@yeaft/webchat-agent 1.0.372 → 1.0.374

package/cli.js

@@ -65,6 +65,14 @@ if (command === 'doctor') {
   await handleLlmCommand(subArgs);
 } else if (command === 'local') {
   await handleLocalCommand(subArgs);
+} else if (command === 'managed-sandbox') {
+  try {
+    const { runManagedSandboxAgent } = await import('./managed-sandbox/agent-runtime.js');
+    await runManagedSandboxAgent(subArgs);
+  } catch (error) {
+    console.error(`Managed Sandbox Agent failed: ${error.message}`);
+    process.exit(1);
+  }
 } else if (command === 'upgrade') {
   await upgrade(subArgs);
 } else if (command === '--version' || command === '-v') {

package/connection/index.js

@@ -67,7 +67,17 @@ export function connect(WebSocketImpl = WebSocket) {
         console.log('Received auth challenge, sending credentials...');
         ctx.pendingAuthTempId = msg.tempId;
         // Send authentication via WebSocket (not URL)
-        socket.send(JSON.stringify({
+        const managed = ctx.CONFIG.managedSandboxIdentity;
+        socket.send(JSON.stringify(managed ? {
+          type: 'auth',
+          tempId: msg.tempId,
+          authKind: 'sandbox',
+          credentialId: managed.credentialId,
+          secret: managed.secret,
+          sandboxClaims: managed.claims,
+          capabilities: ctx.agentCapabilities,
+          version: ctx.agentVersion
+        } : {
           type: 'auth',
           tempId: msg.tempId,
           secret: ctx.CONFIG.agentSecret,

package/index.js

@@ -21,6 +21,7 @@ import {
 import { loadNodePty } from './terminal.js';
 import { connect } from './connection.js';
 import { loadMcpServers } from './mcp.js';
+import { getManagedSandboxIdentity } from './managed-sandbox/identity-store.js';
 import { loadConfig as loadYeaftConfig } from './yeaft/config.js';
 import {
   ensureManagedCliTools,
@@ -48,6 +49,7 @@ ctx.pkgName = pkg.name;
 // service instances must stay scoped to their standard per-instance config.
 const LOCAL_CONFIG_FILE = join(process.cwd(), '.claude-agent.json');
 const IS_LOCAL_RUN = process.env.YEAFT_LOCAL_RUN === 'true';
+const MANAGED_SANDBOX_IDENTITY = getManagedSandboxIdentity();
 const DEFAULT_AGENT_NAME = getDefaultAgentName();
 
 // 加载或创建配置
@@ -119,6 +121,7 @@ const CONFIG = {
   telemetry: loadYeaftConfig({ dir: YEAFT_DIR }).telemetry,
   reconnectInterval: fileConfig.reconnectInterval,
   agentSecret: process.env.AGENT_SECRET || fileConfig.agentSecret,
+  managedSandboxIdentity: MANAGED_SANDBOX_IDENTITY,
   // 显式禁用的工具（非 MCP 相关）
   explicitDisallowedTools: (() => {
     const raw = process.env.DISALLOWED_TOOLS || fileConfig.disallowedTools || '';
@@ -155,6 +158,7 @@ async function detectCapabilities() {
   // flip `agent.encryptOutbound = false`, stopping outbound encryption
   // to this peer. Old servers ignore the unknown capability token.
   const capabilities = ['background_tasks', 'file_editor', 'ping_session', 'plaintext-ok', 'work_center', 'work_center_message_v2', 'session_history_search', 'session_history_outline', 'session_history_window_prefetch'];
+  if (MANAGED_SANDBOX_IDENTITY) capabilities.push('managed-sandbox');
   if (process.platform === 'linux') capabilities.push('work_item_attachments');
   const pty = await loadNodePty();
   if (pty) capabilities.push('terminal');

package/local-runtime/server/api.js

@@ -11,6 +11,7 @@ import { registerSessionRoutes } from './routes/session-routes.js';
 import { registerUploadRoutes } from './routes/upload-routes.js';
 import { registerAdminRoutes } from './routes/admin-routes.js';
 import { registerExpertRoutes } from './routes/expert-routes.js';
+import { registerSandboxRoutes } from './routes/sandbox-routes.js';
 
