froid-plane-test-architecture-enterprise 1.23.4

package/cli/lib/convention-baseline.js

@@ -0,0 +1,237 @@
+/**
+ * Deterministically compute `step-02-discover-tests.md` §2b's "convention baseline"
+ * instead of asking the review agent to sample and self-report it.
+ *
+ * Why this exists: couture-cast PR #106's codex-run review reported
+ * "Convention: priorityMarkers (18 of 40 sampled)" against a repo that has zero
+ * real instances of a P0-P3 marker anywhere (verified with a repo-wide grep). The
+ * skill's own design (§2b) already anticipated and forbade exactly this — "Guessing
+ * a convention is worse than admitting it wasn't measured" — but nothing enforced
+ * it: the sampling was entirely delegated to the agent's prompt-following honor
+ * system, so a plausible-sounding number could be generated without a single file
+ * actually being read.
+ *
+ * Same fix as everywhere else in this CLI (the review set, the deduction score, the
+ * recommendation): whatever can be computed deterministically and cheaply is
+ * computed here, stated in the prompt as a fixed fact, and cross-checked against
+ * the report afterward (see parse-report.js's verifyConventionBaseline). The agent
+ * is never asked to produce a number this module can produce itself.
+ *
+ * Two tiers of grounding:
+ * - corpusSize / sampled / sampledFiles: 100% mechanical (git ls-files, isTestFile,
+ *   directory-distance ranking, a 40-file cap) — this is exactly step-02 §2b's
+ *   sampling rules, just executed by code instead of described in prose. A report
+ *   that cites a different sampled count, or a different corpus, is provably wrong
+ *   and rejected outright.
+ * - adopted counts for the six keys with a concrete, literal recognized form
+ *   (priorityMarkers, testIds, networkFirst, dataFactories, fixtures, playwrightUtils): a generous,
+ *   high-recall regex scan over the real sampled files' real content. This is not
+ *   claimed to be a precise semantic judgment — a regex cannot know intent — but it
+ *   gives a safe one-directional floor: when the scan finds ZERO occurrences of any
+ *   recognized form anywhere in the entire sampled corpus, the true adopted count is
+ *   zero with very high confidence (a looser scan finding nothing all but rules out
+ *   a careful reader finding something), so the report may never claim otherwise.
+ *   The two keys with no literal recognized form (bddNaming — a naming *style*, not
+ *   a token; assertionStyle — dialect consistency) get no mechanical signal and stay
+ *   fully agent-judged; only their sampled/corpusSize grounding applies. This is an
+ *   honest limitation, not an oversight: a regex loose enough to catch every BDD-ish
+ *   test name would also be loose enough to approve almost anything, which defeats
+ *   the point of a floor check.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const { isTestFile } = require('./changed-tests');
+
+// Same order as step-02-discover-tests.md §2b's "Conventions to measure" table and
+// criteria-registry.md's mapping table. Every consumer of this list (build-prompt,
+// parse-report, the tests) shares this one array so the eight keys cannot drift.
+const CONVENTION_KEYS = [
+  'priorityMarkers',
+  'testIds',
+  'bddNaming',
+  'networkFirst',
+  'dataFactories',
+  'fixtures',
+  'assertionStyle',
+  'playwrightUtils',
+];
+
+const MAX_SAMPLED_FILES = 40;
+const MIN_CORPUS_TO_ATTEMPT = 1; // 0 eligible files outside the review set: nothing to sample at all.
+
+// One regex per mechanically-recognizable key, matched against a sampled file's raw
+// content (case-insensitive, no /g flag so repeated .test() calls carry no state).
+// Deliberately high-recall: a false positive here only ever makes the zero-signal
+// floor check more permissive (it stops treating a convention as unattested), never
+// less — see the module doc comment. Each detector must match what the "Adopted when
+// a sampled file..." column in step-02-discover-tests.md's table says, so a headless
+// run and an interactive run count the same corpus. Changing one means changing both.
