fix(mcp): bind lifecycle operations to sandbox target

src/lib/actions/sandbox/mcp-bridge-adapter-teardown.test.ts

@@ -42,6 +42,10 @@ vi.mock("./mcp-bridge-provider", () => ({
   assertNoProviderCredentialCollisions: vi.fn(),
   assertNoRegisteredProviderCredentialCollisions: vi.fn(),
   detachProvider: vi.fn(),
+  getMcpProviderInspectionRuntimeSelection: vi.fn(() => ({
+    gatewayName: "nemoclaw-8091",
+    workspace: "default",
+  })),
   inspectMcpProvider: mocks.inspectMcpProvider,
   preflightMcpEntryTargets: vi.fn(),
   waitForDetachedMcpCredential: vi.fn(),

src/lib/actions/sandbox/mcp-bridge-add-restart.ts

@@ -39,6 +39,7 @@ import {
   detachMissingProviderReference,
   detachProvider,
   ensureMcpBridgeProviderProfile,
+  getMcpProviderInspectionRuntimeSelection,
   inspectMcpProvider,
   type McpCredentialRevisionObservation,
   observeMcpCredentialRevision,
@@ -96,6 +97,7 @@ function assertPreparedMcpAddResourcesAbsent(
   adapter: AgentMcpAdapter,
   entry: McpBridgeEntry,
   target: McpBridgeTargetValidation,
+  providerRuntimeSelection: ReturnType<typeof getMcpProviderInspectionRuntimeSelection>,
 ): void {
   const adapterInspection = inspectAgentAdapterRegistration(sandboxName, adapter, entry);
   if (adapterInspection.state !== "absent") {
@@ -108,7 +110,7 @@ function assertPreparedMcpAddResourcesAbsent(
     );
   }
 
-  const providerInspection = inspectMcpProvider(entry.providerName);
+  const providerInspection = inspectMcpProvider(entry.providerName, providerRuntimeSelection);
   if (providerInspection.exists !== false) {
     const detail =
       providerInspection.exists === null
@@ -185,6 +187,7 @@ async function addMcpBridgeUnlocked(
   }
   const matchingTrustedPrivateHosts = allTrustedPrivateHosts.filter((host) => host === urlHost);
   const sandbox = getSandboxOrThrow(sandboxName);
+  const providerRuntimeSelection = getMcpProviderInspectionRuntimeSelection(sandbox);
   assertMcpDestroyNotPending(sandbox);
   const agent = getSandboxAgent(sandbox);
   const adapter = getBridgeAdapter(agent);
@@ -311,7 +314,7 @@ async function addMcpBridgeUnlocked(
       // Publish the durable MCP reservation under the same cross-command lock
       // used by credentials add. Neither command can pass its collision check
       // before the other records its credential-key reservation.
-      assertNoProviderCredentialCollisions(sandboxName, [entry]);
+      assertNoProviderCredentialCollisions(sandboxName, [entry], providerRuntimeSelection);
       writeBridgeEntry(sandboxName, entry);
     });
   }
@@ -323,7 +326,7 @@ async function addMcpBridgeUnlocked(
   try {
     let detachedMissingProviderReference = false;
     if (resumingPreflightedAdd) {
-      const providerInspection = inspectMcpProvider(entry.providerName);
+      const providerInspection = inspectMcpProvider(entry.providerName, providerRuntimeSelection);
       if (providerInspection.exists === null) {
         throw new McpBridgeError(
           providerInspection.error ??
@@ -337,7 +340,7 @@ async function addMcpBridgeUnlocked(
         // one recovery side effect that must precede the image capability
         // probe. It neither reads nor replaces credential material, and the
         // durable add manifest retains ownership if the later probe fails.
-        detachMissingProviderReference(sandboxName, entry);
+        detachMissingProviderReference(sandboxName, entry, providerRuntimeSelection);
         detachedMissingProviderReference = true;
       }
     }
@@ -350,15 +353,21 @@ async function addMcpBridgeUnlocked(
         // A retry may reuse an exact provider without re-exporting its secret,
         // but recreating a missing provider cannot. This check and any owned
         // policy cleanup happen only after the running-image capability probe.
-        assertMcpProviderRecoverable(entry);
+        assertMcpProviderRecoverable(entry, providerRuntimeSelection);
       } catch (error) {
         removeGeneratedPolicy(sandboxName, entry, { bestEffort: true });
         throw error;
       }
     }
 
