@kafca/agentdock 0.1.44 → 0.1.45

package/dist-electron/tests/electron/sandbox-config.test.js

@@ -0,0 +1,541 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = __importDefault(require("node:test"));
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const sandbox_config_js_1 = require("../../services/local-ai-core/src/sandbox/sandbox-config.js");
+const workspace_route_config_js_1 = require("../../services/local-ai-core/src/router/workspace-route-config.js");
+const sandbox_manager_js_1 = require("../../services/local-ai-core/src/sandbox/sandbox-manager.js");
+const sandbox_manager_js_2 = require("../../services/local-ai-core/src/sandbox/sandbox-manager.js");
+const config_migration_js_1 = require("../../services/local-ai-core/src/runtime/config-migration.js");
+const deployment_diagnostics_js_1 = require("../../services/local-ai-core/src/runtime/deployment-diagnostics.js");
+function configState(path) {
+    return {
+        path,
+        exists: true,
+        raw: '',
+        parsed: { projects: [] },
+    };
+}
+function project(sandbox) {
+    return {
+        name: 'my-project',
+        agent: {
+            type: 'pi',
+            options: {
+                work_dir: '/workspace/source',
+                sandbox,
+            },
+            providers: [],
+        },
+        platforms: [],
+    };
+}
+function launchConfig() {
+    return {
+        workspaceId: 'my-project',
+        agentType: 'pi',
+        workDir: '/workspace/source',
+        command: process.execPath,
+        args: ['/host/node_modules/pi-acp/dist/index.js'],
+        env: {
+            PI_ACP_PI_COMMAND: '/host/node_modules/pi/dist/cli.js',
+            OPENAI_API_KEY: 'secret',
+        },
+        model: 'gpt-5',
+    };
+}
+(0, node_test_1.default)('sandbox config normalizes project scoped Pi defaults', () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentdock-sandbox-'));
+    try {
+        const sandbox = (0, sandbox_config_js_1.normalizeSandboxLaunchConfig)({
+            configState: configState((0, node_path_1.join)(root, 'runtime', 'config.toml')),
+            project: project({ enabled: true }),
+            launchConfig: launchConfig(),
+        });
+        strict_1.default.equal(sandbox?.enabled, true);
+        strict_1.default.equal(sandbox?.serverUrl, 'http://127.0.0.1:8080');
+        strict_1.default.equal(sandbox?.image, 'agentdock/pi-acp:local');
+        strict_1.default.equal(sandbox?.transport, 'http-ndjson');
+        strict_1.default.equal(sandbox?.stateScope, 'project');
+        strict_1.default.equal(sandbox?.lifecycle, 'per_thread');
+        strict_1.default.equal(sandbox?.idleSeconds, 900);
+        strict_1.default.equal(sandbox?.warmPoolSize, 0);
+        strict_1.default.equal(sandbox?.workspaceMountPath, '/workspace');
+        strict_1.default.equal(sandbox?.stateMountPath, '/agent-state');
+        strict_1.default.deepEqual(sandbox?.stateMount, {
+            userId: 'local',
+            projectId: 'my-project',
+            agentType: 'pi',
+            scope: 'project',
+            hostPath: sandbox?.stateHostPath,
+            containerPath: '/agent-state',
+        });
+        strict_1.default.equal(sandbox?.acpPort, 8080);
+        strict_1.default.match(sandbox?.stateHostPath || '', /sandbox-state[/\\]users[/\\]local[/\\]projects[/\\]my-project[/\\]agents[/\\]pi[/\\]state$/);
+        strict_1.default.equal(sandbox?.runtimeCommand, '/usr/local/bin/pi-acp');
+        strict_1.default.deepEqual(sandbox?.runtimeArgs, []);
+        strict_1.default.equal(sandbox?.runtimeEnv.PI_CODING_AGENT_DIR, '/agent-state/pi');
+        strict_1.default.equal(sandbox?.runtimeEnv.PI_ACP_PI_COMMAND, '/usr/local/bin/pi');
+        strict_1.default.equal(sandbox?.runtimeEnv.OPENAI_API_KEY, 'secret');
