fix(runtime): close sandbox negotiation retries safely

Generated-by: OpenAI Codex

Author: testikun

packages/core/src/__tests__/sandbox-boundary.test.ts

@@ -26,7 +26,7 @@ import {
   decodeExecutionBoundary,
   executionBoundaryContains,
   executionBoundaryDisplayMode,
-  projectSandboxBoundaryNegotiation,
+  projectSandboxBoundaryNegotiation as projectSandboxBoundaryNegotiationImpl,
   type SandboxBoundaryRequest,
   validateSandboxBoundaryExpansion,
 } from '../sandbox-boundary.js';
@@ -40,6 +40,11 @@ import {
   type PermissionProfileManaged,
 } from '../permission-profile.js';
 
+const projectSandboxBoundaryNegotiation = (
+  events: readonly RuntimeEvent[],
+  durableRequests: readonly SandboxBoundaryRequest[] = [],
+) => projectSandboxBoundaryNegotiationImpl(events, durableRequests);
+
 describe('executionBoundaryDisplayMode', () => {
   test('keeps the read-only/writable distinction the boundary carries (#1611)', () => {
     assert.strictEqual(
@@ -512,9 +517,9 @@ describe('projectSandboxBoundaryNegotiation', () => {
       kind: 'valid',
       state: {
         denied: true,
-        invalidRounds: 1,
-        unresolvedRounds: 1,
-        finalizationRequested: false,
+        invalidRounds: 0,
+        unresolvedRounds: 0,
+        finalizationRequested: true,
       },
     });
   });
@@ -642,7 +647,15 @@ describe('projectSandboxBoundaryNegotiation', () => {
       kind: 'text',
       text: 'Tool arguments failed validation',
     };
-    assert.equal(projectSandboxBoundaryNegotiation([call, response]).kind, 'invalid');
+    assert.deepEqual(projectSandboxBoundaryNegotiation([call, response]), {
+      kind: 'valid',
+      state: {
+        denied: false,
+        invalidRounds: 0,
+        unresolvedRounds: 0,
+        finalizationRequested: false,
+      },
+    });
 
     const blankJustification = request('request-2', 'boundary-2', 'tool-2');
     (
@@ -700,6 +713,52 @@ describe('projectSandboxBoundaryNegotiation', () => {
     assert.equal(projectSandboxBoundaryNegotiation([call, response]).kind, 'invalid');
   });
 
+  test('counts internal invalid repair calls as boundary attempts', () => {
+    const events = [
+      base('repair-call', {
+        role: 'model',
+        author: 'agent',
+        refs: { toolCallId: 'repair-tool' },
+        content: {
+          kind: 'function_call',
+          id: 'repair-tool',
+          name: 'invalid',
+          args: {
+            tool: 'request_sandbox_boundary',
+            error: 'boundary was denied',
+            sandboxBoundaryAttempt: true,
+          },
+        },
+      }),
+      base('repair-response', {
+        role: 'tool',
+        author: 'tool',
+        refs: { toolCallId: 'repair-tool' },
+        content: {
+          kind: 'function_response',
+          id: 'repair-tool',
+          name: 'invalid',
+          isError: true,
+          result: {
+            kind: 'text',
+            text: 'Sandbox boundary correction failed.',
+            sandboxFailure: { reason: 'invalid_boundary_declaration' },
+          },
+        },
+      }),
+    ];
+
+    assert.deepEqual(projectSandboxBoundaryNegotiation(events), {
+      kind: 'valid',
+      state: {
+        denied: false,
+        invalidRounds: 1,
+        unresolvedRounds: 0,
+        finalizationRequested: false,
+      },
+    });
+  });
+
   test('requests finalization after the bounded correction budget', () => {
     const events = [
       ...failurePair(

