ltcai 8.9.0 → 9.1.0

package/scripts/check_current_release_docs.mjs

@@ -0,0 +1,142 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import path from "node:path";
+import process from "node:process";
+
+const root = process.cwd();
+const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
+const version = pkg.version;
+const releaseDir = `output/release/v${version}`;
+const releaseTheme = "Code Review Completion & Fail-Closed Runtime";
+const title = `${version} — ${releaseTheme}`;
+const escapedVersion = version.replaceAll(".", "\\.");
+
+const currentReleaseFiles = [
+  "README.md",
+  "ARCHITECTURE.md",
+  "FEATURE_STATUS.md",
+  "PRIVACY.md",
+  "SECURITY.md",
+  "docs/COMMUNITY_AND_PLUGINS.md",
+  "docs/DEVELOPMENT.md",
+  "docs/ONBOARDING.md",
+  "docs/TRUST_MODEL.md",
+  "docs/WHY_LATTICE.md",
+  "docs/kg-schema.md",
+  "vscode-extension/README.md",
+];
+
+const errors = [];
+
+function read(rel) {
+  return readFileSync(path.join(root, rel), "utf8");
+}
+
+function requireIncludes(rel, needle) {
+  const text = read(rel);
+  if (!text.includes(needle)) {
+    errors.push(`${rel}: missing ${JSON.stringify(needle)}`);
+  }
+}
+
+function assertNoCurrentDrift(rel) {
+  const text = read(rel);
+  const stale = text.match(
+    new RegExp(`Current release:\\s+\\*\\*(?!${escapedVersion}\\b)[^*]+\\*\\*`, "i"),
+  );
+  if (stale) {
+    errors.push(`${rel}: stale current-release marker ${JSON.stringify(stale[0])}`);
+  }
+  for (const match of text.matchAll(/Latest\b[^\n]*\b(\d+\.\d+\.\d+)\b/gi)) {
+    if (match[1] !== version) {
+      errors.push(`${rel}: stale Latest version reference ${match[1]}`);
+    }
+  }
+  if (new RegExp(`current release is\\s+\\*\\*(?!${escapedVersion}\\b)`, "i").test(text)) {
+    errors.push(`${rel}: stale README current release sentence`);
+  }
+}
+
+for (const rel of currentReleaseFiles) {
+  assertNoCurrentDrift(rel);
+}
+
+for (const rel of [
+  "README.md",
+  "ARCHITECTURE.md",
+  "FEATURE_STATUS.md",
+  "PRIVACY.md",
+  "SECURITY.md",
+]) {
+  requireIncludes(rel, version);
+}
+
+requireIncludes("README.md", `The current release is **${title}**`);
+requireIncludes("README.md", `![v${version} Living Brain walkthrough]`);
+requireIncludes("RELEASE.md", `## v${version} — ${releaseTheme}`);
+requireIncludes("docs/CHANGELOG.md", `## [${version}]`);
+requireIncludes("RELEASE_NOTES.md", `[v${version} - ${releaseTheme}]`);
+requireIncludes("CHANGELOG.md", "starts at v8.0.0");
+requireIncludes("RELEASE_NOTES.md", `8.0.0 through ${version}`);
+requireIncludes("SECURITY.md", `${version.split(".").slice(0, 2).join(".")}.x (latest)`);
+
+for (const rel of ["README.md", "RELEASE.md", "docs/CHANGELOG.md", "RELEASE_NOTES.md"]) {
+  const text = read(rel);
+  for (const forbidden of ["RELEASE_NOTES_v7", "output/release/v7", "## v7.", "## [7."]) {
+    if (text.includes(forbidden)) {
+      errors.push(`${rel}: forbidden pre-8.0 release-history reference ${forbidden}`);
+    }
+  }
+}
+
+const readme = read("README.md");
+const mediaRefs = [...readme.matchAll(/\]\((output\/release\/v[^)]+)\)/g)].map((m) => m[1]);
+if (mediaRefs.length === 0) {
+  errors.push("README.md: no release evidence media references found");
+}
+for (const ref of mediaRefs) {
+  if (!ref.startsWith(`${releaseDir}/`)) {
+    errors.push(`README.md: release media must point at ${releaseDir}, found ${ref}`);
+  }
+  if (!existsSync(path.join(root, ref))) {
+    errors.push(`README.md: missing release media target ${ref}`);
+  }
+}
+
+const evidenceRoot = path.join(root, releaseDir);
+if (!existsSync(evidenceRoot)) {
+  errors.push(`missing current release evidence directory ${releaseDir}`);
+} else {
+  for (const rel of [
+    "SCREENSHOT_INDEX.md",
+    "screenshots/01-login.png",
+    "screenshots/02-recommended-models.png",
+    "screenshots/03-install-load-progress.png",
+    "screenshots/04-brain-chat-home.png",
+    "screenshots/12-review-center.png",
+    `gifs/v${version}-living-brain-walkthrough.gif`,
+  ]) {
+    const target = path.join(evidenceRoot, rel);
+    if (!existsSync(target)) {
+      errors.push(`missing current release evidence file ${releaseDir}/${rel}`);
+    }
+  }
+}
+
+const releaseRoot = path.join(root, "output", "release");
+if (existsSync(releaseRoot)) {
+  for (const entry of readdirSync(releaseRoot)) {
+    if (/^v7\./.test(entry)) {
+      errors.push(`pre-8.0 release evidence should not be tracked: output/release/${entry}`);
+    }
+  }
+}
+
+if (errors.length) {
+  console.error("Current release documentation check failed:");
+  for (const error of errors) {
+    console.error(`- ${error}`);
+  }
+  process.exit(1);
+}
+
+console.log(`Current release documentation is synchronized for ${version}.`);

