspaceSandbox(shell, options) {
             runtimeEnv2,
             onProgress
           );
-          return await finalizeExistingBox(shell, client, recovered, "resumed", name, workspaceId, userId, harness, scope, runtimeEnv2);
+          return rememberRunningBox(name, await finalizeExistingBox(shell, client, recovered, "resumed", name, workspaceId, userId, harness, scope, runtimeEnv2));
         } catch (cause) {
           const error = cause instanceof Error ? cause : new Error(String(cause));
           const recovery = await requestMissingSandboxReplacement(shell, {
@@ -2821,7 +2964,7 @@ async function provisionWorkspaceSandbox(shell, options) {
       throw new Error(`bootstrap failed on new box ${name}`, { cause: boot.error });
     }
   }
-  return box;
+  return rememberRunningBox(name, box);
 }
 function historyTranscript(history) {
   return history.map((entry) => `${entry.role === "assistant" ? "Assistant" : "User"}: ${entry.content}`).join("\n\n");
@@ -3217,8 +3360,10 @@ async function* streamSandboxPrompt(shell, box, message, options) {
       ...options.detach ? { "sandbox.detached": true } : {}
     }
   }) : stream;
+  let delivered = false;
   try {
     for await (const event of observed) {
+      delivered = true;
       const step = classifySeveredStream(event);
       if (step) severedFinishReason = step.kind === "step-finish" && step.severed ? step.reason : null;
       if (severedFinishReason && isTerminalPromptEvent(event)) {
@@ -3232,6 +3377,9 @@ async function* streamSandboxPrompt(shell, box, message, options) {
       }
       yield event;
     }
+  } catch (error) {
+    if (!delivered && !options?.signal?.aborted) dropTrustedBox(box);
+    throw error;
   } finally {
     emitSandboxActivity(options?.spend, box);
   }
@@ -3477,6 +3625,7 @@ export {
   PYPI_EGRESS_DOMAINS,
   buildProductEgressPolicy,
   DEFAULT_SANDBOX_RESOURCES,
+  dropTrustedBox,
   getClient,
   resetClientCache,
   buildAppToolMcpServers,
@@ -3504,6 +3653,7 @@ export {
   assertEnvWithinLimits,
   peekWorkspaceSandbox,
   ensureWorkspaceSandbox,
+  reuseWorkspaceSandbox,
   flattenHistory,
   mergeHistoryIntoParts,
   mergeExtraMcp,
@@ -3527,4 +3677,4 @@ export {
   isTerminalPromptEvent,
   detectInteractiveQuestion
 };
-//# sourceMappingURL=chunk-N7FGEWZU.js.map
+//# sourceMappingURL=chunk-QA2CBATZ.js.map