packages/core/src/sandbox-boundary.ts

@@ -199,7 +199,7 @@ export interface SandboxBoundarySettlement {
  */
 export function projectSandboxBoundaryNegotiation(
   events: readonly RuntimeEvent[],
-  durableRequests: readonly SandboxBoundaryRequest[] = [],
+  durableRequests: readonly SandboxBoundaryRequest[],
 ): SandboxBoundaryNegotiationProjection {
   let denied = false;
   let invalidRounds = 0;
@@ -229,8 +229,25 @@ export function projectSandboxBoundaryNegotiation(
     kind: 'invalid',
     reason,
   });
+  const applyApproval = (requestId: string): SandboxBoundaryNegotiationProjection | undefined => {
+    if (denied || finalizationRequested) {
+      return invalid(`sandbox boundary approval ${requestId} reopens a closed negotiation`);
+    }
+    denied = false;
+    invalidRounds = 0;
+    unresolvedRounds = 0;
+    invalidSteps.clear();
+    unresolvedSteps.clear();
+    finalizationRequested = false;
+    return undefined;
+  };
   const addFailure = (kind: 'invalid' | 'unresolved', step: string): void => {
     hasStatefulEvent = true;
+    if (denied) {
+      finalizationRequested = true;
+      return;
+    }
+    if (finalizationRequested) return;
     const steps = kind === 'invalid' ? invalidSteps : unresolvedSteps;
     if (steps.has(step)) return;
     steps.add(step);
@@ -325,17 +342,8 @@ export function projectSandboxBoundaryNegotiation(
       if (decision.status === 'denied') {
         denied = true;
       } else if (decision.status === 'approved') {
-        if (denied || finalizationRequested) {
-          return invalid(
-            `sandbox boundary approval ${decision.requestId} reopens a closed negotiation`,
-          );
-        }
-        denied = false;
-        invalidRounds = 0;
-        unresolvedRounds = 0;
-        invalidSteps.clear();
-        unresolvedSteps.clear();
-        finalizationRequested = false;
+        const approvalError = applyApproval(decision.requestId);
+        if (approvalError) return approvalError;
       } else {
         addFailure('unresolved', `request:${decision.requestId}`);
       }
@@ -398,11 +406,6 @@ export function projectSandboxBoundaryNegotiation(
       }
       const step = event.refs?.stepId ?? boundaryCall?.step ?? call.step;
       addFailure(failure, step);
-    } else if (content.isError === true && boundaryCall) {
-      // Older ledgers did not carry a structured invalid-boundary marker. Do
-      // not infer a count from their text; the relevant lineage is incomplete
-      // and must be rejected closed by the continuation caller.
-      return invalid(`sandbox boundary call ${content.id} lacks a canonical failure marker`);
     }
     if (boundaryCall) {
       if (boundaryResponses.has(content.id)) {
@@ -462,17 +465,8 @@ export function projectSandboxBoundaryNegotiation(
       if (request.status === 'denied') {
         denied = true;
       } else if (request.status === 'approved') {
-        if (denied || finalizationRequested) {
-          return invalid(
-            `sandbox boundary approval ${request.requestId} reopens a closed negotiation`,
-          );
-        }
-        denied = false;
-        invalidRounds = 0;
-        unresolvedRounds = 0;
-        invalidSteps.clear();
-        unresolvedSteps.clear();
-        finalizationRequested = false;
+        const approvalError = applyApproval(request.requestId);
+        if (approvalError) return approvalError;
       } else {
         addFailure('unresolved', `request:${request.requestId}`);
       }
@@ -510,6 +504,13 @@ export function projectSandboxBoundaryNegotiation(
 
 function isBoundaryAuthorityCall(toolName: string, args: unknown): boolean {
   if (toolName === 'request_sandbox_boundary') return true;
+  if (
+    toolName === 'invalid' &&
+    isRecord(args) &&
+    args.sandboxBoundaryAttempt === true
+  ) {
+    return true;
+  }
   if (toolName !== 'Bash' || !isRecord(args)) return false;
   return args.boundary_intent !== undefined && args.boundary_intent !== 'current';
 }

packages/runtime/src/runtime-kernel.ts

@@ -2847,12 +2847,23 @@ async function revalidateContinuationBoundary(
       'Runtime continuation replay changed after planning',
     );
   }
+  const trimmedSuffixEventIds = new Set(
+    replay.plan.segments.flatMap((segment) => segment.trimmedSuffixEventIds),
+  );
+  const negotiationEvents = prefixes
+    .flatMap((prefix) => prefix.events)
+    .filter((event) => !trimmedSuffixEventIds.has(event.id));
   const negotiation = projectSandboxBoundaryNegotiation(
-    prefixes.flatMap((prefix) => prefix.events),
+    negotiationEvents,
     durableSandboxBoundaryRequests,
   );
-  const sandboxBoundaryNegotiationState =
-    negotiation.kind === 'valid' ? negotiation.state : createSandboxBoundaryFinalizationState();
+  if (negotiation.kind !== 'valid') {
+    throw new RuntimeContinuationRevalidationError(
+      'source_replay_changed',
+      `Runtime continuation sandbox negotiation is invalid: ${negotiation.reason}`,
+    );
+  }
+  const sandboxBoundaryNegotiationState = negotiation.state;
   return { events: [...prefixes.at(-1)!.events], sandboxBoundaryNegotiationState };
 }
 

packages/runtime/src/runtime-resume.ts

@@ -452,14 +452,6 @@ export class RuntimeContinuationPlanner {
         'sandbox boundary interaction log is unavailable',
       );
     }
-    try {
-      await this.deps.readSandboxBoundaryRequests(input.sessionId);
-    } catch {
-      return parkedPlan(
-        'continuation_authority_unavailable',
-        'sandbox boundary interaction log is unavailable',
-      );
-    }
     let durableClaimState: ContinuationClaimStateV1 | undefined;
     try {
       durableClaimState = await this.deps.readContinuationClaimStateByBoundary?.(