test(onboard): centralize sandbox identity fixtures

ci/test-file-size-budget.json

@@ -8,7 +8,7 @@
     "test/generation/generate-openclaw-config.test.ts": 1898,
     "test/installer-integration/install-preflight.test.ts": 3025,
     "test/agents/openclaw/runtime/nemoclaw-start.test.ts": 4626,
-    "test/onboarding/onboard-messaging.test.ts": 1979,
+    "test/onboarding/onboard-messaging.test.ts": 1976,
     "test/onboarding/onboard-selection.test.ts": 4176
   }
 }

src/lib/onboard/__test-helpers__/sandbox-gpu-create-flow.ts

@@ -57,13 +57,13 @@ export function createGpuFlowInput(): SandboxGpuCreateFlowInput {
   };
 }
 
-export function createGpuFlowDeps(): SandboxGpuCreateFlowDeps {
+export function createGpuFlowDeps(sandboxId = "alpha-sandbox-id"): SandboxGpuCreateFlowDeps {
   return {
     runOpenshell: vi.fn((args: string[]) =>
       args[0] === "sandbox" && args[1] === "get"
         ? {
             status: 0,
-            stdout: "Name: alpha\nId: alpha-sandbox-id\nState: Ready\n",
+            stdout: `Name: alpha\nId: ${sandboxId}\nState: Ready\n`,
             stderr: "",
           }
         : { status: 0, stdout: "", stderr: "" },

src/lib/onboard/sandbox-gpu-create-flow.test.ts

@@ -346,12 +346,13 @@ describe("runSandboxGpuCreateFlow provider-owned managed create", () => {
       intendedWorkloadArgv: launch.intendedSandboxStartupCommand,
       expectedSupervisorArgv: ["/mxc/supervisor"],
     };
-    const deps = createDeps();
+    const sandboxId = "mxc-alpha";
+    const deps = createDeps(sandboxId);
     const adapterOverride = {} as never;
     deps.createManagedBootstrapAdapter = vi.fn(() => adapterOverride);
-    deps.runOpenshell = vi.fn(() => readySandboxGetResult("alpha-sandbox-id"));
+    deps.runOpenshell = vi.fn(() => readySandboxGetResult(sandboxId));
     vi.mocked(deps.runCaptureOpenshell).mockImplementation((args) =>
-      args[1] === "get" ? "ID: alpha-sandbox-id\n" : "alpha Ready",
+      args[1] === "get" ? `ID: ${sandboxId}\n` : "alpha Ready",
     );
     recoverUnfinished.mockRejectedValueOnce(new Error("unfinished recovery failed"));
 
@@ -422,7 +423,7 @@ describe("runSandboxGpuCreateFlow provider-owned managed create", () => {
     expect(mocks.streamSandboxCreate).not.toHaveBeenCalled();
     expect(errorOutput()).toContain("recovery stopped before sandbox 'alpha' was created");
     expect(errorOutput()).toContain("Transaction");
-    expect(errorOutput()).toContain("durable sandbox ID mxc-alpha");
+    expect(errorOutput()).toContain(`durable sandbox ID ${sandboxId}`);
     expect(errorOutput()).toContain("OpenShell's sandbox get command");
     expect(errorOutput()).toContain("never delete a runtime by mutable sandbox name");
     expect(errorOutput()).toContain("Authorization: Bearer <REDACTED>");

test/helpers/managed-image-buildless-e2e.ts

@@ -75,6 +75,7 @@ interface ChildPayload {
     agent?: string | null;
     dashboardPort?: number | null;
     imageTag?: string | null;
+    lifecycleLiveIdentityFingerprint?: string | null;
     name?: string;
     workload?: {
       schemaVersion?: number;
@@ -93,6 +94,7 @@ interface ChildPayload {
     };
   }>;
   runnerCommands: string[];
+  sandboxId: string;
   spawnCalls: SpawnCall[];
 }
 
@@ -149,7 +151,6 @@ const managedBootstrapCalls = [];
 const registerCalls = [];
 const runnerCommands = [];
 const spawnCalls = [];
-let sandboxCreated = recreate;
 let existingEntryAvailable = recreate;
 let registeredSandbox = null;
 let managedHermesVolume = recreate ? {
@@ -193,6 +194,12 @@ const replace = (target, name, value) => {
 const childProcess = require("node:child_process");
 const fixtureMocks = require(${source("test/helpers/onboard-script-mocks.cjs")});
 fixtureMocks.mockStandaloneGatewayTeardownAuthority();
+const createdSandbox = fixtureMocks.createCreatedSandboxFixture({
+  sandboxName,
+  sandboxId: "fixture-managed-sandbox",
+  lifecycleState: recreate ? "created" : "absent",
+});
+createdSandbox.installRuntimeObservation();
 
