diff --git a/cloud/apps/sandbox-control/image/env/workspace-prelude.sh b/cloud/apps/sandbox-control/image/env/workspace-prelude.sh
index ce68822cc30..694ee3e485d 100644
--- a/cloud/apps/sandbox-control/image/env/workspace-prelude.sh
+++ b/cloud/apps/sandbox-control/image/env/workspace-prelude.sh
@@ -10,7 +10,6 @@
 #   and checked out; if that fails the workspace still opens at the build's commit.
 # - Otherwise clone ORCA_REPO_URL here so a repo with no commits yet also opens: it gets an empty
 #   first commit on the requested branch, which Orca needs to create the workspace's worktree.
-# - No repo at all (the user chose "Start empty"): a fresh repository with that same first commit.
 set -uo pipefail
 P=/vercel/sandbox/project
 ROOT=/vercel/sandbox/repos
@@ -51,8 +50,5 @@ elif [ ! -e "$P" ] && [ -n "${ORCA_REPO_URL:-}" ]; then
     fi
   fi
   first_commit
-elif [ ! -e "$P" ]; then
-  git init --quiet "$P" || exit 1
-  first_commit
 fi
 exit 0
diff --git a/cloud/apps/sandbox-control/image/vm-scripts.generated.ts b/cloud/apps/sandbox-control/image/vm-scripts.generated.ts
index e5d4dc97373..6039c2a10c9 100644
--- a/cloud/apps/sandbox-control/image/vm-scripts.generated.ts
+++ b/cloud/apps/sandbox-control/image/vm-scripts.generated.ts
@@ -7,4 +7,4 @@ export const VM_SCRIPT_SOURCES: BuildInputs['vmScripts'] = {"orca-sandbox-start"
 export const SOURCE_BUILD_SCRIPT: string = "#!/usr/bin/env bash\n# Golden build from source, run by the Worker inside the build sandbox: orcad + the orca CLI from one\n# commit of the Orca repo (cloud/integration carries host RPCs no upstream release has), then the same\n# provision-golden.sh every image uses. Inputs (env):\n#   ORCA_SRC_REPO (https://github.com/<owner>/<repo>), ORCA_SRC_SHA (40-hex), ORCA_SRC_AUTH (an\n#   `Authorization: Basic …` header value for a 1 h read-only installation token; never printed),\n#   ORCA_PROVISION_SCRIPT (base64 of provision-golden.sh) + everything provision-golden.sh reads.\nset -euo pipefail\nlog() { printf '[source-build] %s\\n' \"$*\" >&2; }\nstart=$(date +%s)\n[[ \"$ORCA_SRC_SHA\" =~ ^[0-9a-f]{40}$ ]] || { log 'ORCA_SRC_SHA must be a full commit sha'; exit 2; }\n\nlog 'build tools'\nif command -v apt-get >/dev/null; then\n  sudo apt-get update -qq\n  sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends build-essential python3 git ca-certificates >/dev/null\nelse\n  sudo dnf install -y -q gcc gcc-c++ make tar gzip python3 git >/dev/null\nfi\nsudo corepack enable >/dev/null 2>&1 || true\n\nlog \"fetch $ORCA_SRC_SHA\"\nsrc=\"$HOME/orca-src\"\nrm -rf \"$src\" && mkdir -p \"$src\" && cd \"$src\"\ngit init -q\n# The header lives only in this one command's config, not in .git/config.