package/scripts/check_i18n_literals.mjs

@@ -1,16 +1,38 @@
 #!/usr/bin/env node
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { join, relative } from "node:path";
+import ts from "typescript";
 
 const repo = join(import.meta.dirname, "..");
-const roots = [
-  join(repo, "frontend", "src"),
-];
+const roots = [join(repo, "frontend", "src")];
 const allowlistPath = join(repo, "scripts", "i18n_literal_allowlist.json");
 const allowlist = existsSync(allowlistPath)
   ? JSON.parse(readFileSync(allowlistPath, "utf8"))
   : {};
 
+const localizedAttributes = new Set([
+  "alt",
+  "aria-label",
+  "description",
+  "detail",
+  "empty",
+  "label",
+  "placeholder",
+  "successLabel",
+  "title",
+  "tooltip",
+]);
+const localizedProperties = new Set([
+  "description",
+  "detail",
+  "empty",
+  "label",
+  "placeholder",
+  "successLabel",
+  "title",
+  "tooltip",
+]);
+
 function walk(dir) {
   if (!existsSync(dir)) return [];
   const out = [];
@@ -18,41 +40,95 @@ function walk(dir) {
     const path = join(dir, name);
     const stat = statSync(path);
     if (stat.isDirectory()) out.push(...walk(path));
-    else if ((name.endsWith(".tsx") || name.endsWith(".ts")) && name !== "openapi.ts") {
-      out.push(path);
-    }
+    else if ((name.endsWith(".tsx") || name.endsWith(".ts")) && name !== "openapi.ts" && !/\.test\.[tj]sx?$/.test(name)) out.push(path);
   }
   return out;
 }
 
