@gethmy/harness 1.5.0 → 1.6.0

package/dist/index.js

@@ -1128,9 +1128,9 @@ __export(exports_git_pr, {
   buildPrBody: () => buildPrBody
 });
 import { execFile as execFile2, execFileSync as execFileSync7 } from "node:child_process";
-import { promisify as promisify2 } from "node:util";
+import { promisify as promisify3 } from "node:util";
 function createExecFileAsync2() {
-  return promisify2(execFile2);
+  return promisify3(execFile2);
 }
 function execFileAsync2() {
   return cachedExecFileAsync2 ??= createExecFileAsync2();
@@ -1187,7 +1187,7 @@ function validateGitProviderCli(provider, cwd) {
     }
     case "bitbucket":
     case "unknown":
-      log.warn(TAG13, `Git provider "${provider}" — PR creation will be skipped (no CLI support)`);
+      log.warn(TAG14, `Git provider "${provider}" — PR creation will be skipped (no CLI support)`);
       break;
   }
 }
@@ -1470,7 +1470,7 @@ async function checkPrMergeStatus(prUrl, cwd, provider) {
         try {
           parsed = JSON.parse(stdout.trim());
         } catch {
-          log.warn(TAG13, `Failed to parse glab JSON output for MR ${mrMatch[1]}`);
+          log.warn(TAG14, `Failed to parse glab JSON output for MR ${mrMatch[1]}`);
           return "unknown";
         }
         if (typeof parsed !== "object" || parsed === null)
@@ -1568,7 +1568,7 @@ async function resolvePrHeadBranch(prUrl, cwd, provider) {
       const { stdout } = await execFileAsync2()("gh", ["pr", "view", prUrl, "--json", "headRefName,isCrossRepository"], { cwd, encoding: "utf-8", timeout: 1e4 });
       return decidePrBranch("github", stdout);
     } catch (err) {
-      log.warn(TAG13, `gh pr view failed for ${prUrl}: ${err instanceof Error ? err.message : String(err)}`);
+      log.warn(TAG14, `gh pr view failed for ${prUrl}: ${err instanceof Error ? err.message : String(err)}`);
       return decidePrBranch("github", null);
     }
   }
@@ -1584,7 +1584,7 @@ async function resolvePrHeadBranch(prUrl, cwd, provider) {
       const { stdout } = await execFileAsync2()("az", ["repos", "pr", "show", "--id", prId, "--output", "json"], { cwd, encoding: "utf-8", timeout: 1e4 });
       return decidePrBranch("azure", stdout);
     } catch (err) {
-      log.warn(TAG13, `az repos pr show failed for ${prUrl}: ${err instanceof Error ? err.message : String(err)}`);
+      log.warn(TAG14, `az repos pr show failed for ${prUrl}: ${err instanceof Error ? err.message : String(err)}`);
       return decidePrBranch("azure", null);
     }
   }
@@ -1626,7 +1626,7 @@ function remoteBranchExists(branchName, cwd) {
 }
 function pushBranch(branchName, cwd) {
   if (remoteBranchExists(branchName, cwd)) {
-    log.info(TAG13, `Remote branch ${branchName} exists (rework), force-pushing`);
+    log.info(TAG14, `Remote branch ${branchName} exists (rework), force-pushing`);
     let expectedSha = null;
     try {
       execFileSync7("git", [...GIT_NO_HOOKS, "fetch", "origin", branchName], {
@@ -1635,7 +1635,7 @@ function pushBranch(branchName, cwd) {
       });
       expectedSha = execFileSync7("git", [...GIT_NO_HOOKS, "rev-parse", `refs/remotes/origin/${branchName}`], { cwd, encoding: "utf-8" }).trim();
     } catch (err) {
-      log.warn(TAG13, `could not resolve remote tip for ${branchName}, falling back to weak lease: ${err instanceof Error ? err.message : err}`);
+      log.warn(TAG14, `could not resolve remote tip for ${branchName}, falling back to weak lease: ${err instanceof Error ? err.message : err}`);
     }
     const lease = expectedSha ? `--force-with-lease=refs/heads/${branchName}:${expectedSha}` : "--force-with-lease";
     execFileSync7("git", [...GIT_NO_HOOKS, "push", lease, "-u", "origin", branchName], {
@@ -1661,7 +1661,7 @@ function renameRemoteBranch(oldRef, newRef, cwd) {
   } catch (err) {
     throw new Error(`renameRemoteBranch: could not resolve HEAD: ${err instanceof Error ? err.message : err}`);
   }
-  log.info(TAG13, `Renaming remote ${oldRef} → ${newRef}`);
+  log.info(TAG14, `Renaming remote ${oldRef} → ${newRef}`);
   execFileSync7("git", [
     ...GIT_NO_HOOKS,
     "push",
@@ -1675,7 +1675,7 @@ function renameRemoteBranch(oldRef, newRef, cwd) {
       stdio: "pipe"