\ngit -c \"http.https://github.com/.extraheader=$ORCA_SRC_AUTH\" fetch -q --depth 1 \"$ORCA_SRC_REPO\" \"$ORCA_SRC_SHA\"\nunset ORCA_SRC_AUTH\ngit -c advice.detachedHead=false checkout -q FETCH_HEAD\ntest \"$(git rev-parse HEAD)\" = \"$ORCA_SRC_SHA\"\n\nlog 'build orcad + CLI'\nexport CI=1 ELECTRON_SKIP_BINARY_DOWNLOAD=1 PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1\ncorepack pnpm install --frozen-lockfile >/tmp/src-install.log 2>&1 || { tail -40 /tmp/src-install.log >&2; exit 1; }\ncorepack pnpm -C mobile install --frozen-lockfile >/tmp/src-mobile.log 2>&1 || { tail -40 /tmp/src-mobile.log >&2; exit 1; }\ncorepack pnpm build:mobile-web >/tmp/src-mobile-web.log 2>&1 || { tail -40 /tmp/src-mobile-web.log >&2; exit 1; }\ncorepack pnpm build:orcad >/tmp/src-orcad.log 2>&1 || { tail -60 /tmp/src-orcad.log >&2; exit 1; }\ncorepack pnpm build:cli >/tmp/src-cli.log 2>&1 || { tail -40 /tmp/src-cli.log >&2; exit 1; }\nmkdir -p out/orca-cli\nnode_modules/.bin/esbuild out/cli/index.js --bundle --platform=node --target=node22 --format=cjs \\\n  --outfile=out/orca-cli/orca-cli.cjs --log-level=error\nprintf '%s\\n' \"$ORCA_SRC_SHA\" >out/orcad/SOURCE_COMMIT\ntar czf /tmp/orcad.tgz -C out orcad runtimes orca-cli\nlog \"built in $(( $(date +%s) - start ))s\"\n\nexport ORCAD_BUNDLE_URL=file:///tmp/orcad.tgz\nORCAD_BUNDLE_SHA256=\"$(sha256sum /tmp/orcad.tgz | cut -d' ' -f1)\"\nexport ORCAD_BUNDLE_SHA256\ncd \"$HOME\"\nprintf '%s' \"$ORCA_PROVISION_SCRIPT\" | base64 -d >/tmp/provision-golden.sh\nunset ORCA_PROVISION_SCRIPT\nbash /tmp/provision-golden.sh\n# Build leftovers stay out of the image.\nrm -rf \"$src\" \"$HOME/.local/share/pnpm\" \"$HOME/.cache/pnpm\" /tmp/orcad.tgz /tmp/provision-golden.sh /tmp/src-*.log\nlog \"done in $(( $(date +%s) - start ))s\"\n"
 export const ENVIRONMENT_BUILD_SCRIPT: string = "#!/usr/bin/env bash\n# Environment build (\"Cloud Computer\"), run by the control plane in a VM booted from the golden image.\n# Clones every repo, runs the org's install script once with `set -euo pipefail`, then records what it\n# built from (commit + lockfile blob ids per repo) so the control plane can tell when a rebuild is due.\n# Everything printed here streams live to the desktop build log.\n#\n# Env from the control plane (validated there): ORCA_BUILD_REPOS (`<url>|<branch or empty>|<dir>|\n# <git auth header or empty>` lines: each private repo gets its own placeholder the egress swaps), ORCA_INSTALL_SCRIPT_B64, ORCA_LOCKFILES (space list), optional ORCA_GIT_EXTRAHEADER, plus\n# the org secrets the environment names. `::orca-step:: <name>` lines mark progress.\n# Exit codes: 10 clone, 20 install script, 30 recording the result.\nset -uo pipefail\numask 022\n# One stream: the provider replays stdout and stderr separately after the fact, so a failed build's\n# log would read out of order. `::orca-error::` lines carry Orca's own failure explanations.\nexec 2>&1\nOUT=/tmp/orca-build\nROOT=/vercel/sandbox/repos\nmkdir -p \"$OUT\" \"$ROOT\"\nstep() { printf '\\n::orca-step:: %s\\n' \"$1\"; }\nstarted=$(date +%s)\nexport PATH=\"/opt/orca/tools/bin:/opt/orca/bin:$PATH\"\nexport ORCA_REPOS_ROOT=\"$ROOT\" ORCA_ENVIRONMENT_BUILD=1 CI=1 GIT_TERMINAL_PROMPT=0\nrepos() { printf '%s\\n' \"$ORCA_BUILD_REPOS\"; }\n\n# Tell the script author (often an agent) what they are installing onto.\npm=$(for c in apt-get dnf yum apk; do command -v \"$c\" >/dev/null 2>&1 && { echo \"$c\"; break; }; done)\necho \"Base image: $(. /etc/os-release 2>/dev/null && echo \"$PRETTY_NAME\"), $(nproc) vCPU, package manager: ${pm:-none} (with sudo)\"\n\nstep clone\nfirst=\"\"\nwhile IFS='|' read -r url branch dir header; do\n  [ -n \"$url\" ] || continue\n  dest=\"$ROOT/$dir\"\n  [ -n \"$first\" ] || first=\"$dest\"\n  # The egress layer swaps the placeholder for a short-lived repo token; nothing real is on disk,\n  # and the header is never written to the repo's config.