diff --git a/Cargo.lock b/Cargo.lock
index ce55f4416..dca7a053e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6994,10 +6994,11 @@ dependencies = [
 [[package]]
 name = "sandbox-driver"
 version = "0.1.0"
-source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=7fc225afc56710d629b6f0f81392068767a1b6f1#7fc225afc56710d629b6f0f81392068767a1b6f1"
+source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610#8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610"
 dependencies = [
  "async-trait",
  "globset",
+ "humantime",
  "rand 0.10.1",
  "serde",
  "serde_json",
@@ -7010,13 +7011,14 @@ dependencies = [
 [[package]]
 name = "sandbox-driver-daytona"
 version = "0.1.0"
-source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=7fc225afc56710d629b6f0f81392068767a1b6f1#7fc225afc56710d629b6f0f81392068767a1b6f1"
+source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610#8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610"
 dependencies = [
  "anyhow",
  "async-trait",
  "base64",
  "daytona-api-client",
  "daytona-sdk",
+ "hmac 0.12.1",
  "rand 0.10.1",
  "reqwest 0.13.4",
  "sandbox-driver",
@@ -7026,6 +7028,7 @@ dependencies = [
  "sandbox-driver-protocol",
  "serde",
  "serde_json",
+ "sha2 0.10.9",
  "tokio",
  "tokio-util",
  "tracing",
@@ -7035,7 +7038,7 @@ dependencies = [
 [[package]]
 name = "sandbox-driver-daytona-config"
 version = "0.1.0"
-source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=7fc225afc56710d629b6f0f81392068767a1b6f1#7fc225afc56710d629b6f0f81392068767a1b6f1"
+source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610#8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610"
 dependencies = [
  "sandbox-driver-docker-config",
  "serde",
@@ -7045,7 +7048,7 @@ dependencies = [
 [[package]]
 name = "sandbox-driver-docker"
 version = "0.1.0"
-source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=7fc225afc56710d629b6f0f81392068767a1b6f1#7fc225afc56710d629b6f0f81392068767a1b6f1"
+source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610#8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -7066,7 +7069,7 @@ dependencies = [
 [[package]]
 name = "sandbox-driver-docker-config"
 version = "0.1.0"
-source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=7fc225afc56710d629b6f0f81392068767a1b6f1#7fc225afc56710d629b6f0f81392068767a1b6f1"
+source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610#8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610"
 dependencies = [
  "serde",
  "serde_json",
@@ -7075,7 +7078,7 @@ dependencies = [
 [[package]]
 name = "sandbox-driver-host"
 version = "0.1.0"
-source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=7fc225afc56710d629b6f0f81392068767a1b6f1#7fc225afc56710d629b6f0f81392068767a1b6f1"
+source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610#8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -7093,7 +7096,7 @@ dependencies = [
 [[package]]
 name = "sandbox-driver-protocol"
 version = "0.1.0"
-source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=7fc225afc56710d629b6f0f81392068767a1b6f1#7fc225afc56710d629b6f0f81392068767a1b6f1"
+source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610#8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610"
 dependencies = [
  "async-trait",
  "base64",
@@ -7110,7 +7113,7 @@ dependencies = [
 [[package]]
 name = "sandbox-driver-testing"
 version = "0.1.0"
-source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=7fc225afc56710d629b6f0f81392068767a1b6f1#7fc225afc56710d629b6f0f81392068767a1b6f1"
+source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610#8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610"
 dependencies = [
  "async-trait",
  "sandbox-driver",
diff --git a/Cargo.toml b/Cargo.toml
index 404f6b4a4..73f2c302a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -102,18 +102,19 @@ futures-util = "0.3"
 # sandbox-driver: the sandbox provider layer. Bundled Host, Docker, and
 # Daytona providers link in-process; third-party providers run as stdio
 # plugins through sandbox-driver-protocol. Pinned by rev; currently the head of
-# the sandbox-driver `git-ambient-credentials` branch (ambient git credentials,
-# git failures, stop grace, snapshot ensure, ownership scope, testing doubles), to
-# move to main on merge. The CI plugin job installs the driver executables at the
-# same rev, read from this file.
-sandbox-driver = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "7fc225afc56710d629b6f0f81392068767a1b6f1" }
-sandbox-driver-protocol = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "7fc225afc56710d629b6f0f81392068767a1b6f1" }
-sandbox-driver-host = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "7fc225afc56710d629b6f0f81392068767a1b6f1" }
-sandbox-driver-docker = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "7fc225afc56710d629b6f0f81392068767a1b6f1" }
-sandbox-driver-docker-config = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "7fc225afc56710d629b6f0f81392068767a1b6f1" }
-sandbox-driver-daytona = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "7fc225afc56710d629b6f0f81392068767a1b6f1" }
-sandbox-driver-daytona-config = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "7fc225afc56710d629b6f0f81392068767a1b6f1" }
-sandbox-driver-testing = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "7fc225afc56710d629b6f0f81392068767a1b6f1" }
+# the sandbox-driver `section-4-driver-items` branch (provider-owned scopes, the
+# supervisor as provider, Host attach by directory, git retry and verbs in the
+# driver, status image/snapshot/network, Daytona snapshot caching, services port
+# wait and list, RFC 3339 timestamps), to move to main on merge. The CI plugin
+# job installs the driver executables at the same rev, read from this file.
+sandbox-driver = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610" }
+sandbox-driver-protocol = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610" }
+sandbox-driver-host = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610" }
+sandbox-driver-docker = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610" }
+sandbox-driver-docker-config = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610" }
+sandbox-driver-daytona = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610" }
+sandbox-driver-daytona-config = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610" }
+sandbox-driver-testing = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "8cc64d4f66a23b6c4306fdc8ae6fbba4c6131610" }
 sentry = { version = "0.35", default-features = false, features = ["backtrace", "contexts", "ureq", "rustls"] }
 fork = "0.2"
 exec = "0.3"
diff --git a/lib/components/fabro-sandbox/src/details.rs b/lib/components/fabro-sandbox/src/details.rs
index cbdd9c09a..3a9c04b7c 100644
--- a/lib/components/fabro-sandbox/src/details.rs
+++ b/lib/components/fabro-sandbox/src/details.rs
@@ -3,8 +3,8 @@ use std::collections::BTreeMap;
 use anyhow::Result;
 use chrono::{DateTime, Utc};
 use fabro_types::{
-    BundledProvider, RunId, RunSandboxInstance, SandboxDetails, SandboxNetwork,
-    SandboxProviderKind, SandboxResources, SandboxState, SandboxTimestamps,
+    BundledProvider, RunId, RunSandboxInstance, SandboxDetails, SandboxNetwork, SandboxResources,
+    SandboxState, SandboxTimestamps,
 };
 