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('sandbox config supports user scoped state shared across projects', () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentdock-sandbox-'));
+    try {
+        const first = (0, sandbox_config_js_1.normalizeSandboxLaunchConfig)({
+            configState: configState((0, node_path_1.join)(root, 'runtime', 'config.toml')),
+            project: {
+                ...project({ enabled: true, state_scope: 'user' }),
+                name: 'first-project',
+                agent: {
+                    ...project({ enabled: true, state_scope: 'user' }).agent,
+                    options: {
+                        work_dir: '/workspace/source',
+                        user_id: 'alice@example.com',
+                        sandbox: { enabled: true, state_scope: 'user' },
+                    },
+                },
+            },
+            launchConfig: { ...launchConfig(), workspaceId: 'first-project' },
+        });
+        const second = (0, sandbox_config_js_1.normalizeSandboxLaunchConfig)({
+            configState: configState((0, node_path_1.join)(root, 'runtime', 'config.toml')),
+            project: {
+                ...project({ enabled: true, state_scope: 'user' }),
+                name: 'second-project',
+                agent: {
+                    ...project({ enabled: true, state_scope: 'user' }).agent,
+                    options: {
+                        work_dir: '/workspace/source',
+                        user_id: 'alice@example.com',
+                        sandbox: { enabled: true, state_scope: 'user' },
+                    },
+                },
+            },
+            launchConfig: { ...launchConfig(), workspaceId: 'second-project' },
+        });
+        strict_1.default.ok(first);
+        strict_1.default.ok(second);
+        strict_1.default.equal(first.stateHostPath, second.stateHostPath);
+        strict_1.default.match(first.stateHostPath || '', /sandbox-state[/\\]users[/\\]alice-example.com[/\\]agents[/\\]pi[/\\]state$/);
+        strict_1.default.equal(first.stateMount?.scope, 'user');
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('sandbox config supports thread scoped state materialization', () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentdock-sandbox-'));
+    try {
+        const sandbox = (0, sandbox_config_js_1.normalizeSandboxLaunchConfig)({
+            configState: configState((0, node_path_1.join)(root, 'runtime', 'config.toml')),
+            project: project({ enabled: true, state_scope: 'thread' }),
+            launchConfig: launchConfig(),
+        });
+        strict_1.default.ok(sandbox);
+        strict_1.default.match(sandbox.stateHostPath || '', /\$\{LOCAL_AI_THREAD_ID\}/);
+        const statePath = (0, sandbox_config_js_1.resolveSandboxStateHostPath)(sandbox, 'thread:abc/def', 'run-1');
+        strict_1.default.match(statePath, /threads[/\\]thread-abc-def[/\\]state$/);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('sandbox proxy env stores serialized launch config', () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentdock-sandbox-'));
+    try {
+        const sandbox = (0, sandbox_config_js_1.normalizeSandboxLaunchConfig)({
+            configState: configState((0, node_path_1.join)(root, 'runtime', 'config.toml')),
+            project: project({ enabled: true }),
+            launchConfig: launchConfig(),
+        });
+        strict_1.default.ok(sandbox);
+        const env = (0, sandbox_config_js_1.sandboxProxyLaunchEnv)(sandbox);
+        strict_1.default.equal(JSON.parse(env.AGENTDOCK_SANDBOX_CONFIG).image, 'agentdock/pi-acp:local');
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('workspace route launches sandbox proxy when sandbox is enabled', () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentdock-sandbox-'));