\n  git_auth=()\n  [ -z \"${header:-}\" ] || git_auth=(-c \"http.https://github.com/.extraheader=$header\")\n  echo \"Cloning $url${branch:+ ($branch)}\"\n  rm -rf -- \"$dest\"\n  # The clone's own error shows only when it really failed (an empty repo is recovered below).\n  if ! git \"${git_auth[@]}\" clone --quiet ${branch:+--branch \"$branch\"} -- \"$url\" \"$dest\" 2>\"$OUT/clone.err\"; then\n    refs=0\n    git \"${git_auth[@]}\" ls-remote --exit-code -- \"$url\" >/dev/null 2>&1 || refs=$?\n    if [ -n \"$branch\" ] && [ \"$refs\" -eq 2 ]; then\n      # Reachable but no refs at all (ls-remote exits 2): a repo with no commits yet.\n      echo \"$url has no commits yet; starting it empty on $branch.\"\n      rm -rf -- \"$dest\"\n      { git \"${git_auth[@]}\" clone --quiet -- \"$url\" \"$dest\" 2>/dev/null && git -C \"$dest\" checkout --quiet -b \"$branch\"; } || exit 10\n    else\n      cat \"$OUT/clone.err\"\n      echo \"::orca-error:: Could not clone $url${branch:+ at $branch}. Check that the branch exists and Orca Cloud can reach the repository.\" \n      exit 10\n    fi\n  fi\n  git -C \"$dest\" log -1 --format='  at %h %s' 2>/dev/null || echo '  (no commits yet)'\ndone < <(repos)\n\nstep install\nprintf '%s' \"${ORCA_INSTALL_SCRIPT_B64:-}\" | base64 -d >\"$OUT/install.sh\"\nif [ -s \"$OUT/install.sh\" ]; then\n  echo \"Running the install script in ${first:-$ROOT}\"\n  (cd \"${first:-$ROOT}\" && exec bash -euo pipefail \"$OUT/install.sh\") </dev/null\n  rc=$?\n  if [ \"$rc\" -ne 0 ]; then\n    echo \"::orca-error:: The install script exited with status $rc.\" \n    exit 20\n  fi\nelse\n  echo \"No install script; the build keeps the cloned repos.\"\nfi\n\nstep record\n# New workspaces are linked worktrees of these checkouts: list the dependency folders the install\n# produced and add a post-checkout hook that hard-links them into each new worktree.\n# Python virtualenvs are left out on purpose: their scripts and editable installs embed the primary\n# checkout's absolute path, so a linked copy would run the wrong source.\ndeps_re='(^|/)(node_modules|vendor/bundle|\\.bundle|bower_components|\\.yarn/cache|\\.pnpm-store)/?$|(^|/)\\.env[^/]*$'\nwhile IFS='|' read -r url branch dir _; do\n  [ -n \"$url\" ] || continue\n  dest=\"$ROOT/$dir\"\n  common=\"$(git -C \"$dest\" rev-parse --path-format=absolute --git-common-dir 2>/dev/null)\" || continue\n  git -C \"$dest\" ls-files --others --ignored --exclude-standard --directory 2>/dev/null \\\n    | sed 's#/$##' | grep -E \"$deps_re\" | head -n 500 >\"$common/orca-env-deps\" || true\n  if [ -n \"${ORCA_DEPS_HOOK_B64:-}\" ]; then\n    # A relative core.hooksPath (husky: .husky/_) names a gitignored folder a new worktree lacks; pin\n    # it to the primary checkout so every worktree runs the same hooks, ours included.