fix(tasks): fail closed on unconfirmed MCP rebind for unknown bindings

The session marker self-expires at half the OAuth token lifetime, so an absent
marker can mean the previous actor's session is still live, not that the sandbox
is fresh. Treating that as a best-effort first bind delivered a new actor's
follow-up under the previous actor's credentials when the mint or refresh failed
in the marker-expired window. Fail closed whenever a rebind can't be confirmed,
not only on a known transition.

Author: VojtechBartos

products/tasks/backend/temporal/process_task/activities/send_followup_to_sandbox.py

@@ -263,11 +263,14 @@ def _refresh_sandbox_mcp(
 ) -> bool:
     """Rebind the sandbox's MCP session to this message's actor.
 
-    Returns ``True`` when the session is safe to use (unchanged actor, first
-    bind, or a successful rebind) and ``False`` only when an actor *transition*
-    could neither rebind nor clear the previous actor's session — the caller
-    then fails the follow-up closed. Same-actor rotation and first binds stay
-    best-effort. Retries the refresh once before giving up.
+    Returns ``True`` when the session is safe to use (unchanged actor or a
+    successful rebind) and ``False`` when a rebind could not be confirmed — the
+    caller then fails the follow-up closed. A rebind is unconfirmed whenever the
+    mint or refresh fails and the binding is not known to be this actor's,
+    including an *unknown* binding: the marker self-expires at half the token
+    lifetime, so an absent marker can mean the previous actor's session is still
+    live, not that the sandbox is fresh. Retries the refresh once before giving
+    up.
     """
     run_id = str(task_run.id)
     if actor_user is None:
@@ -293,7 +296,7 @@ def _refresh_sandbox_mcp(
         access_token = create_oauth_access_token_for_run(task_run.task, state, scopes=scopes)
     except Exception as e:
         logger.warning("refresh_mcp_token_mint_failed", run_id=run_id, error=str(e))
-        return not is_transition  # first-bind: best-effort; transition: fail closed
+        return False  # rebind unconfirmed → fail closed (unknown binding may hide a live session)
 
     mcp_configs = get_sandbox_ph_mcp_configs(
         token=access_token,
@@ -372,7 +375,7 @@ def _refresh_sandbox_mcp(
         error=retry.error,
         status_code=retry.status_code,
     )
-    return not is_transition  # transition that never rebound → fail closed
+    return False  # rebind never confirmed → fail closed (unknown binding may hide a live session)
 
 
 def _get_stop_reason(result_data: dict[str, Any] | None) -> str:

products/tasks/backend/temporal/process_task/tests/test_send_followup_to_sandbox.py

@@ -223,11 +223,13 @@ def test_transition_refresh_failure_reports_unsafe(
         assert safe is False
         assert get_sandbox_mcp_session_user("run-1") == 99
 
-    def test_first_bind_refresh_failure_stays_best_effort(
+    def test_unknown_binding_refresh_failure_fails_closed(
         self, mock_oauth, mock_ph_configs, mock_user_configs, mock_send_refresh, _sleep
     ):
-        # No prior binding: a refresh failure is non-fatal (no earlier actor's
-        # session to leak), so the gate reports safe and delivery proceeds.
+        # No marker for this scope: the marker self-expires before the OAuth
+        # session does, so an absent one may hide the previous actor's still-live
+        # session rather than a fresh sandbox. When the refresh can't confirm the
+        # rebind, the gate reports unsafe so the caller fails closed.
         mock_oauth.return_value = "fresh-token"
         mock_ph_configs.return_value = [_make_mcp_config()]
         mock_user_configs.return_value = []
@@ -236,7 +238,7 @@ def test_first_bind_refresh_failure_stays_best_effort(
         actor = MagicMock(id=42)
         safe = _refresh_sandbox_mcp(_make_task_run_mock(), "read_only", None, actor_user=actor, state=None)
 
-        assert safe is True
+        assert safe is False
 
 
 @patch("products.tasks.backend.temporal.process_task.activities.send_followup_to_sandbox.send_refresh_session")