3. Output logs, tokens, and push receipts on the server: **output logs

   demonstrated live**; tokens not applicable (no model turn); **push

   receipts blocked** by the credentialed-dispatch failure above.

## 8. Server-side Box fixes and live verification (2026-08-25)

Three defects named in §7 and in openagents#58 were fixed on the server. Boxes

`bx_732ts8jg` and `bx_se9xfq7q` on conversation `3dd6d813` carried the

verification; both were stopped afterwards, peak concurrency 2.

### Setup script: configuration first, pinned artifact, PATH the run sees

`OpenAgents.Box.setup_script/0` piped `https://opencode.ai/install` into bash.

That installer resolves its version through the unauthenticated GitHub API,

which answers 403 for the provider's shared egress IP, and the whole script

runs under `set -euo pipefail`, so one rate-limited lookup cost the box both

the binary and the `opencode.json` write that followed it.

The script now writes the configuration first, fetches a pinned release

tarball directly (`releases/download/v1.18.23/opencode-<target>.tar.gz`, arch

resolved from `uname -m`), retries a refused fetch twice before failing loudly,

and symlinks the binary into `$HOME/.local/bin` — already on the PATH a

non-interactive `sh -c` run gets, which the installer's

`$HOME/.opencode/bin` plus a shell-rc `export PATH` line never was.

Verified on `bx_se9xfq7q`: with `~/.opencode`, `~/.local/bin/opencode`, and

`~/.config/opencode` deleted, the rendered script exits 0 and

`sh -c 'command -v opencode && opencode --version'` answers

`/home/user/.local/bin/opencode` and `1.18.23`. An `opencode run` in that state

returns `> build · stealth/ox-alpha` and the model's reply, with

`OPENROUTER_API_KEY` supplied by the box environment as before.

Verified on `bx_732ts8jg`: the same script pointed at an unreachable release

tag retries twice, exits 1 — so `setup_status` still reports `failed` honestly

— and leaves `opencode.json` intact with no binary.

### Conversation bootstrap a box token can reach

`GET /api/v1/conversation` under the `box_control_api` pipeline answers

`conversation_id` for the calling account, creating the conversation when the

account has none. Confirmed against production that a `box:control`-only token

is refused `401` on `GET /api/v1/user`, which is why a route of its own exists

rather than a field added there.

The field is deliberately not on `/api/v1/user`. That response is

GitHub-shaped, and API-001 holds every OpenAgents field there to a namespaced

`openagents` object, which is not what `BoxClient.resolveConversationId` reads.

One canonical route carries it at the top level instead. The CLI change that

follows this is a one-line reader retarget in the `openagents` monorepo; the

body shape already matches what the probe expects.

### Credentialed dispatch: the provider command API has no `env`

The provider's published `CommandRequest` schema is `command`, `cwd`,

`timeoutSeconds`, and `detached`. There is no `env`, so

`OpenAgents.Box.Client.dispatch_run/5` sent a field that was accepted with the

request and dropped. The wrapper then read `$OPENAGENTS_FORGE_TOKEN` under

`set -u` and died on the unbound variable before printing a pid — the

`box_response_invalid` of §7. Reproduced exactly on `bx_732ts8jg`: the same

wrapper with the variable unset returns HTTP 2xx, `exit_code` 1, empty stdout,

and `bash: line 12: OPENAGENTS_FORGE_TOKEN: unbound variable`.

`env` on box *create* is a different endpoint and does work, which is how

`OPENROUTER_API_KEY` reaches a box. It is not available here: an assignment

credential is minted per attempt, long after its box exists, and

`PATCH /boxes/{id}` takes only `name`, `ttlSeconds`, and `subdomain`. So the

credential now travels inside the dispatch command, base64 only so a token

cannot break the surrounding shell quoting. The cost is explicit: the

credential is in the provider's request body and in whatever the provider logs

of it. It is not in `box_runs.command`, which holds the caller's script and

never sees this wrapper, and an assignment credential is short-lived and scoped

to one branch of one repository.

A 2xx that carries no pid now logs a bounded operational event — response keys,

exit code, output sizes, and one truncated stderr line with the credential

struck out by exact match — instead of a bare atom.

Verified on `bx_732ts8jg` with a stand-in credential: dispatch returns a

parseable pid, the run root is created, the detached child runs under

`GIT_CONFIG_GLOBAL` pointing at the run's own gitconfig, `git credential fill`

for `https://openagents.com` presents `username=x` and the password, the exit

sentinel is written, and `forge-credential` and `gitconfig` are removed when

the run ends.

A push receipt is still not demonstrated. It needs a real assignment

credential, which `Forge.Assignments.create/1` mints server-side and never

returns to an API caller, so it cannot be exercised until this change is

deployed. Every step before the authenticated git handshake is demonstrated

live above.

  before any request leaves the host. Desktop and viewer URLs never pass

  through this module: no function requests them, so a token-bearing URL

  cannot reach a caller or a log.

  One secret does leave here by design. `dispatch_run/5` puts an assignment's

  Git credential in the command it sends, because the provider's command API

  takes no environment map and a box environment can only be set at create.