\n    rel=\"$(git -C \"$dest\" config --get core.hooksPath 2>/dev/null || true)\"\n    case \"$rel\" in '' | /*) ;; *) git -C \"$dest\" config core.hooksPath \"$dest/$rel\" ;; esac\n    hooks=\"$(git -C \"$dest\" rev-parse --path-format=absolute --git-path hooks)\"\n    mkdir -p \"$hooks\"\n    if [ -e \"$hooks/post-checkout\" ] && ! grep -q 'orca-env-deps' \"$hooks/post-checkout\"; then\n      mv -- \"$hooks/post-checkout\" \"$hooks/post-checkout.orca-chained\"\n    fi\n    printf '%s' \"$ORCA_DEPS_HOOK_B64\" | base64 -d >\"$hooks/post-checkout\" && chmod 0755 \"$hooks/post-checkout\"\n  fi\n  n=$(wc -l <\"$common/orca-env-deps\" | tr -d ' ')\n  [ \"$n\" -gt 0 ] && echo \"$dir: $n installed folder(s) carried into new workspaces.\"\ndone < <(repos)\n{\n  printf '{\"durationSec\":%d,\"repos\":[' \"$(( $(date +%s) - started ))\"\n  sep=\"\"\n  while IFS='|' read -r url branch dir _; do\n    [ -n \"$url\" ] || continue\n    dest=\"$ROOT/$dir\"\n    commit=$(git -C \"$dest\" rev-parse --verify --quiet HEAD 2>/dev/null || true)\n    head=$(git -C \"$dest\" symbolic-ref --quiet --short HEAD 2>/dev/null || true)\n    printf '%s{\"url\":\"%s\",\"dir\":\"%s\",\"branch\":\"%s\",\"commit\":\"%s\",\"lockfiles\":{' \"$sep\" \"$url\" \"$dir\" \"$head\" \"$commit\"\n    lsep=\"\"\n    if [ -n \"$commit\" ]; then\n      for f in ${ORCA_LOCKFILES:-}; do\n        blob=$(git -C \"$dest\" rev-parse --verify --quiet \"HEAD:$f\" 2>/dev/null || true)\n        if [ -n \"$blob\" ]; then printf '%s\"%s\":\"%s\"' \"$lsep\" \"$f\" \"$blob\"; lsep=\",\"; fi\n      done\n    fi\n    printf '}}'\n    sep=\",\"\n  done < <(repos)\n  printf '],\"diskUsedBytes\":%s,\"diskTotalBytes\":%s}\\n' \\\n    \"$(df -B1 --output=used / | tail -n 1 | tr -d ' ')\" \"$(df -B1 --output=size / | tail -n 1 | tr -d ' ')\"\n} >\"$OUT/result.json\" || exit 30\n# Nothing from this VM's own session belongs in the image, only what the script installed.\nrm -rf -- \"$OUT/install.sh\" \"$HOME/.bash_history\" \"$HOME/.orcad-data\" \"$HOME/.orca-sandbox\"\necho \"Disk used: $(df -h --output=used / | tail -n 1 | tr -d ' ') of $(df -h --output=size / | tail -n 1 | tr -d ' ')\"\n"
 export const ENVIRONMENT_DEPS_HOOK: string = "#!/usr/bin/env bash\n# Installed by Orca environment builds as the repo's post-checkout hook. When git creates a new linked\n# worktree (`git worktree add` passes the null commit as the previous HEAD), give it the dependency\n# folders the build installed in the primary checkout, as hard links: near-instant, real paths (not\n# symlinks, so bundlers and native modules behave). Hard links share file contents: tools that rewrite\n# a file in place inside these folders change it for every worktree on this VM (one workspace per VM).\n# Any post-checkout hook the repo already had runs afterwards, unchanged.\nprev=\"${1:-}\"\nhere=\"$(dirname \"$0\")\"\nif [ \"$prev\" = \"0000000000000000000000000000000000000000\" ] && [ \"${ORCA_SKIP_DEPS_LINK:-}\" != 1 ]; then\n  common=\"$(git rev-parse --path-format=absolute --git-common-dir 2>/dev/null || true)\"\n  top=\"$(git rev-parse --show-toplevel 2>/dev/null || true)\"\n  primary=\"$(dirname \"$common\")\"\n  list=\"$common/orca-env-deps\"\n  if [ -n \"$top\" ] && [ \"$top\" != \"$primary\" ] && [ -f \"$list\" ]; then\n    started=$(date +%s%N)\n    linked=0\n    while IFS= read -r rel; do\n      case \"$rel\" in '' | /* | *..