+    try {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.join)(root, 'runtime'), { recursive: true });
+        const route = (0, workspace_route_config_js_1.toLocalCoreProjectConfig)(configState((0, node_path_1.join)(root, 'runtime', 'config.toml')), project({
+            enabled: true,
+        }));
+        strict_1.default.equal(route.command, process.execPath);
+        strict_1.default.match(route.args[0], /sandbox-stdio-proxy\.js$/);
+        strict_1.default.equal(route.workDir, '/workspace/source');
+        strict_1.default.equal(route.execution?.mode, 'sandbox');
+        strict_1.default.equal(route.execution?.transport, 'sandbox-http-ndjson-stdio-proxy');
+        strict_1.default.equal(route.execution?.sandbox?.stateScope, 'project');
+        strict_1.default.equal(route.execution?.sandbox?.transport, 'http-ndjson');
+        strict_1.default.equal(route.sandbox?.workspaceHostPath, '/workspace/source');
+        strict_1.default.equal(route.sandbox?.proxyCwd, (0, node_path_1.join)(root, 'runtime'));
+        strict_1.default.equal(route.sandbox?.image, 'agentdock/pi-acp:local');
+        strict_1.default.equal(JSON.parse(route.env.AGENTDOCK_SANDBOX_CONFIG).image, 'agentdock/pi-acp:local');
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('legacy sandbox image overrides without transport use the generic HTTP bridge', () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentdock-sandbox-'));
+    try {
+        const route = (0, workspace_route_config_js_1.toLocalCoreProjectConfig)(configState((0, node_path_1.join)(root, 'runtime', 'config.toml')), project({
+            enabled: true,
+            image: 'agentdock/pi-acp:legacy',
+        }));
+        strict_1.default.equal(route.execution?.transport, 'sandbox-http-ndjson-stdio-proxy');
+        strict_1.default.equal(route.sandbox?.transport, 'http-ndjson');
+        strict_1.default.equal(route.sandbox?.image, 'agentdock/pi-acp:legacy');
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('sandbox runtime image can override the stdio runtime command behind the generic bridge', () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentdock-sandbox-'));
+    try {
+        const state = configState((0, node_path_1.join)(root, 'runtime', 'config.toml'));
+        state.parsed = {
+            projects: [],
+            sandbox_runtime_images: [{
+                    id: 'fake-acp',
+                    agent_type: 'pi',
+                    image: 'agentdock/fake-acp:local',
+                    transport: 'http-ndjson',
+                    acp_port: 8080,
+                    entrypoint: ['node', '/opt/agentdock/acp-bridge.mjs'],
+                    runtime_command: '/usr/local/bin/node',
+                    runtime_args: ['/opt/agentdock/fake-acp.mjs'],
+                }],
+        };
+        const sandbox = (0, sandbox_config_js_1.normalizeSandboxLaunchConfig)({
+            configState: state,
+            project: project({ enabled: true, runtime_image_id: 'fake-acp' }),
+            launchConfig: launchConfig(),
+        });
+        strict_1.default.equal(sandbox?.runtimeCommand, '/usr/local/bin/node');
+        strict_1.default.deepEqual(sandbox?.runtimeArgs, ['/opt/agentdock/fake-acp.mjs']);
+        strict_1.default.equal(sandbox?.transport, 'http-ndjson');
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('sandbox proxy cwd is independent from host workspace path', () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentdock-sandbox-'));
+    const previous = process.env.AI_WORKSTATION_USER_DATA_DIR;
+    try {
+        process.env.AI_WORKSTATION_USER_DATA_DIR = root;
+        const route = (0, workspace_route_config_js_1.toLocalCoreProjectConfig)(configState((0, node_path_1.join)(root, 'runtime', 'config.toml')), {