-const rawLocalizedProps = /\b(?:aria-label|placeholder|title)=["'][^"'{]*[A-Za-z][^"']*["']/g;
-const rawJsxText = />\s*([A-Z][A-Za-z0-9][^<>{}\n]{2,})\s*</g;
-const rawComponentCopy = /\b(?:title|detail|description|successLabel|empty)=["'][^"'{]*[A-Za-z][^"']*["']/g;
+function propertyName(node) {
+  if (ts.isIdentifier(node) || ts.isStringLiteral(node)) return node.text;
+  return "";
+}
+
+function literalText(node) {
+  if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) return node.text.trim();
+  if (ts.isTemplateExpression(node)) {
+    return [node.head.text, ...node.templateSpans.map((span) => span.literal.text)].join(" ").trim();
+  }
+  return "";
+}
+
+function renderedLiterals(expression) {
+  if (!expression) return [];
+  const direct = literalText(expression);
+  if (direct) return [direct];
+  if (ts.isParenthesizedExpression(expression)) return renderedLiterals(expression.expression);
+  if (ts.isConditionalExpression(expression)) {
+    return [...renderedLiterals(expression.whenTrue), ...renderedLiterals(expression.whenFalse)];
+  }
+  if (ts.isBinaryExpression(expression) && [ts.SyntaxKind.AmpersandAmpersandToken, ts.SyntaxKind.BarBarToken, ts.SyntaxKind.QuestionQuestionToken].includes(expression.operatorToken.kind)) {
+    return renderedLiterals(expression.right);
+  }
+  return [];
+}
+
+function looksLocalized(text) {
+  return /[A-Za-z\u3131-\uD79D]/u.test(text);
+}
+
+function inspect(file) {
+  const source = readFileSync(file, "utf8");
+  const sourceFile = ts.createSourceFile(
+    file,
+    source,
+    ts.ScriptTarget.Latest,
+    true,
+    file.endsWith(".tsx") ? ts.ScriptKind.TSX : ts.ScriptKind.TS,
+  );
+  const findings = [];
+  const add = (kind, node, value) => {
+    const normalized = String(value || "").trim();
+    if (!looksLocalized(normalized)) return;
+    const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
+    findings.push({ id: `${kind}: ${normalized}`, line: line + 1 });
+  };
+
+  const visit = (node) => {
+    if (ts.isJsxText(node)) add("JSX text", node, node.getText(sourceFile));
+
+    if (ts.isJsxAttribute(node) && localizedAttributes.has(node.name.text)) {
+      if (node.initializer && ts.isStringLiteral(node.initializer)) add(`JSX ${node.name.text}`, node, node.initializer.text);
+      if (node.initializer && ts.isJsxExpression(node.initializer)) {
+        for (const value of renderedLiterals(node.initializer.expression)) add(`JSX ${node.name.text}`, node, value);
+      }
+    }
+
+    if (ts.isJsxExpression(node) && !ts.isJsxAttribute(node.parent)) {
+      for (const value of renderedLiterals(node.expression)) add("JSX expression", node, value);
+    }
+
+    if (file.endsWith(".tsx") && ts.isPropertyAssignment(node) && localizedProperties.has(propertyName(node.name))) {
+      for (const value of renderedLiterals(node.initializer)) add(`property ${propertyName(node.name)}`, node, value);
+    }
+
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return findings;
+}
+
 let failures = 0;
 let allowed = 0;
-
 for (const file of roots.flatMap(walk)) {
-  const text = readFileSync(file, "utf8");
-  const matches = [
-    ...(text.match(rawLocalizedProps) || []),
-    ...(text.match(rawComponentCopy) || []),
-  ];
-  for (const match of text.matchAll(rawJsxText)) {
-    const literal = match[1].trim();
-    if (!literal || /^[A-Z][a-z]*$/.test(literal) || /^Lattice\b/.test(literal)) continue;
-    matches.push(`JSX text: ${literal}`);
-  }
-  if (!matches.length) continue;
   const rel = relative(repo, file);
-  const budget = Number(allowlist[rel]?.maxFindings || 0);
-  if (budget >= matches.length) {
-    allowed += matches.length;
-    continue;
-  }
-  const newMatches = matches.slice(budget);
-  failures += newMatches.length;
-  for (const match of newMatches) {
-    console.error(`${rel}: hardcoded localized prop: ${match}`);
+  const accepted = new Set(allowlist[rel]?.findings || []);
+  for (const finding of inspect(file)) {
+    if (accepted.has(finding.id)) {
+      allowed += 1;
+      continue;
+    }
+    failures += 1;
+    console.error(`${rel}:${finding.line}: hardcoded localized copy: ${finding.id}`);
   }
 }
 
@@ -61,4 +137,4 @@ if (failures) {
   process.exit(1);
 }
 
-console.log(`i18n literal check: localized props use translation keys (${allowed} allowlisted legacy literal(s))`);
+console.log(`i18n literal check: localized copy uses translation keys (${allowed} allowlisted technical literal(s))`);

