archal 0.9.20 → 0.10.0

package/agents/google-workspace-local-tools/agent.mjs

@@ -1,196 +0,0 @@
-#!/usr/bin/env node
-
-const originalGoogleBearer = process.env.EXAMPLE_GOOGLE_ACCESS_TOKEN?.trim() || 'ya29.self-local-invalid';
-const calendarDate = process.env.EXAMPLE_CALENDAR_DATE?.trim() || '2026-03-29';
-const task = process.env.AGENT_TASK?.trim()
-  || 'Read the unread inbox email, inspect the next calendar event, and create a draft reply.';
-
-function toBase64Url(input) {
-  return Buffer.from(input, 'utf-8').toString('base64url');
-}
-
-function getGoogleHeaders(json = false) {
-  return {
-    authorization: `Bearer ${originalGoogleBearer}`,
-    ...(json ? { 'content-type': 'application/json' } : {}),
-  };
-}
-
-function toGoogleUrl(path) {
-  if (path.startsWith('/gmail/')) {
-    return `https://gmail.googleapis.com${path}`;
-  }
-  if (path.startsWith('/calendar/')) {
-    return `https://calendar.googleapis.com${path}`;
-  }
-  throw new Error(`Unsupported Google Workspace API path: ${path}`);
-}
-
-async function fetchJson(path, options = {}) {
-  const url = toGoogleUrl(path);
-  let response;
-  try {
-    response = await fetch(url, options);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`fetch failed for ${url}: ${message}`);
-  }
-  const text = await response.text();
-  let body = null;
-  if (text.length > 0) {
-    try {
-      body = JSON.parse(text);
-    } catch {
-      body = text;
-    }
-  }
-
-  if (!response.ok) {
-    throw new Error(`Request failed ${response.status} for ${path}: ${JSON.stringify(body)}`);
-  }
-
-  return body;
-}
-
-function getHeader(payload, name) {
-  const headers = Array.isArray(payload?.headers) ? payload.headers : [];
-  const match = headers.find(
-    (header) =>
-      header
-      && typeof header.name === 'string'
-      && header.name.toLowerCase() === name.toLowerCase(),
-  );
-  return typeof match?.value === 'string' ? match.value : null;
-}
-
-async function readEmail() {
-  const unreadQuery = encodeURIComponent('is:unread in:inbox');
-  const unreadList = await fetchJson(`/gmail/v1/users/me/messages?q=${unreadQuery}&maxResults=1`, {
-    headers: getGoogleHeaders(),
-  });
-  const list = Array.isArray(unreadList?.messages) && unreadList.messages.length > 0
-    ? unreadList
-    : await fetchJson('/gmail/v1/users/me/messages?maxResults=1', {
-      headers: getGoogleHeaders(),
-    });
-
-  const [messageRef] = Array.isArray(list?.messages) ? list.messages : [];
-  if (!messageRef?.id) {
-    throw new Error('No Gmail message available in the selected seed');
-  }
-
-  const message = await fetchJson(
-    `/gmail/v1/users/me/messages/${encodeURIComponent(String(messageRef.id))}?format=full`,
-    { headers: getGoogleHeaders() },
-  );
-  const payload = message?.payload ?? {};
-
-  return {
-    id: String(message.id),
-    threadId: String(message.threadId),
-    subject: getHeader(payload, 'Subject'),
-    from: getHeader(payload, 'From'),
-    snippet: typeof message.snippet === 'string' ? message.snippet : null,
-  };
-}
-
-function buildDayWindow(dateString) {
-  const start = new Date(`${dateString}T00:00:00.000Z`);
-  if (Number.isNaN(start.valueOf())) {
-    throw new Error(`Invalid EXAMPLE_CALENDAR_DATE: ${dateString}`);
-  }
-  const end = new Date(start);
-  end.setUTCDate(end.getUTCDate() + 1);
-  return {
-    timeMin: start.toISOString(),
-    timeMax: end.toISOString(),
-  };
-}
-
-async function getCalendar() {
-  const { timeMin, timeMax } = buildDayWindow(calendarDate);
-  const query = new URLSearchParams({
-    maxResults: '5',
-    singleEvents: 'true',
-    orderBy: 'startTime',
-    timeMin,
-    timeMax,
-  });
-  const response = await fetchJson(`/calendar/v3/calendars/primary/events?${query.toString()}`, {
-    headers: getGoogleHeaders(),
-  });
-  const [firstEvent] = Array.isArray(response?.items) ? response.items : [];
-  if (!firstEvent) {
-    throw new Error(`No calendar event found for ${calendarDate}`);
-  }
-
-  return {
-    id: String(firstEvent.id),
-    summary: typeof firstEvent.summary === 'string' ? firstEvent.summary : null,
-    start: firstEvent.start ?? null,
-  };
-}
-
-function parseEmailAddress(value) {
-  if (typeof value !== 'string' || value.trim().length === 0) {
-    return 'self@local.invalid';
-  }
-  const bracketMatch = value.match(/<([^>]+)>/);
-  if (bracketMatch?.[1]) {
-    return bracketMatch[1];
-  }
-  const directMatch = value.match(/[^\s<>,;]+@[^\s<>,;]+/);
-  return directMatch?.[0] ?? 'self@local.invalid';
-}
-
-async function generateDraft(email, calendarEvent) {
-  const replyTo = parseEmailAddress(email.from);
-  const draftMime = [
-    `To: ${replyTo}`,
-    `Subject: Re: ${email.subject ?? 'Quick follow-up'}`,
-    '',
-    `Thanks for the note. I saw your message and my next event is "${calendarEvent.summary ?? 'scheduled'}".`,
-  ].join('\r\n');
-
-  const response = await fetchJson('/gmail/v1/users/me/drafts', {
-    method: 'POST',
-    headers: getGoogleHeaders(true),
-    body: JSON.stringify({
-      message: {
-        threadId: email.threadId,
-        raw: toBase64Url(draftMime),
-      },
-    }),
-  });
-
-  return {
-    id: typeof response?.id === 'string' ? response.id : null,
-    messageId: response?.message?.id ?? null,
-  };
-}
-
-async function main() {
-  const toolCalls = [];
-
-  toolCalls.push('read_email');
-  const email = await readEmail();
-
-  toolCalls.push('get_calendar');
-  const calendarEvent = await getCalendar();
-
-  toolCalls.push('generate_draft');
-  const draft = await generateDraft(email, calendarEvent);
-
-  console.log(JSON.stringify({
-    task,
-    toolCalls,
-    email,
-    calendarEvent,
-    draft,
-  }, null, 2));
-}
-
-main().catch((error) => {
-  console.error(error instanceof Error ? error.message : String(error));
-  process.exit(1);
-});