 use crate::driver::ProviderAccess;
@@ -63,8 +63,8 @@ pub(crate) fn info_from_status(
         display_name:      status.name.clone().filter(|name| !name.is_empty()),
         state:             fields.state,
         native_state:      fields.native_state,
-        image:             status.source.clone(),
-        snapshot:          None,
+        image:             status.image.clone(),
+        snapshot:          status.snapshot.clone(),
         region:            status.region.clone(),
         web_url:           status.web_url.clone(),
         working_directory: None,
@@ -82,14 +82,8 @@ pub(crate) fn details_from_status(
     let fields = fields_from_status(status);
     SandboxDetails {
         sandbox:      RunSandboxInstance {
-            image: (record.provider == SandboxProviderKind::DOCKER)
-                .then(|| status.source.clone())
-                .flatten()
-                .or_else(|| record.image.clone()),
-            snapshot: (record.provider == SandboxProviderKind::DAYTONA)
-                .then(|| status.source.clone())
-                .flatten()
-                .or_else(|| record.snapshot.clone()),
+            image: status.image.clone().or_else(|| record.image.clone()),
+            snapshot: status.snapshot.clone().or_else(|| record.snapshot.clone()),
             ..record.clone()
         },
         state:        fields.state,
@@ -152,6 +146,7 @@ pub(crate) fn normalize_driver_state(state: sandbox_driver::SandboxState) -> San
 
 #[cfg(test)]
 mod tests {
+    use fabro_types::SandboxProviderKind;
     use sandbox_driver::SandboxId;
 
     use super::*;
@@ -185,7 +180,7 @@ mod tests {
         );
         status.name = Some("fabro-run-abc".to_string());
         status.provider_state = "running".to_string();
-        status.source = Some("buildpack-deps:noble".to_string());
+        status.image = Some("buildpack-deps:noble".to_string());
         status
             .labels
             .insert("sh.fabro.managed".to_string(), "true".to_string());
diff --git a/lib/components/fabro-sandbox/src/driver.rs b/lib/components/fabro-sandbox/src/driver.rs
index 7acbfe8c9..b116647f4 100644
--- a/lib/components/fabro-sandbox/src/driver.rs
+++ b/lib/components/fabro-sandbox/src/driver.rs
@@ -265,21 +265,18 @@ impl PluginBackedProvider {
                 kind: kind.clone(),
                 source,
             })?;
-        let supervisor = PluginSupervisor::new(
-            PLUGIN_BINARY_PREFIX,
-            plugin_config(driver_kind.clone(), settings),
-        );
         // Launch once now so a misconfigured plugin fails at connect time and
         // the declared capabilities are known for preflight.
-        let capabilities = supervisor
-            .current()
-            .await
-            .map_err(|source| ConnectError::Driver {
-                kind: kind.clone(),
-                source,
-            })?
-            .capabilities()
-            .clone();
+        let supervisor = PluginSupervisor::launch(
+            PLUGIN_BINARY_PREFIX,
+            plugin_config(driver_kind.clone(), settings),
+        )
+        .await
+        .map_err(|source| ConnectError::Driver {
+            kind: kind.clone(),
+            source,
+        })?;
+        let capabilities = SandboxProvider::capabilities(&supervisor).clone();
         Ok(Self {
             kind: driver_kind,
             capabilities,
diff --git a/lib/components/fabro-sandbox/src/provider_sandbox.rs b/lib/components/fabro-sandbox/src/provider_sandbox.rs
index 33e032870..565903ac7 100644
--- a/lib/components/fabro-sandbox/src/provider_sandbox.rs
+++ b/lib/components/fabro-sandbox/src/provider_sandbox.rs
@@ -108,7 +108,7 @@ pub async fn attach_provider_sandbox(
     );
     let sandbox = RunSandbox::attached(kind.clone(), handle, workspace);
     if kind.bundled() == Some(BundledProvider::Daytona) {
-        if let Some(snapshot) = status.source {
+        if let Some(snapshot) = status.snapshot {
             sandbox.set_snapshot(snapshot);
         }
     }