+            ...project({ enabled: true }),
+            agent: {
+                ...project({ enabled: true }).agent,
+                options: {
+                    work_dir: '/Users/example/persistent-project',
+                    sandbox: { enabled: true },
+                },
+            },
+        });
+        strict_1.default.equal(route.workDir, '/Users/example/persistent-project');
+        strict_1.default.equal(route.sandbox?.workspaceHostPath, '/Users/example/persistent-project');
+        strict_1.default.equal(route.sandbox?.workspaceMountPath, '/workspace');
+        strict_1.default.equal(route.sandbox?.proxyCwd, root);
+        strict_1.default.notEqual(route.sandbox?.proxyCwd, route.workDir);
+    }
+    finally {
+        if (previous === undefined) {
+            delete process.env.AI_WORKSTATION_USER_DATA_DIR;
+        }
+        else {
+            process.env.AI_WORKSTATION_USER_DATA_DIR = previous;
+        }
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('workspace route records local execution when sandbox is disabled', () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentdock-sandbox-'));
+    try {
+        const route = (0, workspace_route_config_js_1.toLocalCoreProjectConfig)(configState((0, node_path_1.join)(root, 'runtime', 'config.toml')), project({
+            enabled: false,
+        }));
+        strict_1.default.equal(route.execution?.mode, 'local');
+        strict_1.default.equal(route.execution?.transport, 'stdio');
+        strict_1.default.equal(route.sandbox, undefined);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('desktop config migration normalizes user id, DeepSeek provider, and sandbox defaults', () => {
+    const migrated = (0, config_migration_js_1.migrateDesktopConnectConfig)({
+        projects: [{
+                name: 'cloud-project',
+                agent: {
+                    type: 'pi',
+                    options: {
+                        tenant_id: 'team-a',
+                        sandbox: { enabled: true },
+                    },
+                    providers: [{
+                            name: 'deepseek-v4-flash',
+                            api_key: 'secret',
+                            model: 'deepseek-v4-flash',
+                        }],
+                },
+                platforms: [],
+            }],
+    });
+    strict_1.default.equal(migrated.changed, true);
+    strict_1.default.equal(migrated.config.config_version, 2);
+    const projectConfig = migrated.config.projects?.[0];
+    strict_1.default.equal(projectConfig?.agent.options?.user_id, 'team-a');
+    strict_1.default.equal((projectConfig?.agent.options).tenant_id, undefined);
+    strict_1.default.equal(projectConfig?.agent.providers?.[0]?.name, 'deepseek');
+    strict_1.default.equal(projectConfig?.agent.options?.sandbox?.provider_id, 'opensandbox-default');
+    strict_1.default.equal(projectConfig?.agent.options?.sandbox?.runtime_image_id, 'pi-acp-local');
+    strict_1.default.equal(projectConfig?.agent.options?.sandbox?.sandbox_lifecycle, 'per_thread');
+    strict_1.default.equal(projectConfig?.agent.options?.sandbox?.idle_seconds, 900);
+    strict_1.default.equal(migrated.config.sandbox_providers?.[0]?.server_url, 'http://127.0.0.1:8080');
+    strict_1.default.equal(migrated.config.sandbox_runtime_images?.[0]?.image, 'agentdock/pi-acp:local');
+    strict_1.default.equal(migrated.config.sandbox_runtime_images?.[0]?.transport, 'http-ndjson');
+});
+(0, node_test_1.default)('desktop config migration upgrades built-in Pi sandbox image to HTTP transport', () => {
+    const migrated = (0, config_migration_js_1.migrateDesktopConnectConfig)({
+        config_version: 2,
+        projects: [{
+                name: 'cloud-project',
+                agent: {