     });
   } catch (err) {
-    log.warn(TAG13, `renameRemoteBranch: could not delete old ref ${oldRef}: ${err instanceof Error ? err.message : err}`);
+    log.warn(TAG14, `renameRemoteBranch: could not delete old ref ${oldRef}: ${err instanceof Error ? err.message : err}`);
   }
   try {
     execFileSync7("git", [...GIT_NO_HOOKS, "branch", "-m", oldRef, newRef], {
@@ -1734,7 +1734,7 @@ function buildPrBody(card, commitLog) {
 }
 function createPullRequest(card, branchName, worktreePath, config, provider, existingPrUrl) {
   if (existingPrUrl) {
-    log.info(TAG13, `Reusing existing PR from card description: ${existingPrUrl}`);
+    log.info(TAG14, `Reusing existing PR from card description: ${existingPrUrl}`);
     return existingPrUrl;
   }
   let commitLog = "";
@@ -1753,7 +1753,7 @@ function createPullRequest(card, branchName, worktreePath, config, provider, exi
   const base = config.worktree.baseBranch;
   const existingUrl = findExistingPr(branchName, worktreePath, provider);
   if (existingUrl) {
-    log.info(TAG13, `PR already exists for ${branchName}, updating body...`);
+    log.info(TAG14, `PR already exists for ${branchName}, updating body...`);
     updateExistingPr(branchName, body, worktreePath, provider);
     return existingUrl;
   }
@@ -1803,13 +1803,13 @@ function createPullRequest(card, branchName, worktreePath, config, provider, exi
         ], { cwd: worktreePath, encoding: "utf-8" }).trim();
         break;
       default:
-        log.warn(TAG13, `No PR CLI for provider "${provider}" — branch pushed but no PR created`);
+        log.warn(TAG14, `No PR CLI for provider "${provider}" — branch pushed but no PR created`);
         return null;
     }
-    log.info(TAG13, `PR created: ${result}`);
+    log.info(TAG14, `PR created: ${result}`);
     return result;
   } catch (err) {
-    log.error(TAG13, `Failed to create PR: ${err instanceof Error ? err.message : err}`);
+    log.error(TAG14, `Failed to create PR: ${err instanceof Error ? err.message : err}`);
     return null;
   }
 }
@@ -1843,12 +1843,12 @@ function updateExistingPr(branchName, body, worktreePath, provider) {
         execFileSync7("glab", ["mr", "update", branchName, "--description", body], { cwd: worktreePath, stdio: "pipe" });
         break;
     }
-    log.info(TAG13, `Updated existing PR body for ${branchName}`);
+    log.info(TAG14, `Updated existing PR body for ${branchName}`);
   } catch (err) {
-    log.warn(TAG13, `Failed to update PR body: ${err instanceof Error ? err.message : err}`);
+    log.warn(TAG14, `Failed to update PR body: ${err instanceof Error ? err.message : err}`);
   }
 }
-var cachedExecFileAsync2, TAG13 = "git-pr", VALID_PR_URL_RE, PR_URL_RE, REVIEWED_SHA_RE, CI_REVIEW_REQUESTED_SHA_RE;
+var cachedExecFileAsync2, TAG14 = "git-pr", VALID_PR_URL_RE, PR_URL_RE, REVIEWED_SHA_RE, CI_REVIEW_REQUESTED_SHA_RE;
 var init_git_pr = __esm(() => {
   init_dist();
   init_log();
@@ -2721,6 +2721,7 @@ init_dist();
 
 // src/exec-types.ts
 var DEFAULT_METRIC_TIMEOUT_MS = 300000;
+var SANDBOX_STARTUP_GRACE_MS = 60000;
 
 // src/gate-config-error.ts
 init_dist();
@@ -3439,8 +3440,8 @@ function errText(err) {
 }
 
 // src/verification.ts
-init_log();
 import { execFileSync as execFileSync5, spawn as spawn2 } from "node:child_process";
+init_log();
 
 // src/pm.ts
 init_log();
@@ -3672,11 +3673,108 @@ function resolveXcodeScheme(pt) {
   }
 }
 
+// src/repair-sandbox.ts
+init_log();
+import { randomUUID } from "node:crypto";
+import { promisify as promisify2 } from "node:util";
+var TAG9 = "repair-sandbox";
+async function dockerExec(argv, opts) {
+  const { execFile: execFile2 } = await import("node:child_process");
+  return promisify2(execFile2)("docker", argv, {
+    encoding: "utf-8",
+    ...opts
+  });
+}
+var MAX_OUTPUT_BUFFER2 = 20971520;
+var PROBE_TIMEOUT_MS = 1e4;
+var SANDBOX_MOUNT = "/repo";
+var SANDBOX_MEMORY = "4g";
+var SANDBOX_PIDS = "512";
+var dockerProbe = null;
+async function sandboxAvailable() {
+  if (dockerProbe === true)
+    return true;
+  try {
+    await dockerExec(["version", "--format", "{{.Server.Version}}"], {
+      timeout: PROBE_TIMEOUT_MS
+    });
