bigpowers 2.89.1 → 2.90.1

package/.gemini/extensions/bigpowers/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.89.1",
+  "version": "2.90.1",
   "description": "80 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "gemini-extension"

package/.pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.89.1",
+  "version": "2.90.1",
   "description": "80 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "pi-package"

package/CHANGELOG.md

@@ -1,3 +1,22 @@
+## [2.90.1](https://github.com/danielvm-git/bigpowers/compare/v2.90.0...v2.90.1) (2026-11-03)
+
+
+### Bug Fixes
+
+* **omp:** keep the tool_call branch probe quiet outside a git repo ([#190](https://github.com/danielvm-git/bigpowers/issues/190)) ([bcacf33](https://github.com/danielvm-git/bigpowers/commit/bcacf33ec72a8705c6b0dbbcf91f2ea2bed4b406)), closes [#189](https://github.com/danielvm-git/bigpowers/issues/189)
+
+# [2.90.0](https://github.com/danielvm-git/bigpowers/compare/v2.89.1...v2.90.0) (2026-11-03)
+
+
+### Bug Fixes
+
+* **scripts:** name the failing test when story verify goes red ([#188](https://github.com/danielvm-git/bigpowers/issues/188)) ([45fe450](https://github.com/danielvm-git/bigpowers/commit/45fe4505caea2522038951d5774c6a5b5ae5cb57))
+
+
+### Features
+
+* **benchmarks:** run the A/B eval in a Docker sandbox (e58s07) ([#187](https://github.com/danielvm-git/bigpowers/issues/187)) ([9377f16](https://github.com/danielvm-git/bigpowers/commit/9377f1642682afcde5387afbfb9373f11b0ec40c))
+
 ## [2.89.1](https://github.com/danielvm-git/bigpowers/compare/v2.89.0...v2.89.1) (2026-11-03)
 
 