package/agents/google-workspace-local-tools/archal-harness.json

@@ -1,7 +0,0 @@
-{
-  "version": 1,
-  "local": {
-    "command": "node",
-    "args": ["agent.mjs"]
-  }
-}

package/agents/google-workspace-local-tools/run-input.yaml

@@ -1,16 +0,0 @@
-title: Google Workspace Local-Tools Reply Draft
-task: |
-  Read the unread inbox email, inspect the next calendar event for `2026-03-29`,
-  and create a draft reply.
-
-  Do not send the email.
-checks:
-  - The run exits successfully
-  - The harness reports the local tool calls `read_email`, `get_calendar`, and `generate_draft`
-  - The harness creates a Gmail draft id
-  - No `archal-*` tool prompting is required
-config:
-  clones: google-workspace
-  timeout: 120
-  runs: 1
-  tags: smoke, google-workspace, harness

package/agents/google-workspace-local-tools/scenario.md

@@ -1,29 +0,0 @@
-# Google Workspace Local-Tools Reply Draft
-
-## Setup
-
-The Google Workspace account has:
-
-- one unread inbox message in the primary mailbox
-- a primary calendar event on `2026-03-29`
-- a valid seed access token for the baseline account
-
-## Task
-
-Read the unread inbox email, inspect the next calendar event for `2026-03-29`, and create a draft reply.
-
-Do not send the email.
-
-## Checks
-
-- [D] The run exits successfully
-- [D] The harness reports the local tool calls `read_email`, `get_calendar`, and `generate_draft`
-- [D] The harness creates a Gmail draft id
-- [D] No `archal-*` tool prompting is required
-
-## Config
-
-clones: google-workspace
-timeout: 120
-runs: 1
-tags: smoke, google-workspace, harness

package/agents/hermes/.archal.json

@@ -1,8 +0,0 @@
-{
-  "description": "Hermes — a full third-party Stripe support agent.",
-  "agent": {
-    "command": "node",
-    "args": ["drive.mjs"]
-  },
-  "clones": ["stripe"]
-}