+    dockerProbe = true;
+  } catch {
+    dockerProbe = false;
+  }
+  return dockerProbe;
+}
+function __resetSandboxProbe() {
+  dockerProbe = null;
+}
+async function removeContainer(name) {
+  try {
+    await dockerExec(["rm", "--force", name], { timeout: PROBE_TIMEOUT_MS });
+    log.warn(TAG9, `removed the timed-out sandbox container ${name}`);
+  } catch {}
+}
+function sandboxRunArgs(image, worktree, command, name) {
+  return [
+    "run",
+    "--rm",
+    ...name ? ["--name", name] : [],
+    "--network=none",
+    "--cap-drop=ALL",
+    "--security-opt=no-new-privileges",
+    `--memory=${SANDBOX_MEMORY}`,
+    `--pids-limit=${SANDBOX_PIDS}`,
+    ...typeof process.getuid === "function" && typeof process.getgid === "function" ? ["--user", `${process.getuid()}:${process.getgid()}`] : [],
+    "--env",
+    "HOME=/tmp",
+    "--volume",
+    `${worktree}:${SANDBOX_MOUNT}`,
+    "--workdir",
+    SANDBOX_MOUNT,
+    "--entrypoint",
+    command.cmd,
+    image,
+    ...command.args
+  ];
+}
+async function runInSandbox(args) {
+  const name = `harmony-repair-${randomUUID()}`;
+  const argv = sandboxRunArgs(args.image, args.worktree, args.command, name);
+  log.info(TAG9, `sandbox: ${args.command.cmd} ${args.command.args.join(" ")} (image ${args.image})`);
+  try {
+    const { stdout } = await dockerExec(argv, {
+      timeout: args.timeoutMs,
+      maxBuffer: MAX_OUTPUT_BUFFER2
+    });
+    return { passed: true, output: stdout ?? "" };
+  } catch (err) {
+    const e = err;
+    const output = `${e.stdout ?? ""}${e.stderr ?? ""}`;
+    if (typeof e.code !== "number") {
+      const timedOut = e.killed === true || e.signal != null;
+      if (timedOut)
+        await removeContainer(name);
+      return {
+        passed: false,
+        output,
+        sandboxError: timedOut ? `the sandbox timed out after ${args.timeoutMs}ms` : `the sandbox did not run: ${e.message ?? "unknown error"}`
+      };
+    }
+    if (e.code === 125) {
+      return {
+        passed: false,
+        output,
+        sandboxError: `the sandbox could not start (image "${args.image}" missing or unusable)`
+      };
+    }
+    return { passed: false, output };
+  }
+}
+
 // src/revert-guard.ts
 init_log();
 init_run_containment();
 import { execFileSync as execFileSync4 } from "node:child_process";
-var TAG9 = "revert-guard";
+var TAG10 = "revert-guard";
 var TEST_FILE = /(?:^|\/)__tests__\/|\.(?:test|spec)\.[cm]?[jt]sx?$/;
 function isTestFile(path) {
   return TEST_FILE.test(path);
@@ -3691,7 +3789,7 @@ function refetchBase(worktreePath, baseBranch) {
       stdio: "pipe"
     });
   } catch {
-    log.warn(TAG9, "Failed to re-fetch base for revert guard — using last fetch");
+    log.warn(TAG10, "Failed to re-fetch base for revert guard — using last fetch");
   }
 }
 function listDeletedFilesAgainstBase(worktreePath, baseBranch) {
@@ -3706,7 +3804,7 @@ function listDeletedFilesAgainstBase(worktreePath, baseBranch) {
     return out.split(`
 `).map((l) => l.trim()).filter((l) => l.length > 0);
   } catch (err) {
-    log.warn(TAG9, `Failed to list deleted files: ${err instanceof Error ? err.message : err}`);
+    log.warn(TAG10, `Failed to list deleted files: ${err instanceof Error ? err.message : err}`);
     return [];
   }
 }
@@ -3717,8 +3815,8 @@ function findDeletedTestFiles(worktreePath, baseBranch) {
 
 // src/verification.ts
 init_run_containment();
-var TAG10 = "verification";
-var MAX_OUTPUT_BUFFER2 = 64 * 1024 * 1024;
+var TAG11 = "verification";
+var MAX_OUTPUT_BUFFER3 = 64 * 1024 * 1024;
 async function runVerification(worktreePath, config, workerId) {
   const result = {
     passed: true,
@@ -3728,137 +3826,163 @@ async function runVerification(worktreePath, config, workerId) {
     reviewFindings: [],
     revertWarnings: []
   };
+  const sandbox = verificationSandbox(config);
   if (config.verification.revertGuard) {
-    log.info(TAG10, `[worker:${workerId}] Checking for reverted merged work...`);
+    log.info(TAG11, `[worker:${workerId}] Checking for reverted merged work...`);
     const deletedTests = findDeletedTestFiles(worktreePath, config.worktree.baseBranch);
     if (deletedTests.length > 0) {
