[robstolarz]

Inside a Dispatch sandbox, depot agent watch, create --watch, send and launch now call the API with the turn's own token. The API takes that token on WatchSession, SendInput and Launch for a session the turn's own session started, so an agent can start a session, follow it to its reply and message it again. DEP-8577.

Command	RPCs	Token in a sandbox
create, list, logs	CreateSession, ListDepotAgentSessions, GetSession, GetSessionMessage	turn (unchanged)
watch, create --watch	WatchSession, GetSessionMessage	turn (was the organization token)
send, launch	SendInput, Launch	turn (was the organization token)
stop	InterruptSession, ArchiveSession	organization token (unchanged)

• Outside a sandbox nothing changes: the token order is the same as before.
• An API that refuses the turn's token on one of these calls is named in the error. Nothing is retried with another token: a sandbox's cache token is not an API credential. --token and DEPOT_TOKEN still come first, and the error says so.
• When a watch fails after a create, send or launch, the error names the session and says to read its reply with depot agent logs <id>. The session is left running, because archiving it is a call the turn's token cannot make.
• A watch stream that ends cleanly was already reconnected; that is unchanged and covered by the existing reconnect test.

Tests and post-deploy test plan

pkg/cmd/agent/credential_test.go asserts the Authorization each RPC arrives with for every command, with and without a cache token, and the error text against an API that refuses the token. Both tests fail on current main.

Post-deploy test plan

Needs the API change deployed and a CLI release carrying this change. From inside a sandbox on the test organization, as an agent turn a person sent:

1. depot agent create "Reply with the word ready" --watch -o json exits 0 and prints the reply.
2. depot agent send <id> "Now reply with the word done" --watch -o json exits 0 and prints the second reply.
3. depot agent watch <id> --until-idle exits 0.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RQk3K7GpvQg7ySXyCrirEe

---

Note

Medium Risk
Changes agent CLI authentication for several session RPCs in sandbox environments; mistakes could block agent turns from watching or messaging sessions, though stop/org flows and explicit user tokens are preserved.

Overview
In a Dispatch sandbox, depot agent watch, create --watch, send, and launch now authenticate with the turn’s own token (not the cache/org token) for WatchSession, SendInput, and Launch, matching DEP-8577. stop still requires an org token for InterruptSession / ArchiveSession.

ResolveAgentAuth now returns a single credential plus a turn flag: inside a turn it prefers the minted turn token ahead of DEPOT_CACHE_TOKEN; explicit --token / env paths are unchanged.

Agent commands route through turnCaller and a unified authed helper instead of the old split between asTurn and org auth. When the API rejects the turn token, caller.refused names the RPC and points users to --token / DEPOT_TOKEN; failed watches after create/send/launch add guidance to use depot agent logs.

Tests in credential_test.go and token_test.go assert per-RPC Authorization headers (with and without a cache token) and backward-compatible error text when the API still refuses the turn token.

^{Reviewed by Cursor Bugbot for commit 694445b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[linear-code]

DEP-8577

[cursor]

Risk: high. Approved. Cursor Bugbot completed with no findings that need human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[robstolarz]

From Claude: merge proof.

• Head: 694445bed5079c8d70154d61a3fdb3d3f46545c8, base main at ecac218a02c8fd492cdd611f0b0f4875228f256c
• Command: codex -s read-only review --base origin/main (2026-11-15)
• Verdict: "The credential precedence and RPC call changes are consistent with the updated tests. I found no actionable regression in the diff."
• On this exact head: check runs Cursor Bugbot and Cursor Approval Agent: Pull Request Router and Approver both completed with success; 0 open review threads; CI green.