@@ -8,6 +8,7 @@
  */
 import { spawn } from "child_process";
 import * as fs from "fs";
+import * as os from "os";
 import { writeExport } from "./exportStream";
 
 assertInSandbox(); // first: on a host, kill(-1) below hits every process of this user
@@ -71,7 +72,10 @@ job.on("error", (error) => {
   console.error(`sandbox entry: ${command}: ${error.message}`);
   done(127);
 });
-job.on("exit", (code, signal) => done(code ?? (signal != null ? 143 : 1)));
+// The shell convention, as the launcher's exitCode(): 128 + the signal number.
+job.on("exit", (code, signal) =>
+  done(code ?? (signal != null ? 128 + os.constants.signals[signal] : 1))
+);
 
 function assertInSandbox(): void {
   const init = fs.readFileSync("/proc/1/cmdline", "utf8");
 
@@ -2,11 +2,13 @@ import { expect, test } from "bun:test";
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
-import { appAi, containerEnv, outputDir, plainFolders } from "./launch";
+import { spawnSync } from "child_process";
+import { appAi, containerEnv, exactStepRefusal, exitCode, outputDir, plainFolders } from "./launch";
 
 test("the container env holds the allowlisted names, the fixed values and no host secret", () => {
   const host = {
     BUGBASH_AI_RESOLVED: "mock",
+    BUGBASH_AI_REASON: "https://user:pass@proxy.example/v1 unreachable",
     BUGBASH_MODEL: "anthropic:claude-sonnet-5-5",
     ANTHROPIC_API_KEY: "sk-ant-real",
     OPENAI_API_KEY: "sk-real",
@@ -76,3 +78,122 @@ test("a symlinked folder cannot lead a copy or an export out of the checkout", (
     fs.rmSync(outside, { recursive: true, force: true });
   }
 });
+
+test("a job that a signal ended exits 128 + the signal number", () => {
+  expect(exitCode(3, null)).toBe(3);
+  expect(exitCode(null, "SIGKILL")).toBe(137);
+  expect(exitCode(null, "SIGTERM")).toBe(143);
+});
+
+const BUGBASH_DIR = path.resolve(import.meta.dir, "..");
+const OUT = ["--output", ".e2e/launch-test"];
+const OK = ["run", "--config", "e2e.config.ts", ...OUT];
+// Each one would let e2e load another config or tests, or let a model pick actions.
+const NOT_EXACT: string[][] = [
+  ["run", "--config", "e2e.config.ts", "--config", "e2e.mcpapps.config.ts", ...OUT],
+  ["run", "--config=e2e.mcpapps.config.ts", ...OUT],
+  ["run", "--config", "./e2e.config.ts", ...OUT],
+  ["run", "--config", "../bugbash/e2e.config.ts", ...OUT],
+  ["run", "--config", "./tests/../e2e.config.ts", ...OUT],
+  ["run", "--config", "mcpapps/../e2e.config.ts", ...OUT],
+  [...OK, "--", "mcpapps/mcp-apps.e2e.ts"],
+  [...OK, "mcpapps/mcp-apps.e2e.ts"],
+  ["explore", "--config", "e2e.config.ts", ...OUT],
+  ["run", "explore", "--config", "e2e.config.ts", ...OUT],
+  [...OK, "explore"],
+  [...OK, "--agent", "explorer"],
+  [...OK, "--no-cache"],
+  ["run", "--tag", "--config", "e2e.mcpapps.config.ts", ...OUT],
+  ["run", ...OUT],
+  // Each of these is refused by one rule only (the mutation check showed that the cases above
+  // also trip a second rule): two positionals, a dash-led option value, `explore` as a value.
+  [...OK, "mcpapps/mcp-apps.e2e.ts", "mcpapps/seed.ts"],
+  ["run", "--grep", "--config=e2e.mcpapps.config.ts", "--config", "e2e.config.ts", ...OUT],
+  [...OK, "--grep", "explore"],
+];
+
+test("only `e2e run --config e2e.config.ts` with selection options is an exact-step run", () => {
+  expect(exactStepRefusal(OK, BUGBASH_DIR)).toBeNull();
+  // prettier-ignore
+  expect(exactStepRefusal(["run", "--config=e2e.config.ts", "--tag", "a", "--grep=b", "--pass-with-no-tests", ...OUT], BUGBASH_DIR)).toBeNull();
+  for (const args of NOT_EXACT) expect(exactStepRefusal(args, BUGBASH_DIR)).toBeString();
+  // e2e resolves --config from its cwd: another folder, or a symlinked config, is refused.
+  const other = fs.mkdtempSync(path.join(os.tmpdir(), "xbb-launch-test-"));
+  try {
+    expect(exactStepRefusal(OK, other)).toContain("the cwd must be");
+    fs.symlinkSync(path.join(BUGBASH_DIR, "e2e.config.ts"), path.join(other, "e2e.config.ts"));
+    expect(exactStepRefusal(OK, other, other)).toContain("not a regular file");
+  } finally {
+    fs.rmSync(other, { recursive: true, force: true });
+  }
+});
+
+/**
+ * Runs the launcher with a fake docker and a fake e2e node, which log each call. `sandbox`: the
+ * fake docker reports a local Linux engine, so the launcher picks the sandbox. Else the real
+ * app AI sends the job to the host fallback.
+ */
+function launch(args: string[], sandbox: boolean, cwd = BUGBASH_DIR) {
+  const bin = fs.mkdtempSync(path.join(os.tmpdir(), "xbb-launch-test-"));
+  const calls = path.join(bin, "calls.log");
+  const fake = (name: string, body: string) =>
+    fs.writeFileSync(path.join(bin, name), `#!/bin/sh\necho "${name} $*" >> ${calls}\n${body}\n`, {
+      mode: 0o755,
+    });
+  fake(
+    "docker",
+    [
+      'case "$1" in',
+      "  context) echo unix:///var/run/docker.sock ;;",