+const MECHANICAL_DETECTORS = {
+  priorityMarkers: /(\[P[0-3]\]|@P[0-3]\b|['"`]@?P[0-3]['"`]|\bpriority\s*:\s*['"`]?P[0-3]\b)/i,
+  testIds: /(data-testid|data-test-id|getByTestId|test-id\s*=|testid\s*=)/i,
+  networkFirst:
+    /(interceptNetworkCall\s*\(|page\.route\s*\(|cy\.intercept\s*\(|waitForResponse\s*\(|waitForRequest\s*\(|route\.fulfill\s*\()/i,
+  dataFactories: /(\bbuild[A-Z]\w*\s*\(|\bFactory\s*\(|from\s+['"][^'"]*factories|\bfactories\/)/i,
+  fixtures: /(mergeTests\s*\(|test\.extend\s*\(|from\s+['"][^'"]*fixtures|merged-fixtures)/i,
+  // Only the package literal. `merged-fixtures` is already the `fixtures` key's
+  // signal, and a hand-rolled merged-fixtures.ts with no playwright-utils anywhere
+  // would otherwise register adoption for a package the repo never installed.
+  // Import-shaped only. The bare package literal also matches a prose mention in a
+  // comment ("// TODO: migrate to @seontechnologies/playwright-utils"), which would
+  // register adoption for a file that uses none of it.
+  playwrightUtils: /(?:from|require\s*\(|import\s*\()\s*['"`]@seontechnologies\/playwright-utils/i,
+};
+
+const MECHANICAL_CONVENTION_KEYS = Object.keys(MECHANICAL_DETECTORS);
+// bddNaming and assertionStyle: no literal token distinguishes "adopted" from "not",
+// so no mechanical signal is offered for them. Grounded on sampled/corpusSize only.
+const JUDGMENT_ONLY_CONVENTION_KEYS = CONVENTION_KEYS.filter((key) => !MECHANICAL_CONVENTION_KEYS.includes(key));
+
+/**
+ * List every git-tracked file in the repo, repo-relative POSIX paths.
+ *
+ * @param {string} projectRoot
+ * @returns {string[]|null} File list, or null when git ls-files could not run
+ *   (not a git repo, or some other git failure) — treated as baseline-unavailable
+ *   by the caller rather than thrown, matching step-02's own "shallow clone with
+ *   nothing else checked out" fallback case.
+ */
+function listGitTrackedFiles(projectRoot) {
+  const result = spawnSync('git', ['-c', 'core.quotePath=false', 'ls-files', '-z'], { cwd: projectRoot, encoding: 'utf8' });
+  if (result.error || result.status !== 0) {
+    return null;
+  }
+  return result.stdout.split('\0').filter(Boolean);
+}
+
+/** The directory portion of a repo-relative POSIX path ('' for a root-level file). */
+function directoryOf(filePath) {
+  const normalized = filePath.replaceAll('\\', '/');
+  const index = normalized.lastIndexOf('/');
+  return index === -1 ? '' : normalized.slice(0, index);
+}
+
+/** Path-segment distance between two directories: segments not on their shared prefix, both sides counted. */
+function directoryDistance(dirA, dirB) {
+  const a = dirA.split('/').filter(Boolean);
+  const b = dirB.split('/').filter(Boolean);
+  let common = 0;
+  while (common < a.length && common < b.length && a[common] === b[common]) {
+    common++;
+  }
+  return a.length - common + (b.length - common);
+}
+
+/** Minimum directory distance from a candidate file to any reviewed file's directory. */
+function closestDistance(candidateDir, reviewedDirs) {
+  let min = Number.POSITIVE_INFINITY;
+  for (const reviewedDir of reviewedDirs) {
+    const distance = directoryDistance(candidateDir, reviewedDir);
+    if (distance < min) {
+      min = distance;
+    }
+  }
+  return min;
+}
+
+/**
+ * Mechanically measure adoption of the five literal-form conventions across the
+ * already-sampled files' real content.
+ *
+ * @param {object} options
+ * @param {string} options.projectRoot
+ * @param {string[]} options.sampledFiles - Repo-relative paths, already capped/ranked.
+ * @returns {object} One entry per CONVENTION_KEYS, `{ mechanical: false }` for the
+ *   two judgment-only keys, `{ mechanical: true, adopted, mechanicalSignal }` for
+ *   the rest. `mechanicalSignal` is `adopted > 0`, i.e. whether the scan found the
+ *   convention anywhere at all in the sampled corpus.