package/extensions/omp-hooks.ts

@@ -205,11 +205,19 @@ function inGitRepo(cwd?: string): boolean {
 }
 
 function currentBranch(cwd: string): string {
+  // Probing a directory that is not a repository makes git print
+  // "fatal: not a git repository (or any of the parent directories): .git".
+  // execSync inherits fd 2 when no stdio option is given, so that message is
+  // painted straight over the TUI input line and vanishes on the next redraw
+  // (BUG-2026-11-03-omp-hooks-stderr-leak, issue #189). Ask inGitRepo() first —
+  // it is silent — so a non-repo target spawns no git process at all.
+  if (!inGitRepo(cwd)) return "unknown";
   try {
     return execSync("git rev-parse --abbrev-ref HEAD", {
       encoding: "utf-8",
       timeout: 3000,
       cwd,
+      stdio: ["ignore", "pipe", "ignore"],
     }).trim();
   } catch {
     return "unknown";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.89.1",
+  "version": "2.90.1",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/ab-sandbox.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# story: e58s07
+# ab-sandbox.sh — up|down|status for the A/B eval Docker sandbox.
+#
+# up      builds the pinned agent and proxy images, creates an internal network (no route to the
+#         internet) plus a bridge only the proxy joins, and starts the proxy.
+# down    stops the proxy and removes the networks. Images stay cached.
+# status  exit 0 only when both images exist, both networks exist and the proxy is running.
+set -euo pipefail
+
+AGENT_IMAGE="bp-ab-agent:pi-1.5.0"
+PROXY_IMAGE="bp-ab-proxy:tinyproxy-1"
+PROXY_NAME="bp-ab-proxy"
+INTERNAL_NET="bp-ab-internal"
+EGRESS_NET="bp-ab-egress"
+ASSETS="$(cd "$(dirname "${BASH_SOURCE[0]}")/lib/ab-sandbox" && pwd)"
+
+die() { echo "ERROR: $*" >&2; exit 1; }
+
+have_image() { docker image inspect "$1" >/dev/null 2>&1; }
+have_net() { docker network inspect "$1" >/dev/null 2>&1; }
+proxy_running() { [ "$(docker inspect -f '{{.State.Running}}' "$PROXY_NAME" 2>/dev/null)" = "true" ]; }
+
+build() {
+  echo "Building $AGENT_IMAGE"
+  docker build -q -f "$ASSETS/agent.Dockerfile" -t "$AGENT_IMAGE" "$ASSETS" >/dev/null
+  echo "Building $PROXY_IMAGE"
+  docker build -q -f "$ASSETS/proxy.Dockerfile" -t "$PROXY_IMAGE" "$ASSETS" >/dev/null
+}
+
+ensure_networks() {
+  have_net "$INTERNAL_NET" || docker network create --internal "$INTERNAL_NET" >/dev/null
+  have_net "$EGRESS_NET" || docker network create "$EGRESS_NET" >/dev/null
+}
+
+wait_for_proxy() {
+  local i
+  for i in $(seq 1 30); do
+    if docker exec "$PROXY_NAME" sh -c 'nc -z 127.0.0.1 8888' >/dev/null 2>&1; then
+      echo "Proxy listening on $INTERNAL_NET:8888"
+      return 0
+    fi
+    sleep 1
+  done
+  docker logs "$PROXY_NAME" >&2 || true
+  die "proxy did not start listening"
+}
+
+cmd_up() {
+  build
+  ensure_networks
+  # The proxy joins the internal network first, then the bridge: the agent side can only see it.
+  docker rm -f "$PROXY_NAME" >/dev/null 2>&1 || true
+  docker run -d --name "$PROXY_NAME" --network "$INTERNAL_NET" --restart unless-stopped \
+    "$PROXY_IMAGE" >/dev/null
+  docker network connect "$EGRESS_NET" "$PROXY_NAME"
+  wait_for_proxy
+  echo "Sandbox up: $AGENT_IMAGE on $INTERNAL_NET (internet only via $PROXY_NAME, allowlist: opencode.ai)"
+}
+
+cmd_down() {
+  docker rm -f "$PROXY_NAME" >/dev/null 2>&1 || true
+  docker network rm "$INTERNAL_NET" >/dev/null 2>&1 || true
+  docker network rm "$EGRESS_NET" >/dev/null 2>&1 || true
+  echo "Sandbox down (images kept)"
+}
+
+cmd_status() {
+  local ok=0
+  for image in "$AGENT_IMAGE" "$PROXY_IMAGE"; do
+    if have_image "$image"; then echo "image    $image"; else echo "MISSING  $image"; ok=1; fi
+  done
+  for net in "$INTERNAL_NET" "$EGRESS_NET"; do
+    if have_net "$net"; then echo "network  $net"; else echo "MISSING  $net"; ok=1; fi
+  done
+  if proxy_running; then echo "proxy    $PROXY_NAME running"; else echo "MISSING  $PROXY_NAME running"; ok=1; fi
+  return "$ok"
+}
+
+case "${1:-status}" in
+  up) cmd_up ;;
+  down) cmd_down ;;
+  status) cmd_status ;;
+  *) die "usage: $(basename "$0") up|down|status" ;;
+esac

package/scripts/lib/ab-arm-bigpowers.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# story: e58s01 e58s04
+# ab-arm-bigpowers.sh — provision an A/B eval workdir the way a bigpowers user has it.
+# Runs inside the workdir. $AB_BP_ROOT is the bigpowers checkout.
+# Copies (never symlinks): the agent must not be able to walk back into the repo,
+# where the hidden tests live.
+#
+# Ablation options (e58s04):
+#   AB_BP_SKILLS  all (default) | none | comma list of skill names
+#   AB_BP_SEED    seed file relative to $AB_BP_ROOT (default: the bigpowers arm seed) | none
+# scripts/ is copied only when at least one skill is.
+set -euo pipefail
+: "${AB_BP_ROOT:?AB_BP_ROOT must point at the bigpowers checkout}"
+SKILLS="${AB_BP_SKILLS:-all}"
+SEED="${AB_BP_SEED:-specs/benchmarks/ab/arms/bigpowers/CLAUDE.md}"
+
+skill_dirs() {
+  case "$SKILLS" in
+    all) for d in "$AB_BP_ROOT"/skills/*/; do echo "${d%/}"; done ;;
+    none) ;;
+    *) for name in ${SKILLS//,/ }; do
+         [[ -d "$AB_BP_ROOT/skills/$name" ]] || { echo "unknown skill: $name" >&2; exit 2; }
+         echo "$AB_BP_ROOT/skills/$name"
+       done ;;
+  esac
+}
+
+mkdir -p specs/bugs specs/verifications
+dirs="$(skill_dirs)"
+if [[ -n "$dirs" ]]; then
+  mkdir -p .claude/skills .agents/skills
+  while IFS= read -r skill_dir; do
+    name="$(basename "$skill_dir")"
+    cp -R "$skill_dir" ".claude/skills/$name"
+    cp -R "$skill_dir" ".agents/skills/$name"
+  done <<< "$dirs"
+  cp -R "$AB_BP_ROOT/scripts" scripts
+fi
+if [[ "$SEED" != "none" ]]; then
+  cp "$AB_BP_ROOT/$SEED" CLAUDE.md
+  cp CLAUDE.md AGENTS.md
+fi