 // 登录速率限制: IP -> { attempts, resetAt }
 const loginAttempts = new Map();
@@ -111,4 +112,5 @@ export function registerApiRoutes(app) {
   registerUploadRoutes(app, shared);
   registerAdminRoutes(app, shared);
   registerExpertRoutes(app, shared);
+  registerSandboxRoutes(app, shared);
 }

package/local-runtime/server/auth/login.js

@@ -13,6 +13,7 @@ import { generateVerificationCode, maskEmail } from './utils.js';
  */
 export function completeLogin(username, sessionKey, role) {
   const user = getUserByUsername(username);
+  if (!user) return { success: false, error: 'Invalid or disabled account' };
   const token = issueSessionToken(username);
   activeSessions.set(token, { username, sessionKey });
   return {

package/local-runtime/server/auth/oauth-flow.js

@@ -214,8 +214,8 @@ export async function handleCallback({ provider, code, state }) {
   // intent='login' (or anything else — default to login).
   if (existing) {
     const user = userDb.get(existing.user_id);
-    if (!user) {
-      return { kind: 'error', status: 500, error: 'Bound user no longer exists' };
+    if (!user || user.deletion_state !== 'active') {
+      return { kind: 'error', status: 403, error: 'Account is disabled' };
     }
     // Backfill display_name on subsequent logins if it was never set away
     // from the auto-generated username (e.g. early logins before this code

package/local-runtime/server/auth/token.js

@@ -32,6 +32,10 @@ export function verifyToken(token) {
     }
 
     const user = getUserByUsername(decoded.username);
+    if (!user) {
+      activeSessions.delete(token);
+      return { valid: false };
+    }
 
     return {
       valid: true,

package/local-runtime/server/config.js

@@ -3,6 +3,7 @@ import { readFileSync, existsSync, writeFileSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
 import { userDb } from './database.js';
+import { validateSandboxDeploymentConfig } from './sandbox-config.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -114,6 +115,44 @@ export const CONFIG = {
   // Agent authentication (global fallback — per-user agent_secret is preferred)
   agentSecret: process.env.AGENT_SECRET || DEFAULT_AGENT_SECRET,
 