 const coreVersion = require(${source("src/lib/core/version.ts")});
 replace(coreVersion, "getVersion", () => catalogRelease);
@@ -420,16 +427,16 @@ runner.run = (command, options = {}) => {
   const argv = Array.isArray(command) ? command.map(String) : [];
   const normalized = normalize(command);
   runnerCommands.push(normalized);
-  sandboxCreated = normalized.includes("sandbox delete") ? false : sandboxCreated;
-  existingEntryAvailable = normalized.includes("sandbox delete") ? false : existingEntryAvailable;
+  if (
+    normalized.includes("sandbox delete") &&
+    createdSandbox.state.lifecycleState === "created"
+  ) {
+    createdSandbox.delete();
+    existingEntryAvailable = false;
+  }
   if (/(?:^|\s)docker(?:\s+buildx)?\s+build(?:\s|$)/u.test(normalized)) {
     return poison("docker build");
   }
-  if (normalized.includes("sandbox get") && normalized.includes(sandboxName)) {
-    return sandboxCreated
-      ? { status: 0, stdout: "Name: " + sandboxName + "\nId: fixture-managed-sandbox\n", stderr: "" }
-      : { status: 1, stdout: "", stderr: "sandbox not found" };
-  }
   if (argv[0] === "docker" && argv[1] === "volume") {
     const volumeName = argv.at(-1);
     if (argv[2] === "inspect") {
@@ -449,16 +456,13 @@ runner.run = (command, options = {}) => {
       return { status: 0, stdout: volumeName + "\n", stderr: "" };
     }
   }
-  return { status: 0, stdout: "", stderr: "" };
+  return createdSandbox.run(command) ?? { status: 0, stdout: "", stderr: "" };
 };
 runner.runFile = (file, args = []) => runner.run([file, ...args]);
 runner.runCapture = (command) => {
   const normalized = normalize(command);
   runnerCommands.push(normalized);
-  const createdIdentity = fixtureMocks.mockCreatedSandboxIdentityList(command, {
-    sandboxName,
-    sandboxId: "fixture-managed-sandbox",
-  });
+  const createdIdentity = createdSandbox.capture(command);
   if (createdIdentity !== null) return createdIdentity;
   if (normalized.includes("policy get") && normalized.includes("--output json")) {
     return JSON.stringify({
@@ -474,12 +478,6 @@ runner.runCapture = (command) => {
   if (normalized.includes("gateway info")) {
     return "Gateway endpoint: http://127.0.0.1:8080";
   }
-  if (normalized.includes("sandbox get") && normalized.includes(sandboxName)) {
-    return sandboxCreated
-      ? "Name: " + sandboxName + "\nId: fixture-managed-sandbox\nState: Ready"
-      : "";
-  }
-  if (normalized.includes("sandbox list")) return sandboxName + " Ready";
   if (normalized.includes("forward list")) {
     return sandboxName + " 127.0.0.1 18789 23189 running";
   }
@@ -543,7 +541,7 @@ const sourceEntry = recreate ? fixtureMocks.managedSandboxPolicyReceiptFixture({
     credentialProxyReplayRequired: true,
     shared: true,
   },
-}, { sandboxName, sandboxId: "fixture-managed-sandbox" }) : null;
+}, { sandboxName, sandboxId: createdSandbox.state.sandboxId }) : null;
 registry.getSandbox = () => registeredSandbox ?? (existingEntryAvailable ? sourceEntry : null);
 registry.getDefault = () => null;
 registry.listExtraProviders = () => [];
@@ -578,7 +576,13 @@ childProcess.spawn = (command, args = [], options = {}) => {
   if (/(?:^|\s)docker(?:\s+buildx)?\s+build(?:\s|$)/u.test(normalized)) {
     return poison("docker build");
   }
-  if (normalized.includes("sandbox create")) sandboxCreated = true;
+  if (normalized.includes("sandbox create")) {
+    if (createdSandbox.state.lifecycleState === "deleted") {
+      createdSandbox.recreate([command, ...argv]);
+    } else {
+      createdSandbox.create([command, ...argv]);
+    }
+  }
   spawnCalls.push({ command: String(command), args: argv });
   const child = new EventEmitter();
   child.stdout = new EventEmitter();
@@ -625,6 +629,7 @@ const { createSandbox } = require(${source("src/lib/onboard.ts")});
     managedBootstrapCalls,
     registerCalls,
     runnerCommands,
+    sandboxId: createdSandbox.state.sandboxId,
     spawnCalls,
   }));
 })().catch((error) => {
@@ -645,9 +650,6 @@ function writeRuntimeStubs(fakeBin: string, dockerLog: string): void {
       'if [ "${1:-}" = "policy" ] && [ "${2:-}" = "list" ] && [[ " $* " = *" --global "* ]]; then',
       '  printf "%s\\n" "No global policy history found" >&2',
       "fi",
-      'if [ "${1:-}" = "sandbox" ] && [ "${2:-}" = "get" ]; then',
-      '  printf "Sandbox:\\n\\n  Id: fixture-managed-sandbox\\n  Name: %s\\n  Phase: Ready\\n" "${!#}"',
-      "fi",
       "exit 0",
       "",
     ].join("\n"),
@@ -878,6 +880,9 @@ function assertManagedLaunch(
     )}`,
   ).toBeDefined();
   expect(registration?.agent).toBe(agent);
+  expect(registration?.lifecycleLiveIdentityFingerprint).toBe(
+    createHash("sha256").update(result.payload.sandboxId).digest("hex"),
+  );
   if (agent === "langchain-deepagents-code") {
     expect(registration?.dashboardPort).toBe(0);
   }