razzou-harness 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -3,6 +3,50 @@
 The notable changes in each release of razzou-harness. Before 1.0, a new minor version
 may change how a project is set up, and its notes say how.
 
+## 0.4.0 (2026-11-08)
+
+**Upgrading a project from 0.3.x:** install the new version, then rebuild the agents'
+image with `harness doctor --build-images`, or run `harness setup`, which does it: the
+image's tag follows the harness's version. The doctor now removes the 0.3.0 image once
+no container uses it. Nothing else changes in a project.
+
+- A **Sandboxes** view in the dashboard lists the sandboxes on the OpenShell gateway:
+  this project's, with what each is for and whether anything still uses it, then the
+  others'. A left-over sandbox of this project, which a crash or a failed delete left,
+  can be deleted there; one in use, or another project's, can't. Selecting a sandbox
+  shows the network requests its policy refused, from its log: the program, the host,
+  why, and how often. The daemon labels the sandboxes it makes with the project's name
+  (`harness.project`) to tell them apart; a left-over sandbox from 0.3.0 or earlier has
+  no label, so it shows among the others.
+- The view shows what each sandbox uses of the machine now, its CPUs and memory against
+  its caps, and the total for every OpenShell sandbox, read from `docker stats` every
+  five seconds while the view is open.
+- **Caps on each sandbox**, set in the Sandboxes view: how many CPUs and how much memory
+  each new sandbox may use, so that Developers, check runs and reviewers in parallel
+  leave the machine usable. The daemon records them, and creates every sandbox with
+  them from then on; those already there keep theirs. There is no cap until you set one.
+- An attempt keeps the network requests its sandbox's policy refused. OpenShell keeps
+  only a sandbox's last 2,000 log lines, so the daemon reads the log every minute while
+  the Developer works, and once more before the sandbox goes. The attempt's card shows
+  them, and the Manager gets them with a failed attempt. A refused host is the
+  Manager's to resolve: it guides the next Developer around the host, or asks the owner
+  to allow it, since only the owner widens the network policy.
+
+Disk space:
+- The git bundles the daemon hands to sandboxes, each a copy of the plan branch's whole
+  history, are deleted once uploaded, and the ones it takes back once fetched. One was
+  kept for every attempt and every review, and never deleted, so `.harness/` grew with
+  each. The daemon deletes the ones earlier versions left in `.harness/modules/` when it
+  starts.
+- The daemon deletes this project's left-over sandboxes when it starts and every hour:
+  those the Sandboxes view offers to delete, so a delete that failed is tried again. It
+  spares an Architect's, which holds the owner's conversation with it.
+- `harness doctor --build-images` removes the agents' images the new one replaces, about
+  2 GB each, once no container uses them: the other versions' tags, and the untagged
+  images that building a tag again leaves. It also shows the size of Docker's build
+  cache, with `docker builder prune` to free it; that cache is shared with every other
+  build on the machine, so the doctor leaves it alone.
+
 ## 0.3.0 (2026-11-07)
 
 **Upgrading a project from 0.2.x:** install the new version, then run `harness setup`

package/README.md

@@ -261,7 +261,18 @@ behind a token. Its views:
 - **Project:** modules, proposals, plans and features, with attempts, findings, CI,
   deploys and `progress.txt`.
 - **Agents:** the Architect's terminal, the Manager's and the Developers' live
-  transcripts, a message box for the Manager, and a shell in any agent's sandbox.
+  transcripts, a message box for the Manager, and a shell in any agent's sandbox. An
+  attempt's card keeps the network requests its sandbox's policy refused.
+- **Sandboxes:** what runs on the OpenShell gateway. This project's sandboxes, with what
+  each is for, whether anything still uses it, and the CPUs and memory it uses now,
+  read from `docker stats` every five seconds. A left-over one, which a crash or a
+  failed delete left, has a button to delete it; the daemon deletes them itself when it
+  starts and every hour, except an Architect's. Select one to see the network requests
+  its policy refused, from its log: the program, the host, why, and how often. Then the
+  other projects' sandboxes, which the dashboard only lists, and the gateway's status.
+  Above them, the caps on each new sandbox: how many CPUs and how much memory it may
+  use, so that agents and checks in parallel leave the machine usable. There is no cap
+  until you set one.