*) continue ;; esac\n      [ -e \"$primary/$rel\" ] && [ ! -e \"$top/$rel\" ] || continue\n      mkdir -p \"$(dirname \"$top/$rel\")\"\n      if [ -d \"$primary/$rel\" ]; then\n        if ! cp -al -- \"$primary/$rel\" \"$top/$rel\" 2>/dev/null; then\n          # A partial hard-link copy would make the fallback nest inside it: start clean.\n          rm -rf -- \"$top/$rel\"\n          cp -a -- \"$primary/$rel\" \"$top/$rel\" 2>/dev/null || { rm -rf -- \"$top/$rel\"; continue; }\n        fi\n      else\n        cp -a -- \"$primary/$rel\" \"$top/$rel\" 2>/dev/null || continue\n      fi\n      linked=$((linked + 1))\n    done <\"$list\"\n    if [ \"$linked\" -gt 0 ]; then\n      echo \"Orca: reused $linked installed dependency folder(s) from the environment build ($(( ($(date +%s%N) - started) / 1000000 )) ms).\" >&2\n    fi\n  fi\nfi\nif [ -x \"$here/post-checkout.orca-chained\" ]; then\n  if head -n 1 \"$here/post-checkout.orca-chained\" | grep -Eq '^#!.*(ba|da|z)?sh'; then\n    # Sourced, so $0 still names `post-checkout` (husky v9 finds the user's hook by basename \"$0\").\n    ( . \"$here/post-checkout.orca-chained\" \"$@\" )\n    exit $?\n  fi\n  exec \"$here/post-checkout.orca-chained\" \"$@\"\nfi\nexit 0\n"
-export const WORKSPACE_PRELUDE_SCRIPT: string = "#!/usr/bin/env bash\n# Runs right before orca-sandbox-start on a workspace's first boot. Prints only to stderr: the start\n# script's last stdout line is the orcad recipe line the control plane parses.\n#\n# - Booted from an environment build (ORCA_ENV_REPO_DIR set): the repo is already cloned with its\n#   dependencies installed under /vercel/sandbox/repos. Link it as the project (a link, not a move,\n#   so absolute paths baked into installed dependencies keep working). No fetch when the build is\n#   already on the requested branch: Orca fetches the base right before it adds the workspace's\n#   worktree, so a fetch here would only delay orcad (measured ~0.5-1 s). Another branch is fetched\n#   and checked out; if that fails the workspace still opens at the build's commit.\n# - Otherwise clone ORCA_REPO_URL here so a repo with no commits yet also opens: it gets an empty\n#   first commit on the requested branch, which Orca needs to create the workspace's worktree.\n# - No repo at all (the user chose \"Start empty\"): a fresh repository with that same first commit.\nset -uo pipefail\nP=/vercel/sandbox/project\nROOT=/vercel/sandbox/repos\nexport GIT_TERMINAL_PROMPT=0\nauth=()\nif [ -n \"${ORCA_GIT_EXTRAHEADER:-}\" ]; then\n  auth=(-c \"http.https://github.com/.extraheader=$ORCA_GIT_EXTRAHEADER\")\nfi\nref=\"${ORCA_REPO_REF:-}\"\n\nfirst_commit() {\n  if ! git -C \"$P\" rev-parse --verify --quiet HEAD >/dev/null; then\n    git -C \"$P\" checkout --quiet -B \"${ref:-main}\" 2>/dev/null || true\n    git -C \"$P\" -c user.name='Orca' -c user.email='cloud@onorca.dev' \\\n      commit --quiet --allow-empty -m 'Initial commit' && echo 'Empty repository: created a first commit.'