+      '  info) echo \'{"OSType":"linux","OperatingSystem":"Ubuntu","SecurityOptions":[]}\' ;;',
+      "  image) exit 0 ;;",
+      "  *) exit 1 ;;", // the same-host probe fails: the job falls back to the host fake below
+      "esac",
+    ].join("\n")
+  );
+  fake("e2e-node", "exit 0");
+  try {
+    const r = spawnSync(
+      process.execPath,
+      [path.join(import.meta.dir, "launch.ts"), "--", ...args],
+      {
+        cwd,
+        encoding: "utf8",
+        env: {
+          PATH: `${bin}:${process.env.PATH ?? ""}`,
+          HOME: process.env.HOME,
+          E2E_NODE: path.join(bin, "e2e-node"),
+          BUGBASH_AI_RESOLVED: sandbox ? "mock" : "real",
+        },
+      }
+    );
+    const log = fs.existsSync(calls) ? fs.readFileSync(calls, "utf8") : "";
+    return { status: r.status, stderr: r.stderr, log };
+  } finally {
+    fs.rmSync(bin, { recursive: true, force: true });
+    fs.rmSync(path.join(BUGBASH_DIR, ".e2e/launch-test"), { recursive: true, force: true });
+  }
+}
+
+test("the launcher runs nothing else, in the sandbox and on the host fallback", () => {
+  // Controls: the exact-step run reaches the docker run (sandbox) or the e2e node (host).
+  const sandboxed = launch(OK, true);
+  expect(sandboxed.log).toContain("docker run");
+  const hosted = launch(OK, false);
+  expect(hosted.log).toContain(
+    `e2e-node ${path.resolve(BUGBASH_DIR, "../..")}/node_modules/.bin/e2e run`
+  );
+  for (const sandbox of [true, false])
+    for (const args of NOT_EXACT) {
+      const r = launch(args, sandbox);
+      expect({ args, status: r.status, ran: r.log.match(/docker (run|build)|e2e-node/g) }).toEqual({
+        args,
+        status: 2,
+        ran: null,
+      });
+      expect(r.stderr).toContain("exact-step repros");
+    }
+  // The same args from another cwd would load another e2e.config.ts.
+  const elsewhere = launch(OK, false, path.resolve(BUGBASH_DIR, "../.."));
+  expect([elsewhere.status, elsewhere.log.includes("e2e-node")]).toEqual([2, false]);
+});
@@ -7,10 +7,13 @@
  * capabilities, a read-only root, copies of the git-listed inputs, and read-only dist/ and
  * node_modules/. Its output comes back on its stdout as an export stream (exportStream.ts).
  *
+ * It runs only exact-step jobs: `e2e run --config e2e.config.ts` (the repros). Other e2e commands
+ * and configs (`explore`, the MCP Apps suite) let a model pick the actions. They need a model,
+ * which the sandbox reaches only through its provider proxy (a later step of #5714), and they
+ * never run on the host. So the launcher refuses them for now.
  * BUGBASH_SANDBOX=auto (default): without usable Docker, or with the real app AI (that needs the
- * provider proxy, a later step of #5714), the exact-step job runs on the host as before.
- * BUGBASH_SANDBOX=require refuses instead. Only `e2e run` (exact-step tests) falls back: any
- * other e2e command, such as `explore`, lets a model pick the actions, so it never runs on the host.
+ * provider proxy too), the exact-step job runs on the host as before. BUGBASH_SANDBOX=require
+ * refuses instead.
  * Exit codes: the job's code, 2 when the launcher refuses, 4 when the evidence is incomplete.
  */
 import { spawn, spawnSync } from "child_process";
@@ -27,10 +30,10 @@ const DEADLINE_MS = 30 * 60_000;
 // The container reads copies of these git-listed inputs. A symlink stops the launch.
 const INPUTS = ["src", "tests/bugbash", "tsconfig.json", "package.json"];
 // The host env names that e2e.config.ts and startApp.ts read. No other host value passes.
+// Not BUGBASH_AI_REASON: after a failed probe it holds the provider URL and response text.
 const PASS_ENV = [
   "BUGBASH_AI",
   "BUGBASH_AI_RESOLVED",
-  "BUGBASH_AI_REASON",
   "BUGBASH_APP_MODEL",
   "BUGBASH_MODEL",
   "BUGBASH_EFFORT",
@@ -86,7 +89,11 @@ export function checkEndpoint(): string | null {
     OSType?: string;
     OperatingSystem?: string;
     SecurityOptions?: string[];
+    ServerErrors?: string[];
   };
+  // `docker info` exits 0 when no daemon answers, with only the client fields.
+  if ((daemon.OSType ?? "") === "")
+    return `docker info: no daemon answered (${(daemon.ServerErrors ?? []).join("; ")})`;
   if (daemon.OSType !== "linux" || /docker desktop/i.test(daemon.OperatingSystem ?? ""))
     return "Docker Desktop is not supported";
   if ((daemon.SecurityOptions ?? []).some((o) => o.includes("rootless")))
@@ -245,13 +252,19 @@ export async function runInSandbox(run: SandboxRun): Promise<number> {
       "sandbox/entry.ts", "--export", run.exportDir, "--", ...run.command];
     plainFolders(BUGBASH_DIR, path.dirname(run.exportDir), true);
     log(`${name} --network none, ${appAi() ?? "no"} app AI, no proxy`);
-    return await runContainer(args, { name, owner, dest });
+    return await runContainer(args, { name, owner, checkout: checkoutId, dest });
   } finally {
     fs.rmSync(jobDir, { recursive: true, force: true });
   }
 }
 