+  // Managed Sandbox is fail-closed. Enabling the product flag is not enough:
+  // entitlement and a qualified dedicated Host with capacity are also required.
+  sandbox: {
+    enabled: process.env.SANDBOX_ENABLED === 'true',
+    maxReservedSandboxes: parseInt(process.env.SANDBOX_MAX_RESERVED, 10) || 2,
+    hostMemoryReserveMiB: parseInt(process.env.SANDBOX_HOST_MEMORY_RESERVE_MIB, 10) || 2048,
+    hostFreshnessMs: parseInt(process.env.SANDBOX_HOST_FRESHNESS_MS, 10) || 30_000,
+    agentRecoveryGraceMs: parseInt(process.env.SANDBOX_AGENT_RECOVERY_GRACE_MS, 10) || 60_000,
+    operationTimeoutMs: parseInt(process.env.SANDBOX_OPERATION_TIMEOUT_MS, 10) || 10 * 60_000,
+    reconcileIntervalMs: parseInt(process.env.SANDBOX_RECONCILE_INTERVAL_MS, 10) || 5_000,
+    controllerRequestTimeoutMs: parseInt(process.env.SANDBOX_CONTROLLER_TIMEOUT_MS, 10) || 10_000,
+    bootstrapTtlMs: parseInt(process.env.SANDBOX_BOOTSTRAP_TTL_MS, 10) || 5 * 60_000,
+    bootstrapSigningKey: process.env.SANDBOX_BOOTSTRAP_SIGNING_KEY || '',
+    hostAttestationKey: process.env.SANDBOX_HOST_ATTESTATION_KEY || '',
+    controllerAttestationFingerprint: process.env.SANDBOX_CONTROLLER_ATTESTATION_FINGERPRINT || '',
+    hostAttestationListenerHost: process.env.SANDBOX_HOST_ATTESTATION_LISTENER_HOST || '',
+    hostAttestationListenerPort: parseInt(process.env.SANDBOX_HOST_ATTESTATION_LISTENER_PORT, 10) || 0,
+    hostAttestationServerCert: process.env.SANDBOX_HOST_ATTESTATION_SERVER_CERT || '',
+    hostAttestationServerKey: process.env.SANDBOX_HOST_ATTESTATION_SERVER_KEY || '',
+    hostAttestationClientCa: process.env.SANDBOX_HOST_ATTESTATION_CLIENT_CA || '',
+    hostAttestationBodyLimitBytes:
+      parseInt(process.env.SANDBOX_HOST_ATTESTATION_BODY_LIMIT_BYTES, 10) || 64 * 1024,
+    hostAttestationShutdownTimeoutMs:
+      parseInt(process.env.SANDBOX_HOST_ATTESTATION_SHUTDOWN_TIMEOUT_MS, 10) || 1_000,
+    helperAttestationPublicKey: process.env.SANDBOX_HELPER_ATTESTATION_PUBLIC_KEY || '',
+    hostAttestationMaxSkewMs: parseInt(process.env.SANDBOX_HOST_ATTESTATION_MAX_SKEW_MS, 10) || 30_000,
+    imageDigest: process.env.SANDBOX_IMAGE_DIGEST || '',
+    controllerUrl: process.env.SANDBOX_CONTROLLER_URL || '',
+    controllerToken: process.env.SANDBOX_CONTROLLER_TOKEN || '',
+    controllerClientCert: process.env.SANDBOX_CONTROLLER_CLIENT_CERT || '',
+    controllerClientKey: process.env.SANDBOX_CONTROLLER_CLIENT_KEY || '',
+    controllerCaCert: process.env.SANDBOX_CONTROLLER_CA_CERT || '',
+    operationSigningPrivateKey: process.env.SANDBOX_OPERATION_SIGNING_PRIVATE_KEY || '',
+    controllerResultPublicKey: process.env.SANDBOX_CONTROLLER_RESULT_PUBLIC_KEY || '',
+    controllerProtocolMaxSkewMs: parseInt(process.env.SANDBOX_CONTROLLER_PROTOCOL_MAX_SKEW_MS, 10) || 30_000,
+    controllerHostId: process.env.SANDBOX_CONTROLLER_HOST_ID || ''
+  },