\n  fi\n}\n\nif [ ! -e \"$P\" ] && [ -n \"${ORCA_ENV_REPO_DIR:-}\" ] && [ -d \"$ROOT/$ORCA_ENV_REPO_DIR/.git\" ]; then\n  ln -s \"$ROOT/$ORCA_ENV_REPO_DIR\" \"$P\"\n  if [ -n \"$ref\" ] && [ \"$(git -C \"$P\" symbolic-ref --quiet --short HEAD 2>/dev/null)\" != \"$ref\" ]; then\n    if timeout 60 git \"${auth[@]}\" -C \"$P\" fetch --quiet origin \"+refs/heads/$ref:refs/remotes/origin/$ref\"; then\n      # -f: the install may have rewritten tracked files (a lockfile); the branch's version wins.\n      git -C \"$P\" checkout --quiet -f -B \"$ref\" \"origin/$ref\" -- ||\n        echo \"Could not switch to $ref; the workspace starts at the build's commit.\"\n    else\n      echo \"Could not fetch $ref; the workspace starts at the build's commit.\"\n    fi\n  fi\n  first_commit\nelif [ ! -e \"$P\" ] && [ -n \"${ORCA_REPO_URL:-}\" ]; then\n  if ! git \"${auth[@]}\" clone --quiet ${ref:+--branch \"$ref\"} -- \"$ORCA_REPO_URL\" \"$P\" 2>/dev/null; then\n    rm -rf -- \"$P\"\n    # Branch missing (or a repo with no commits): clone the default branch, then switch.\n    git \"${auth[@]}\" clone --quiet -- \"$ORCA_REPO_URL\" \"$P\" || exit 1\n    if [ -n \"$ref\" ] && ! git -C \"$P\" checkout --quiet \"$ref\" -- 2>/dev/null; then\n      git -C \"$P\" checkout --quiet -b \"$ref\" -- || true\n    fi\n  fi\n  first_commit\nelif [ ! -e \"$P\" ]; then\n  git init --quiet \"$P\" || exit 1\n  first_commit\nfi\nexit 0\n"
+export const WORKSPACE_PRELUDE_SCRIPT: string = "#!/usr/bin/env bash\n# Runs right before orca-sandbox-start on a workspace's first boot. Prints only to stderr: the start\n# script's last stdout line is the orcad recipe line the control plane parses.\n#\n# - Booted from an environment build (ORCA_ENV_REPO_DIR set): the repo is already cloned with its\n#   dependencies installed under /vercel/sandbox/repos. Link it as the project (a link, not a move,\n#   so absolute paths baked into installed dependencies keep working). No fetch when the build is\n#   already on the requested branch: Orca fetches the base right before it adds the workspace's\n#   worktree, so a fetch here would only delay orcad (measured ~0.5-1 s). Another branch is fetched\n#   and checked out; if that fails the workspace still opens at the build's commit.\n# - Otherwise clone ORCA_REPO_URL here so a repo with no commits yet also opens: it gets an empty\n#   first commit on the requested branch, which Orca needs to create the workspace's worktree.\nset -uo pipefail\nP=/vercel/sandbox/project\nROOT=/vercel/sandbox/repos\nexport GIT_TERMINAL_PROMPT=0\nauth=()\nif [ -n \"${ORCA_GIT_EXTRAHEADER:-}\" ]; then\n  auth=(-c \"http.https://github.com/.extraheader=$ORCA_GIT_EXTRAHEADER\")\nfi\nref=\"${ORCA_REPO_REF:-}\"\n\nfirst_commit() {\n  if ! git -C \"$P\" rev-parse --verify --quiet HEAD >/dev/null; then\n    git -C \"$P\" checkout --quiet -B \"${ref:-main}\" 2>/dev/null || true\n    git -C \"$P\" -c user.name='Orca' -c user.email='cloud@onorca.dev' \\\n      commit --quiet --allow-empty -m 'Initial commit' && echo 'Empty repository: created a first commit.'