     if (entry.addState === "prepared") {
-      assertPreparedMcpAddResourcesAbsent(sandboxName, adapter, entry, target);
+      assertPreparedMcpAddResourcesAbsent(
+        sandboxName,
+        adapter,
+        entry,
+        target,
+        providerRuntimeSelection,
+      );
       entry = { ...entry, addState: "preflighted" };
       // This second durable boundary proves the derived resource names and the
       // adapter slot were absent before any side effect. After a crash, retries
@@ -381,8 +390,8 @@ async function addMcpBridgeUnlocked(
     // Credential keys are sandbox-global. Prove this key is not already
     // supplied by a foreign attachment before opening its MCP route, then check
     // again after provider creation to close the intervening race.
-    assertNoProviderCredentialCollisions(sandboxName, [entry]);
-    ensureMcpBridgeProviderProfile();
+    assertNoProviderCredentialCollisions(sandboxName, [entry], providerRuntimeSelection);
+    ensureMcpBridgeProviderProfile(providerRuntimeSelection);
     // Load the real protocol:mcp policy without a credential binding before
     // provider mutation. OpenShell requires the endpointless provider to be
     // attached before it accepts credential_binding.provider, and withholds
@@ -395,6 +404,7 @@ async function addMcpBridgeUnlocked(
       // provider whose immutable ID was already persisted by this add.
       allowExisting: resumingPreflightedAdd,
       expectedProviderId: entry.providerId,
+      runtimeSelection: providerRuntimeSelection,
       prepareMutation: (action) => {
         // A fresh create has no prior revision to compare. Observe only the
         // bounded placeholder classification for an actual update, after the
@@ -418,14 +428,14 @@ async function addMcpBridgeUnlocked(
       // adapter mutations. A process death before this write fails closed.
       writeBridgeEntry(sandboxName, entry);
     }
-    assertNoProviderCredentialCollisions(sandboxName, [entry]);
+    assertNoProviderCredentialCollisions(sandboxName, [entry], providerRuntimeSelection);
     if (providerResult.action === "updated" && previousCredentialRevision === undefined) {
       throw new McpBridgeError(
         `Could not retain the prior OpenShell credential revision for provider '${entry.providerName}'.`,
       );
     }
     providerAttachAttempted = true;
-    attachProvider(sandboxName, entry);
+    attachProvider(sandboxName, entry, providerRuntimeSelection);
     applyGeneratedPolicy(sandboxName, entry, target);
     let refreshedAfterObservedAbsence = false;
     let credentialRevision = waitForAttachedMcpCredential(sandboxName, entry, {
@@ -455,8 +465,11 @@ async function addMcpBridgeUnlocked(
           allowExisting: true,
           expectedProviderId: entry.providerId,
           requireExisting: true,
+          runtimeSelection: providerRuntimeSelection,
         });
-        if (republished.action !== "updated") refreshMcpProviderEnvironment(entry);
+        if (republished.action !== "updated") {
+          refreshMcpProviderEnvironment(entry, providerRuntimeSelection);
+        }
       },
     });
     if (Object.hasOwn(adapterEnvValues, entry.env[0]) && !refreshedAfterObservedAbsence) {
@@ -469,6 +482,7 @@ async function addMcpBridgeUnlocked(
         allowExisting: true,
         expectedProviderId: entry.providerId,
         requireExisting: true,
+        runtimeSelection: providerRuntimeSelection,
       });
       credentialRevision = waitForAttachedMcpCredential(sandboxName, entry, {
         previousRevision: credentialRevision,
@@ -492,7 +506,7 @@ async function addMcpBridgeUnlocked(
   } catch (error) {
     const rollbackProviderInspection =
       (providerAttachAttempted || providerCreated) && entry.providerId
-        ? inspectMcpProvider(providerName)
+        ? inspectMcpProvider(providerName, providerRuntimeSelection)
         : undefined;
     const rollbackProviderOwned =
       !!rollbackProviderInspection &&
@@ -508,7 +522,10 @@ async function addMcpBridgeUnlocked(
       removeGeneratedPolicy(sandboxName, entry, { bestEffort: true });
     }
     const detachOutcome = providerAttachAttempted
-      ? detachProvider(sandboxName, entry, { bestEffort: true })
+      ? detachProvider(sandboxName, entry, {
+          bestEffort: true,
+          runtimeSelection: providerRuntimeSelection,
+        })
       : "absent";
     let reservationCleanupProved = !providerAttachAttempted;
     if (providerAttachAttempted && detachOutcome !== "unknown") {
@@ -520,9 +537,13 @@ async function addMcpBridgeUnlocked(
       }
     }
     if (providerCreated && rollbackProviderOwned && reservationCleanupProved) {
-      const beforeDelete = inspectMcpProvider(providerName);
+      const beforeDelete = inspectMcpProvider(providerName, providerRuntimeSelection);
       if (providerMatchesCredential(beforeDelete, entry.env[0], entry.providerId)) {
-        deleteProvider(entry, { allowMissing: true, bestEffort: true });
+        deleteProvider(entry, {
+          allowMissing: true,
+          bestEffort: true,
+          runtimeSelection: providerRuntimeSelection,
+        });
       }
     }
     // Exception rollback is best-effort and process death skips it entirely.

