fix(sandbox): renew workspace credentials before reuse

[drewstone]

Expiring workspace tool credentials were resolved only when a sandbox was created. Retained workspaces could keep expired credentials; GTM renewed them in its own bootstrap, while Relationships still used creation-only configuration.

Add SandboxRuntimeConfig.runtimeEnv so products define credential minting once. Agent-app supplies fresh values at creation and awaits the Sandbox SDK update before bootstrap on reuse, resume, and recovery. Renewal failure preserves the sandbox and prevents dispatch. Static configuration remains in env; Sandbox owns reserved-key enforcement. Both scaffolds and the SDK peer floor require Sandbox 0.39.4.

Validation against final head b17f12d1233641f4252996d00d7a4386daa9154a: committed-source signoff passed on Node 24.18.0, including both randomized full test runs, typecheck, incident gates, build, generated projects, and knip. Verify PR run 34824933645 passed. The six new lifecycle regressions failed before implementation and pass afterward. Independent source review approved this head with no blocking findings.

Production requires the matching Sandbox runtime before a consumer enables renewal. GTM and Relationships adoption and retained-workspace production proofs are separate delivery steps.

[drewstone]

Independent review: agent-app PR 593

Conclusion: APPROVE. No blocking findings.

Scope: read-only review of b17f12d against origin/main a9831d4 in /tmp/agent-app-workspace-runtime-env.
Root owns source mutations, checks, GitHub actions, and release.

Inspected the complete diff, repository AGENTS.md, architecture guidance, runtime environment tests, and these implementation paths:

• SandboxRuntimeConfig and resolveWorkspaceRuntimeEnv.
• Creation payload composition and existing environment and payload size gates.
• Running reuse, cached liveness, stopped resume, and unresponsive-box recovery through finalizeExistingBox.
• Deferred profile materialization, bootstrap ordering, outer replacement catches, and missing-sandbox, capacity, and configuration classifiers.
• Installed Sandbox 0.39.4 public setRuntimeEnv declaration and runtime API implementation.
• Peer minimums, template dependencies, lockfile, and affected credential documentation.

Fresh creation resolves runtimeEnv once and merges its values over creation-only env before the combined size and payload gates.
Every retained path reaches the shared finalizer, resolves fresh values after deferred materialization, and awaits setRuntimeEnv before bootstrap.
An empty map avoids an SDK call that would reject it.
SDK acknowledgement validates the injected count before resolving.
The runtime endpoint is /config/config/app-env; runtime errors do not satisfy the sandbox-api resource-missing classifier.
Issuer and ordinary runtime-update failures propagate without deleting or stopping the retained sandbox.
The workspace authority boundary remains explicit; consumers supply issuance policy without duplicating lifecycle coordination.

The public SDK contract delegates reserved-key rejection to the runtime and states that updates affect new children and profile references.
Existing processes retain their environment, and runtime changes do not modify durable creation configuration.
The documented requirement for a matching deployed runtime is therefore material and appropriate.

Limits: this review inspected tests but did not run another suite alongside root-owned final-head signoff.
New tests cover creation, cached reuse, resume, issuer failure, rejected update, and empty maps.
They do not independently exercise every recovery branch or prove production runtime deployment and reserved-key enforcement.
Recovery ordering is supported by the shared finalizer in source; deployed behavior needs release/runtime evidence.
Environment shape relies on the typed callback and Sandbox boundary; the shell validator measures byte limits rather than duplicating runtime schema or reserved-key policy.
No source, Git state, or GitHub resources were changed by this reviewer.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.