@yeaft/webchat-agent 1.0.373 → 1.0.375

package/local-runtime/server/sandbox-config.js

@@ -0,0 +1,42 @@
+/**
+ * Existing Sandbox cleanup needs only the Controller trust and transport configuration.
+ * It deliberately does not depend on the product admission flag or creation-only settings.
+ * @param {object} config
+ * @returns {boolean}
+ */
+export function validateSandboxCleanupConfig(config) {
+  if (!config?.controllerUrl || !config.controllerToken
+    || !config.operationSigningPrivateKey || !config.controllerResultPublicKey
+    || !config.controllerHostId || !config.helperAttestationPublicKey
+    || !config.controllerClientCert || !config.controllerClientKey
+    || !config.controllerCaCert) return false;
+  try {
+    return new URL(config.controllerUrl).protocol === 'https:';
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Sandbox execution is allowed only through a fully configured dedicated HTTPS Controller.
+ * The current mixed-use Server Host is never an implicit execution target.
+ * @param {object} config
+ * @returns {boolean}
+ */
+export function validateSandboxDeploymentConfig(config) {
+  if (!config?.enabled || !validateSandboxCleanupConfig(config)
+    || !config.bootstrapSigningKey
+    || !config.hostAttestationKey || !config.controllerAttestationFingerprint
+    || !config.hostAttestationListenerHost
+    || !Number.isSafeInteger(config.hostAttestationListenerPort)
+    || config.hostAttestationListenerPort <= 0
+    || config.hostAttestationListenerPort > 65_535
+    || !config.hostAttestationServerCert || !config.hostAttestationServerKey
+    || !config.hostAttestationClientCa
+    || !Number.isSafeInteger(config.hostAttestationBodyLimitBytes)
+    || config.hostAttestationBodyLimitBytes <= 0
+    || !config.imageDigest
+    || !Number.isSafeInteger(config.hostMemoryReserveMiB)
+    || config.hostMemoryReserveMiB <= 0) return false;
+  return true;
+}

package/local-runtime/server/sandbox-host-attestation.js

@@ -0,0 +1,175 @@
+import { createHmac, timingSafeEqual } from 'crypto';
+import db, { transaction } from './db/connection.js';
+
+const HEALTH_FIELDS = Object.freeze([
+  'controllerHealthy',
+  'helperHealthy',
+  'runtimeHealthy',
+  'quotaHealthy',
+  'networkHealthy'
+]);
+
+export class SandboxHostAttestationError extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+}
+
+function canonicalPayload(attestation) {
+  return JSON.stringify({
+    hostId: attestation.hostId,
+    epoch: attestation.epoch,
+    nonce: attestation.nonce,
+    observedAt: attestation.observedAt,
+    imageDigest: attestation.imageDigest,
+    resources: attestation.resources,
+    checks: attestation.checks
+  });
+}
+
+function validIdentifier(value, maxLength = 128) {
+  return typeof value === 'string' && value.length > 0 && value.length <= maxLength
+    && /^[a-zA-Z0-9._:-]+$/.test(value);
+}
+
+function verifySignature(payload, signature, key) {
+  if (!key || typeof signature !== 'string') return false;
+  const expected = createHmac('sha256', key).update(payload).digest();
+  let actual;
+  try {
+    actual = Buffer.from(signature, 'base64url');
+  } catch {
+    return false;
+  }
+  return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+
+function validateAttestation(attestation, config, now) {
+  if (!attestation || !validIdentifier(attestation.hostId) || !validIdentifier(attestation.epoch)
+    || !validIdentifier(attestation.nonce, 192) || !validIdentifier(attestation.imageDigest, 192)) {
+    throw new SandboxHostAttestationError('SANDBOX_HOST_ATTESTATION_INVALID');
+  }
+  if (attestation.hostId !== config.controllerHostId
+    || attestation.imageDigest !== config.imageDigest) {
+    throw new SandboxHostAttestationError('SANDBOX_HOST_ATTESTATION_SCOPE_MISMATCH');
+  }
+  const observedAt = Number(attestation.observedAt);
+  if (!Number.isSafeInteger(observedAt)
+    || Math.abs(now - observedAt) > config.hostAttestationMaxSkewMs) {
+    throw new SandboxHostAttestationError('SANDBOX_HOST_ATTESTATION_STALE');
+  }
+  const resources = attestation.resources || {};
+  if (![resources.cpuMillis, resources.memoryMiB, resources.memoryAvailableMiB, resources.diskGiB]
+    .every(value => Number.isSafeInteger(value) && value > 0)
+    || resources.memoryAvailableMiB > resources.memoryMiB) {
+    throw new SandboxHostAttestationError('SANDBOX_HOST_ATTESTATION_INVALID');
+  }
+  if (!verifySignature(canonicalPayload(attestation), attestation.signature, config.hostAttestationKey)) {
+    throw new SandboxHostAttestationError('SANDBOX_HOST_ATTESTATION_INVALID');
+  }
+  return Boolean(attestation.checks)
+    && HEALTH_FIELDS.every(field => attestation.checks[field] === true);
+}
+
+function appendAudit(attestation, outcome, errorCode, now) {
+  db.prepare(`
+    INSERT INTO sandbox_host_audit_events (
+      host_id, epoch, event_type, outcome, error_code, created_at
+    ) VALUES (?, ?, 'qualification_attested', ?, ?, ?)
