[anycodes]

Description

Successive synchronous ProviderSandbox calls recreated event loops while reusing clients. This uses one lazy loop, removes duplicate decorator bridges, and keeps session records when remote deletion fails.

Both command modes preserve quoted literal arguments and explicit shell expansion in background execution. Status queries propagate authentication/network/service failures instead of reporting that the sandbox is absent.

Closes #150
Companion: Alibaba-Agent-Sandbox/agent-sandbox#216

Type of Change

• Bug fix
• Refactoring
• Documentation
• Tests

Changes

• Reuse the sync loop, cancel interrupted calls, reject callback self-deadlock and close borrowed decorator connections.
• Keep capability checks, authentication boundaries, management-key consent and supported public signatures.
• Correct bilingual task guides and remove internal audit narratives from public usage pages.

Testing

• Complete remote unit matrix passes; local environment failures remain recorded below
• Lint/typecheck/build checks pass
• Manual tests use actual binaries and a real Express sandbox
• Changed behavior has regressions

Client full suite: 2362 passed / 27 skipped; changed behavior: 199 passed. Unmodified server suite: 873 passed / 1 skipped / 2 failed; a raw loopback probe receives environment HTTP 501 rather than project output. Additional engine probes: 18 passed / 8 failed (five environment responses and three existing non-CI expectation drifts).

Targeted real-cloud command regressions: 3 passed; declarative cloud suite: 6 passed; additional TypeScript/Python literal/background/file/lifecycle probes passed. Owned resource deletion was independently verified. No managed key was created or renewed. Full all-provider cloud acceptance was not run.

Checklist

• Code follows project conventions
• Tests added/updated
• Documentation updated in English and Chinese
• No credentials included

Definition of Done

• Complete final-head unit/CI matrix passes
• Targeted E2E against real components recorded
• Implemented ADR and verification evidence recorded
• Bilingual docs and CHANGELOG updated
• Repository health check passes

Evidence: .agents/evidence/verify/2026-10-29-defensive-complexity-cleanup.md.

Qualified-ID routing, implicit deployment of local registrations and retained-instance handle design remain separate unresolved design work. No release/version bump is included.

Complete source CI passed at 7499ddf6c6805b50a65afa6e4b9778f5c466d468. The final documentation-only commit also passed all checks before merge.