[waleedlatif1]

Summary

• Every warm workbench call ran a separate deployment-CLI integrity check before the user's command: its own ownership write, launch, stop receipt and settle. Per-phase timing put it at roughly a third of a warm shell call's fixed cost
• The session supervisor's PID 1 now runs that check as the ordinary user, after recording itself and before starting the command. A mismatch starts nothing; the result travels on the stop receipt every call already fetches, so Sim can never mistake a refused launch for a run one
• A refused launch is repaired under the session lock and relaunched once (it ran nothing, so at-most-once holds); a second refusal fails the call. Each launch keeps its own recorded, stopped, and settled process
• The check runs outside the command's lock, so Stop can kill the namespace while it runs, and the closed tombstone is re-read before the command starts
• The check now uses the supervisor's isolated interpreter (-I, fixed env) instead of the user's login shell, opens artifacts with O_NOFOLLOW|O_NONBLOCK, requires a regular file, and treats an unreadable artifact as stale so repair overwrites it. ensureSessionCli verifies through the same supervisor on handles that support it
• A reused machine runs no separate check; a new machine still installs the CLI first. Providers without launch verification and one-shot sandboxes are unchanged. Old and new instances embed their own supervisor, and the record only gains an optional cli key

Type of Change

• Improvement

Testing

• New gated live test session-cli-launch.live.test.ts against a real E2B workbench (SANDBOX_SESSION_SMOKE=1, JSON report via SESSION_CLI_LAUNCH_REPORT_PATH), 12/12 passed: verified launch runs as user; modified, symlinked, missing, unreadable, and FIFO artifacts are refused without starting the command (FIFO refused in ~0.6 s), then repaired; shell-profile and Python-site hooks cannot make the launch check pass; Stop during a 6 GB check settled in ~1.3 s and started nothing; exit codes and streams unchanged. Warm-call median: separate check + launch 507–638 ms vs verified launch 266–378 ms; unverified launch 245–307 ms
• Unit tests, each red on pre-change code: a reused workbench runs code and shell with no separate check; a changed CLI is repaired and the command runs exactly once, verified; a CLI that stays stale fails without running; a stale/failed receipt rejects whatever the process returned
• lib/execution/remote-sandbox/, execute-request.test.ts, lib/mothership/tools (1,333 tests) and bun run lint; type-check and audits run in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Nov 3, 2026 2:58am UTC

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Moves workbench CLI verification into each command’s owned launch process, removing the separate check on reused workbenches.

• Reused workbench commands verify the CLI as they start.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Record command ownership] --> B[Start supervisor and record namespace]
  B --> C[Check CLI as ordinary user]
  C --> D[Re-read closed state under lock]
  D -->|Stopped| E[Exit without starting command]
  D -->|CLI matches| F[Start user command]
  D -->|CLI changed| G[Record refusal and exit]
  E --> H[Stop and settle namespace]
  F --> H
  G --> H
  H --> I{Stale CLI receipt?}
  I -->|No| J[Return result or error]
  I -->|Yes| K[Repair under session lock]
  K --> L[Retry launch once]

Loading

_{Reviews (2) · Last reviewed commit: "improvement(sandbox): verify the workben..." · Reviewed by Greptile}

[cubic-dev-ai]

No issues found across 10 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}