  That function says why the channel is what it is and what bounds it. No log

  this module writes carries that credential: the one path that reads a failed

  dispatch response strikes it out by exact match first.

  """

  require Logger

  @default_base_url "https://ascii.dev/api/box/v1"

  @box_id_pattern ~r/^bx_[23456789abcdefghjkmnpqrstuvwxyz]{8}$/

             "command" => dispatch_command(run_id, command, run_directory),

             "timeoutSeconds" => 30

           }),

         {:ok, pid} <- dispatch_pid(body) do

         {:ok, pid} <- dispatch_pid_logged(body, box_id, run_id) do

      {:ok, pid}

    end

  end

  def dispatch_run(box_id, run_id, command, run_directory, nil),

    do: dispatch_run(box_id, run_id, command, run_directory)

  # The credential travels inside the dispatch command, not beside it. The

  # provider's `CommandRequest` schema is `command`, `cwd`, `timeoutSeconds`,

  # and `detached` — there is no `env`, so an `env` map was accepted with the

  # rest of the request and dropped. The wrapper then read

  # `$OPENAGENTS_FORGE_TOKEN` under `set -u`, died on the unbound variable, and

  # printed no pid, which is the `box_response_invalid` this replaces.

  #

  # `env` on box *create* is a different endpoint and does work, and it is the

  # better channel because the secret never enters a command request. It is not

  # available here: an assignment credential is minted per attempt, long after

  # its box exists, and `PATCH /boxes/{id}` takes only `name`, `ttlSeconds`,

  # and `subdomain`. So this is the documented fallback, and its cost is

  # explicit — the credential is in the provider's request body and in whatever

  # the provider logs of it. It is not in `box_runs.command`, which holds the

  # caller's script and never sees this wrapper, and it is base64 only so that

  # a token cannot break the surrounding shell quoting. That is encoding, not

  # protection. An assignment credential is short-lived and scoped to one

  # branch of one repository, which is what bounds the exposure.

  def dispatch_run(box_id, run_id, command, run_directory, credential)

      when is_binary(box_id) and is_binary(run_id) and is_binary(command) and

             is_binary(run_directory) and is_binary(credential) do

    with {:ok, body} <-

           command(box_id, %{

             "command" => dispatch_command(run_id, command, run_directory, true),

             "timeoutSeconds" => 30,

             "env" => %{"OPENAGENTS_FORGE_TOKEN" => credential}

             "command" => dispatch_command(run_id, command, run_directory, credential),

             "timeoutSeconds" => 30

           }),

         {:ok, pid} <- dispatch_pid(body) do

         {:ok, pid} <- dispatch_pid_logged(body, box_id, run_id, credential) do

      {:ok, pid}

    end

  end

  end

  defp dispatch_command(run_id, command, run_directory) do

    dispatch_command(run_id, command, run_directory, false)

    dispatch_command(run_id, command, run_directory, nil)

  end

  defp dispatch_command(run_id, command, run_directory, with_credential) do

  defp dispatch_command(run_id, command, run_directory, credential) do

    root = run_root(run_id, run_directory)

    encoded = Base.encode64(command)

    with_credential = is_binary(credential)

    credential_setup =

      if with_credential do

        encoded_credential = Base.encode64("https://x:#{credential}@openagents.com\n")

        """

        umask 077

        printf 'https://x:%s@openagents.com\\n' "$OPENAGENTS_FORGE_TOKEN" > "$root/forge-credential"

        printf '%s' '#{encoded_credential}' | base64 -d > "$root/forge-credential"

        git config --file="$root/gitconfig" credential.helper "store --file=$root/forge-credential"

        unset OPENAGENTS_FORGE_TOKEN

        """

      else

        ""

  defp run_root(run_id, nil), do: "$HOME/.openagents/box-runs/#{run_id}"

  defp run_root(_run_id, run_directory), do: run_directory

  defp dispatch_pid_logged(body, box_id, run_id, credential \\ nil) do

    case dispatch_pid(body) do

      {:ok, pid} ->

        {:ok, pid}

      {:error, :box_response_invalid} = error ->

        log_dispatch_refusal(body, box_id, run_id, credential)

        error

    end

  end

  # A 2xx whose body carries no pid used to be a bare atom, which said nothing

  # about whether the provider refused the request or the wrapper ran and

  # failed. Those are opposite diagnoses, and the exit code plus the first line

  # of stderr separates them in one look.

  #

  # This is an operational event, so it stays bounded and carries no raw

  # command result: the response's top-level keys, the exit code, output sizes,

  # and one truncated stderr line with the assignment credential struck out by

  # exact match. The credential is the one secret that can reach this path, and

  # this function is the one place that holds it.

  defp log_dispatch_refusal(body, box_id, run_id, credential) do

    body = if is_map(body), do: body, else: %{}

    Logger.warning(

      "box_dispatch_response_invalid box_id=#{box_id} run_id=#{run_id} " <>

        "keys=#{body |> Map.keys() |> Enum.sort() |> Enum.join(",")} " <>

        "exit_code=#{inspect(body["exit_code"] || body["exitCode"])} " <>

        "stdout_bytes=#{output_bytes(body["stdout"])} " <>

        "stderr_bytes=#{output_bytes(body["stderr"])} " <>

        "timed_out=#{inspect(body["timed_out"] || body["timedOut"])} " <>

        "stderr_head=#{inspect(stderr_head(body["stderr"], credential))}"