package/scripts/check_openapi_drift.mjs

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repo = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const tempRoot = mkdtempSync(join(tmpdir(), "ltcai-openapi-check-"));
+const generatedSchema = join(tempRoot, "openapi.json");
+const generatedTypes = join(tempRoot, "openapi.ts");
+
+function runNode(script, args) {
+  const result = spawnSync(process.execPath, [script, ...args], {
+    cwd: repo,
+    env: process.env,
+    stdio: "inherit",
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    throw new Error(`${script} exited with status ${result.status ?? "unknown"}`);
+  }
+}
+
+function matches(left, right) {
+  return readFileSync(left).equals(readFileSync(right));
+}
+
+try {
+  runNode(join(repo, "scripts", "run_python.mjs"), [
+    "scripts/export_openapi.py",
+    generatedSchema,
+  ]);
+  runNode(join(repo, "node_modules", "openapi-typescript", "bin", "cli.js"), [
+    generatedSchema,
+    "-o",
+    generatedTypes,
+  ]);
+
+  const committedSchema = join(repo, "frontend", "openapi.json");
+  const committedTypes = join(repo, "frontend", "src", "api", "openapi.ts");
+  const drift = [];
+  if (!matches(generatedSchema, committedSchema)) drift.push("frontend/openapi.json");
+  if (!matches(generatedTypes, committedTypes)) drift.push("frontend/src/api/openapi.ts");
+
+  if (drift.length) {
+    console.error("OpenAPI generated artifacts are stale:");
+    for (const path of drift) console.error(`- ${path}`);
+    console.error("Run `npm run frontend:openapi` and commit both generated files.");
+    process.exitCode = 1;
+  } else {
+    console.log("OpenAPI schema and TypeScript client are synchronized.");
+  }
+} finally {
+  rmSync(tempRoot, { recursive: true, force: true });
+}

package/scripts/export_openapi.py

@@ -6,22 +6,82 @@ from __future__ import annotations
 import json
 import os
 import sys
+import tempfile
+from contextlib import contextmanager
 from pathlib import Path
+from typing import Iterator, Mapping
 
 REPO = Path(__file__).resolve().parents[1]
 sys.path.insert(0, str(REPO))
 
 
-def main() -> int:
-    from latticeai.app_factory import create_app
+@contextmanager
+def isolated_runtime_environment(root: Path) -> Iterator[Mapping[str, str]]:
+    """Point every runtime/user-state path at a disposable directory.
+
+    OpenAPI generation constructs the real application so route wiring stays
+    authoritative. That construction must not inspect or mutate the caller's
+    HOME, Brain, keyring, agent workspace, or local Lattice data.
+    """
+
+    home = root / "home"
+    paths = {
+        "HOME": home,
+        "USERPROFILE": home,
+        "XDG_CACHE_HOME": root / "cache",
+        "XDG_CONFIG_HOME": root / "config",
+        "XDG_DATA_HOME": root / "share",
+        "TMPDIR": root / "tmp",
+        "TEMP": root / "tmp",
+        "TMP": root / "tmp",
+        "LATTICEAI_DATA_DIR": root / "data",
+        "LATTICEAI_BRAIN_DIR": root / "brain",
+        "LATTICEAI_AGENT_ROOT": root / "agent-workspace",
+        "LATTICEAI_OBSIDIAN_VAULT_DIR": root / "vault",
+        "LATTICEAI_STATIC_DIR": root / "static",
+    }
+    for path in paths.values():
+        path.mkdir(parents=True, exist_ok=True)
+
+    overrides = {
+        **{key: str(value) for key, value in paths.items()},
+        "LATTICEAI_MODE": "local",
+        "LATTICEAI_STORAGE_ENGINE": "sqlite",
+        "LATTICEAI_POSTGRES_DSN": "",
+        "LATTICEAI_REQUIRE_AUTH": "false",
+        "LATTICEAI_TUNNEL": "false",
+        "LATTICEAI_ENABLE_TELEGRAM": "false",
+        "LATTICEAI_AUTOLOAD_MODELS": "false",
+        "LATTICEAI_ALLOW_MODEL_DOWNLOADS": "false",
+        "LATTICEAI_AUTO_READ_CHAT_PATHS": "false",
+        "LATTICEAI_DISCORD_PERMISSION_WEBHOOK": "",
+        "LATTICEAI_DISCORD_BOT_TOKEN": "",
+        "OIDC_DISCOVERY_URL": "",
+        "PYTHON_KEYRING_BACKEND": "keyring.backends.null.Keyring",
+    }
+    previous = {key: os.environ.get(key) for key in overrides}
+    os.environ.update(overrides)
+    try:
+        yield overrides
+    finally:
+        for key, value in previous.items():
+            if value is None:
+                os.environ.pop(key, None)
+            else:
+                os.environ[key] = value
 