src/lib/actions/sandbox/mcp-bridge-destroy-preflight.ts

@@ -10,7 +10,9 @@ import {
   removeGeneratedPolicy,
 } from "./mcp-bridge-policy";
 import {
+  getMcpProviderInspectionRuntimeSelection,
   inspectMcpProvider,
+  type McpProviderInspectionRuntimeSelection,
   type McpProviderInspection,
   providerMatchesManagedCredential,
   providerShapeDetail,
@@ -71,13 +73,14 @@ export async function discardSafeIncompleteMcpAdds(
     (entry) => entry.addState === "preflighted" && !entry.providerId,
   );
   if (providerlessCandidates.length > 0) await ensureSandboxGatewaySelected(sandboxName);
+  const providerRuntimeSelection = getMcpProviderInspectionRuntimeSelection(sandbox);
   const remainingEntries: Array<[string, McpBridgeEntry]> = [];
   const providerlessPreflighted: McpBridgeEntry[] = [];
   for (const [server, entry] of Object.entries(bridges)) {
     if (entry.addState === "prepared") continue;
     if (entry.addState === "preflighted" && !entry.providerId) {
       assertAuthenticatedBridgeEntry(entry);
-      const inspection = inspectMcpProvider(entry.providerName);
+      const inspection = inspectMcpProvider(entry.providerName, providerRuntimeSelection);
       if (inspection.exists === false) {
         providerlessPreflighted.push(entry);
         continue;
@@ -122,15 +125,19 @@ export function assertMcpDestroySnapshotCurrent(
 