       result.revertWarnings = deletedTests.map((f) => `Branch deletes test file '${f}' relative to current ${config.worktree.baseBranch} — ` + "likely an accidental revert of already-merged work. Restore the test or rebase on current main.");
-      log.warn(TAG10, `[worker:${workerId}] Revert guard tripped: ${deletedTests.length} deleted test file(s)`);
+      log.warn(TAG11, `[worker:${workerId}] Revert guard tripped: ${deletedTests.length} deleted test file(s)`);
       result.passed = false;
     } else {
-      log.info(TAG10, `[worker:${workerId}] Revert guard passed`);
+      log.info(TAG11, `[worker:${workerId}] Revert guard passed`);
     }
   }
   if (config.verification.build) {
-    log.info(TAG10, `[worker:${workerId}] Running build...`);
-    result.buildErrors = runBuild(worktreePath, config.verification.timeout);
+    log.info(TAG11, `[worker:${workerId}] Running build...`);
+    result.buildErrors = await runBuild(worktreePath, config.verification.timeout, sandbox);
     if (result.buildErrors.length > 0) {
-      log.warn(TAG10, `[worker:${workerId}] Build failed with ${result.buildErrors.length} error(s)`);
+      log.warn(TAG11, `[worker:${workerId}] Build failed with ${result.buildErrors.length} error(s)`);
       result.passed = false;
     } else {
-      log.info(TAG10, `[worker:${workerId}] Build passed`);
+      log.info(TAG11, `[worker:${workerId}] Build passed`);
     }
   }
   if (config.verification.test && result.buildErrors.length === 0) {
-    log.info(TAG10, `[worker:${workerId}] Running tests...`);
-    result.testFailures = runTests(worktreePath, config.verification.testTimeout);
+    log.info(TAG11, `[worker:${workerId}] Running tests...`);
+    result.testFailures = await runTests(worktreePath, config.verification.testTimeout, sandbox);
     if (result.testFailures.length > 0) {
-      log.warn(TAG10, `[worker:${workerId}] Tests failed with ${result.testFailures.length} failure(s)`);
+      log.warn(TAG11, `[worker:${workerId}] Tests failed with ${result.testFailures.length} failure(s)`);
       result.passed = false;
     } else {
-      log.info(TAG10, `[worker:${workerId}] Tests passed`);
+      log.info(TAG11, `[worker:${workerId}] Tests passed`);
     }
   }
   if (config.verification.lint) {
-    log.info(TAG10, `[worker:${workerId}] Running lint...`);
-    result.lintWarnings = runLint(worktreePath, config.verification.timeout);
+    log.info(TAG11, `[worker:${workerId}] Running lint...`);
+    result.lintWarnings = await runLint(worktreePath, config.verification.timeout, sandbox);
     if (result.lintWarnings.length > 0) {
-      log.warn(TAG10, `[worker:${workerId}] Lint found ${result.lintWarnings.length} issue(s)`);
+      log.warn(TAG11, `[worker:${workerId}] Lint found ${result.lintWarnings.length} issue(s)`);
     } else {
-      log.info(TAG10, `[worker:${workerId}] Lint passed`);
+      log.info(TAG11, `[worker:${workerId}] Lint passed`);
     }
   }
   if (config.verification.deepReview) {
-    log.info(TAG10, `[worker:${workerId}] Running deep review...`);
+    log.info(TAG11, `[worker:${workerId}] Running deep review...`);
     result.reviewFindings = await runDeepReview(worktreePath, config, workerId);
     if (result.reviewFindings.length > 0) {
-      log.warn(TAG10, `[worker:${workerId}] Deep review found ${result.reviewFindings.length} finding(s)`);
+      log.warn(TAG11, `[worker:${workerId}] Deep review found ${result.reviewFindings.length} finding(s)`);
     } else {
-      log.info(TAG10, `[worker:${workerId}] Deep review passed`);
+      log.info(TAG11, `[worker:${workerId}] Deep review passed`);
     }
   }
   return result;
 }
-function runBuild(worktreePath, timeout) {
-  const command = buildCommand(worktreePath);
-  if (!command) {
-    log.warn(TAG10, `No known build toolchain for ${worktreePath} — skipping build`);
-    return [];
+function verificationSandbox(config) {
+  const image = config.verification.sandboxImage?.trim();
+  if (!image)
+    return;
+  return { image };
+}
+async function execStep(command, args) {
+  const { worktreePath, timeout } = args;
+  const sandbox = args.sandbox?.image.trim() ? args.sandbox : undefined;