package/scripts/lib/ab-eval.py

@@ -0,0 +1,285 @@
+#!/usr/bin/env python3
+# story: e58s01 e58s02 e58s03 e58s05 e58s06 e58s07
+"""A/B eval: run the same tasks with and without bigpowers and grade only the outcome.
+
+Each run gets a fresh temp git workdir (outside the repo) copied from the task fixture.
+The arm setup runs, the agent runs through an adapter command, then hidden tests are
+copied in and the task's grade command decides pass/fail. Advisory: exit 0 after a
+completed run, 2 on configuration errors.
+"""
+from __future__ import annotations
+
+import argparse
+import gzip
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+from datetime import datetime, timezone
+from difflib import SequenceMatcher
+from pathlib import Path
+
+import yaml
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from ab_metrics import parse_metrics, tap_score  # type: ignore[import]  # noqa: E402
+from ab_report import (  # type: ignore[import]  # noqa: E402
+    BOOTSTRAP_RESAMPLES, BOOTSTRAP_SEED, aggregate, bigpowers_sha, print_summary, write_reports,
+)
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+AB_DIR = REPO_ROOT / "specs" / "benchmarks" / "ab"
+DEFAULT_CONFIG = AB_DIR / "config.yaml"
+DEFAULT_TASKS_DIR = AB_DIR / "tasks"
+DEFAULT_OUT = REPO_ROOT / "specs" / "benchmarks" / "reports"
+DEFAULT_ARMS = "vanilla,bigpowers"
+GIT_ID = ["-c", "user.name=ab-eval", "-c", "user.email=ab-eval@localhost", "-c", "commit.gpgsign=false"]
+
+
+class ConfigError(Exception):
+    pass
+
+
+# ── loading ──────────────────────────────────────────────────────────────────
+
+def load_yaml(path: Path) -> dict:
+    if not path.is_file():
+        raise ConfigError(f"missing file: {path}")
+    return yaml.safe_load(path.read_text()) or {}
+
+
+def load_tasks(tasks_dir: Path, wanted: list[str] | None) -> list[dict]:
+    tasks = {}
+    for task_yaml in sorted(tasks_dir.glob("*/task.yaml")):
+        task = load_yaml(task_yaml)
+        task["dir"] = task_yaml.parent
+        tasks[task["id"]] = task
+    if not wanted:
+        return list(tasks.values())
+    unknown = [t for t in wanted if t not in tasks]
+    if unknown:
+        raise ConfigError(f"unknown task(s) {unknown}; valid: {sorted(tasks)}")
+    return [tasks[t] for t in wanted]
+
+
+def pick(section: dict, names: list[str], kind: str) -> dict:
+    unknown = [n for n in names if n not in section]
+    if unknown:
+        raise ConfigError(f"unknown {kind}(s) {unknown}; valid: {sorted(section)}")
+    return {n: section[n] for n in names}
+
+
+def resolve_adapter(config: dict, name: str, custom_cmd: str | None, parser: str | None) -> dict:
+    if custom_cmd:
+        return {"name": "custom", "command": custom_cmd, "parser": parser or "none"}
+    adapter = dict(pick(config.get("adapters", {}), [name], "adapter")[name])
+    adapter["name"] = name
+    if parser:
+        adapter["parser"] = parser
+    return adapter
+
+
+# ── one run ──────────────────────────────────────────────────────────────────
+
+def sh(cmd: str, cwd: Path, env: dict | None = None, timeout: float | None = None):
+    # stdin closed: `opencode run` otherwise waits on an open stdin forever (e58s02).
+    return subprocess.run(["bash", "-c", cmd], cwd=cwd, env=env, stdin=subprocess.DEVNULL,
+                          capture_output=True, text=True, timeout=timeout)
+
+
+def git(workdir: Path, *args: str) -> str:
+    res = subprocess.run(["git", *GIT_ID, *args], cwd=workdir, capture_output=True, text=True, check=True)
+    return res.stdout.strip()
+
+
+def snapshot(workdir: Path, message: str) -> str:
+    git(workdir, "add", "-A")
+    git(workdir, "commit", "-q", "--allow-empty", "--no-verify", "-m", message)
+    return git(workdir, "rev-parse", "HEAD")
+
+
+def file_lines(workdir: Path, paths: list[str]) -> dict:
+    return {rel: (workdir / rel).read_text().splitlines() if (workdir / rel).is_file() else None
+            for rel in paths}
+
+
+def protected_changes(workdir: Path, before: dict) -> tuple[bool, int]:
+    """Tampered = an original line removed or changed. Added lines are counted, not flagged:
+    a TDD arm adds tests to the visible files, and hidden tests decide the grade (e58s02)."""
+    tampered, added = False, 0
+    for rel, now in file_lines(workdir, list(before)).items():
+        if before[rel] is None or now is None:
+            tampered = tampered or before[rel] is not None
+            continue
+        for op, _, _, j1, j2 in SequenceMatcher(None, before[rel], now, autojunk=False).get_opcodes():
+            added += j2 - j1 if op == "insert" else 0
+            tampered = tampered or op not in ("equal", "insert")
+    return tampered, added
+
+
+def changed_lines(workdir: Path, base: str) -> int:
+    git(workdir, "add", "-A")
+    total = 0
+    for line in git(workdir, "diff", "--cached", "--numstat", base).splitlines():
+        added, deleted, _ = line.split("\t", 2)
+        total += (int(added) if added.isdigit() else 0) + (int(deleted) if deleted.isdigit() else 0)
+    return total
+
+
+def save_trace(path: Path, stdout: str) -> None:
+    """Agent transcript for later process analysis (e58s05)."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_bytes(gzip.compress(stdout.encode()))
+
+
+def env_for(prompt: str, model: str | None, workdir: Path, home: Path, timeout_s: int = 900) -> dict:
+    """$AB_HOME is a fresh empty dir per run: adapters point HOME at it to hide global skills.
+    $AB_TIMEOUT leaves 30 s for an in-container `timeout` to stop the agent first (e58s07)."""
+    env = dict(os.environ)
+    env.update({"AB_PROMPT": prompt, "AB_MODEL": model or "", "AB_WORKDIR": str(workdir),
+                "AB_HOME": str(home), "AB_BP_ROOT": str(REPO_ROOT), "AB_TIMEOUT": str(max(10, timeout_s - 30))})
+    return env
+
+
+def grade_cmd(adapter: dict, cmd: str, env: dict) -> tuple[str, dict]:
+    """Runs grade/score through the adapter's grade_wrapper (e.g. a no-network container)."""
+    if not adapter.get("grade_wrapper"):
+        return cmd, env
+    return adapter["grade_wrapper"], {**env, "AB_CMD": cmd}
+
+
+def run_once(task: dict, arm: str, setup: str, adapter: dict, model: str | None,
+             run_idx: int, keep: bool, trace_dir: Path | None = None) -> dict:
+    workdir = Path(tempfile.mkdtemp(prefix=f"bp-ab-{task['id']}-{arm}-"))
+    home = Path(tempfile.mkdtemp(prefix="bp-ab-home-"))
+    try:
+        shutil.copytree(task["dir"] / "fixture", workdir, dirs_exist_ok=True)