+  `).run(
+    String(attestation?.hostId || 'invalid').slice(0, 128),
+    String(attestation?.epoch || 'invalid').slice(0, 128),
+    outcome,
+    errorCode,
+    now
+  );
+}
+
+export function registerSandboxHostAttestation(attestation, config, now = Date.now()) {
+  try {
+    const qualified = validateAttestation(attestation, config, now);
+    return transaction(() => {
+      const prior = db.prepare('SELECT nonce FROM sandbox_host_attestations WHERE nonce = ?')
+        .get(attestation.nonce);
+      if (prior) throw new SandboxHostAttestationError('SANDBOX_HOST_ATTESTATION_REPLAYED');
+
+      const latest = db.prepare(`
+        SELECT observed_at FROM sandbox_host_attestations
+        WHERE host_id = ? ORDER BY observed_at DESC LIMIT 1
+      `).get(attestation.hostId);
+      if (latest && Number(attestation.observedAt) <= latest.observed_at) {
+        throw new SandboxHostAttestationError('SANDBOX_HOST_ATTESTATION_OUT_OF_ORDER');
+      }
+
+      const priorEpoch = db.prepare(`
+        SELECT source_epoch, epoch FROM sandbox_host_epochs WHERE host_id = ?
+      `).get(attestation.hostId);
+      const allocatedEpoch = priorEpoch
+        ? priorEpoch.epoch + Number(priorEpoch.source_epoch !== attestation.epoch)
+        : 1;
+      const { resources, checks } = attestation;
+      db.prepare(`
+        INSERT INTO sandbox_hosts (
+          id, epoch, qualified, controller_healthy, helper_healthy, runtime_healthy,
+          quota_healthy, network_healthy, image_digest, cpu_millis_total,
+          memory_mib_total, memory_mib_available, disk_gib_total, updated_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(id) DO UPDATE SET
+          epoch = excluded.epoch,
+          qualified = excluded.qualified,
+          controller_healthy = excluded.controller_healthy,
+          helper_healthy = excluded.helper_healthy,
+          runtime_healthy = excluded.runtime_healthy,
+          quota_healthy = excluded.quota_healthy,
+          network_healthy = excluded.network_healthy,
+          image_digest = excluded.image_digest,
+          cpu_millis_total = excluded.cpu_millis_total,
+          memory_mib_total = excluded.memory_mib_total,
+          memory_mib_available = excluded.memory_mib_available,
+          disk_gib_total = excluded.disk_gib_total,
+          updated_at = excluded.updated_at
+      `).run(
+        attestation.hostId, allocatedEpoch, Number(qualified),
+        Number(checks.controllerHealthy), Number(checks.helperHealthy),
+        Number(checks.runtimeHealthy), Number(checks.quotaHealthy), Number(checks.networkHealthy),
+        attestation.imageDigest, resources.cpuMillis, resources.memoryMiB,
+        resources.memoryAvailableMiB, resources.diskGiB, now
+      );
+      db.prepare(`
+        INSERT INTO sandbox_host_epochs
+          (host_id, source_epoch, epoch, activation_digest, activated_at, updated_at)
+        VALUES (?, ?, ?, NULL, NULL, ?)