+
   // File upload settings
   maxFileSize: parseInt(process.env.MAX_FILE_SIZE, 10) || 50 * 1024 * 1024, // 50MB
   fileCleanupInterval: parseInt(process.env.FILE_CLEANUP_INTERVAL, 10) || 600000, // 10 minutes
@@ -192,6 +231,7 @@ export function getUserByUsername(username) {
   // Query database first (includes migrated, registered, and SSO-only users).
   const dbUser = userDb.getByUsername(username);
   if (dbUser) {
+    if (dbUser.deletion_state && dbUser.deletion_state !== 'active') return null;
     return {
       username: dbUser.username,
       passwordHash: dbUser.password_hash || null,
@@ -202,7 +242,9 @@ export function getUserByUsername(username) {
       id: dbUser.id
     };
   }
-  // Fallback to CONFIG.users (only relevant before first migration)
+  // A finalized deletion remains authoritative after the users row is erased.
+  if (userDb.isDeletionTombstoned(username)) return null;
+  // Fallback to CONFIG.users only when no authoritative database state exists.
   return CONFIG.users.find(u => u.username === username) || null;
 }
 
@@ -257,6 +299,10 @@ export function validateProductionConfig() {
     errors.push('JWT_SECRET must be set to a secure value in production mode');
   }
 
+  if (CONFIG.sandbox.enabled && !validateSandboxDeploymentConfig(CONFIG.sandbox)) {
+    errors.push('Sandbox requires an HTTPS dedicated Controller, Host binding, fixed image digest, a dedicated mTLS Host attestation listener with a pinned Controller certificate, Controller token, asymmetric operation/result keys, bootstrap signing key, Host attestation key, and Helper attestation public key');
+  }
+
   // Check that at least one user with a password exists (in DB or config)
   // Only warn (don't block startup) — allows first-time setup via create-user.js
   const dbUsers = userDb.getAll();

package/local-runtime/server/database.js

@@ -10,5 +10,6 @@ export { messageDb } from './db/message-db.js';
 export { userStatsDb } from './db/user-stats-db.js';
 export { expertDb } from './db/expert-db.js';
 export { identityDb } from './db/identity-db.js';
+export { sandboxDb } from './db/sandbox-db.js';
 export { closeDb } from './db/connection.js';
 export { default } from './db/connection.js';

package/local-runtime/server/db/connection.js

@@ -32,7 +32,18 @@ db.exec(`
     username TEXT UNIQUE NOT NULL,
     display_name TEXT,
     created_at INTEGER NOT NULL,
-    last_login_at INTEGER
+    last_login_at INTEGER,
+    deletion_state TEXT NOT NULL DEFAULT 'active',
+    deletion_requested_at INTEGER,
+    deletion_id TEXT UNIQUE
+  );
+
+  -- Finalized deletion survives removal of the users row. This prevents a
+  -- configured credential from becoming authoritative again on restart.
+  CREATE TABLE IF NOT EXISTS user_deletion_tombstones (
+    username TEXT PRIMARY KEY,
+    deletion_id TEXT,
+    deleted_at INTEGER NOT NULL
   );
 