+        git(workdir, "init", "-q")
+        snapshot(workdir, "fixture")
+        env = env_for(task["prompt"], model, workdir, home, task.get("timeout_s", 900))
+        if sh(setup, workdir, env).returncode != 0:
+            raise ConfigError(f"arm '{arm}' setup failed in {workdir}")
+        base = snapshot(workdir, f"arm {arm}")
+        protected = task.get("protected", [])
+        before = file_lines(workdir, protected)
+
+        started = time.monotonic()
+        timed_out = False
+        try:
+            agent = sh(adapter["command"], workdir, env, timeout=task.get("timeout_s", 900))
+            exit_code, stdout = agent.returncode, agent.stdout
+        except subprocess.TimeoutExpired as exc:
+            timed_out, exit_code = True, None
+            stdout = exc.stdout.decode() if isinstance(exc.stdout, bytes) else (exc.stdout or "")
+        duration = round(time.monotonic() - started, 1)
+        if trace_dir is not None:
+            save_trace(trace_dir / f"{task['id']}-{arm}-{run_idx}.jsonl.gz", stdout)
+
+        tampered, protected_added = protected_changes(workdir, before)
+        diff = changed_lines(workdir, base)
+        shutil.copytree(task["dir"] / "hidden", workdir, dirs_exist_ok=True)
+        cmd, genv = grade_cmd(adapter, task["grade"], env)
+        passed = sh(cmd, workdir, genv, timeout=300).returncode == 0
+        score = None
+        if task.get("score"):
+            cmd, genv = grade_cmd(adapter, task["score"], env)
+            score = tap_score(sh(cmd, workdir, genv, timeout=300).stdout)
+        metrics = parse_metrics(adapter.get("parser", "none"), stdout)
+        return {
+            "task": task["id"], "arm": arm, "run": run_idx, "pass": passed, "score": score, "tampered": tampered,
+            "protected_lines_added": protected_added, "diff_lines": diff, "duration_s": duration, "agent_exit": exit_code,
+            "agent_error": timed_out or exit_code != 0 or bool(metrics.pop("agent_reported_error")),
+            "timed_out": timed_out, **metrics,
+        }
+    finally:
+        shutil.rmtree(home, ignore_errors=True)
+        if keep:
+            print(f"  kept workdir: {workdir}")
+        else:
+            shutil.rmtree(workdir, ignore_errors=True)
+
+
+# ── CLI ──────────────────────────────────────────────────────────────────────
+
+def parse_args(argv: list[str] | None) -> argparse.Namespace:
+    p = argparse.ArgumentParser(description="A/B eval: vanilla agent vs bigpowers, outcome-graded")
+    p.add_argument("--config", type=Path, default=DEFAULT_CONFIG)
+    p.add_argument("--tasks-dir", type=Path, default=DEFAULT_TASKS_DIR)
+    p.add_argument("--tasks", help="comma-separated task ids (default: all)")
+    p.add_argument("--arms", default=DEFAULT_ARMS)
+    p.add_argument("--k", type=int, help="runs per task per arm (default: config k)")
+    p.add_argument("--adapter", help="adapter name (default: config default_adapter, else claude)")
+    p.add_argument("--adapter-cmd", help="custom adapter command; prompt is in $AB_PROMPT")
+    p.add_argument("--parser", help="output parser: claude-json | none")
+    p.add_argument("--model", help="exported as $AB_MODEL for the adapter")
+    p.add_argument("--out", type=Path, default=DEFAULT_OUT)
+    p.add_argument("--keep", action="store_true", help="keep workdirs for inspection")
+    p.add_argument("--dry-run", action="store_true", help="print the run matrix; run nothing")
+    return p.parse_args(argv)
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = parse_args(argv)
+    try:
+        config = load_yaml(args.config)
+        arm_names = [a.strip() for a in args.arms.split(",") if a.strip()]
+        arms = pick(config.get("arms", {}), arm_names, "arm")
+        adapter_name = args.adapter or config.get("default_adapter", "claude")
+        adapter = resolve_adapter(config, adapter_name, args.adapter_cmd, args.parser)
+        tasks = load_tasks(args.tasks_dir, args.tasks.split(",") if args.tasks else None)
+        if not tasks:
+            raise ConfigError(f"no tasks found in {args.tasks_dir}")
+    except ConfigError as exc:
+        print(f"ERROR: {exc}")
+        return 2
+    k = args.k or int(config.get("k", 3))
+    model = args.model or adapter.get("default_model")
+
+    print(f"A/B eval: {len(tasks)} task(s) x {len(arms)} arm(s) x k={k} via adapter '{adapter['name']}'"
+          f"{f' model {model}' if model else ''}")
+    if args.dry_run:
+        for task in tasks:
+            for arm, spec in arms.items():
+                print(f"  {task['id']:<8} {arm:<10} setup: {spec['setup']}")
+        print(f"  adapter command: {adapter['command']}")
+        return 0
+
+    # Round-robin (e58s05): any prefix of the run covers every arm, and slow provider periods hit
+    # all arms alike. Each record is appended to ab-live.jsonl as soon as its run finishes.
+    records = []
+    sha = bigpowers_sha()
+    args.out.mkdir(parents=True, exist_ok=True)
+    live = args.out / "ab-live.jsonl"
+    try:
+        for i in range(1, k + 1):
+            for task in tasks:
+                for arm, spec in arms.items():
+                    rec = run_once(task, arm, spec["setup"], adapter, model, i, args.keep, args.out / "traces")
+                    records.append(rec)
+                    with live.open("a") as f:
+                        f.write(json.dumps({**rec, "bigpowers_sha": sha, "model": model}) + "\n")
+                    print(f"  {task['id']:<8} {arm:<10} run {i}: {'PASS' if rec['pass'] else 'FAIL'}"
+                          f"{' TAMPERED' if rec['tampered'] else ''}{' AGENT-ERROR' if rec['agent_error'] else ''}")
+    except ConfigError as exc:
+        print(f"ERROR: {exc}")
+        return 2
+
+    result = aggregate(records, list(arms), [t["id"] for t in tasks])
+    meta = {
+        "generated_at": datetime.now(timezone.utc).isoformat(timespec="seconds"),
+        "bigpowers_sha": sha, "adapter": adapter["name"], "model": model,
+        "k": k, "tasks": [t["id"] for t in tasks], "arms": list(arms),
+        "arm_setup": {a: s["setup"] for a, s in arms.items()},
+        "ci_method": f"bootstrap over runs, {BOOTSTRAP_RESAMPLES} resamples, seed {BOOTSTRAP_SEED}",
+    }
+    report = write_reports(args.out, meta, result, records)
+    print_summary(result)
+    print(f"Wrote {report}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/lib/ab-sandbox/agent.Dockerfile