+        ON CONFLICT(host_id) DO UPDATE SET
+          source_epoch = excluded.source_epoch,
+          epoch = excluded.epoch,
+          activation_digest = CASE
+            WHEN sandbox_host_epochs.epoch = excluded.epoch
+              THEN sandbox_host_epochs.activation_digest ELSE NULL END,
+          activated_at = CASE
+            WHEN sandbox_host_epochs.epoch = excluded.epoch
+              THEN sandbox_host_epochs.activated_at ELSE NULL END,
+          updated_at = excluded.updated_at
+      `).run(attestation.hostId, attestation.epoch, allocatedEpoch, now);
+      db.prepare(`
+        INSERT INTO sandbox_host_attestations (nonce, host_id, epoch, observed_at, created_at)
+        VALUES (?, ?, ?, ?, ?)
+      `).run(attestation.nonce, attestation.hostId, allocatedEpoch, attestation.observedAt, now);
+      appendAudit(
+        { ...attestation, epoch: allocatedEpoch },
+        qualified ? 'accepted' : 'rejected',
+        qualified ? null : 'SANDBOX_HOST_NOT_QUALIFIED',
+        now
+      );
+      return { accepted: true, qualified, epoch: allocatedEpoch };
+    })();
+  } catch (error) {
+    const code = error instanceof SandboxHostAttestationError
+      ? error.code
+      : 'SANDBOX_HOST_ATTESTATION_INVALID';
+    appendAudit(attestation, 'rejected', code, now);
+    throw error instanceof SandboxHostAttestationError
+      ? error
+      : new SandboxHostAttestationError(code);
+  }
+}

package/local-runtime/server/sandbox-reconciler.js

@@ -0,0 +1,355 @@
+import { createHash, randomUUID, sign, verify } from 'crypto';
+import { request as httpsRequest } from 'https';
+import { sandboxDb } from './database.js';
+import { isSandboxAgentReady } from './sandbox-agent-auth.js';
+import {
+  validateSandboxCleanupConfig,
+  validateSandboxDeploymentConfig
+} from './sandbox-config.js';
+
+function canonicalEnvelope(envelope) {
+  return JSON.stringify({
+    protocolVersion: envelope.protocolVersion,
+    operationId: envelope.operationId,
+    hostId: envelope.hostId,
+    sandboxId: envelope.sandboxId,
+    action: envelope.action,
+    requestDigest: envelope.requestDigest,
+    generation: envelope.generation,
+    hostEpoch: envelope.hostEpoch,
+    instanceId: envelope.instanceId,
+    imageDigest: envelope.imageDigest,
+    desiredState: envelope.desiredState,
+    issuedAt: envelope.issuedAt,
+    expiresAt: envelope.expiresAt,
+    nonce: envelope.nonce,
+    bootstrap: envelope.bootstrap || null,
+    resources: envelope.resources
+  });
+}
+
+function signEnvelope(envelope, privateKey) {
+  return sign(null, Buffer.from(canonicalEnvelope(envelope)), privateKey).toString('base64url');
+}
+
+function activationDigest(hostId, epoch) {
+  return createHash('sha256')
+    .update(JSON.stringify({ protocolVersion: 1, action: 'ACTIVATE_EPOCH', hostId, epoch }))
+    .digest('hex');
+}
+
+function canonicalHelperAttestation(attestation) {
+  return JSON.stringify({
+    protocolVersion: attestation.protocolVersion,
+    operationId: attestation.operationId,
+    hostId: attestation.hostId,
+    sandboxId: attestation.sandboxId,
+    action: attestation.action,
+    requestDigest: attestation.requestDigest,
+    generation: attestation.generation,
+    hostEpoch: attestation.hostEpoch,
+    requestNonce: attestation.requestNonce,
+    issuedAt: attestation.issuedAt,
+    imageDigest: attestation.imageDigest || null,
+    readinessProof: attestation.readinessProof || null,
+    absenceProof: attestation.absenceProof || null,
+    resourceInspection: attestation.resourceInspection || null
+  });
+}
+
+function canonicalControllerResult(result) {
+  return JSON.stringify({
+    operationId: result.operationId,
+    action: result.action,
+    hostId: result.hostId,
+    sandboxId: result.sandboxId,
+    requestDigest: result.requestDigest,
+    generation: result.generation,
+    hostEpoch: result.hostEpoch,
+    requestNonce: result.requestNonce,
+    issuedAt: result.issuedAt,
+    success: result.success,
+    imageDigest: result.imageDigest || null,
+    helperAttestation: result.helperAttestation || null,
+    errorCode: result.errorCode || null
+  });
+}
+
+function verifyHelperAttestation(result, operation, config, now) {
+  const attestation = result.helperAttestation;
+  if (!attestation || attestation.protocolVersion !== 1