\n  fi\n}\n\nif [ ! -e \"$P\" ] && [ -n \"${ORCA_ENV_REPO_DIR:-}\" ] && [ -d \"$ROOT/$ORCA_ENV_REPO_DIR/.git\" ]; then\n  ln -s \"$ROOT/$ORCA_ENV_REPO_DIR\" \"$P\"\n  if [ -n \"$ref\" ] && [ \"$(git -C \"$P\" symbolic-ref --quiet --short HEAD 2>/dev/null)\" != \"$ref\" ]; then\n    if timeout 60 git \"${auth[@]}\" -C \"$P\" fetch --quiet origin \"+refs/heads/$ref:refs/remotes/origin/$ref\"; then\n      # -f: the install may have rewritten tracked files (a lockfile); the branch's version wins.\n      git -C \"$P\" checkout --quiet -f -B \"$ref\" \"origin/$ref\" -- ||\n        echo \"Could not switch to $ref; the workspace starts at the build's commit.\"\n    else\n      echo \"Could not fetch $ref; the workspace starts at the build's commit.\"\n    fi\n  fi\n  first_commit\nelif [ ! -e \"$P\" ] && [ -n \"${ORCA_REPO_URL:-}\" ]; then\n  if ! git \"${auth[@]}\" clone --quiet ${ref:+--branch \"$ref\"} -- \"$ORCA_REPO_URL\" \"$P\" 2>/dev/null; then\n    rm -rf -- \"$P\"\n    # Branch missing (or a repo with no commits): clone the default branch, then switch.\n    git \"${auth[@]}\" clone --quiet -- \"$ORCA_REPO_URL\" \"$P\" || exit 1\n    if [ -n \"$ref\" ] && ! git -C \"$P\" checkout --quiet \"$ref\" -- 2>/dev/null; then\n      git -C \"$P\" checkout --quiet -b \"$ref\" -- || true\n    fi\n  fi\n  first_commit\nfi\nexit 0\n"
diff --git a/cloud/apps/sandbox-control/src/lifecycle.ts b/cloud/apps/sandbox-control/src/lifecycle.ts
index 4f34c741391..bdcb5ac41cc 100644
--- a/cloud/apps/sandbox-control/src/lifecycle.ts
+++ b/cloud/apps/sandbox-control/src/lifecycle.ts
@@ -457,12 +457,9 @@ export async function createSandbox(
     deps.background?.(refill)
   }
   const claimedAt = deps.now()
-  // Every first boot gets the prelude: with no repo it makes an empty repository, so Orca can still
-  // create the workspace's worktree in it.
-  const prelude: StartInputs['prelude'] = {
-    script: WORKSPACE_PRELUDE_SCRIPT,
-    env: source?.repoDir ? { ORCA_ENV_REPO_DIR: source.repoDir } : {}
-  }
+  const prelude: StartInputs['prelude'] = request.repo
+    ? { script: WORKSPACE_PRELUDE_SCRIPT, env: source?.repoDir ? { ORCA_ENV_REPO_DIR: source.repoDir } : {} }
+    : undefined
   const id = pooled?.id ?? randomId()
   // Write-ahead row and the VM-independent prep (secrets, repo token) run together.
   const [row, prep] = await timer.time('prepare', async () => {
diff --git a/cloud/apps/sandbox-control/test/empty-workspace.test.ts b/cloud/apps/sandbox-control/test/empty-workspace.test.ts
deleted file mode 100644
index 519c29f109d..00000000000
--- a/cloud/apps/sandbox-control/test/empty-workspace.test.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { createHarness } from './harness'
-
-describe('a workspace started without a repo ("Start empty")', () => {
-  it('still runs the prelude, which makes an empty repository Orca can open', async () => {
-    const h = await createHarness()
-    const created = await h.call('POST', '/v1/sandboxes', {
-      body: { workspaceId: 'empty', machineSize: 'standard' }
-    })
-    expect(created.status).toBe(200)
-    const start = h.vercel.commands.filter((c) => c.command === '/opt/orca/bin/orca-sandbox-start').at(-1)!
-    expect(start.env.ORCA_REPO_URL).toBeUndefined()
-    expect(start.env.ORCA_PRELUDE).toContain('git init --quiet "$P"')
-  })
-})