   -- 会话表
@@ -141,6 +152,158 @@ db.exec(`
   -- concurrent reads continue during the build; writers will block briefly.
   CREATE INDEX IF NOT EXISTS idx_messages_session_role_id ON messages(session_id, role, id DESC);
   CREATE INDEX IF NOT EXISTS idx_daily_stats_date ON daily_stats(date);
+
+  -- Managed Sandbox control-plane state. Runtime resources are deliberately
+  -- not created on this mixed-use Server Host; qualified Controllers report
+  -- Host capacity separately.
+  CREATE TABLE IF NOT EXISTS sandbox_hosts (
+    id TEXT PRIMARY KEY,
+    epoch INTEGER NOT NULL,
+    qualified INTEGER NOT NULL DEFAULT 0,
+    controller_healthy INTEGER NOT NULL DEFAULT 0,
+    helper_healthy INTEGER NOT NULL DEFAULT 0,
+    runtime_healthy INTEGER NOT NULL DEFAULT 0,
+    quota_healthy INTEGER NOT NULL DEFAULT 0,
+    network_healthy INTEGER NOT NULL DEFAULT 0,
+    image_digest TEXT NOT NULL,
+    cpu_millis_total INTEGER NOT NULL,
+    memory_mib_total INTEGER NOT NULL,
+    memory_mib_available INTEGER NOT NULL,
+    disk_gib_total INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS sandbox_host_attestations (
+    nonce TEXT PRIMARY KEY,
+    host_id TEXT NOT NULL REFERENCES sandbox_hosts(id) ON DELETE CASCADE,
+    epoch INTEGER NOT NULL,
+    observed_at INTEGER NOT NULL,
+    created_at INTEGER NOT NULL
+  );
+
+  -- Controller boot identity is only a change detector. The Server owns this
+  -- durable monotonic fence and its exact activation identity.
+  CREATE TABLE IF NOT EXISTS sandbox_host_epochs (
+    host_id TEXT PRIMARY KEY REFERENCES sandbox_hosts(id) ON DELETE CASCADE,
+    source_epoch TEXT NOT NULL,
+    epoch INTEGER NOT NULL CHECK(epoch >= 1),
+    activation_digest TEXT,
+    activated_at INTEGER,
+    updated_at INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_sandbox_host_attestations_host
+    ON sandbox_host_attestations(host_id, created_at DESC);
+
+  CREATE TABLE IF NOT EXISTS sandbox_host_audit_events (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    host_id TEXT NOT NULL,
+    epoch INTEGER NOT NULL,
+    event_type TEXT NOT NULL,
+    outcome TEXT NOT NULL,
+    error_code TEXT,
+    created_at INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_sandbox_host_audit_created
+    ON sandbox_host_audit_events(host_id, created_at DESC, id DESC);
+
+  CREATE TABLE IF NOT EXISTS sandbox_entitlements (
+    user_id TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+    enabled INTEGER NOT NULL DEFAULT 0,
+    updated_at INTEGER NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS sandbox_entitlement_audit_events (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    actor_username TEXT NOT NULL,
+    enabled INTEGER NOT NULL,
+    created_at INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_sandbox_entitlement_audit_user_created
+    ON sandbox_entitlement_audit_events(user_id, created_at DESC, id DESC);
+
+  CREATE TABLE IF NOT EXISTS sandboxes (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE RESTRICT,
+    host_id TEXT NOT NULL REFERENCES sandbox_hosts(id) ON DELETE RESTRICT,
+    host_epoch INTEGER NOT NULL,
+    agent_name TEXT NOT NULL,
+    size_id TEXT NOT NULL,
+    cpu_millis INTEGER NOT NULL,
+    memory_mib INTEGER NOT NULL,
+    disk_gib INTEGER NOT NULL,
+    desired_state TEXT NOT NULL,
+    observed_state TEXT NOT NULL,
+    generation INTEGER NOT NULL DEFAULT 1,
+    instance_id TEXT NOT NULL,
+    image_digest TEXT NOT NULL,
+    reservation_held INTEGER NOT NULL DEFAULT 1,
+    last_error_code TEXT,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    removed_at INTEGER
+  );
+
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_sandboxes_active_user
+    ON sandboxes(user_id) WHERE reservation_held = 1;
+  CREATE INDEX IF NOT EXISTS idx_sandboxes_host_reservation
+    ON sandboxes(host_id, reservation_held);
+
+  CREATE TABLE IF NOT EXISTS sandbox_operations (
+    id TEXT PRIMARY KEY,
+    sandbox_id TEXT NOT NULL REFERENCES sandboxes(id) ON DELETE CASCADE,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    idempotency_key TEXT NOT NULL,
+    request_digest TEXT NOT NULL,
+    kind TEXT NOT NULL,
+    status TEXT NOT NULL,
+    stage TEXT NOT NULL,
+    generation INTEGER NOT NULL,
+    host_epoch INTEGER NOT NULL,
+    deadline_at INTEGER NOT NULL,
+    error_code TEXT,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    UNIQUE(user_id, idempotency_key)
+  );
+
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_sandbox_operations_active
+    ON sandbox_operations(sandbox_id)
+    WHERE status IN ('pending', 'running');
+
+  CREATE TABLE IF NOT EXISTS sandbox_credentials (
+    id TEXT PRIMARY KEY,
+    sandbox_id TEXT NOT NULL REFERENCES sandboxes(id) ON DELETE CASCADE,
+    instance_id TEXT NOT NULL,
+    generation INTEGER NOT NULL,
+    image_digest TEXT NOT NULL,
+    kind TEXT NOT NULL,
+    secret_hash TEXT NOT NULL,
+    expires_at INTEGER,
+    consumed_at INTEGER,
+    revoked_at INTEGER,
+    created_at INTEGER NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS sandbox_audit_events (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    sandbox_id TEXT NOT NULL REFERENCES sandboxes(id) ON DELETE CASCADE,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    operation_id TEXT,
+    event_type TEXT NOT NULL,
+    actor_kind TEXT NOT NULL,
+    generation INTEGER NOT NULL,
+    host_epoch INTEGER NOT NULL,
+    outcome TEXT NOT NULL,
+    error_code TEXT,
+    created_at INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_sandbox_audit_sandbox_created
+    ON sandbox_audit_events(sandbox_id, created_at, id);
 `);
 