+  if (sandbox) {
+    if (!await sandboxAvailable()) {
+      return {
+        ok: false,
+        sandboxError: `verification.sandboxImage is set to "${sandbox.image}" but no container runtime answered — ` + "start Docker or unset the image to verify on the host"
+      };
+    }
+    const result = await runInSandbox({
+      image: sandbox.image,
+      worktree: worktreePath,
+      command,
+      timeoutMs: timeout + SANDBOX_STARTUP_GRACE_MS
+    });
+    if (result.sandboxError) {
+      return { ok: false, sandboxError: result.sandboxError };
+    }
+    if (result.passed)
+      return { ok: true };
+    return { ok: false, err: { stdout: result.output, stderr: "" } };
   }
   try {
     execFileSync5(command.cmd, command.args, {
       cwd: worktreePath,
       timeout,
       stdio: "pipe",
-      maxBuffer: MAX_OUTPUT_BUFFER2,
+      maxBuffer: MAX_OUTPUT_BUFFER3,
       env: containedEnv()
     });
-    return [];
+    return { ok: true };
   } catch (err) {
-    return parseErrorOutput(err);
+    return { ok: false, err };
+  }
+}
+async function runBuild(worktreePath, timeout, sandbox) {
+  const command = buildCommand(worktreePath);
+  if (!command) {
+    log.warn(TAG11, `No known build toolchain for ${worktreePath} — skipping build`);
+    return [];
   }
+  const outcome = await execStep(command, { worktreePath, timeout, sandbox });
+  if (outcome.ok)
+    return [];
+  if (outcome.sandboxError) {
+    log.error(TAG11, `Build not verified: ${outcome.sandboxError}`);
+    return [`Build did not run: ${outcome.sandboxError}`];
+  }
+  return parseErrorOutput(outcome.err);
 }
-function runTests(worktreePath, timeout) {
+async function runTests(worktreePath, timeout, sandbox) {
   const command = testCommand(worktreePath);
   if (!command) {
-    log.warn(TAG10, `No test command for detected toolchain in ${worktreePath} — skipping tests`);
+    log.warn(TAG11, `No test command for detected toolchain in ${worktreePath} — skipping tests`);
     return [];
   }
-  try {
-    execFileSync5(command.cmd, command.args, {
-      cwd: worktreePath,
-      timeout,
-      stdio: "pipe",
-      maxBuffer: MAX_OUTPUT_BUFFER2,
-      env: containedEnv()
-    });
+  const outcome = await execStep(command, { worktreePath, timeout, sandbox });
+  if (outcome.ok)
     return [];
-  } catch (err) {
-    const output = combineOutput(err);
-    log.warn(TAG10, `Test run failed:
-${output.slice(-4000) || "(no output captured)"}`);
-    return parseTestFailures(err, timeout);
+  if (outcome.sandboxError) {
+    log.error(TAG11, `Tests not verified: ${outcome.sandboxError}`);
+    return [`Test run did not happen: ${outcome.sandboxError}`];
   }
+  const output = combineOutput(outcome.err);
+  log.warn(TAG11, `Test run failed:
+${output.slice(-4000) || "(no output captured)"}`);
+  return parseTestFailures(outcome.err, timeout);
 }
-function runFormatFix(worktreePath, timeout, workerId) {
+async function runFormatFix(worktreePath, timeout, workerId, sandbox) {
   const command = formatFixCommand(worktreePath);
   if (!command)
     return;
-  try {
-    execFileSync5(command.cmd, command.args, {
-      cwd: worktreePath,
-      timeout,
-      stdio: "pipe",
-      maxBuffer: MAX_OUTPUT_BUFFER2,
-      env: containedEnv()
-    });
-    log.info(TAG10, `[worker:${workerId}] Auto-formatted worktree before commit/push`);
-  } catch (err) {
-    log.warn(TAG10, `[worker:${workerId}] Auto-format step exited non-zero (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+  const outcome = await execStep(command, { worktreePath, timeout, sandbox });
+  if (outcome.ok) {
+    log.info(TAG11, `[worker:${workerId}] Auto-formatted worktree before commit/push`);
+    return;
   }
+  const why = outcome.sandboxError ? outcome.sandboxError : outcome.err instanceof Error ? outcome.err.message : String(outcome.err);
+  log.warn(TAG11, `[worker:${workerId}] Auto-format step did not complete (non-fatal): ${why}`);
 }
-function runLint(worktreePath, timeout) {
+async function runLint(worktreePath, timeout, sandbox) {
   const command = lintCommand(worktreePath);
   if (!command) {