 - **Events:** the event log, live, with a filter.
 
 The header pauses and resumes the pipeline: a pause lets what runs finish, and starts
@@ -421,7 +432,7 @@ through an `Arch:` pull request, or a commit of your own on `main`.
 
 ```json
 {
-  "harnessVersion": "0.3.0",
+  "harnessVersion": "0.4.0",
   "project": { "name": "shop", "repo": "<org>/shop", "bot": "<org>-harness[bot]" },
   "roles": {
     "architect": { "model": "claude-opus-5-5", "effort": "max" },

package/dist/daemon/architects.js

@@ -56,7 +56,7 @@ export class Architects {
             throw new Error(`could not take the design: ${(result.stderr || result.stdout).trim()}`);
         const local = join(this.localDir(module.module), 'design.bundle');
         await o.driver.download(module.architect.sandbox, `${p.out}/design.bundle`, local);
-        return { head: await o.repo.fetchBundle(local, `refs/architect/${module.module}`) };
+        return { head: await o.fetchBundle(local, `refs/architect/${module.module}`) };
     }
     async syncModule(module) {
         const o = this.o;
@@ -93,7 +93,7 @@ export class Architects {
         const branch = `arch/${module.module}`;
         const reviewing = module.status === 'in_review' && (await o.repo.revParse(`refs/heads/${branch}`)) !== undefined;
         await o.repo.bundle(reviewing ? ['refs/heads/main', `refs/heads/${branch}`] : 'refs/heads/main', join(dir, 'main.bundle'));
-        await o.driver.upload(sandbox, join(dir, 'main.bundle'), p.harness);
+        await o.uploadBundle(sandbox, join(dir, 'main.bundle'), p.harness);
         const clone = await o.exec(sandbox, [
             `git clone --quiet --branch main ${sh(`${p.harness}/main.bundle`)} ${sh(p.work)}`,
             `cd ${sh(p.work)}`,
@@ -199,7 +199,7 @@ export class Architects {
         const p = o.paths(module.architect.sandbox);
         const local = join(this.localDir(module.module), 'arch.bundle');
         await o.repo.bundle(`refs/heads/arch/${module.module}`, local);
-        await o.driver.upload(module.architect.sandbox, local, p.harness);
+        await o.uploadBundle(module.architect.sandbox, local, p.harness);
         const result = await o.exec(module.architect.sandbox, [
             `cd ${sh(p.work)}`,
             `git fetch --quiet --force ${sh(`${p.harness}/arch.bundle`)} ${sh(`refs/heads/arch/${module.module}:refs/remotes/harness/arch`)}`,
@@ -252,7 +252,7 @@ export class Architects {
         await o.forge.fetchMain(o.repo);
         const local = join(this.localDir(module.module), 'main.bundle');
         await o.repo.bundle('refs/heads/main', local);
-        await o.driver.upload(module.architect.sandbox, local, p.harness);
+        await o.uploadBundle(module.architect.sandbox, local, p.harness);
         await o.exec(module.architect.sandbox, [
             `cd ${sh(p.work)}`,
             `git fetch --quiet --force ${sh(`${p.harness}/main.bundle`)} refs/heads/main:refs/heads/main`,

package/dist/daemon/items.js

@@ -116,6 +116,7 @@ function reviewItem(o, feature, attempt) {
                 `The Developer reports done: ${attempt.summary ?? '(no summary)'}`,
                 ...(attempt.notes ? ['', `Its notes: ${attempt.notes}`] : []),
                 ...questionsAsked(attempt),
+                ...refusedLines(attempt, false),
                 '',
                 'Every check passed in a fresh sandbox:',
                 ...checkLines(attempt.checks ?? []),
@@ -155,6 +156,7 @@ function failureItem(o, feature, attempt) {
                     ? ['', `Its finding (${finding.category}): ${finding.summary}`, ...(finding.tried?.length ? [`Tried: ${finding.tried.join('; ')}`] : []), ...(finding.needs ? [`Needs: ${finding.needs}`] : [])]
                     : []),
                 ...questionsAsked(attempt),
+                ...refusedLines(attempt, true),
                 ...(failing.length ? ['', 'Failing checks:', ...checkLines(failing, true)] : []),
                 '',
                 head
@@ -245,6 +247,26 @@ function questionsAsked(attempt) {
         return [];
     return ['', 'Its questions:', ...asked.map((q) => `- ${clip(q.text, 500)} → ${q.answer === undefined ? '(unanswered)' : clip(q.answer, 500)}`)];
 }
+/**
+ * The requests the attempt's sandbox policy refused. A host the feature needs and the
+ * policy doesn't allow explains many failures; the Manager resolves it, around the host
+ * or with the owner, who alone widens the policy.