+
+def main() -> int:
     target = Path(sys.argv[1] if len(sys.argv) > 1 else "frontend/openapi.json")
     target.parent.mkdir(parents=True, exist_ok=True)
-    os.environ.setdefault("LATTICEAI_REQUIRE_AUTH", "false")
-    os.environ.setdefault("LATTICEAI_TUNNEL", "false")
-    os.environ.setdefault("LATTICEAI_AUTOLOAD_MODELS", "false")
-    app = create_app()
-    schema = app.openapi()
+    with tempfile.TemporaryDirectory(prefix="ltcai-openapi-") as temp_dir:
+        with isolated_runtime_environment(Path(temp_dir)):
+            # Import only after isolation is active in case a future dependency
+            # starts reading environment or user paths during module import.
+            from latticeai.app_factory import create_app
+
+            app = create_app()
+            schema = app.openapi()
     target.write_text(json.dumps(schema, sort_keys=True, indent=2) + "\n", encoding="utf-8")
     print(f"wrote {target} with {len(schema.get('paths', {}))} paths")
     return 0

package/scripts/i18n_literal_allowlist.json

@@ -1,34 +1,32 @@
 {
   "frontend/src/App.tsx": {
-    "maxFindings": 1,
-    "reason": "legacy shell aria label pending translation-key migration"
+    "findings": [
+      "JSX text: Lattice"
+    ],
+    "reason": "Product brand name"
   },
-  "frontend/src/components/LivingBrain.tsx": {
-    "maxFindings": 1,
-    "reason": "legacy visual component aria label pending translation-key migration"
-  },
-  "frontend/src/components/primitives.tsx": {
-    "maxFindings": 1,
-    "reason": "shared empty-state fallback pending translation-key migration"
-  },
-  "frontend/src/pages/Act.tsx": {
-    "maxFindings": 41,
-    "reason": "large legacy automation page pending incremental copy migration"
-  },
-  "frontend/src/pages/Brain.tsx": {
-    "maxFindings": 25,
-    "reason": "large legacy memory page pending incremental copy migration"
+  "frontend/src/features/brain/MessageMarkdown.tsx": {
+    "findings": [
+      "JSX expression: text"
+    ],
+    "reason": "Technical fallback language identifier for untyped code blocks"
   },
   "frontend/src/pages/Capture.tsx": {
-    "maxFindings": 2,
-    "reason": "technical type-name literals are intentionally preserved for now"
+    "findings": [
+      "JSX text: KB ·"
+    ],
+    "reason": "International technical storage unit"
   },
   "frontend/src/pages/Library.tsx": {
-    "maxFindings": 21,
-    "reason": "large legacy model/plugin page pending incremental copy migration"
+    "findings": [
+      "JSX text: ✓ HF"
+    ],
+    "reason": "Hugging Face verification abbreviation"
   },
-  "frontend/src/pages/System.tsx": {
-    "maxFindings": 118,
-    "reason": "large legacy system/admin page pending incremental copy migration"
+  "frontend/src/pages/brain/CytoscapeGraph.tsx": {
+    "findings": [
+      "property label: data(displayLabel)"
+    ],
+    "reason": "Cytoscape data-expression syntax, not user-facing copy"
   }
 }

package/scripts/run_integration_tests.mjs

@@ -1,21 +1,87 @@
 #!/usr/bin/env node
 import { spawn } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 const host = process.env.LTCAI_TEST_HOST || "127.0.0.1";
+if (!new Set(["127.0.0.1", "localhost"]).has(host)) {
+  throw new Error(`LTCAI_TEST_HOST must be loopback, received: ${host}`);
+}
 const port = process.env.LTCAI_TEST_PORT || "8899";
-const baseUrl = process.env.LTCAI_TEST_BASE_URL || `http://${host}:${port}`;
+if (!/^\d+$/.test(port) || Number(port) < 1 || Number(port) > 65535) {
+  throw new Error(`LTCAI_TEST_PORT must be an integer from 1 to 65535, received: ${port}`);
+}
+// This runner owns the server lifecycle; never redirect its tests to a caller-
+// supplied live server through LTCAI_TEST_BASE_URL.
+const baseUrl = `http://${host}:${port}`;
 const venvPython = join(process.cwd(), ".venv", "bin", "python");
 const python = process.env.PYTHON || (existsSync(venvPython) ? venvPython : "python");
 