-    log.info(TAG10, `No lint step for detected toolchain in ${worktreePath} — skipping lint`);
+    log.info(TAG11, `No lint step for detected toolchain in ${worktreePath} — skipping lint`);
     return [];
   }
-  try {
-    execFileSync5(command.cmd, command.args, {
-      cwd: worktreePath,
-      timeout,
-      stdio: "pipe",
-      maxBuffer: MAX_OUTPUT_BUFFER2,
-      env: containedEnv()
-    });
+  const outcome = await execStep(command, { worktreePath, timeout, sandbox });
+  if (outcome.ok)
     return [];
-  } catch (err) {
-    return parseErrorOutput(err);
+  if (outcome.sandboxError) {
+    log.error(TAG11, `Lint not verified: ${outcome.sandboxError}`);
+    return [`Lint did not run: ${outcome.sandboxError}`];
   }
+  return parseErrorOutput(outcome.err);
 }
 async function runDeepReview(worktreePath, config, workerId) {
   if (!supportsDevServer(worktreePath)) {
-    log.info(TAG10, `[worker:${workerId}] Detected non-web toolchain — skipping deep review`);
+    log.info(TAG11, `[worker:${workerId}] Detected non-web toolchain — skipping deep review`);
     return [];
   }
   const port = config.verification.devServerBasePort + workerId;
@@ -3874,7 +3998,7 @@ async function runDeepReview(worktreePath, config, workerId) {
       await waitForDevServer(devServer, 30000);
       await probeDevServer(port);
     } catch (err) {
-      log.error(TAG10, `Dev server did not become ready: ${err instanceof Error ? err.message : err}`);
+      log.error(TAG11, `Dev server did not become ready: ${err instanceof Error ? err.message : err}`);
       return [];
     }
     let diff = "";
@@ -3883,7 +4007,7 @@ async function runDeepReview(worktreePath, config, workerId) {
         cwd: worktreePath,
         encoding: "utf-8",
         timeout: 30000,
-        maxBuffer: MAX_OUTPUT_BUFFER2
+        maxBuffer: MAX_OUTPUT_BUFFER3
       });
     } catch {
       diff = "(unable to retrieve diff)";
@@ -3917,12 +4041,12 @@ async function runDeepReview(worktreePath, config, workerId) {
       encoding: "utf-8",
       timeout: config.verification.timeout,
       stdio: "pipe",
-      maxBuffer: MAX_OUTPUT_BUFFER2,
+      maxBuffer: MAX_OUTPUT_BUFFER3,
       env: containedEnv()
     });
     return parseReviewFindings(output);
   } catch (err) {
-    log.error(TAG10, `Deep review failed: ${err instanceof Error ? err.message : err}`);
+    log.error(TAG11, `Deep review failed: ${err instanceof Error ? err.message : err}`);
     return [];
   } finally {
     if (devServer && !devServer.killed) {
@@ -3960,12 +4084,12 @@ function attemptAutoFix(worktreePath, config, errors) {
     "--",
     fixPrompt
   ];
-  log.info(TAG10, "Spawning Claude for auto-fix...");
+  log.info(TAG11, "Spawning Claude for auto-fix...");
   execFileSync5("claude", args, {
     cwd: worktreePath,
     timeout: config.verification.timeout,
     stdio: "pipe",
-    maxBuffer: MAX_OUTPUT_BUFFER2,
+    maxBuffer: MAX_OUTPUT_BUFFER3,
     env: containedEnv()
   });
 }
@@ -3999,7 +4123,7 @@ async function reportFindings(client, cardId, result, recovery) {
     try {
       await client.createSubtask(cardId, title);
     } catch (err) {
-      log.error(TAG10, `Failed to create subtask: ${err instanceof Error ? err.message : err}`);
+      log.error(TAG11, `Failed to create subtask: ${err instanceof Error ? err.message : err}`);
     }
   }));
   if (overflow > 0) {
@@ -4007,7 +4131,7 @@ async function reportFindings(client, cardId, result, recovery) {
       await client.createSubtask(cardId, `...and ${overflow} more issues`);
     } catch {}
   }
-  log.info(TAG10, `Reported ${Math.min(items.length, maxSubtasks)} finding(s) as subtasks on card ${cardId}`);
+  log.info(TAG11, `Reported ${Math.min(items.length, maxSubtasks)} finding(s) as subtasks on card ${cardId}`);
 }
 function combineOutput(err) {
   const stderr = err?.stderr?.toString() ?? "";
@@ -4040,7 +4164,7 @@ function parseTestFailures(err, timeout) {
   }
   if (e?.code === "ENOBUFS") {
     return [
-      `Test output exceeded the ${MAX_OUTPUT_BUFFER2 / (1024 * 1024)}MB capture limit and the run was killed — ` + "the suite's real result is unknown. Quieten the reporter or raise the limit."