+ */
+function refusedLines(attempt, failed) {
+    const refused = attempt.refused ?? [];
+    if (refused.length === 0)
+        return [];
+    const shown = refused.slice(0, 12);
+    return [
+        '',
+        "Its sandbox's network policy refused:",
+        ...shown.map((d) => `- ${d.target} ${d.program ? `from ${d.program}` : '(a DNS query)'}, ${d.count} time${d.count === 1 ? '' : 's'}: ${d.reason.replace(/_/g, ' ')}`),
+        ...(refused.length > shown.length ? [`- and ${refused.length - shown.length} more`] : []),
+        ...(failed
+            ? ["A sandbox reaches only the hosts of network.bundles and network.extraHosts in harness/config.json, and the next attempt meets the same policy. If the feature can do without a host, give the way around it in your guidance. If it can't, ask_owner to allow the host, with blocking: true when no attempt can succeed without it: only the owner widens the policy."]
+            : []),
+    ];
+}
 function checkLines(results, withOutput = false) {
     return results.flatMap((r) => {
         const verdict = r.exit === 0 ? 'passed' : r.timedOut ? 'timed out' : `exited ${r.exit}`;

package/dist/daemon/manager.js

@@ -132,7 +132,8 @@ export class Managers {
         await o.repo.bundle(`refs/heads/${branch}`, join(dir, 'clone.bundle'));
         copyFileSync(join(o.options.packageDir, 'roles', 'manager.md'), join(dir, 'manager.md'));
         writeFileSync(join(dir, 'settings.json'), managerSettings());
-        for (const file of ['clone.bundle', 'manager.md', 'settings.json'])
+        await o.uploadBundle(manager.sandbox, join(dir, 'clone.bundle'), p.harness);
+        for (const file of ['manager.md', 'settings.json'])
             await o.driver.upload(manager.sandbox, join(dir, file), p.harness);
         await o.uploadAgentFiles(manager.sandbox, 'manager', dir);
         const clone = await o.exec(manager.sandbox, `git clone --quiet --branch ${sh(branch)} ${sh(`${p.harness}/clone.bundle`)} ${sh(p.work)}`);
@@ -254,7 +255,7 @@ export class Managers {
         const local = join(this.localDir(manager), 'review.bundle');
         await o.repo.bundle([`refs/heads/${branch}`, ...(head && attemptRef ? [attemptRef] : [])], local);
         const p = this.paths(manager);
-        await o.driver.upload(manager.sandbox, local, p.harness);
+        await o.uploadBundle(manager.sandbox, local, p.harness);
         const result = await o.exec(manager.sandbox, [
             `cd ${sh(p.work)}`,
             `git fetch --quiet --force ${sh(`${p.harness}/review.bundle`)} '+refs/heads/*:refs/remotes/harness/*' '+refs/attempts/*:refs/remotes/harness/attempts/*'`,

package/dist/daemon/orchestrator.js

@@ -1,6 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { EventEmitter } from 'node:events';
-import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { claudeCode, mcpConfig, readResult, reportJsonSchema } from '../agents/claude-code.js';
 import { loadClaudeToken, readUsage } from '../anthropic/usage.js';
@@ -13,23 +13,28 @@ import { GitHubClient, loadAppCredentials } from '../github/app.js';
 import { GitHubForge, LocalForge } from '../github/forge.js';
 import { rulesProblems } from '../github/setup.js';
 import { toolsManifest } from '../roles.js';
+import { PROJECT_LABEL } from '../sandbox/driver.js';
 import { BUNDLES } from '../sandbox/allowlist.js';