+ */
+function measureConventions({ projectRoot, sampledFiles }) {
+  const conventions = {};
+  for (const key of CONVENTION_KEYS) {
+    const detector = MECHANICAL_DETECTORS[key];
+    if (!detector) {
+      conventions[key] = { mechanical: false };
+      continue;
+    }
+    let adopted = 0;
+    for (const file of sampledFiles) {
+      let content;
+      try {
+        content = fs.readFileSync(path.join(projectRoot, file), 'utf8');
+      } catch {
+        continue; // unreadable file contributes no signal either way, not a crash
+      }
+      if (detector.test(content)) {
+        adopted++;
+      }
+    }
+    conventions[key] = { mechanical: true, adopted, mechanicalSignal: adopted > 0 };
+  }
+  return conventions;
+}
+
+function unavailable(reason) {
+  return { baselineUnavailable: true, reason, corpusSize: 0, sampled: 0, sampledFiles: [], conventions: {} };
+}
+
+/**
+ * Compute the convention baseline for a review run: the real corpus outside the
+ * review set, ranked closest-first by directory distance and capped at 40 (per
+ * step-02-discover-tests.md §2b's sampling rules), plus a mechanical adoption scan
+ * over the sampled files' real content.
+ *
+ * @param {object} options
+ * @param {string} options.projectRoot - Repo root (git ls-files runs here).
+ * @param {string[]} options.reviewFiles - The review set; excluded from sampling and
+ *   used as the distance anchor.
+ * @param {number} [options.cap] - Sample size cap (default 40, matching step-02).
+ * @returns {object} `{ baselineUnavailable: true, reason, ... }` when no corpus
+ *   exists outside the review set (or git ls-files failed), otherwise
+ *   `{ baselineUnavailable: false, corpusSize, sampled, sampledFiles, conventions }`.
+ */
+function computeConventionBaseline({ projectRoot, reviewFiles, cap = MAX_SAMPLED_FILES }) {
+  const tracked = listGitTrackedFiles(projectRoot);
+  if (tracked === null) {
+    return unavailable('could not list repository files (git ls-files failed; not a git repo, or a git error)');
+  }
+
+  const reviewSet = new Set(reviewFiles.map((file) => file.replaceAll('\\', '/')));
+  const eligible = tracked.filter((file) => isTestFile(file) && !reviewSet.has(file));
+  const corpusSize = eligible.length;
+  if (corpusSize < MIN_CORPUS_TO_ATTEMPT) {
+    return unavailable('no test files exist outside the review set to measure a house convention against');
+  }
+
+  const reviewedDirs = reviewFiles.length > 0 ? reviewFiles.map(directoryOf) : [''];
+  const ranked = eligible
+    .map((file) => ({ file, distance: closestDistance(directoryOf(file), reviewedDirs) }))
+    // Plain code-unit comparison, not localeCompare: the tie-break order has to be
+    // the same sampled set on every machine regardless of the runtime's ICU/locale
+    // data, or "deterministic sampling" would itself be an environment-dependent claim.
+    .sort((a, b) => a.distance - b.distance || (a.file < b.file ? -1 : a.file > b.file ? 1 : 0));
+  const sampledFiles = ranked.slice(0, cap).map((entry) => entry.file);
+
+  return {
+    baselineUnavailable: false,
+    reason: null,
+    corpusSize,
+    sampled: sampledFiles.length,
+    sampledFiles,
+    conventions: measureConventions({ projectRoot, sampledFiles }),
+  };
+}
+
+module.exports = {
+  computeConventionBaseline,
+  CONVENTION_KEYS,
+  MECHANICAL_CONVENTION_KEYS,
+  JUDGMENT_ONLY_CONVENTION_KEYS,
+  // Exposed for tests only: unit-test the pure helpers without shelling out to git.
+  directoryDistance,
+  directoryOf,
+  measureConventions,
+};

package/cli/lib/isolate.js

@@ -0,0 +1,353 @@
+/**
+ * Filesystem isolation for the agent run (owner-approved). The agent may read
+ * the whole project but must only write the report/verdict artifacts; nothing
+ * else in the tree may be created or modified.
+ *
+ * Backend preference order:
+ *   1. sandbox-exec (darwin): a generated seatbelt profile allows everything
+ *      EXCEPT writes outside the writable paths + os.tmpdir(); the agent spawn
+ *      is prefixed with `sandbox-exec -f <profile>`.
+ *   2. bwrap (linux, when on PATH): binds the project root read-only and a
+ *      fresh tmpdir writable.