+    || attestation.operationId !== operation.id
+    || attestation.hostId !== operation.host_id
+    || attestation.sandboxId !== operation.sandbox_id
+    || attestation.action !== operation.kind
+    || attestation.requestDigest !== operation.request_digest
+    || attestation.generation !== operation.generation
+    || attestation.hostEpoch !== operation.host_epoch
+    || attestation.requestNonce !== operation.requestNonce
+    || !Number.isFinite(attestation.issuedAt)
+    || Math.abs(now - attestation.issuedAt) > (config.controllerProtocolMaxSkewMs || 30_000)) {
+    throw new Error('Controller returned a mismatched Helper attestation');
+  }
+  let signatureValid = false;
+  try {
+    signatureValid = verify(
+      null,
+      Buffer.from(canonicalHelperAttestation(attestation)),
+      config.helperAttestationPublicKey,
+      Buffer.from(String(attestation.signature || ''), 'base64url')
+    );
+  } catch {
+    signatureValid = false;
+  }
+  if (!signatureValid) throw new Error('Controller returned an invalid Helper attestation signature');
+  return attestation;
+}
+
+function verifyResourceInspection(attestation, operation) {
+  if (['remove', 'ACTIVATE_EPOCH'].includes(operation.kind)) return;
+  const inspection = attestation.resourceInspection;
+  const expected = {
+    cpuMillis: operation.cpu_millis,
+    memoryMiB: operation.memory_mib,
+    diskGiB: operation.disk_gib
+  };
+  if (!inspection
+    || inspection.cpuMillis !== expected.cpuMillis
+    || inspection.memoryMiB !== expected.memoryMiB
+    || inspection.diskGiB !== expected.diskGiB
+    || !Number.isInteger(inspection.pidsLimit) || inspection.pidsLimit <= 0
+    || !Number.isInteger(inspection.ioWeight) || inspection.ioWeight <= 0
+    || inspection.quotaHard !== true
+    || inspection.networkPolicy !== 'public-egress-isolated') {
+    throw new Error('Helper attestation does not prove the requested Sandbox resource policy');
+  }
+}
+
+function verifyControllerResult(result, operation, config, now = Date.now()) {
+  if (result.operationId !== operation.id
+    || result.action !== operation.kind
+    || result.hostId !== operation.host_id
+    || result.sandboxId !== operation.sandbox_id
+    || result.requestDigest !== operation.request_digest
+    || result.generation !== operation.generation
+    || result.hostEpoch !== operation.host_epoch
+    || result.requestNonce !== operation.requestNonce) {
+    throw new Error('Controller returned a mismatched operation result');
+  }
+  if (!Number.isFinite(result.issuedAt)
+    || Math.abs(now - result.issuedAt) > (config.controllerProtocolMaxSkewMs || 30_000)) {
+    throw new Error('Controller returned a stale operation result');
+  }
+  let signatureValid = false;
+  try {
+    signatureValid = verify(
+      null,
+      Buffer.from(canonicalControllerResult(result)),
+      config.controllerResultPublicKey,
+      Buffer.from(String(result.signature || ''), 'base64url')
+    );
+  } catch {
+    signatureValid = false;
+  }
+  if (!signatureValid) throw new Error('Controller returned an invalid operation result signature');
+  const attestation = verifyHelperAttestation(result, operation, config, now);
+  verifyResourceInspection(attestation, operation);
+  return attestation;
+}
+
+export function validateControllerConfig(config) {
+  return validateSandboxDeploymentConfig(config);
+}
+
+function requestController(url, options) {
+  return new Promise((resolve, reject) => {
+    const request = httpsRequest(url, {
+      method: 'POST',
+      headers: options.headers,
+      cert: options.cert,
+      key: options.key,
+      ca: options.ca,
+      rejectUnauthorized: true,
+      timeout: options.timeout
+    }, response => {
+      const chunks = [];
+      response.on('data', chunk => chunks.push(chunk));
+      response.on('end', () => resolve({
+        ok: response.statusCode >= 200 && response.statusCode < 300,
+        status: response.statusCode,
+        json: async () => JSON.parse(Buffer.concat(chunks).toString('utf8'))
+      }));
+    });
+    request.on('timeout', () => request.destroy(new Error('Controller request timed out')));
+    request.on('error', reject);
+    request.end(options.body);
+  });
+}
+
+export function createSandboxReconciler({