+                    type: 'pi',
+                    options: {
+                        sandbox: {
+                            enabled: true,
+                            provider_id: 'opensandbox-default',
+                            runtime_image_id: 'pi-acp-local',
+                        },
+                    },
+                },
+                platforms: [],
+            }],
+        sandbox_runtime_images: [{
+                id: 'pi-acp-local',
+                agent_type: 'pi',
+                image: 'agentdock/pi-acp:local',
+                acp_port: 8080,
+                entrypoint: ['node', '/opt/agentdock/acp-bridge.mjs'],
+                workspace_mount_path: '/workspace',
+                state_mount_path: '/agent-state',
+            }],
+    });
+    strict_1.default.equal(migrated.changed, true);
+    strict_1.default.equal(migrated.config.sandbox_runtime_images?.[0]?.transport, 'http-ndjson');
+});
+(0, node_test_1.default)('OpenSandbox create input includes volumes, resources, env, and metadata', () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentdock-sandbox-'));
+    try {
+        const sandbox = (0, sandbox_config_js_1.normalizeSandboxLaunchConfig)({
+            configState: configState((0, node_path_1.join)(root, 'runtime', 'config.toml')),
+            project: project({ enabled: true, cpu: '2000m', memory: '4Gi' }),
+            launchConfig: launchConfig(),
+        });
+        strict_1.default.ok(sandbox);
+        const input = (0, sandbox_manager_js_1.buildOpenSandboxCreateInput)(sandbox, {
+            LOCAL_AI_WORKSPACE_ID: 'my-project',
+            LOCAL_AI_THREAD_ID: 'thread-1',
+            AGENTDOCK_SANDBOX_RUN_ID: 'run-1',
+        });
+        strict_1.default.equal(input.image, 'agentdock/pi-acp:local');
+        strict_1.default.deepEqual(input.ports, [8080]);
+        strict_1.default.equal(input.cpu, '2000m');
+        strict_1.default.equal(input.memory, '4Gi');
+        strict_1.default.deepEqual(input.volumes.map((volume) => volume.container), ['/workspace', '/agent-state']);
+        strict_1.default.equal(input.volumes[0]?.host, '/workspace/source');
+        strict_1.default.equal(input.env.AGENTDOCK_ACP_COMMAND, '/usr/local/bin/pi-acp');
+        strict_1.default.equal(input.env.LOCAL_AI_WORKSPACE_PATH, '/workspace');
+        strict_1.default.equal(input.env.AGENTDOCK_ACP_STATE_DIRS, '["/agent-state","/agent-state/pi"]');
+        strict_1.default.equal(input.metadata.userId, 'local');
+        strict_1.default.equal(input.metadata.runId, 'run-1');
+        strict_1.default.equal(input.metadata.agentType, 'pi');
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('OpenSandbox metadata is Kubernetes label safe while env keeps raw ids', () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentdock-sandbox-'));
+    try {
+        const sandbox = (0, sandbox_config_js_1.normalizeSandboxLaunchConfig)({
+            configState: configState((0, node_path_1.join)(root, 'runtime', 'config.toml')),
+            project: project({ enabled: true }),
+            launchConfig: launchConfig(),
+        });
+        strict_1.default.ok(sandbox);
+        const rawThreadId = 'my-project::ca0ab5c3-8b05-4460-a66f-0bf2d1361968';
+        const rawRunId = `run:${rawThreadId}:1778671476585`;
+        const input = (0, sandbox_manager_js_1.buildOpenSandboxCreateInput)(sandbox, {
+            LOCAL_AI_WORKSPACE_ID: 'my-project',
+            LOCAL_AI_THREAD_ID: rawThreadId,
+            AGENTDOCK_SANDBOX_RUN_ID: rawRunId,
+        });
+        strict_1.default.equal(input.env.LOCAL_AI_THREAD_ID, rawThreadId);
+        strict_1.default.equal(input.env.AGENTDOCK_SANDBOX_RUN_ID, rawRunId);
+        strict_1.default.match(input.metadata.threadId, /^[a-zA-Z0-9]([-_.a-zA-Z0-9]{0,61}[a-zA-Z0-9])?$/);