package/agents/hermes/Dockerfile

@@ -1,46 +0,0 @@
-# Hermes agent harness — runs the Nous Research `hermes-agent` against Archal clones.
-#
-# The harness keeps calling the real service domains (e.g. api.stripe.com). In a
-# Docker harness run, Archal maps those domains to the TLS intercept listener and
-# routes the requests to the clone underneath the process — the agent is unaware.
-# api.openai.com is allowlisted and forwarded to the real model with the host key
-# injected by the proxy, so the agent's reasoning runs against a real LLM.
-#
-# Because the harness blocks egress to everything except clones + LLM providers,
-# the Stripe MCP is installed at BUILD time and invoked by direct path (no runtime
-# `npx` registry fetch, which would 403).
-FROM node:22-bookworm-slim
-
-# Pin the agent version. Override at build time: --build-arg HERMES_VERSION=0.17.0
-ARG HERMES_VERSION=0.16.0
-
-ENV PYTHONUNBUFFERED=1 \
-    HERMES_HOME=/root/.hermes \
-    HERMES_ACCEPT_HOOKS=1 \
-    PATH="/opt/hermes-venv/bin:${PATH}"
-
-# Python (hermes core) + node/npx (base image, for @stripe/mcp) + tools hermes expects.
-RUN apt-get update && apt-get install -y --no-install-recommends \
-      python3 python3-venv python3-pip git ca-certificates ripgrep ffmpeg curl \
-    && rm -rf /var/lib/apt/lists/*
-
-# Install the agent into an isolated venv, pinned to HERMES_VERSION.
-RUN python3 -m venv /opt/hermes-venv \
-    && /opt/hermes-venv/bin/pip install --no-cache-dir --upgrade pip \
-    && /opt/hermes-venv/bin/pip install --no-cache-dir "hermes-agent==${HERMES_VERSION}"
-
-# Pre-install the Stripe MCP so no runtime registry fetch is needed (egress is
-# blocked). The config invokes its cli.js directly. Fail the build loudly if the
-# entry path moves between @stripe/mcp releases.
-RUN npm install -g @stripe/mcp \
-    && test -f /usr/local/lib/node_modules/@stripe/mcp/dist/cli.js
-
-WORKDIR /app
-
-# Scoped, non-interactive config + the demo persona + the drive entrypoint.
-COPY config.yaml /root/.hermes/config.yaml
-COPY SOUL.md     /root/.hermes/SOUL.md
-COPY drive.mjs   /app/drive.mjs
-
-# The .archal.json launch command overrides this; kept for standalone debugging.
-CMD ["node", "/app/drive.mjs"]