+      `Test output exceeded the ${MAX_OUTPUT_BUFFER3 / (1024 * 1024)}MB capture limit and the run was killed — ` + "the suite's real result is unknown. Quieten the reporter or raise the limit."
     ];
   }
   const combined = combineOutput(err);
@@ -4131,7 +4255,7 @@ async function probeDevServer(port, timeoutMs = 5000) {
 }
 
 // src/gate-collectors.ts
-var TAG11 = "gate-collectors";
+var TAG12 = "gate-collectors";
 async function resolveStageGate(client, card) {
   const currentStage = card.current_stage;
   const playbookId = card.playbook_id;
@@ -4149,7 +4273,7 @@ async function resolveStageGate(client, card) {
       return null;
     return { stage: resolution.stage, gate };
   } catch (err) {
-    log.warn(TAG11, `resolveStageGate failed for stage "${currentStage}": ${err instanceof Error ? err.message : err}`);
+    log.warn(TAG12, `resolveStageGate failed for stage "${currentStage}": ${err instanceof Error ? err.message : err}`);
     return null;
   }
 }
@@ -4184,8 +4308,8 @@ class BuildGreenCollector {
   async collect(_context) {
     const doBuild = this.deps.runBuild ?? runBuild;
     const doLint = this.deps.runLint ?? runLint;
-    const buildErrors = doBuild(this.deps.worktreePath, this.deps.buildTimeout);
-    const lintWarnings = doLint(this.deps.worktreePath, this.deps.lintTimeout);
+    const buildErrors = await doBuild(this.deps.worktreePath, this.deps.buildTimeout, this.deps.sandbox);
+    const lintWarnings = await doLint(this.deps.worktreePath, this.deps.lintTimeout, this.deps.sandbox);
     const buildPassed = buildErrors.length === 0;
     const lintPassed = lintWarnings.length === 0;
     const result = buildPassed ? "passed" : "failed";
@@ -4281,7 +4405,7 @@ function buildGateCollectorRegistry(deps) {
 async function collectGateEvidence(registry, context) {
   const collector = registry[context.gate.kind];
   if (!collector) {
-    log.info(TAG11, `No collector for gate kind "${context.gate.kind}" — reporting blocked`);
+    log.info(TAG12, `No collector for gate kind "${context.gate.kind}" — reporting blocked`);
     return {
       result: "blocked",
       structured: {
@@ -4293,7 +4417,7 @@ async function collectGateEvidence(registry, context) {
     return await collector.collect(context);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    log.warn(TAG11, `Collector for "${context.gate.kind}" threw: ${msg} — reporting blocked`);
+    log.warn(TAG12, `Collector for "${context.gate.kind}" threw: ${msg} — reporting blocked`);
     return { result: "blocked", structured: { error: msg } };
   }
 }
@@ -4301,7 +4425,7 @@ async function collectGateEvidence(registry, context) {
 init_log();
 init_run_containment();
 import { execFileSync as execFileSync6 } from "node:child_process";
-var TAG12 = "git-diff-stat";
+var TAG13 = "git-diff-stat";
 var MAX_CHANGED_FILES = 30;
 function parseNumstat(raw, maxFiles = MAX_CHANGED_FILES) {
   const files = [];
@@ -4383,7 +4507,7 @@ function captureDiffStat(worktreePath, baseBranch, maxFiles = MAX_CHANGED_FILES)
     const raw = execFileSync6("git", [...GIT_NO_HOOKS, "diff", "--numstat", `${baseBranch}...HEAD`], { cwd: worktreePath, encoding: "utf-8", timeout: 30000 });
     return parseNumstat(raw, maxFiles);
   } catch (err) {
-    log.warn(TAG12, "git diff --numstat failed", {
+    log.warn(TAG13, "git diff --numstat failed", {
       event: "diff_stat_failed",
       error: err instanceof Error ? err.message : String(err)
     });
@@ -4396,7 +4520,7 @@ init_git_pr();
 
 // src/harmony-client.ts
 init_log();
-var TAG14 = "harmony-client";
+var TAG15 = "harmony-client";
 function readClientConfig(env) {
   const apiUrl = env.HARMONY_API_URL?.trim();
   const apiKey = env.HARMONY_API_KEY?.trim();
@@ -4448,7 +4572,7 @@ class HarmonyClient {
       purpose: "gate_evaluation"
     });
     if (!response.ok) {