 export function inspectExactMcpDestroyProvider(
   entry: McpBridgeEntry,
-  options: { allowMissing: boolean; force?: boolean },
+  options: {
+    allowMissing: boolean;
+    force?: boolean;
+    runtimeSelection: McpProviderInspectionRuntimeSelection;
+  },
 ): McpProviderInspection {
   assertAuthenticatedBridgeEntry(entry);
   if (!entry.providerId) {
     throw new McpBridgeError(
       `MCP server '${entry.server}' has no stable OpenShell provider ID. Refusing destructive cleanup of same-name provider '${entry.providerName}'. Remove the legacy bridge with --force only after independently cleaning that provider.`,
     );
   }
-  const inspection = inspectMcpProvider(entry.providerName);
+  const inspection = inspectMcpProvider(entry.providerName, options.runtimeSelection);
   if (inspection.exists === null) {
     throw new McpBridgeError(
       inspection.error ?? `Could not inspect OpenShell provider '${entry.providerName}'.`,
@@ -169,8 +176,13 @@ export async function prepareMcpBridgesForAbsentSandboxDestroy(
   const entries = Object.values(bridgeState(sandbox)).map(cloneMcpBridgeEntry);
   const destroyAlreadyPrepared = !!sandbox.mcp?.destroyPreparedAt;
   const destroyAlreadyPending = !!sandbox.mcp?.destroyPendingAt;
+  const providerRuntimeSelection = getMcpProviderInspectionRuntimeSelection(sandbox);
   for (const entry of entries) {
-    inspectExactMcpDestroyProvider(entry, { allowMissing: true, force: options.force });
+    inspectExactMcpDestroyProvider(entry, {
+      allowMissing: true,
+      force: options.force,
+      runtimeSelection: providerRuntimeSelection,
+    });
   }
   return {
     entries,

src/lib/actions/sandbox/mcp-bridge-destroy.ts

@@ -20,6 +20,7 @@ import {
 import {
   deleteProvider,
   detachProvider,
+  getMcpProviderInspectionRuntimeSelection,
   inspectMcpProvider,
   waitForDetachedMcpCredential,
 } from "./mcp-bridge-provider";
@@ -70,6 +71,7 @@ export async function prepareMcpBridgesForDestroy(
   );
   const sandbox = await discardSafeIncompleteMcpAdds(sandboxName, currentSandbox);
   const entries = Object.values(bridgeState(sandbox)).map(cloneMcpBridgeEntry);
+  const providerRuntimeSelection = getMcpProviderInspectionRuntimeSelection(sandbox);
   const destroyAlreadyPrepared = !!sandbox.mcp?.destroyPreparedAt;
   const destroyAlreadyPending = !!sandbox.mcp?.destroyPendingAt;
   const incompleteAdd = entries.find((entry) => entry.addState === "preflighted");
@@ -94,6 +96,7 @@ export async function prepareMcpBridgesForDestroy(
   for (const entry of entries) {
     inspectExactMcpDestroyProvider(entry, {
       allowMissing: destroyAlreadyPending,
+      runtimeSelection: providerRuntimeSelection,
     });
   }
   if (destroyAlreadyPending) {
@@ -132,8 +135,14 @@ export async function prepareMcpBridgesForDestroy(
       removedPolicies.push(entry);
     }
     for (const entry of entries) {
-      inspectExactMcpDestroyProvider(entry, { allowMissing: false });
-      const detachOutcome = detachProvider(sandboxName, entry, { allowLegacyGeneric: true });
+      inspectExactMcpDestroyProvider(entry, {
+        allowMissing: false,
+        runtimeSelection: providerRuntimeSelection,
+      });
+      const detachOutcome = detachProvider(sandboxName, entry, {
+        allowLegacyGeneric: true,
+        runtimeSelection: providerRuntimeSelection,
+      });
       if (detachOutcome === "unknown") {
         throw new McpBridgeError(
           `Could not prove provider detach for MCP server '${entry.server}'.`,
@@ -224,6 +233,7 @@ export async function restoreMcpBridgesAfterDestroyAbort(
     return;
   }
   const preparedSandbox = assertMcpDestroySnapshotCurrent(sandboxName, preparation.entries);
+  const providerRuntimeSelection = getMcpProviderInspectionRuntimeSelection(preparedSandbox);
   const destroyPreparedAt = preparedSandbox.mcp?.destroyPreparedAt ?? nowIso();
   const cleared = registry.updateSandbox(sandboxName, {
     mcp: {
@@ -244,7 +254,10 @@ export async function restoreMcpBridgesAfterDestroyAbort(
     // Reattach only the exact existing providers. This restoration path never
     // reads host secret values and therefore cannot rotate preserved credentials.
     for (const entry of preparation.entries)
-      inspectExactMcpDestroyProvider(entry, { allowMissing: false });
+      inspectExactMcpDestroyProvider(entry, {
+        allowMissing: false,
+        runtimeSelection: providerRuntimeSelection,
+      });
     await restoreExistingMcpBridgeRuntime(sandboxName, preparation.entries, {
       lifecyclePhase: "teardown-rollback",
     });
@@ -292,6 +305,7 @@ export async function finalizeMcpBridgesAfterSandboxDelete(
   await ensureSandboxGatewaySelected(sandboxName);
 