 // 数据库迁移 - 添加缺失的列
@@ -194,7 +357,11 @@ const migrations = [
   `ALTER TABLE daily_stats ADD COLUMN output_tokens INTEGER DEFAULT 0`,
   `ALTER TABLE daily_stats ADD COLUMN cache_read_tokens INTEGER DEFAULT 0`,
   `ALTER TABLE daily_stats ADD COLUMN cache_write_tokens INTEGER DEFAULT 0`,
-  `ALTER TABLE daily_stats ADD COLUMN total_tokens INTEGER DEFAULT 0`
+  `ALTER TABLE daily_stats ADD COLUMN total_tokens INTEGER DEFAULT 0`,
+  `ALTER TABLE sandbox_hosts ADD COLUMN memory_mib_available INTEGER NOT NULL DEFAULT 0`,
+  `ALTER TABLE users ADD COLUMN deletion_state TEXT NOT NULL DEFAULT 'active'`,
+  `ALTER TABLE users ADD COLUMN deletion_requested_at INTEGER`,
+  `ALTER TABLE users ADD COLUMN deletion_id TEXT`
 ];
 
 // Yeaft sessions table — server-side persistence so the unified sidebar
@@ -356,6 +523,165 @@ for (const migration of migrations) {
   }
 }
 
+// One-time fail-closed migration from the PR's opaque TEXT Host epochs. SQLite
+// does not change existing column affinity for CREATE TABLE IF NOT EXISTS, so
+// normalize every live fence explicitly and seed the Server-owned allocator.
+const unmigratedSandboxHosts = db.prepare(`
+  SELECT h.id, h.epoch FROM sandbox_hosts h
+  LEFT JOIN sandbox_host_epochs e ON e.host_id = h.id
+  WHERE e.host_id IS NULL
+`).all();
+for (const host of unmigratedSandboxHosts) {
+  const values = [host.epoch];
+  for (const row of db.prepare('SELECT host_epoch AS epoch FROM sandboxes WHERE host_id = ?').all(host.id)) {
+    values.push(row.epoch);
+  }
+  for (const row of db.prepare(`
+    SELECT o.host_epoch AS epoch FROM sandbox_operations o
+    JOIN sandboxes s ON s.id = o.sandbox_id WHERE s.host_id = ?
+  `).all(host.id)) values.push(row.epoch);
+  const observed = values.map(value => {
+    const numeric = Number(value);
+    if (Number.isSafeInteger(numeric) && numeric >= 1) return numeric;
+    const match = String(value || '').match(/(\d+)$/);
+    return match ? Number(match[1]) : 0;
+  }).filter(value => Number.isSafeInteger(value) && value >= 1);
+  const epoch = Math.max(0, ...observed) + 1;
+  const now = Date.now();
+  db.exec('BEGIN IMMEDIATE');
+  try {
+    db.prepare('UPDATE sandbox_hosts SET epoch = ? WHERE id = ?').run(epoch, host.id);
+    db.prepare('UPDATE sandboxes SET host_epoch = ? WHERE host_id = ?').run(epoch, host.id);
+    db.prepare(`
+      UPDATE sandbox_operations SET host_epoch = ?
+      WHERE sandbox_id IN (SELECT id FROM sandboxes WHERE host_id = ?)
+    `).run(epoch, host.id);
+    db.prepare(`
+      UPDATE sandbox_audit_events SET host_epoch = ?
+      WHERE sandbox_id IN (SELECT id FROM sandboxes WHERE host_id = ?)
+    `).run(epoch, host.id);
+    db.prepare('UPDATE sandbox_host_attestations SET epoch = ? WHERE host_id = ?').run(epoch, host.id);
+    db.prepare('UPDATE sandbox_host_audit_events SET epoch = ? WHERE host_id = ?').run(epoch, host.id);
+    db.prepare(`
+      INSERT INTO sandbox_host_epochs
+        (host_id, source_epoch, epoch, activation_digest, activated_at, updated_at)
+      VALUES (?, ?, ?, NULL, NULL, ?)
+    `).run(host.id, `migrated:${String(host.epoch)}`, epoch, now);
+    db.exec('COMMIT');
+  } catch (error) {
+    try { db.exec('ROLLBACK'); } catch {}
+    throw error;
+  }
+}
+
+// SQLite keeps the affinity from the original CREATE TABLE. Rebuild legacy
+// sandbox tables so epoch values are stored and compared as integers, rather
+// than merely writing numeric-looking values into TEXT-affinity columns.
+const sandboxEpochTableRebuilds = [
+  {
+    table: 'sandbox_hosts', column: 'epoch',
+    create: `CREATE TABLE sandbox_hosts (
+      id TEXT PRIMARY KEY, epoch INTEGER NOT NULL, qualified INTEGER NOT NULL DEFAULT 0,
+      controller_healthy INTEGER NOT NULL DEFAULT 0, helper_healthy INTEGER NOT NULL DEFAULT 0,
+      runtime_healthy INTEGER NOT NULL DEFAULT 0, quota_healthy INTEGER NOT NULL DEFAULT 0,
+      network_healthy INTEGER NOT NULL DEFAULT 0, image_digest TEXT NOT NULL,
+      cpu_millis_total INTEGER NOT NULL, memory_mib_total INTEGER NOT NULL,
+      memory_mib_available INTEGER NOT NULL, disk_gib_total INTEGER NOT NULL, updated_at INTEGER NOT NULL
+    )`,