-async function runContainer(args: string[], job: { name: string; owner: string; dest: string }) {
+interface Job {
+  name: string;
+  owner: string;
+  checkout: string;
+}
+
+async function runContainer(args: string[], job: Job & { dest: string }) {
   // The lifeline: this process holds the container's stdin. When it dies, the pipe closes and
   // entry.ts stops the job (measured: the container was gone 0.59 s after a SIGKILL).
   const child = spawn("docker", args, { env: dockerEnv(), stdio: ["pipe", "pipe", "inherit"] });
@@ -286,14 +299,14 @@ async function runContainer(args: string[], job: { name: string; owner: string;
   return result.complete ? code : 4;
 }
 
-/** Removes the job's container. It matches the name AND the owner label, never the name alone. */
-function removeContainer(job: { name: string; owner: string }): string {
-  const filters = [
-    "--filter",
-    `name=^/${job.name}$`,
-    "--filter",
-    `label=xum.bugbash.owner=${job.owner}`,
-  ];
+/**
+ * Removes the job's container. It matches the name, the owner label AND this checkout's label,
+ * never the name alone: other checkouts on this host run their own sandboxes.
+ */
+export function removeContainer(job: Job): string {
+  // prettier-ignore
+  const filters = ["--filter", `name=^/${job.name}$`, "--filter", `label=xum.bugbash.owner=${job.owner}`,
+    "--filter", `label=xum.bugbash.checkout=${job.checkout}`];
   const find = () => docker(["ps", "-aq", "--no-trunc", ...filters], { timeoutMs: 15_000 });
   const found = find();
   if (!found.ok) return `container state unknown: ${found.error}`;
@@ -322,10 +335,56 @@ function runOnHost(args: string[]): Promise<number> {
   // The node directory leads PATH, so the app command and its children use the same node.
   const PATH = `${path.dirname(node)}${path.delimiter}${process.env.PATH ?? ""}`;
   const child = spawn(node, [path.join(ROOT, "node_modules/.bin/e2e"), ...args], {
+    cwd: BUGBASH_DIR, // where exactStepRefusal() checked e2e.config.ts
     stdio: "inherit",
     env: { ...process.env, PATH },
   });
-  return new Promise((resolve) => child.on("exit", (code) => resolve(code ?? 1)));
+  // A signal to this launcher alone reaches e2e too, and the launcher waits for e2e's teardown.
+  const forward = (signal: NodeJS.Signals) => child.kill(signal);
+  process.on("SIGINT", forward).on("SIGTERM", forward);
+  return new Promise((resolve) =>
+    child.on("exit", (code, signal) => resolve(exitCode(code, signal)))
+  );
+}
+
+/** The shell convention: the exit code, or 128 + the number of the signal that ended the process. */
+export function exitCode(code: number | null, signal: NodeJS.Signals | null): number {
+  return code ?? (signal != null ? 128 + os.constants.signals[signal] : 1);
+}
+
+// The `e2e run` options that a repro run may use: selection and output only. Not allowed, among
+// others: a second --config, positional files, "--", --agent and the cache and trace switches.
+// e2e reads no env var that picks a config or an agent (only E2E_TELEMETRY_*, the E2E_USER*,
+// E2E_SECRET* and E2E_OAUTH_CREDENTIALS test values, NODE_OPTIONS and CI names; e2e 0.17).
+const RUN_VALUE_OPTIONS = ["--config", "--output", "--tag", "--exclude-tag", "--tag-mode",
+  "--grep", "--grep-invert", "--target", "--shard", "--workers", "--retries", "--max-failures",