+ *   3. chmod fallback: locks the project root with `chmod -R a-w`, re-enables
+ *      writes on the writable paths and their parents, and ALWAYS restores in a
+ *      finally from a permission-bit snapshot taken before the lock, so the tree
+ *      comes back with its exact original modes. A restore failure prints a loud
+ *      warning but never masks the run result.
+ *
+ * TEA_TEST_REVIEW_ISOLATION (sandbox-exec|bwrap|chmod|none) overrides backend
+ * selection; it exists so tests can force the chmod fallback on any platform.
+ */
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const BACKEND_OVERRIDE_ENV = 'TEA_TEST_REVIEW_ISOLATION';
+
+function isolationError(message) {
+  const error = new Error(message);
+  error.code = 'ISOLATION_ERROR';
+  return error;
+}
+
+function executableOnPath(name, env = process.env) {
+  for (const dir of (env.PATH || '').split(path.delimiter)) {
+    if (!dir) {
+      continue;
+    }
+    try {
+      fs.accessSync(path.join(dir, name), fs.constants.X_OK);
+      return true;
+    } catch {
+      // not in this PATH entry; keep looking
+    }
+  }
+  return false;
+}
+
+/**
+ * Pick the isolation backend for this platform.
+ *
+ * @param {object} [env] - Environment to read the override/PATH from.
+ * @param {string} [platform] - Platform override for tests.
+ * @returns {'sandbox-exec'|'bwrap'|'chmod'|null}
+ */
+function selectBackend(env = process.env, platform = process.platform) {
+  const override = env[BACKEND_OVERRIDE_ENV];
+  if (override) {
+    if (override === 'none') {
+      return null;
+    }
+    if (override === 'sandbox-exec' && platform === 'darwin') {
+      return 'sandbox-exec';
+    }
+    if (override === 'bwrap' && platform === 'linux') {
+      return 'bwrap';
+    }
+    if (override === 'chmod' && platform !== 'win32') {
+      return 'chmod';
+    }
+    // A typo (e.g. "chmodd") or a backend name that is real but wrong for this
+    // platform (e.g. "bwrap" on darwin) must not silently degrade to "no
+    // isolation": that would run the agent unsandboxed while looking, from the
+    // log, exactly like a deliberate "none". Only the literal "none" opts out.
+    throw isolationError(
+      `${BACKEND_OVERRIDE_ENV}="${override}" is not a valid isolation backend for ${platform} ` +
+        '(sandbox-exec on darwin, bwrap on linux, chmod on darwin/linux, or none).',
+    );
+  }
+  if (platform === 'darwin' && executableOnPath('sandbox-exec', env)) {
+    return 'sandbox-exec';
+  }
+  if (platform === 'linux' && executableOnPath('bwrap', env)) {
+    return 'bwrap';
+  }
+  if (platform !== 'win32') {
+    return 'chmod';
+  }
+  return null;
+}
+
+/**
+ * Whether any isolation backend can run on this machine. Propagates
+ * selectBackend's ISOLATION_ERROR for an invalid override rather than
+ * swallowing it to a plain `false` — a typo is a config bug, not "unavailable".
+ */
+function isolationAvailable() {
+  return selectBackend() !== null;
+}
+
+function assertProfileSafePath(filePath) {
+  if (/["\n\r]/.test(filePath)) {
+    throw isolationError(`Path cannot be embedded in a sandbox profile: ${JSON.stringify(filePath)}`);
+  }
+}
+
+// The skill's own step contract hard-codes /tmp: steps-c/step-03a..03e each
+// declare `outputFile: /tmp/tea-test-review-<dimension>-<timestamp>.json`, and
+// step-03 section 5 aborts the workflow when any of them is missing. On darwin
+// os.tmpdir() is /var/folders/.../T, so /tmp needs its own entry or every
+// isolated run fails inside the skill rather than at the gate.
+const SKILL_TMP_DIR = '/tmp';
+
+/**
+ * Build the seatbelt profile: allow everything by default, deny all writes,
+ * then re-allow writes under os.tmpdir(), /tmp (the skill's subagent output
+ * directory), and the writable paths (each with its realpath, since /var
+ * symlinks to /private/var on darwin).
+ *
+ * @param {string[]} writablePaths - Absolute paths the agent may write.