+    columns: 'id, epoch, qualified, controller_healthy, helper_healthy, runtime_healthy, quota_healthy, network_healthy, image_digest, cpu_millis_total, memory_mib_total, memory_mib_available, disk_gib_total, updated_at',
+    select: 'id, CAST(epoch AS INTEGER), qualified, controller_healthy, helper_healthy, runtime_healthy, quota_healthy, network_healthy, image_digest, cpu_millis_total, memory_mib_total, memory_mib_available, disk_gib_total, updated_at',
+    indexes: ['CREATE INDEX IF NOT EXISTS idx_sandboxes_host_reservation ON sandboxes(host_id, reservation_held)']
+  },
+  {
+    table: 'sandbox_host_attestations', column: 'epoch',
+    create: `CREATE TABLE sandbox_host_attestations (
+      nonce TEXT PRIMARY KEY, host_id TEXT NOT NULL REFERENCES sandbox_hosts(id) ON DELETE CASCADE,
+      epoch INTEGER NOT NULL, observed_at INTEGER NOT NULL, created_at INTEGER NOT NULL
+    )`,
+    columns: 'nonce, host_id, epoch, observed_at, created_at',
+    select: 'nonce, host_id, CAST(epoch AS INTEGER), observed_at, created_at',
+    indexes: ['CREATE INDEX IF NOT EXISTS idx_sandbox_host_attestations_host ON sandbox_host_attestations(host_id, created_at DESC)']
+  },
+  {
+    table: 'sandbox_host_audit_events', column: 'epoch',
+    create: `CREATE TABLE sandbox_host_audit_events (
+      id INTEGER PRIMARY KEY AUTOINCREMENT, host_id TEXT NOT NULL, epoch INTEGER NOT NULL,
+      event_type TEXT NOT NULL, outcome TEXT NOT NULL, error_code TEXT, created_at INTEGER NOT NULL
+    )`,
+    columns: 'id, host_id, epoch, event_type, outcome, error_code, created_at',
+    select: 'id, host_id, CAST(epoch AS INTEGER), event_type, outcome, error_code, created_at',
+    indexes: ['CREATE INDEX IF NOT EXISTS idx_sandbox_host_audit_created ON sandbox_host_audit_events(host_id, created_at DESC, id DESC)']
+  },
+  {
+    table: 'sandboxes', column: 'host_epoch',
+    create: `CREATE TABLE sandboxes (
+      id TEXT PRIMARY KEY, user_id TEXT NOT NULL REFERENCES users(id) ON DELETE RESTRICT,
+      host_id TEXT NOT NULL REFERENCES sandbox_hosts(id) ON DELETE RESTRICT, host_epoch INTEGER NOT NULL,
+      agent_name TEXT NOT NULL, size_id TEXT NOT NULL, cpu_millis INTEGER NOT NULL,
+      memory_mib INTEGER NOT NULL, disk_gib INTEGER NOT NULL, desired_state TEXT NOT NULL,
+      observed_state TEXT NOT NULL, generation INTEGER NOT NULL DEFAULT 1, instance_id TEXT NOT NULL,
+      image_digest TEXT NOT NULL, reservation_held INTEGER NOT NULL DEFAULT 1, last_error_code TEXT,
+      created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, removed_at INTEGER
+    )`,
+    columns: 'id, user_id, host_id, host_epoch, agent_name, size_id, cpu_millis, memory_mib, disk_gib, desired_state, observed_state, generation, instance_id, image_digest, reservation_held, last_error_code, created_at, updated_at, removed_at',
+    select: 'id, user_id, host_id, CAST(host_epoch AS INTEGER), agent_name, size_id, cpu_millis, memory_mib, disk_gib, desired_state, observed_state, generation, instance_id, image_digest, reservation_held, last_error_code, created_at, updated_at, removed_at',
+    indexes: [
+      'CREATE UNIQUE INDEX IF NOT EXISTS idx_sandboxes_active_user ON sandboxes(user_id) WHERE reservation_held = 1',
+      'CREATE INDEX IF NOT EXISTS idx_sandboxes_host_reservation ON sandboxes(host_id, reservation_held)'
+    ]
+  },
+  {
+    table: 'sandbox_operations', column: 'host_epoch',
+    create: `CREATE TABLE sandbox_operations (
+      id TEXT PRIMARY KEY, sandbox_id TEXT NOT NULL REFERENCES sandboxes(id) ON DELETE CASCADE,
+      user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE, idempotency_key TEXT NOT NULL,
+      request_digest TEXT NOT NULL, kind TEXT NOT NULL, status TEXT NOT NULL, stage TEXT NOT NULL,
+      generation INTEGER NOT NULL, host_epoch INTEGER NOT NULL, deadline_at INTEGER NOT NULL,
+      error_code TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL,
+      UNIQUE(user_id, idempotency_key)
+    )`,
+    columns: 'id, sandbox_id, user_id, idempotency_key, request_digest, kind, status, stage, generation, host_epoch, deadline_at, error_code, created_at, updated_at',