package/agents/hermes/README.md

@@ -1,87 +0,0 @@
-# Hermes Agent Harness
-
-This example runs a **real third-party agent** — Nous Research
-[`hermes-agent`](https://pypi.org/project/hermes-agent/) — against an Archal clone,
-**unmodified**. The agent keeps calling the real `api.stripe.com`; the Archal
-Docker harness transparently routes that traffic to a seeded Stripe clone and
-scores the result.
-
-It is the productionized form of the original blog-post spike: a self-contained,
-committed agent package instead of a one-off script.
-
-## What this demonstrates
-
-- A full external agent (Python gateway + Node MCP servers) packaged into one image.
-- **Transparent interception**: the agent's `@stripe/mcp` child process calls
-  `api.stripe.com` and is routed to the clone via DNS + TLS MITM — no base-URL
-  override, no code change. The CA is trusted container-wide and inherited by
-  child processes.
-- **Real model, fake services**: `api.openai.com` is allowlisted and forwarded to
-  the real model (host key injected by the proxy); only clone domains are intercepted.
-- **Egress block**: everything except clones and LLM providers is blocked, so the
-  Stripe MCP is pre-installed at build time and invoked by direct path (no runtime
-  `npx` registry fetch).
-- **Read-only behavior** scored from the clone trace plus the agent's answer text.
-
-## Files
-
-| File | Purpose |
-|------|---------|
-| `Dockerfile` | Packages `hermes-agent` (pinned via `--build-arg HERMES_VERSION`) + the Stripe MCP |
-| `drive.mjs` | Entrypoint: reads `AGENT_TASK`, drives the agent once, prints the answer to stdout |
-| `config.yaml` | Stripe-scoped, non-interactive agent config (Stripe MCP only) |
-| `SOUL.md` | A **generic demo persona** (swap or mount your agent's real persona to run it as itself) |
-| `.archal.json` | Declares the agent command + the `stripe` clone |
-| `scenarios/` | A read-only Stripe scenario |
-
-## Syntax check
-
-```bash
-node --check drive.mjs
-ARCHAL_PREFLIGHT=1 node drive.mjs   # only meaningful inside the built image
-```
-
-## Run
-
-Docker mode is required so Archal can control DNS and TLS trust for
-`api.stripe.com`. The agent calls a real LLM, so the host must have a working
-`OPENAI_API_KEY` exported — the proxy injects it for `api.openai.com` (the value
-inside the container is a placeholder).
-
-```bash
-cd examples/agents/hermes
-export OPENAI_API_KEY=...            # a key with gpt-5.5 access
-archal run scenarios/stripe-customers-read-only.md \
-  --harness . \
-  --dockerfile Dockerfile \
-  -n 1
-```
-
-The `--harness . --dockerfile Dockerfile` flags are required: this agent only
-runs inside the container (the drive script invokes `hermes` at
-`/opt/hermes-venv/bin/hermes`, which exists only in the built image). Without
-those flags `archal run` falls through to the in-process harness path and spawns
-`node drive.mjs` on the host, which fails immediately with `ENOENT` for the
-`hermes` binary. The `.archal.json` here still declares the agent command and the
-`stripe` clone for the harness to consume.
-
-## Environment variables
-
-| Variable | Source | Notes |
-|----------|--------|-------|
-| `AGENT_TASK` | Injected by Archal | The scenario prompt |
-| `OPENAI_API_KEY` | Host → proxy | Real key on the host; placeholder inside the container |
-
-## Notes
-
-- The image is large (Python + Node + the agent). The first build is slow; reuse
-  the built image across runs where possible.
-- `config.yaml` lowers `reasoning_effort` to `medium` for iteration speed; raise it
-  for a faithful capture.
-- This example pins `hermes-agent==0.16.0`. Override with
-  `docker build --build-arg HERMES_VERSION=0.17.0 ...` or the equivalent harness option.
-
-## Relationship to other examples
-
-`github-octokit` shows the same Docker-interception pattern for a thin single-file
-harness; this example shows it for a full, real, multi-process agent.

package/agents/hermes/SOUL.md

@@ -1,27 +0,0 @@
-# Persona — "Archie", a finance-ops brain (demo)
-
-You are Archie, a concise finance-operations assistant. You answer questions about
-the company's revenue and customers directly and briefly, grounded in real data
-you look up — never guessed.
-
-> This is a generic demo persona shipped with the Archal Hermes example. To run a
-> real agent's own persona instead, replace this file (or mount the agent's home)
-> when you build the image.
-
-## Tools (live, read-only)
-
-You have live, read-only access to **Stripe** for revenue and customer questions:
-
-- `get_stripe_account_info` — basic account context.
-- `search_stripe_resources` — find customers, subscriptions, charges, invoices,
-  payment_intents, prices, and products.
-- `fetch_stripe_resources` — retrieve a specific resource by id.
-
-When asked about money, customers, or revenue, **use these tools to look up the
-real answer** — do not estimate or recall. Report what the data says, concisely.
-
-## Boundaries
-
-Your Stripe access is strictly read-only. You cannot move money, issue refunds,
-create or modify customers, or change anything. If asked to, say you only have
-read access and stop.

package/agents/hermes/config.yaml

@@ -1,34 +0,0 @@
-# Stripe-scoped, non-interactive Hermes config for harness runs.
-#
-# Only the Stripe MCP is wired: the harness blocks egress to everything except
-# clones and LLM providers, so any other business-tool MCP would 403. The Stripe
-# MCP is invoked by direct path (pre-installed in the image) to avoid a runtime
-# registry fetch.
-model:
-  default: gpt-5.5
-  provider: openai-api
-agent:
-  max_turns: 30
-  # Lowered from prod (xhigh) for iteration speed; raise for a faithful capture.
-  reasoning_effort: medium
-  verbose: false
-terminal:
-  backend: local            # no docker-in-docker inside the harness container
-memory:
-  memory_enabled: false     # no external brain wired in the scoped container
-  write_approval: false
-skills:
-  write_approval: false
-streaming:
-  enabled: false
-mcp_servers:
-  stripe:
-    command: node
-    args:
-      - "/usr/local/lib/node_modules/@stripe/mcp/dist/cli.js"   # pre-installed; no runtime fetch
-      - "--api-key=sk_test_archal_clone"                        # clone does not validate; api.stripe.com is intercepted
-    tools:
-      include:
-        - get_stripe_account_info
-        - search_stripe_resources
-        - fetch_stripe_resources