+ * @param {string} [tmpDir] - Temp directory root (defaults to os.tmpdir()).
+ * @returns {string} Profile source.
+ */
+function buildSandboxProfile(writablePaths, tmpDir = os.tmpdir()) {
+  const allowed = new Set();
+  for (const candidate of [tmpDir, SKILL_TMP_DIR, ...writablePaths]) {
+    const resolved = path.resolve(candidate);
+    assertProfileSafePath(resolved);
+    allowed.add(resolved);
+    try {
+      allowed.add(fs.realpathSync(resolved));
+    } catch {
+      // path may not exist yet; the literal entry still covers it
+    }
+  }
+  const subpaths = [...allowed].map((entry) => `    (subpath "${entry}")`).join('\n');
+  return ['(version 1)', '(allow default)', '(deny file-write*)', `(allow file-write*\n${subpaths})`, ''].join('\n');
+}
+
+/**
+ * Build the bwrap spawn prefix: the real filesystem with the project root
+ * rebound read-only and a fresh tmpdir bound writable.
+ *
+ * @param {string} projectRoot - Absolute project root.
+ * @param {string} writableTmp - Fresh writable temp directory.
+ * @returns {string[]}
+ */
+function buildBwrapPrefix(projectRoot, writableTmp) {
+  return [
+    'bwrap',
+    '--dev-bind',
+    '/',
+    '/',
+    '--ro-bind',
+    projectRoot,
+    projectRoot,
+    '--bind',
+    writableTmp,
+    writableTmp,
+    '--chdir',
+    projectRoot,
+  ];
+}
+
+function runChmod(args) {
+  const result = spawnSync('chmod', args, { encoding: 'utf8' });
+  if (result.error || result.status !== 0) {
+    const detail = ((result.stderr || '').trim() || (result.error && result.error.message) || 'unknown chmod error').trim();
+    throw isolationError(`chmod ${args.join(' ')} failed: ${detail}`);
+  }
+}
+
+function isInside(child, parent) {
+  const relative = path.relative(path.resolve(parent), path.resolve(child));
+  return relative !== '' && !relative.startsWith('..') && !path.isAbsolute(relative);
+}
+
+/** Parent directories of a path that sit strictly below projectRoot. */
+function lockedParents(writablePath, projectRoot) {
+  const chain = [];
+  let current = path.dirname(path.resolve(writablePath));
+  const stop = path.resolve(projectRoot);
+  while (current !== stop && current !== path.dirname(current)) {
+    chain.push(current);
+    current = path.dirname(current);
+  }
+  return chain;
+}
+
+/**
+ * Walk a tree depth-first without following symlinks (matching `chmod -R`), and
+ * visit every entry. Unreadable entries are skipped rather than aborting: a
+ * partial snapshot still restores more than a blanket `chmod -R u+w`.
+ */
+function walkTree(root, visit) {
+  const stack = [root];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    let stats;
+    try {
+      stats = fs.lstatSync(current);
+    } catch {
+      continue;
+    }
+    if (stats.isSymbolicLink()) {
+      continue;
+    }
+    visit(current, stats);
+    if (stats.isDirectory()) {
+      let names;
+      try {
+        names = fs.readdirSync(current);
+      } catch {
+        continue;
+      }
+      for (const name of names) {
+        stack.push(path.join(current, name));
+      }
+    }
+  }
+}
+
+/**
+ * Record every entry's permission bits so the lock can be undone exactly.
+ * `chmod -R u+w` is not an inverse of `chmod -R a-w`: it drops group/other write
+ * bits permanently and makes deliberately read-only files writable, so a local
+ * run would silently rewrite the permissions of the tree it was protecting.
+ *
+ * @returns {Map<string, number>|null} Path to mode, or null when the snapshot
+ *   could not be taken (the caller then falls back to the blanket restore).
+ */
+function snapshotModes(projectRoot) {
+  try {
+    const modes = new Map();
+    walkTree(path.resolve(projectRoot), (entry, stats) => modes.set(entry, stats.mode & 0o7777));
+    return modes.size > 0 ? modes : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Undo the lock. With a snapshot, every recorded entry goes back to its exact
+ * mode; entries created during the run were never locked and are left alone.