+  "--reporter"]; // prettier-ignore
+const RUN_FLAGS = ["--pass-with-no-tests", "--last-failed", "--debug"];
+
+/**
+ * Why these e2e args are not an exact-step repro run, or null. Only `e2e run` with the repro
+ * config passes: its tests are repros/** (no agent fixture: reproRules.test.ts). e2e resolves
+ * --config from its cwd, so the cwd must be tests/bugbash and the config a regular file there.
+ */
+export function exactStepRefusal(args: string[], cwd: string, dir = BUGBASH_DIR): string | null {
+  if (args[0] !== "run") return `${JSON.stringify(args[0] ?? "")} is not \`e2e run\``;
+  if (args.includes("explore")) return "an `explore` argument";
+  const configs: string[] = [];
+  for (let i = 1; i < args.length; i++) {
+    const [name, inline] = args[i].startsWith("--") ? args[i].split(/=(.*)/s, 2) : [args[i]];
+    if (RUN_FLAGS.includes(name) && inline == null) continue;
+    if (!RUN_VALUE_OPTIONS.includes(name)) return `the argument ${JSON.stringify(args[i])}`;
+    const value = inline ?? args[++i];
+    if (value == null || value === "" || value.startsWith("-"))
+      return `${name} needs a value, got ${JSON.stringify(value ?? "")}`;
+    if (name === "--config") configs.push(value);
+  }
+  if (configs.length !== 1 || configs[0] !== "e2e.config.ts")
+    return `--config must be given once as e2e.config.ts, got ${JSON.stringify(configs)}`;
+  if (fs.realpathSync(cwd) !== fs.realpathSync(dir)) return `the cwd must be ${dir}, got ${cwd}`;
+  if (fs.lstatSync(path.join(dir, "e2e.config.ts"), { throwIfNoEntry: false })?.isFile() !== true)
+    return `${dir}/e2e.config.ts is not a regular file (a symlink?)`;
+  return null;
 }
 
 /** The one `--output .e2e/<folder>` of the e2e args. The export comes back to that folder only. */
@@ -353,10 +412,15 @@ async function main(): Promise<number> {
   const mode = process.env.BUGBASH_SANDBOX ?? "auto";
   if (mode !== "auto" && mode !== "require")
     throw new Refusal(`BUGBASH_SANDBOX must be auto or require, got ${mode}`);
+  // Before the sandbox and the host fallback both: neither runs anything else.
+  const notExact = exactStepRefusal(e2eArgs, process.cwd());
+  if (notExact != null)
+    throw new Refusal(
+      `${notExact}: only \`e2e run --config e2e.config.ts\` (exact-step repros) runs for now. ` +
+        "Model-driven runs wait for the sandbox's provider proxy (#5714)."
+    );
   const why = hostReason();
   if (why != null && mode === "require") throw new Refusal(`${why} (BUGBASH_SANDBOX=require)`);
-  if (why != null && e2eArgs[0] !== "run")
-    throw new Refusal(`${why}. Only exact-step \`e2e run\` tests run on the host.`);
   if (why != null) {
     log(`not used: ${why}. These exact-step tests run on the host, as before.`);
     return runOnHost(e2eArgs);
@@ -369,7 +433,7 @@ async function main(): Promise<number> {
     return await runInSandbox({ command, exportDir: output, env });
   } catch (error) {
     // A failed image build or same-host probe: as without Docker (the job did not start).
-    if (!(error instanceof Unusable) || mode === "require" || e2eArgs[0] !== "run") throw error;
+    if (!(error instanceof Unusable) || mode === "require") throw error;
     log(`not used: ${error.message}. These exact-step tests run on the host, as before.`);
     return runOnHost(e2eArgs);
   }