 import { buildPolicy } from '../sandbox/policy.js';
+import { Denials, LOG_LINES } from '../sandbox/refusals.js';
 import { EventStore } from '../state/events.js';
 import { activeAttempts, apply, countedAttempts, featureKey, interruptions, isActive, managersOf, planKey, planMerged, project, writeSnapshot, } from '../state/state.js';
-import { clip, sh, sleep } from '../util.js';
+import { clip, machineSize, sh, sleep } from '../util.js';
 import { Architects } from './architects.js';
 import { AgentChannel } from './channel.js';
 import { architectRef } from './design.js';
 import { parseCostEstimate } from '../review/cost-estimate.js';
 import { activeReview, reviewStep, stepReview } from './review.js';
 import { Managers } from './manager.js';
+import { sweepLeftOvers } from './sandboxes.js';
 import { attemptRefName, preMerge, probeScript, refOf, sandboxName, waitForFile } from './refs.js';
 import { handleRequest } from './requests.js';
 import { buildTask } from './task.js';
 import { webRead } from './web-read.js';
 /** After this many errors in a row on the same attempt or plan (infrastructure, not the agent), the attempt is interrupted, or the pipeline pauses. */
 const STEP_ERROR_LIMIT = 5;
+/** How often the daemon deletes this project's left-over sandboxes, besides when it starts. */
+const SWEEP_EVERY_MS = 3_600_000;
 /**
  * Runs the loop in code (proposal v2 §7). Each pass looks at the state and takes the
  * next step for each attempt under way, or starts the next piece of work, then brings
@@ -48,6 +53,8 @@ export class Orchestrator {
     repo;
     options;
     driver;
+    /** The check sandboxes in use, with the ref each checks: the state doesn't name them. */
+    checking = new Map();
     agent;
     managers;
     architects;
@@ -66,6 +73,8 @@ export class Orchestrator {
     again = false;
     stopping = false;
     stepErrors = { key: '', count: 0 };
+    /** When the left-over sandboxes are next deleted: at the first pass, then every hour. */
+    nextSweep = 0;
     /** Errors in a row of each plan's step, and when it is tried again: one plan that keeps failing never stops the others. */
     planErrors = new Map();
     /** The heads of Arch and Fix PRs already given the reviewers' statuses as "not reviewed". */
@@ -74,6 +83,8 @@ export class Orchestrator {
     developers = new Map();
     /** The reviewers under way, by sandbox: plans in parallel can be reviewed at once. */
     reviewers = new Map();
+    /** What the policy refused the attempts under way, by sandbox, added up from their logs every minute. */
+    refusals = new Map();
     constructor(options) {
         this.options = options;
         this.driver = options.driver;
@@ -101,9 +112,33 @@ export class Orchestrator {
             throw new Error(`harness/config.json says the bot is ${config.project.bot}, but the App here is ${this.forge.bot}`);
         }
         await this.refreshDesign();
+        this.deleteOldBundles();
         this.record({ type: 'DAEMON_STARTED', payload: { version: this.options.version, pid: process.pid } });
         this.takePendingSetup();
     }
+    /**
+     * The git bundles earlier versions kept in `.harness/modules/`: a copy of the plan
+     * branch's history for each attempt and each review, though each was read once, by the
+     * sandbox. Nothing uses one before the first pass, so all of them go.