+// Integration tests must never discover or mutate the developer's real HOME,
+// ~/.ltcai, Brain vault, or agent workspace. Keep every user-state path under
+// one disposable root and pass the exact same environment to the server and
+// pytest process.
+const sandboxRoot = mkdtempSync(join(tmpdir(), "ltcai-integration-"));
+const sandbox = {
+  home: join(sandboxRoot, "home"),
+  data: join(sandboxRoot, "data"),
+  brain: join(sandboxRoot, "brain"),
+  agent: join(sandboxRoot, "agent-workspace"),
+  vault: join(sandboxRoot, "vault"),
+  cache: join(sandboxRoot, "cache"),
+  config: join(sandboxRoot, "config"),
+  tmp: join(sandboxRoot, "tmp"),
+};
+for (const path of Object.values(sandbox)) mkdirSync(path, { recursive: true });
+
+const isolatedEnv = {
+  ...process.env,
+  HOME: sandbox.home,
+  USERPROFILE: sandbox.home,
+  XDG_CACHE_HOME: sandbox.cache,
+  XDG_CONFIG_HOME: sandbox.config,
+  XDG_DATA_HOME: join(sandboxRoot, "share"),
+  TMPDIR: sandbox.tmp,
+  TEMP: sandbox.tmp,
+  TMP: sandbox.tmp,
+  LATTICEAI_MODE: "local",
+  LATTICEAI_HOST: host,
+  LATTICEAI_PORT: port,
+  LATTICEAI_DATA_DIR: sandbox.data,
+  LATTICEAI_BRAIN_DIR: sandbox.brain,
+  LATTICEAI_AGENT_ROOT: sandbox.agent,
+  LATTICEAI_OBSIDIAN_VAULT_DIR: sandbox.vault,
+  LATTICEAI_STORAGE_ENGINE: "sqlite",
+  LATTICEAI_POSTGRES_DSN: "",
+  LATTICEAI_REQUIRE_AUTH: "false",
+  LATTICEAI_ENABLE_TELEGRAM: "false",
+  LATTICEAI_AUTOLOAD_MODELS: "false",
+  LATTICEAI_ALLOW_MODEL_DOWNLOADS: "false",
+  LATTICEAI_AUTO_READ_CHAT_PATHS: "false",
+  LATTICEAI_TUNNEL: "false",
+  LATTICEAI_DISCORD_PERMISSION_WEBHOOK: "",
+  LATTICEAI_DISCORD_BOT_TOKEN: "",
+  OIDC_DISCOVERY_URL: "",
+  PYTHON_KEYRING_BACKEND: "keyring.backends.null.Keyring",
+};
+
+let sandboxCleaned = false;
+function cleanupSandbox() {
+  if (sandboxCleaned) return;
+  sandboxCleaned = true;
+  rmSync(sandboxRoot, { recursive: true, force: true });
+}
+process.once("exit", cleanupSandbox);
+
 function run(command, args, options = {}) {
-  return new Promise((resolve) => {
+  return new Promise((resolve, reject) => {
     const child = spawn(command, args, {
       stdio: "inherit",
-      env: { ...process.env, ...options.env },
+      env: { ...isolatedEnv, ...options.env },
       cwd: options.cwd || process.cwd(),
     });
+    child.on("error", reject);
     child.on("close", (code, signal) => resolve({ code, signal }));
   });
 }
@@ -62,12 +128,7 @@ const server = spawn(
   ["-m", "uvicorn", "server:app", "--host", host, "--port", port],
   {
     cwd: process.cwd(),
-    env: {
-      ...process.env,
-      LATTICEAI_MODE: process.env.LATTICEAI_MODE || "test",
-      LATTICEAI_HOST: host,
-      LATTICEAI_PORT: port,
-    },
+    env: isolatedEnv,
     stdio: ["ignore", "pipe", "pipe"],
   },
 );
@@ -86,6 +147,7 @@ try {
   console.error(String(error?.message || error));
 } finally {
   await stop(server);
+  cleanupSandbox();
 }
 
 process.exit(exitCode);