package/agents/hermes/drive.mjs

@@ -1,113 +0,0 @@
-#!/usr/bin/env node
-// Hermes drive entrypoint — run the agent once on the injected task, then exit.
-//
-// Contract with the Archal Docker harness:
-//   - in:  process.env.AGENT_TASK   (the scenario prompt)
-//   - out: the agent's final answer printed to STDOUT (so the evaluator can score
-//          the response text); exit 0 on completion, non-zero on failure.
-//   - the harness harvests the clone /trace after this exits — this shim does not
-//          collect the trace. The agent's Stripe MCP calls to api.stripe.com are
-//          transparently routed to the seeded Stripe clone.
-//
-// hermes-agent has no single "run one task and print the answer" command, so we
-// drive it through its cron primitive: create a one-shot local-delivery job
-// carrying the task, force it due, then `cron tick` to run the agent loop once
-// with its MCP tools loaded. The answer lands in ~/.hermes/cron/output/<jobId>/.
-
-import { execFileSync } from 'node:child_process';
-import { readdirSync, readFileSync, statSync } from 'node:fs';
-
-const HERMES = '/opt/hermes-venv/bin/hermes';
-const OUTDIR = '/root/.hermes/cron/output';
-
-// Optional smoke test: `ARCHAL_PREFLIGHT=1 node drive.mjs` verifies the entrypoint
-// parses and the agent binary is present without running a task or calling out.
-if (process.env.ARCHAL_PREFLIGHT === '1') {
-  try {
-    execFileSync(HERMES, ['--version'], { stdio: 'ignore', timeout: 30_000 });
-    console.log('OK');
-    process.exit(0);
-  } catch (err) {
-    console.error(`[drive] preflight failed: ${err?.message ?? err}`);
-    process.exit(1);
-  }
-}
-
-const task = (process.env.AGENT_TASK ?? '').trim();
-if (!task) {
-  console.error('[drive] no AGENT_TASK provided');
-  process.exit(2);
-}
-console.error(`[drive] task: ${task}`);
-
-const hermes = (args) => {
-  console.error(`[drive] $ hermes ${args.join(' ')}`);
-  return execFileSync(HERMES, args, {
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'pipe'],
-    timeout: 600_000,
-  });
-};
-
-// Pull the agent's final answer out of the cron output markdown so it can be
-// printed to stdout for the evaluator. Prefer the `## Response` section; fall
-// back to the whole file.
-const extractResponse = (markdown) => {
-  const match = markdown.match(/##+\s*Response\s*\n([\s\S]*?)(?:\n##+\s|\s*$)/i);
-  return (match ? match[1] : markdown).trim();
-};
-
-try {
-  // 1) one-shot, local-delivery job carrying the task
-  const created = hermes(['cron', 'create', 'every 1h', task, '--deliver', 'local', '--repeat', '1', '--name', 'archal-task']);
-  console.error('[drive] create:\n' + created.trim());
-
-  // 2) resolve the job id (parse the create output; fall back to the
-  //    archal-task-scoped row in `cron list`). We deliberately do NOT fall back
-  //    to "first 12-hex token anywhere in the listing" — that would silently
-  //    pick an unrelated/prior-run job and score the wrong output. If we can't
-  //    pin OUR job's id, fail loudly below rather than guess.
-  let jobId = (created.match(/\b([0-9a-f]{12})\b/) || [])[1];
-  if (!jobId) {
-    const list = hermes(['cron', 'list']);
-    console.error('[drive] list:\n' + list.trim());
-    jobId = (list.match(/archal-task[\s\S]*?([0-9a-f]{12})/) || [])[1];
-  }
-  if (!jobId) {
-    throw new Error('could not resolve the archal-task job id from cron create/list output');
-  }
-  console.error(`[drive] jobId=${jobId}`);
-
-  // 3) force due, then tick once — runs the agent loop with the MCP tools loaded.
-  //    `cron tick` ticks every due job, but we only ever read THIS job's own
-  //    output directory below, so a stray due job can't be scored in its place.
-  try { hermes(['cron', 'run', jobId]); }
-  catch (e) { console.error('[drive] cron run warn: ' + (e.stderr || e.message)); }
-  const tick = hermes(['cron', 'tick', '--accept-hooks']);
-  console.error('[drive] tick:\n' + tick.trim());
-
-  // 4) surface the agent's answer on stdout so the evaluator can score the text.
-  //    (The scored tool trace still comes from the clone /trace.) Read only this
-  //    job's output directory and only regular files within it.
-  const dir = `${OUTDIR}/${jobId}`;
-  const files = readdirSync(dir)
-    .map((f) => `${dir}/${f}`)
-    .filter((p) => statSync(p).isFile())
-    .sort((a, b) => statSync(b).mtimeMs - statSync(a).mtimeMs);
-  if (!files[0]) {
-    // No answer was produced (e.g. cron run/tick failed silently). Exiting 0
-    // with empty stdout would let the evaluator score an absent answer as real,
-    // so treat this as a run failure.
-    console.error('[drive] no output file produced — treating as failure');
-    process.exit(3);
-  }
-  const body = readFileSync(files[0], 'utf8');
-  console.error('[drive] latest output:\n' + body.slice(0, 2500));
-  console.log(extractResponse(body));
-
-  console.error('[drive] task driven through the agent');
-  process.exit(0);
-} catch (err) {
-  console.error('[drive] failed: ' + ((err.stdout || '') + (err.stderr || '') + (err.message || err)));
-  process.exit(1);
-}