+  config,
+  store = sandboxDb,
+  fetchImpl = requestController,
+  logger = console
+}) {
+  let running = false;
+  const epochActivations = new Map();
+
+  async function ensureEpochActivated(operation, { allowActivation }) {
+    if (!store.isEpochActivated || !store.recordEpochActivation) return allowActivation;
+    const epoch = Number(operation.host_epoch);
+    if (!Number.isSafeInteger(epoch) || epoch < 1) throw new Error('Invalid Host epoch');
+    const digest = activationDigest(operation.host_id, epoch);
+    if (store.isEpochActivated(operation.host_id, epoch, digest)) return true;
+    if (!allowActivation) return false;
+    const key = `${operation.host_id}:${epoch}`;
+    if (epochActivations.has(key)) return epochActivations.get(key);
+    const activationPromise = (async () => {
+      const issuedAt = Date.now();
+      const activation = {
+        protocolVersion: 1,
+        operationId: `activate:${operation.host_id}:${epoch}`,
+        hostId: operation.host_id,
+        sandboxId: null,
+        action: 'ACTIVATE_EPOCH',
+        requestDigest: digest,
+        generation: null,
+        hostEpoch: epoch,
+        instanceId: null,
+        imageDigest: null,
+        desiredState: null,
+        issuedAt,
+        expiresAt: issuedAt + (config.controllerRequestTimeoutMs || 10_000),
+        nonce: randomUUID(),
+        bootstrap: null,
+        resources: null
+      };
+      const response = await fetchImpl(new URL('/v1/operations', config.controllerUrl), {
+        method: 'POST',
+        headers: { authorization: `Bearer ${config.controllerToken}`, 'content-type': 'application/json' },
+        body: JSON.stringify({ ...activation, signature: signEnvelope(activation, config.operationSigningPrivateKey) }),
+        cert: config.controllerClientCert,
+        key: config.controllerClientKey,
+        ca: config.controllerCaCert,
+        timeout: config.controllerRequestTimeoutMs || 10_000
+      });
+      if (!response.ok) throw new Error(`Controller returned HTTP ${response.status}`);
+      const result = await response.json();
+      verifyControllerResult(result, {
+        id: activation.operationId,
+        kind: activation.action,
+        host_id: activation.hostId,
+        sandbox_id: activation.sandboxId,
+        request_digest: activation.requestDigest,
+        generation: activation.generation,
+        host_epoch: activation.hostEpoch,
+        requestNonce: activation.nonce,
+        cpu_millis: null,
+        memory_mib: null,
+        disk_gib: null
+      }, config);
+      store.recordEpochActivation(operation.host_id, epoch, digest, Date.now());
+      return true;
+    })();
+    epochActivations.set(key, activationPromise);
+    try {
+      return await activationPromise;
+    } finally {
+      epochActivations.delete(key);
+    }
+  }
+
+  async function dispatch(pendingOperation, { allowActivation }) {
+    if (pendingOperation.host_id !== config.controllerHostId) return;
+    if (!await ensureEpochActivated(pendingOperation, { allowActivation })) return;
+    const operation = store.admitPendingOperation?.(pendingOperation.id, config, Date.now())
+      || (store.admitPendingOperation ? null : pendingOperation);
+    if (!operation) return;
+    const issuedAt = Date.now();
+    const envelope = {
+      protocolVersion: 1,
+      operationId: operation.id,
+      hostId: operation.host_id,
+      sandboxId: operation.sandbox_id,
+      action: operation.kind,
+      requestDigest: operation.request_digest,
+      generation: operation.generation,
+      hostEpoch: operation.host_epoch,
+      instanceId: operation.instance_id,
+      imageDigest: operation.image_digest,
+      desiredState: operation.desired_state,
+      issuedAt,
+      expiresAt: issuedAt + (config.controllerRequestTimeoutMs || 10_000),
+      nonce: randomUUID(),
+      ...(['create', 'start', 'retry'].includes(operation.kind)
+        ? { bootstrap: store.issueBootstrap(
+          operation.id,
+          config.bootstrapTtlMs,
+          config.bootstrapSigningKey
+        ) }
+        : {}),
+      resources: {
+        cpuMillis: operation.cpu_millis,
+        memoryMiB: operation.memory_mib,
+        diskGiB: operation.disk_gib
+      }
+    };