-      log.warn(TAG14, `Oracle fetch for stage ${stageId} returned ${response.status} — no oracle read, the gate will report blocked`);
+      log.warn(TAG15, `Oracle fetch for stage ${stageId} returned ${response.status} — no oracle read, the gate will report blocked`);
       return null;
     }
     const body = await response.json();
@@ -4528,102 +4652,6 @@ function relayAgentEvent(draft) {
   }
   return { type: "agent_event", event: draft };
 }
-// src/repair-sandbox.ts
-init_log();
-import { randomUUID } from "node:crypto";
-import { promisify as promisify3 } from "node:util";
-var TAG15 = "repair-sandbox";
-async function dockerExec(argv, opts) {
-  const { execFile: execFile3 } = await import("node:child_process");
-  return promisify3(execFile3)("docker", argv, {
-    encoding: "utf-8",
-    ...opts
-  });
-}
-var MAX_OUTPUT_BUFFER3 = 20971520;
-var PROBE_TIMEOUT_MS = 1e4;
-var SANDBOX_MOUNT = "/repo";
-var SANDBOX_MEMORY = "4g";
-var SANDBOX_PIDS = "512";
-var dockerProbe = null;
-async function sandboxAvailable() {
-  if (dockerProbe === true)
-    return true;
-  try {
-    await dockerExec(["version", "--format", "{{.Server.Version}}"], {
-      timeout: PROBE_TIMEOUT_MS
-    });
-    dockerProbe = true;
-  } catch {
-    dockerProbe = false;
-  }
-  return dockerProbe;
-}
-function __resetSandboxProbe() {
-  dockerProbe = null;
-}
-async function removeContainer(name) {
-  try {
-    await dockerExec(["rm", "--force", name], { timeout: PROBE_TIMEOUT_MS });
-    log.warn(TAG15, `removed the timed-out sandbox container ${name}`);
-  } catch {}
-}
-function sandboxRunArgs(image, worktree, command, name) {
-  return [
-    "run",
-    "--rm",
-    ...name ? ["--name", name] : [],
-    "--network=none",
-    "--cap-drop=ALL",
-    "--security-opt=no-new-privileges",
-    `--memory=${SANDBOX_MEMORY}`,
-    `--pids-limit=${SANDBOX_PIDS}`,
-    ...typeof process.getuid === "function" && typeof process.getgid === "function" ? ["--user", `${process.getuid()}:${process.getgid()}`] : [],
-    "--env",
-    "HOME=/tmp",
-    "--volume",
-    `${worktree}:${SANDBOX_MOUNT}`,
-    "--workdir",
-    SANDBOX_MOUNT,
-    "--entrypoint",
-    command.cmd,
-    image,
-    ...command.args
-  ];
-}
-async function runInSandbox(args) {
-  const name = `harmony-repair-${randomUUID()}`;
-  const argv = sandboxRunArgs(args.image, args.worktree, args.command, name);
-  log.info(TAG15, `sandbox: ${args.command.cmd} ${args.command.args.join(" ")} (image ${args.image})`);
-  try {
-    const { stdout } = await dockerExec(argv, {
-      timeout: args.timeoutMs,
-      maxBuffer: MAX_OUTPUT_BUFFER3
-    });
-    return { passed: true, output: stdout ?? "" };
-  } catch (err) {
-    const e = err;
-    const output = `${e.stdout ?? ""}${e.stderr ?? ""}`;
-    if (typeof e.code !== "number") {
-      const timedOut = e.killed === true || e.signal != null;
-      if (timedOut)
-        await removeContainer(name);
-      return {
-        passed: false,
-        output,
-        sandboxError: timedOut ? `the sandbox timed out after ${args.timeoutMs}ms` : `the sandbox did not run: ${e.message ?? "unknown error"}`
-      };
-    }
-    if (e.code === 125) {
-      return {
-        passed: false,
-        output,
-        sandboxError: `the sandbox could not start (image "${args.image}" missing or unusable)`
-      };
-    }
-    return { passed: false, output };
-  }
-}
 
 // src/index.ts
 init_run_containment();
@@ -5202,6 +5230,7 @@ var MOTOR_NAME = "harmony-harness";
 export {
   writeOnlyDenyPaths,
   waitForDevServer,
+  verificationSandbox,
   validateGitProviderCli,
   upsertReviewedSha,
   upsertCiReviewRequestedSha,
@@ -5343,6 +5372,7 @@ export {
   SdkAgentRunner,
   SIZING_MODEL,
   SDK_ALLOWED_TOOLS,
+  SANDBOX_STARTUP_GRACE_MS,
   SANDBOX_MOUNT,
   ReviewPassedCollector,
   ProjectSandboxOverrideError,