fix(sandbox): run post-rename cleanup as the editor's bound user

src/agents/sandbox/apply_patch.py

@@ -97,7 +97,7 @@ async def apply_operation(
             moved_destination = self._session.normalize_path(moved_relative_path)
             await self._write_text(moved_destination, updated_text)
             if moved_destination != destination:
-                await self._session.rm(destination)
+                await self._session.rm(destination, user=self._user)
             moved_display_path = moved_relative_path.as_posix()
             return ApplyPatchResult(
                 output=f"Updated {display_path}\nMoved {display_path} to {moved_display_path}"

tests/sandbox/capabilities/test_apply_patch_tool.py

@@ -177,6 +177,31 @@ async def test_editor_runs_file_operations_as_bound_user(self) -> None:
         assert session.write_users == ["sandbox-user", "sandbox-user"]
         assert session.rm_users == ["sandbox-user"]
 
+    @pytest.mark.asyncio
+    async def test_editor_runs_move_cleanup_as_bound_user(self) -> None:
+        session = UserRecordingApplyPatchSession()
+        session.files[Path("/workspace/existing.txt")] = b"old\n"
+        tool = SandboxApplyPatchTool(session=session, user=User(name="sandbox-user"))
+
+        await cast(
+            Awaitable[ApplyPatchResult],
+            tool.editor.update_file(
+                ApplyPatchOperation(
+                    type="update_file",
+                    path="existing.txt",
+                    diff="@@\n-old\n+new\n",
+                    move_to="renamed.txt",
+                )
+            ),
+        )
+
+        # Renaming writes the new file and removes the original; both must run
+        # as the editor's bound user, not the default sandbox user.
+        assert session.write_users == ["sandbox-user"]
+        assert session.rm_users == ["sandbox-user"]
+        assert Path("/workspace/existing.txt") not in session.files
+        assert Path("/workspace/renamed.txt") in session.files
+
     @pytest.mark.asyncio
     async def test_custom_tool_input_create_update_move_delete(self) -> None:
         session = ApplyPatchSession()