+        strict_1.default.match(input.metadata.runId, /^[a-zA-Z0-9]([-_.a-zA-Z0-9]{0,61}[a-zA-Z0-9])?$/);
+        strict_1.default.ok(input.metadata.threadId.length <= 63);
+        strict_1.default.ok(input.metadata.runId.length <= 63);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('normalizeEndpoint keeps HTTP endpoints for the sandbox ACP bridge', () => {
+    strict_1.default.equal((0, sandbox_manager_js_1.normalizeEndpoint)('http://127.0.0.1:3000'), 'http://127.0.0.1:3000');
+    strict_1.default.equal((0, sandbox_manager_js_1.normalizeEndpoint)('https://example.test/acp'), 'https://example.test/acp');
+    strict_1.default.equal((0, sandbox_manager_js_1.normalizeEndpoint)('127.0.0.1:3000'), 'http://127.0.0.1:3000');
+    strict_1.default.equal((0, sandbox_manager_js_1.normalizeEndpoint)('127.0.0.1:3000', 'host.docker.internal'), 'http://host.docker.internal:3000/');
+    strict_1.default.equal((0, sandbox_manager_js_1.normalizeEndpoint)('http://127.0.0.1:3000', '', 'http-ndjson'), 'http://127.0.0.1:3000');
+    strict_1.default.equal((0, sandbox_manager_js_1.normalizeEndpoint)('https://example.test/acp', '', 'http-ndjson'), 'https://example.test/acp');
+    strict_1.default.equal((0, sandbox_manager_js_1.normalizeEndpoint)('127.0.0.1:3000', '', 'http-ndjson'), 'http://127.0.0.1:3000');
+    strict_1.default.equal((0, sandbox_manager_js_1.normalizeEndpoint)('127.0.0.1:3000', 'host.docker.internal', 'http-ndjson'), 'http://host.docker.internal:3000/');
+});
+(0, node_test_1.default)('OpenSandbox local compose auth falls back to the default local API key', () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentdock-sandbox-'));
+    try {
+        const sandbox = (0, sandbox_config_js_1.normalizeSandboxLaunchConfig)({
+            configState: configState((0, node_path_1.join)(root, 'runtime', 'config.toml')),
+            project: project({ enabled: true }),
+            launchConfig: launchConfig(),
+        });
+        strict_1.default.ok(sandbox);
+        strict_1.default.equal((0, sandbox_manager_js_1.resolveOpenSandboxApiKey)(sandbox, {}), 'agentdock-local');
+        strict_1.default.equal((0, sandbox_manager_js_1.resolveOpenSandboxApiKey)({ ...sandbox, serverUrl: 'https://sandbox.example.com' }, {}), '');
+        strict_1.default.equal((0, sandbox_manager_js_1.resolveOpenSandboxApiKey)(sandbox, { OPEN_SANDBOX_API_KEY: 'custom-key' }), 'custom-key');
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('OpenSandbox default server URL can be overridden for compose networks', () => {
+    strict_1.default.equal((0, sandbox_config_js_1.defaultOpenSandboxServerUrl)({}), 'http://127.0.0.1:8080');
+    strict_1.default.equal((0, sandbox_config_js_1.defaultOpenSandboxServerUrl)({ AGENTDOCK_OPENSANDBOX_SERVER_URL: 'http://opensandbox-server:8080/' }), 'http://opensandbox-server:8080');
+});
+(0, node_test_1.default)('sandbox state host root can be overridden for compose host mounts', () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentdock-sandbox-'));
+    const previous = process.env[sandbox_config_js_1.DEFAULT_SANDBOX_STATE_HOST_ROOT_ENV];
+    const stateRoot = (0, node_path_1.join)(root, 'host-state');
+    try {
+        process.env[sandbox_config_js_1.DEFAULT_SANDBOX_STATE_HOST_ROOT_ENV] = stateRoot;
+        const sandbox = (0, sandbox_config_js_1.normalizeSandboxLaunchConfig)({
+            configState: configState((0, node_path_1.join)(root, 'runtime', 'config.toml')),
+            project: project({ enabled: true, state_scope: 'project' }),
+            launchConfig: launchConfig(),
+        });
+        strict_1.default.ok(sandbox);
+        strict_1.default.ok(sandbox.stateHostPath?.startsWith(stateRoot));
+    }
+    finally {
+        if (previous === undefined) {
+            delete process.env[sandbox_config_js_1.DEFAULT_SANDBOX_STATE_HOST_ROOT_ENV];