+    const response = await fetchImpl(new URL('/v1/operations', config.controllerUrl), {
+      method: 'POST',
+      headers: {
+        authorization: `Bearer ${config.controllerToken}`,
+        'content-type': 'application/json'
+      },
+      body: JSON.stringify({ ...envelope, signature: signEnvelope(envelope, config.operationSigningPrivateKey) }),
+      cert: config.controllerClientCert,
+      key: config.controllerClientKey,
+      ca: config.controllerCaCert,
+      timeout: config.controllerRequestTimeoutMs || 10_000
+    });
+    if (!response.ok) throw new Error(`Controller returned HTTP ${response.status}`);
+    const result = await response.json();
+    const helperAttestation = verifyControllerResult(
+      result,
+      { ...operation, requestNonce: envelope.nonce },
+      config
+    );
+    store.applyControllerResult({
+      ...result,
+      imageDigest: helperAttestation.imageDigest,
+      readinessProof: helperAttestation.readinessProof,
+      absenceProof: helperAttestation.absenceProof,
+      resourceInspection: helperAttestation.resourceInspection
+    }, config, { isAgentReady: isSandboxAgentReady });
+  }
+
+  async function tick(now = Date.now()) {
+    if (running || !config) return;
+    running = true;
+    try {
+      store.reconcileRuntimeState?.(now, config, { isAgentReady: isSandboxAgentReady });
+      const operations = store.listPendingOperations(now);
+      const deploymentReady = validateControllerConfig(config);
+      const cleanupReady = validateSandboxCleanupConfig(config);
+      const dispatchable = operations.filter(operation => (
+        deploymentReady || (cleanupReady && operation.kind === 'remove')
+      ));
+      await Promise.all(dispatchable.map(operation => dispatch(operation, {
+        allowActivation: deploymentReady
+      }).catch(error => {
+        logger.warn(`[Sandbox] Controller dispatch failed for ${operation.id}: ${error.message}`);
+      })));
+    } finally {
+      running = false;
+    }
+  }
+
+  function start() {
+    if (!config) return null;
+    const timer = setInterval(() => void tick(), config.reconcileIntervalMs || 5_000);
+    timer.unref?.();
+    void tick();
+    return timer;
+  }
+
+  return { start, tick };
+}

package/local-runtime/server/ws-agent.js

@@ -2,6 +2,7 @@ import { randomUUID } from 'crypto';
 import { WebSocket } from 'ws';
 import { CONFIG } from './config.js';
 import { verifyAgent } from './auth.js';
+import { authenticateSandboxAgent, canForceReadyAfterSyncTimeout } from './sandbox-agent-auth.js';
 import { encodeKey } from './encryption.js';
 import { agents, pendingAgentConnections } from './context.js';
 import { userDb } from './database.js';
@@ -103,9 +104,15 @@ export function handleAgentConnection(ws, url) {
           clearTimeout(pending.timeout);
           pendingAgentConnections.delete(tempId);
 
-          const authResult = skipAgentAuth
-            ? { valid: true, sessionKey: null, userId: null, username: null }
-            : verifyAgent(msg.secret);
+          const sandboxAuth = !skipAgentAuth && msg.authKind === 'sandbox'
+            ? authenticateSandboxAgent(msg, pending)
+            : null;
+          const authResult = sandboxAuth
+            || (msg.authKind
+              ? { valid: false, sessionKey: null, userId: null, username: null }
+              : skipAgentAuth
+                ? { valid: true, sessionKey: null, userId: null, username: null }
+                : verifyAgent(msg.secret));
           if (!authResult.valid) {
             pruneAgentConnectionGenerations();
             console.log(`Agent auth failed: ${agentName}`);
@@ -115,19 +122,26 @@ export function handleAgentConnection(ws, url) {
 
           const capabilities = Array.isArray(msg.capabilities) ? msg.capabilities : urlCapabilities;
           const agentVersion = msg.version || null;
+          if (sandboxAuth && !capabilities.includes('managed-sandbox')) {
+            pruneAgentConnectionGenerations();
+            ws.close(1008, 'Invalid Sandbox Agent capability');
+            return;
+          }
           // Local no-auth mode still has one durable browser owner. This makes
           // the server-side Session catalog persistent without changing generic
           // development-server behavior, which remains ownerless.