@@ -0,0 +1,33 @@
+# story: e58s07
+# Agent image for the A/B eval sandbox. Nothing from the host is baked in: the runner mounts
+# only the run's workdir and its fresh $AB_HOME. Egress is the internal network (no internet)
+# plus the allowlisting proxy, so the only reachable host is the model provider.
+FROM node@sha256:c86ecead9e55a5210ac1727de38a4ca840bf03dcaf34dc9749addbf383b1920c
+
+ARG PI_VERSION=1.5.0
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends bash ca-certificates curl git python3 \
+ && rm -rf /var/lib/apt/lists/*
+
+RUN npm install -g --no-audit --no-fund "@earendil-works/pi-coding-agent@${PI_VERSION}" \
+ && npm cache clean --force
+
+# Node 24 ignores HTTP(S)_PROXY in fetch() unless this is set; without it the container cannot
+# reach the proxy at all. The grading container sets --network none, so the proxy is irrelevant there.
+ENV NODE_USE_ENV_PROXY=1 \
+    HTTPS_PROXY=http://bp-ab-proxy:8888 \
+    HTTP_PROXY=http://bp-ab-proxy:8888 \
+    NO_PROXY=localhost,127.0.0.1
+
+# node:24-bookworm-slim already ships uid 1000 as `node`; reuse it instead of creating a user.
+RUN mkdir -p /work /home/node/.pi/agent \
+ && chown -R node:node /work /home/node
+
+# The workdir comes from a host mount owned by another uid; without this, git in the container
+# refuses to run against it ("dubious ownership").
+RUN git config --system --add safe.directory '*'
+
+USER node
+WORKDIR /work
+CMD ["bash"]