+    select: 'id, sandbox_id, user_id, idempotency_key, request_digest, kind, status, stage, generation, CAST(host_epoch AS INTEGER), deadline_at, error_code, created_at, updated_at',
+    indexes: ["CREATE UNIQUE INDEX IF NOT EXISTS idx_sandbox_operations_active ON sandbox_operations(sandbox_id) WHERE status IN ('pending', 'running')"]
+  },
+  {
+    table: 'sandbox_audit_events', column: 'host_epoch',
+    create: `CREATE TABLE sandbox_audit_events (
+      id INTEGER PRIMARY KEY AUTOINCREMENT, sandbox_id TEXT NOT NULL REFERENCES sandboxes(id) ON DELETE CASCADE,
+      user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE, operation_id TEXT,
+      event_type TEXT NOT NULL, actor_kind TEXT NOT NULL, generation INTEGER NOT NULL,
+      host_epoch INTEGER NOT NULL, outcome TEXT NOT NULL, error_code TEXT, created_at INTEGER NOT NULL
+    )`,
+    columns: 'id, sandbox_id, user_id, operation_id, event_type, actor_kind, generation, host_epoch, outcome, error_code, created_at',
+    select: 'id, sandbox_id, user_id, operation_id, event_type, actor_kind, generation, CAST(host_epoch AS INTEGER), outcome, error_code, created_at',
+    indexes: ['CREATE INDEX IF NOT EXISTS idx_sandbox_audit_sandbox_created ON sandbox_audit_events(sandbox_id, created_at, id)']
+  }
+];
+
+for (const rebuild of sandboxEpochTableRebuilds) {
+  const affinity = db.prepare(`PRAGMA table_info(${rebuild.table})`).all()
+    .find(column => column.name === rebuild.column)?.type?.toUpperCase();
+  if (affinity === 'INTEGER') continue;
+  const legacyTable = `${rebuild.table}_legacy_epoch`;
+  db.exec('PRAGMA foreign_keys = OFF');
+  db.exec('PRAGMA legacy_alter_table = ON');
+  db.exec('BEGIN IMMEDIATE');
+  try {
+    db.exec(`ALTER TABLE ${rebuild.table} RENAME TO ${legacyTable}`);
+    db.exec(rebuild.create);
+    db.exec(`INSERT INTO ${rebuild.table} (${rebuild.columns}) SELECT ${rebuild.select} FROM ${legacyTable}`);
+    db.exec(`DROP TABLE ${legacyTable}`);
+    for (const index of rebuild.indexes) db.exec(index);
+    db.exec('COMMIT');
+  } catch (error) {
+    try { db.exec('ROLLBACK'); } catch {}
+    throw error;
+  } finally {
+    db.exec('PRAGMA legacy_alter_table = OFF');
+    db.exec('PRAGMA foreign_keys = ON');
+  }
+}
+
 // User identities table (multi-provider SSO + account binding)
 // One user can have multiple identities (microsoft / github / google / wechat / alipay).
 // UNIQUE(provider, subject) enforces "this provider account is bound to one user only".
@@ -442,7 +768,8 @@ try { db.exec(customExpertTables); } catch (e) { /* tables already exist */ }
 const postMigrationIndexes = [
   `CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions(user_id)`,
   `CREATE INDEX IF NOT EXISTS idx_users_agent_secret ON users(agent_secret)`,
-  `CREATE INDEX IF NOT EXISTS idx_users_aad_oid ON users(aad_oid)`
+  `CREATE INDEX IF NOT EXISTS idx_users_aad_oid ON users(aad_oid)`,
+  `CREATE UNIQUE INDEX IF NOT EXISTS idx_users_deletion_id ON users(deletion_id)`
 ];
 // Time the post-migration index pass so the operational signal lands in the
 // deploy log on first startup after composite-index addition — a multi-second
@@ -514,8 +841,17 @@ export const stmts = {
     SELECT * FROM users WHERE username = ?
   `),
 
+  getUserDeletionTombstone: db.prepare(`
+    SELECT * FROM user_deletion_tombstones WHERE username = ?
+  `),
+
+  insertUserDeletionTombstone: db.prepare(`
+    INSERT OR IGNORE INTO user_deletion_tombstones (username, deletion_id, deleted_at)
+    VALUES (?, ?, ?)
+  `),
+
   getUserByAgentSecret: db.prepare(`
-    SELECT * FROM users WHERE agent_secret = ?
+    SELECT * FROM users WHERE agent_secret = ? AND deletion_state = 'active'
   `),
 
   getAllUsers: db.prepare(`
@@ -988,6 +1324,12 @@ export const stmts = {
   clearInvitationUsedBy: db.prepare(`
     UPDATE invitations SET used_by = NULL WHERE used_by = ?
   `),
+  getReservedSandboxForUser: db.prepare(`
+    SELECT id FROM sandboxes WHERE user_id = ? AND reservation_held = 1 LIMIT 1
+  `),
+  deleteReleasedSandboxesForUser: db.prepare(`
+    DELETE FROM sandboxes WHERE user_id = ? AND reservation_held = 0
+  `),
   deleteUserById: db.prepare(`
     DELETE FROM users WHERE id = ?
   `),