   const sandbox = assertMcpDestroySnapshotCurrent(sandboxName, entries);
+  const providerRuntimeSelection = getMcpProviderInspectionRuntimeSelection(sandbox);
   if (!sandbox.mcp?.destroyPendingAt) {
     const marked = registry.updateSandbox(sandboxName, {
       mcp: {
@@ -319,17 +333,23 @@ export async function finalizeMcpBridgesAfterSandboxDelete(
     inspectExactMcpDestroyProvider(entry, {
       allowMissing: true,
       force: options.force,
+      runtimeSelection: providerRuntimeSelection,
     }),
   );
   for (const [index, entry] of entries.entries()) {
     if (!inspections[index]?.exists) continue;
     const beforeDelete = inspectExactMcpDestroyProvider(entry, {
       allowMissing: true,
       force: options.force,
+      runtimeSelection: providerRuntimeSelection,
     });
     if (!beforeDelete.exists) continue;
-    deleteProvider(entry, { allowLegacyGeneric: true, allowMissing: true });
-    const after = inspectMcpProvider(entry.providerName);
+    deleteProvider(entry, {
+      allowLegacyGeneric: true,
+      allowMissing: true,
+      runtimeSelection: providerRuntimeSelection,
+    });
+    const after = inspectMcpProvider(entry.providerName, providerRuntimeSelection);
     if (after.exists !== false) {
       throw new McpBridgeError(
         after.error ??

src/lib/actions/sandbox/mcp-bridge-hermes-reconciliation.test.ts

@@ -45,6 +45,7 @@ function sandbox(overrides: Partial<SandboxEntry> = {}): SandboxEntry {
   return {
     name: "alpha",
     agent: "hermes",
+    gatewayName: "nemoclaw-8091",
     mcp: {
       bridges: { github: entry },
       managedServerNames: ["github", "retired"],
@@ -101,7 +102,11 @@ describe("Hermes MCP host reconciliation", () => {
       absent: ["retired"],
     });
     expect(JSON.stringify(args)).not.toContain("host-only-secret");
-    expect(options).toMatchObject({ ignoreError: true, timeout: 60_000 });
+    expect(options).toMatchObject({
+      ignoreError: true,
+      runtimeSelection: { gatewayName: "nemoclaw-8091", workspace: "default" },
+      timeout: 60_000,
+    });
   });
 
   it("requires the observed credential revision during status reconciliation (#10079)", () => {

src/lib/actions/sandbox/mcp-bridge-hermes-reconciliation.ts

@@ -11,6 +11,7 @@ import {
 } from "./mcp-bridge-adapter-status";
 import { McpBridgeError } from "./mcp-bridge-contracts";
 import { redactBridgeSecretsForDisplay } from "./mcp-bridge-output";
+import { getMcpProviderInspectionRuntimeSelection } from "./mcp-bridge-provider-inspection";
 import type { McpAttachedCredentialRevision } from "./mcp-bridge-provider-readiness";
 import { sleepMcpBridgeRetry } from "./mcp-bridge/timing";
 
@@ -161,10 +162,12 @@ export function inspectHermesMcpRuntimeIntent(
     managedServerNames,
     options.credentialRevisions,
   );
+  const runtimeSelection = getMcpProviderInspectionRuntimeSelection(sandbox);
   let result: ReturnType<typeof runOpenshellProviderCommand>;
   try {
     result = runOpenshellProviderCommand(buildInspectArgs(sandboxName, JSON.stringify(payload)), {
       ignoreError: true,
+      runtimeSelection,
       stdio: ["ignore", "pipe", "pipe"],
       timeout: HERMES_MCP_INSPECT_TIMEOUT_MS,
     });