+        }
+        else {
+            process.env[sandbox_config_js_1.DEFAULT_SANDBOX_STATE_HOST_ROOT_ENV] = previous;
+        }
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('deployment diagnostics delegate compose sandbox workspace paths to OpenSandbox', async () => {
+    const originalFetch = globalThis.fetch;
+    try {
+        globalThis.fetch = (async () => new Response('{}', { status: 200 }));
+        const result = await (0, deployment_diagnostics_js_1.runDeploymentDiagnostics)({
+            config: {
+                deployment_profile: 'docker-compose',
+                sandbox_providers: [{
+                        id: 'opensandbox-default',
+                        type: 'opensandbox',
+                        name: 'OpenSandbox',
+                        server_url: 'http://opensandbox-server:8080',
+                        api_key_env: 'OPEN_SANDBOX_API_KEY',
+                    }],
+                projects: [{
+                        name: 'remote-project',
+                        agent: {
+                            type: 'pi',
+                            options: {
+                                work_dir: '/Users/example/persistent-project',
+                                sandbox: { enabled: true },
+                            },
+                        },
+                        platforms: [],
+                    }],
+            },
+            env: {
+                AI_WORKSTATION_HOST: '0.0.0.0',
+                OPEN_SANDBOX_HOST_MOUNT_ALLOWLIST: '/Users,/tmp',
+            },
+        });
+        const workspaceCheck = result.checks.find((check) => check.id === 'workspace.paths');
+        strict_1.default.equal(workspaceCheck?.status, 'pass');
+        strict_1.default.equal(workspaceCheck?.summary, 'Sandbox workspace host paths are delegated to OpenSandbox.');
+    }
+    finally {
+        globalThis.fetch = originalFetch;
+    }
+});
+(0, node_test_1.default)('sandbox manager deletes sandbox and run scoped state on cleanup', async () => {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentdock-sandbox-'));
+    try {
+        const sandbox = (0, sandbox_config_js_1.normalizeSandboxLaunchConfig)({
+            configState: configState((0, node_path_1.join)(root, 'runtime', 'config.toml')),
+            project: project({ enabled: true, state_scope: 'run' }),
+            launchConfig: launchConfig(),
+        });
+        strict_1.default.ok(sandbox);
+        const deleted = [];
+        const fakeClient = {
+            async health() { },
+            async createSandbox() {
+                return { id: 'sandbox-1', status: { state: 'Running' } };
+            },
+            async getSandbox() {
+                return { id: 'sandbox-1', status: { state: 'Running' } };
+            },
+            async getEndpoint() {
+                return { endpoint: 'http://127.0.0.1:39231' };
+            },
+            async deleteSandbox(id) {
+                deleted.push(id);
+            },
+        };
+        const manager = new sandbox_manager_js_2.SandboxManager({
+            config: sandbox,
+            env: {
+                LOCAL_AI_THREAD_ID: 'thread-1',
+                LOCAL_AI_WORKSPACE_ID: 'my-project',
+                AGENTDOCK_SANDBOX_RUN_ID: 'run-1',
+            },
+            client: fakeClient,
+        });
+        const run = await manager.start();
+        strict_1.default.equal(run.sandboxId, 'sandbox-1');
+        strict_1.default.equal((0, node_fs_1.existsSync)(run.stateHostPath), true);
+        await manager.cleanup(run);
+        strict_1.default.deepEqual(deleted, ['sandbox-1']);
+        strict_1.default.equal((0, node_fs_1.existsSync)(run.stateHostPath), false);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
+    }
+});