           const localOwner = skipAgentAuth && process.env.YEAFT_LOCAL_RUN === 'true'
             ? userDb.getOrCreate('dev-user')
             : null;
-          const ownerId = localOwner?.id || authResult.userId;
-          const ownerUsername = localOwner?.username || authResult.username;
+          const ownerId = sandboxAuth?.userId || localOwner?.id || authResult.userId;
+          const ownerUsername = localOwner?.username || authResult.username || null;
+          const registeredInstanceId = sandboxAuth?.instanceId
+            || pending.instanceId || pending.agentId || pending.agentName;
           // Authenticated Agents use an owner-scoped key. SKIP_AUTH preserves
           // its historical unscoped id while still receiving version metadata.
           resolvedAgentId = skipAgentAuth
             ? clientAgentId
-            : buildAgentMapKey(ownerId, pending.instanceId || pending.agentId || pending.agentName);
+            : buildAgentMapKey(ownerId, registeredInstanceId);
           if (!claimAgentConnection(resolvedAgentId, connectionGeneration)) {
             resolvedAgentId = null;
             pruneAgentConnectionGenerations();
@@ -144,7 +158,12 @@ export function handleAgentConnection(ws, url) {
             ownerId,
             ownerUsername,
             agentVersion,
-            pending.instanceId || pending.agentId || pending.agentName,
+            registeredInstanceId,
+            sandboxAuth ? {
+              sandboxId: sandboxAuth.sandboxId,
+              generation: sandboxAuth.generation,
+              imageDigest: sandboxAuth.imageDigest,
+            } : null,
           );
           pruneAgentConnectionGenerations();
         }
@@ -160,6 +179,10 @@ export function handleAgentConnection(ws, url) {
         if (!agent) console.error(`[Agent] No agent found for id: ${resolvedAgentId}`);
         return;
       }
+      if (!skipAgentAuth && agent.ownerId && !userDb.isActive(agent.ownerId)) {
+        ws.close(1008, 'Account disabled');
+        return;
+      }
       markAgentHeartbeatSeen(agent);
       const msg = await parseMessage(data, agent.sessionKey);
       if (msg) {
@@ -225,7 +248,7 @@ function handleAgentDisconnect(agentId, agentName, ws) {
   broadcastAgentList();
 }
 
-function completeAgentRegistration(ws, agentId, agentName, workDir, sessionKey, capabilities = [], ownerId = null, ownerUsername = null, agentVersion = null, instanceId = null) {
+function completeAgentRegistration(ws, agentId, agentName, workDir, sessionKey, capabilities = [], ownerId = null, ownerUsername = null, agentVersion = null, instanceId = null, sandboxIdentity = null) {
   // 如果是重连，保留 conversations；否则（server 重启）创建空 Map
   const existingAgent = agents.get(agentId);
   const conversations = existingAgent?.conversations || new Map();
@@ -262,13 +285,13 @@ function completeAgentRegistration(ws, agentId, agentName, workDir, sessionKey,
     ownerId,
     ownerUsername,
     version: agentVersion,
-    encryptOutbound
+    encryptOutbound,
+    sandboxIdentity
   });
 
-  // 同步超时保护：30 秒后强制 ready
   const syncTimeout = setTimeout(() => {
     const ag = agents.get(agentId);
-    if (ag?.ws === ws && ag.status === 'syncing') {
+    if (ag?.ws === ws && ag.status === 'syncing' && canForceReadyAfterSyncTimeout(ag)) {
       console.warn(`[Sync] Agent ${agentName} sync timeout, forcing ready`);
       ag.status = 'ready';
       broadcastAgentList();