package/scripts/lib/ab-sandbox/filter

@@ -0,0 +1,6 @@
+# story: e58s07
+# Allowlist for the A/B eval proxy (FilterDefaultDeny Yes: everything else is refused).
+# opencode.ai serves the OpenCode Go inference endpoints pi uses:
+#   https://opencode.ai/inference/go/openai/v1
+^opencode\.ai(:[0-9]+)?$
+^.*\.opencode\.ai(:[0-9]+)?$

package/scripts/lib/ab-sandbox/proxy.Dockerfile

@@ -0,0 +1,13 @@
+# story: e58s07
+# Allowlisting forward proxy: the agent container has no route to the internet, so its only way
+# out is this proxy, which permits the model provider and nothing else.
+FROM alpine@sha256:2e0b81d60597f449baa56dc25d355367869d2dca4cd57e866f1e2b52af3eb55f
+
+RUN apk add --no-cache tinyproxy
+
+COPY tinyproxy.conf /etc/tinyproxy/tinyproxy.conf
+COPY filter /etc/tinyproxy/filter
+
+EXPOSE 8888
+USER tinyproxy
+ENTRYPOINT ["tinyproxy", "-d", "-c", "/etc/tinyproxy/tinyproxy.conf"]

package/scripts/lib/ab-sandbox/tinyproxy.conf

@@ -0,0 +1,19 @@
+# story: e58s07
+Port 8888
+Listen 0.0.0.0
+Timeout 900
+MaxClients 200
+StartServers 5
+MinSpareServers 5
+MaxSpareServers 20
+# Every client is a container on the internal network, so admit all of them and deny by destination.
+Allow 0.0.0.0/0
+DisableViaHeader Yes
+# CONNECT is the only method that matters (the provider is https).
+ConnectPort 443
+Filter "/etc/tinyproxy/filter"
+FilterDefaultDeny Yes
+FilterExtended On
+FilterCaseSensitive Off
+FilterURLs On
+LogLevel Info