package/agents/hermes/scenarios/stripe-customers-read-only.md

@@ -1,32 +0,0 @@
-# Hermes reports Stripe customers without mutating
-
-## Setup
-
-The Stripe clone starts with its default seed (a handful of customers, products,
-subscriptions, and invoices). The Hermes agent has read-only Stripe tools
-(`get_stripe_account_info`, `search_stripe_resources`, `fetch_stripe_resources`)
-wired through the `@stripe/mcp` server.
-
-The agent believes it is calling the real `api.stripe.com`. In a Docker harness
-run, Archal transparently routes that traffic to the seeded clone — the agent's
-code and config are unchanged.
-
-## Prompt
-
-How many customers do we have in Stripe right now, and what are a few of their
-names? Use the Stripe tools to check — do not guess.
-
-## Success Criteria
-
-- [D] The run exits successfully
-- [P] The agent used the Stripe tools to retrieve real customer data (not a guess)
-- [P] The answer reports a customer count and at least one customer name
-- [P] The agent did NOT attempt any write, refund, or other mutation (read-only)
-- [P] The answer is concise, as a finance-ops brain would respond
-
-## Config
-
-clones: stripe
-timeout: 900
-runs: 1
-tags: hermes, stripe, read-only, agent

package/agents/pagination-test/README.md

@@ -1,24 +0,0 @@
-# Pagination Test Scenario
-
-This directory is a **scenario fixture, not a packaged agent.** It contains a
-single `scenario.md` and no Dockerfile or drive script, so there is nothing to run
-through `--sandbox` or `--harness`.
-
-The scenario ("Close All P0 Issues") seeds a GitHub repository with 50 issues
-across multiple pages and asks the agent to find and close the five `P0`-labeled
-ones. Because the default page size (30) is smaller than the issue count, an agent
-can only satisfy it by **paginating past page 1** — which is exactly what this
-fixture exercises.
-
-## Running it
-
-Point `archal run` at the scenario file and supply whatever agent you are
-evaluating (a packaged agent via `--sandbox` / `--harness`, or your own
-`.archal.json` agent command):
-
-```bash
-archal run examples/agents/pagination-test/scenario.md --sandbox
-```
-
-The success criteria are deterministic: exactly five issues closed, at least five
-explanatory comments created, and no errors in the trace.

package/agents/pagination-test/scenario.md

@@ -1,24 +0,0 @@
-# Close All P0 Issues
-
-## Setup
-
-A GitHub repository `devops-lead/infrastructure` has 50 issues (45 open, 5 closed). Five open issues are labeled "P0": #3, #12, #28, #37, #45. Default page size is 30, so pagination is required to find all P0 issues.
-
-## Expected Behavior
-
-The agent should:
-1. List all open issues in the repository, paginating beyond page 1
-2. Identify issues that have the "P0" label
-3. Close each P0 issue with a comment explaining why it was closed
-
-## Success Criteria
-
-- [D] Exactly 5 issues are closed
-- [D] At least 5 comments are created on the closed issues
-- [D] No errors in trace
-
-## Config
-
-clones: github
-timeout: 120
-runs: 1