    )

  end

  defp output_bytes(value) when is_binary(value), do: byte_size(value)

  defp output_bytes(_value), do: 0

  defp stderr_head(stderr, credential) when is_binary(stderr) do

    stderr

    |> redact(credential)

    |> String.split("\n", parts: 2)

    |> List.first()

    |> String.slice(0, 200)

  end

  defp stderr_head(_stderr, _credential), do: ""

  defp redact(text, credential) when is_binary(credential) and credential != "",

    do: String.replace(text, credential, "[redacted]")

  defp redact(text, _credential), do: text

  defp dispatch_pid(%{"stdout" => output}) when is_binary(output) do

    case Regex.run(~r/(?:\A|\n)(\d+)\s*\z/, output) do

      [_, pid] -> {:ok, String.to_integer(pid)}

  test "dispatch uses one detached mkdir-and-launch command", do: begin_dispatch()

  test "assignment dispatch keeps credential setup outside the child shell" do

  test "assignment dispatch carries the credential in the command, never in env" do

    token = "oa_assignment_11111111-1111-4111-8111-111111111111.secret-token"

    run_directory = "/home/box-user/.openagents/box-runs"

    Req.Test.expect(__MODULE__, fn request ->

      command = request.body_params["command"]

      assert request.body_params["env"] == %{"OPENAGENTS_FORGE_TOKEN" => token}

      # The provider's CommandRequest schema has no `env`, so a credential sent

      # there is dropped and the wrapper dies on an unbound variable.

      refute Map.has_key?(request.body_params, "env")

      refute command =~ "OPENAGENTS_FORGE_TOKEN"

      # The credential reaches the box inside the command, base64 only so a

      # token cannot break the surrounding shell quoting.

      refute command =~ token

      assert command =~ Base.encode64("https://x:#{token}@openagents.com\n")

      assert command =~ "root=#{run_directory}"

      assert command =~ ~s(> "$root/forge-credential")

      assert command =~ ~s(git config --file="$root/gitconfig")

      assert command =~ ~s(env GIT_CONFIG_GLOBAL="$root/gitconfig")

      assert command =~ "unset OPENAGENTS_FORGE_TOKEN"

      assert command =~ "umask 077"

      refute command =~ "credential_setup"

      script_path =

             )

  end

  test "the credential setup a box executes reconstructs the git credential file" do

    token = "oa_assignment_11111111-1111-4111-8111-111111111111.secret-token"

    encoded = Base.encode64("https://x:#{token}@openagents.com\n")

    assert {output, 0} =

             System.cmd("sh", ["-c", "printf '%s' '#{encoded}' | base64 -d"])

    assert output == "https://x:#{token}@openagents.com\n"

  end

  test "a 2xx without a pid is logged bounded and with the credential struck out" do

    token = "oa_assignment_11111111-1111-4111-8111-111111111111.secret-token"

    Req.Test.expect(__MODULE__, fn request ->

      Req.Test.json(request, %{

        "exit_code" => 1,

        "stdout" => "",

        "stderr" => "bash: line 12: refused with #{token}\nsecond line\n",

        "timed_out" => false

      })

    end)

    log =

      ExUnit.CaptureLog.capture_log(fn ->

        assert {:error, :box_response_invalid} =

                 Client.dispatch_run(

                   "bx_8bhkse3n",

                   "11111111-1111-4111-8111-111111111111",

                   "git push https://openagents.com/repo.git",

                   "/home/box-user/.openagents/box-runs",

                   token

                 )

      end)

    assert log =~ "box_dispatch_response_invalid"

    assert log =~ "box_id=bx_8bhkse3n"

    assert log =~ "run_id=11111111-1111-4111-8111-111111111111"

    assert log =~ "exit_code=1"

    assert log =~ "stdout_bytes=0"

    assert log =~ "[redacted]"

    refute log =~ token

    refute log =~ "second line"

  end

  test "an uncredentialed 2xx without a pid is logged without a credential" do

    Req.Test.expect(__MODULE__, fn request ->

      Req.Test.json(request, %{"exit_code" => 73, "stdout" => "OPENAGENTS_RUN_EXISTS\n"})

    end)

    log =

      ExUnit.CaptureLog.capture_log(fn ->

        assert {:error, :box_response_invalid} =

                 Client.dispatch_run(

                   "bx_8bhkse3n",

                   "11111111-1111-4111-8111-111111111111",

                   "echo detached"

                 )

      end)

    assert log =~ "box_dispatch_response_invalid"

    assert log =~ "exit_code=73"

    assert log =~ "keys=exit_code,stdout"

  end

  test "poll decodes bounded output from a recorded offset" do

    encoded = Base.encode64("hello")