Run a bash command on the box that serves the session's agent bash.

/bash above proxies to kernel sandbox sessions and fails closed when the kernel is gone — but on Modal the agent's own bash tool runs on the workspace sandbox (see ModalKernelContext), whose /local is a sandbox-private rootfs no kernel session can see. A client that needs to read what the agent's bash wrote (--artifacts) must therefore exec on that box, through the same route_bash path the agent's tool uses, so the two can never resolve to different filesystems.

chat_session_id is required: it drives the same workspace-identity resolution as the agent's bash (including isolated-run identity), and it is validated against the caller so bash on another user's sandbox is unreachable.

The session's stored sandbox-environment spec is installed as the ambient scope for the call, exactly as generation_turn_runtime_scope does for the agent's own bash. The workspace-sandbox alias is derived from that spec (ModalAgentBridge._workspace_alias), so without it an isolated run's command would land on the default box — a different filesystem from the one the run wrote.