+ */
+function restoreModes(projectRoot, modes) {
+  if (modes === null) {
+    runChmod(['-R', 'u+w', projectRoot]);
+    return;
+  }
+  for (const [entry, mode] of modes) {
+    try {
+      fs.chmodSync(entry, mode);
+    } catch {
+      // entry was removed during the run; nothing to restore
+    }
+  }
+}
+
+/**
+ * Lock projectRoot (chmod -R a-w) while keeping the requested artifact paths
+ * writable. Only paths inside the project root need unlocking; the root itself
+ * stays locked so the agent cannot create new top-level entries.
+ */
+function prepareChmodLock(projectRoot, writablePaths) {
+  const insidePaths = writablePaths.map((entry) => path.resolve(entry)).filter((entry) => isInside(entry, projectRoot));
+  // Snapshot phase: the artifact parent directories must exist before the tree
+  // is locked, because they cannot be created afterwards. The artifact files
+  // themselves are pre-created empty for the same reason: an artifact that sits
+  // directly in the project root has no unlockable parent (the root stays
+  // locked so the agent cannot add top-level entries), and writing it later
+  // would need a directory it is not allowed to modify. Truncating an existing
+  // file only needs permission on the file, which the unlock phase grants.
+  // This never widens the stale-report window: under isolation the agent writes
+  // into the redirect tmpdir, and the freshness check runs against that path.
+  for (const entry of insidePaths) {
+    fs.mkdirSync(path.dirname(entry), { recursive: true });
+    if (!fs.existsSync(entry)) {
+      fs.writeFileSync(entry, '');
+    }
+  }
+  const modes = snapshotModes(projectRoot);
+  runChmod(['-R', 'a-w', projectRoot]);
+  for (const entry of insidePaths) {
+    if (fs.existsSync(entry)) {
+      runChmod(['u+w', entry]);
+    }
+    for (const parent of lockedParents(entry, projectRoot)) {
+      runChmod(['u+w', parent]);
+    }
+  }
+  return modes;
+}
+
+/**
+ * Run fn under filesystem isolation. fn receives { agentCwd, spawnPrefix };
+ * spawnPrefix is prepended to the agent command (sandbox-exec/bwrap) or empty
+ * (chmod, where the restriction is filesystem state rather than a wrapper).
+ *
+ * @param {string} projectRoot - Absolute project root (the tree to protect).
+ * @param {string[]} writablePaths - Artifact paths that must stay writable.
+ * @param {(context: {agentCwd: string, spawnPrefix: string[]}) => any} fn
+ * @returns {any} fn's return value.
+ */
+function withIsolation(projectRoot, writablePaths, fn) {
+  const backend = selectBackend();
+  if (backend === null) {
+    return fn({ agentCwd: projectRoot, spawnPrefix: [] });
+  }
+
+  if (backend === 'sandbox-exec') {
+    const profileDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tea-test-review-profile-'));
+    const profilePath = path.join(profileDir, 'tea-test-review.sb');
+    fs.writeFileSync(profilePath, buildSandboxProfile(writablePaths), 'utf8');
+    try {
+      return fn({ agentCwd: projectRoot, spawnPrefix: ['sandbox-exec', '-f', profilePath] });
+    } finally {
+      fs.rmSync(profileDir, { recursive: true, force: true });
+    }
+  }
+
+  if (backend === 'bwrap') {
+    const writableTmp = fs.mkdtempSync(path.join(os.tmpdir(), 'tea-test-review-bwrap-'));
+    try {
+      return fn({ agentCwd: projectRoot, spawnPrefix: buildBwrapPrefix(path.resolve(projectRoot), writableTmp) });
+    } finally {
+      fs.rmSync(writableTmp, { recursive: true, force: true });
+    }
+  }
+
+  const modes = prepareChmodLock(projectRoot, writablePaths);
+  try {
+    return fn({ agentCwd: projectRoot, spawnPrefix: [] });
+  } finally {
+    try {
+      restoreModes(projectRoot, modes);
+    } catch (error) {
+      console.error(
+        `tea-test-review WARNING: failed to restore write permissions under ${projectRoot}: ${error.message}. ` +
+          'Restore manually with: chmod -R u+w <path>',
+      );
+    }
+  }
+}
+
+module.exports = {
+  withIsolation,
+  isolationAvailable,
+  selectBackend,
+  buildSandboxProfile,
+  buildBwrapPrefix,
+};