+     */
+    deleteOldBundles() {
+        const modules = join(this.options.harnessDir, 'modules');
+        if (!existsSync(modules))
+            return;
+        let count = 0;
+        let bytes = 0;
+        for (const file of readdirSync(modules, { recursive: true, encoding: 'utf8' }).filter((f) => f.endsWith('.bundle'))) {
+            const path = join(modules, file);
+            const stat = statSync(path, { throwIfNoEntry: false });
+            if (!stat?.isFile())
+                continue;
+            rmSync(path, { force: true });
+            bytes += stat.size;
+            count += 1;
+        }
+        if (count > 0)
+            this.log(`deleted ${count} git bundle${count === 1 ? '' : 's'} left in .harness/modules, ${(bytes / 1024 ** 2).toFixed(1)} MiB`);
+    }
     /**
      * What `harness setup`, `harness budget` or `harness mode` left for the daemon while it
      * was down (v4 §5), taken once: the owner's hours, which setup only offers, so they don't
@@ -204,6 +239,10 @@ export class Orchestrator {
                 await this.architects.sync();
             if (!this.stopping)
                 await this.verifyActions().catch((error) => this.log(`owner action: ${error.message}`));
+            if (!this.stopping && this.now() >= this.nextSweep) {
+                this.nextSweep = this.now() + SWEEP_EVERY_MS;
+                await sweepLeftOvers(this).catch((error) => this.log(`left-over sandboxes: ${error.message}`));
+            }
         } while (this.again && !this.stopping);
     }
     // ── Owner actions ────────────────────────────────────────────────────────────
@@ -261,6 +300,22 @@ export class Orchestrator {
         }
         return changed;
     }
+    /**
+     * The owner caps what each new sandbox may use of the machine, CPUs and memory; null
+     * lifts a cap. The sandboxes already there keep theirs. Returns why not, if not.
+     */
+    setSandboxLimits(limits) {
+        const { cpu, memoryGiB } = limits;
+        const machine = machineSize();
+        if (cpu !== null && !(Number.isFinite(cpu) && cpu >= 0.5 && cpu <= machine.cpus))
+            return `CPUs: from 0.5 to ${machine.cpus}, this machine's`;
+        if (memoryGiB !== null && !(Number.isFinite(memoryGiB) && memoryGiB >= 1 && memoryGiB <= machine.memoryGiB))
+            return `memory: from 1 to ${Math.floor(machine.memoryGiB)} GiB, this machine's`;
+        const current = this.state.sandboxLimits;
+        if ((current?.cpu ?? null) !== cpu || (current?.memoryGiB ?? null) !== memoryGiB)
+            this.record({ type: 'SANDBOX_LIMITS_SET', payload: { cpu, memoryGiB } });
+        return undefined;
+    }
     /** The owner grants one more attempt to an escalated feature (`module/plan/feature`). */
     retry(key, note) {
         const feature = this.state.features[key];
@@ -754,7 +809,8 @@ export class Orchestrator {
         }));
         copyFileSync(join(this.options.packageDir, 'roles', 'developer.md'), join(dir, 'developer.md'));
         writeFileSync(join(dir, 'report.schema.json'), reportJsonSchema());
-        for (const file of ['plan.bundle', 'task.md', 'developer.md', 'report.schema.json']) {
+        await this.uploadBundle(sandbox, join(dir, 'plan.bundle'), p.harness);
+        for (const file of ['task.md', 'developer.md', 'report.schema.json']) {
             await this.driver.upload(sandbox, join(dir, file), p.harness);
         }
         await this.uploadAgentFiles(sandbox, 'developer', dir);
@@ -805,8 +861,10 @@ export class Orchestrator {
                 this.record({ type: 'ATTEMPT_ENDED', ref, payload: { outcome: 'aborted', summary: attempt.abort.reason } });
                 return 'progress';
             }
-            if (this.now() < Date.parse(attempt.deadline))
+            if (this.now() < Date.parse(attempt.deadline)) {
+                await this.readRefusals(attempt.sandbox);
                 return 'wait';
+            }
             await this.killAgent(attempt.sandbox);
             this.record({ type: 'ATTEMPT_ENDED', ref, payload: { outcome: 'timed_out' } });
             return 'progress';
@@ -836,6 +894,7 @@ export class Orchestrator {
     /** Step 7: take the Developer's commits out as a bundle, whatever the outcome, and refuse changes to protected files. */
     async collect(state, attempt) {
         this.stopFollowing(attempt.sandbox);
+        await this.keepRefusals(state, attempt);
         const ref = refOf(state, attempt);
         if (attempt.outcome === 'usage_limit') {
             // Not the Developer's doing, but the sandbox writes the stream it is read from: like any
@@ -1330,31 +1389,38 @@ export class Orchestrator {
     /** Runs checks on a commit of the daemon's repository, in a fresh sandbox with no agent and no credentials. */
     async runChecksIn(name, gitRef, dir, checks) {
         const p = this.paths(name);
-        await this.driver.remove(name);
-        await this.driver.create({
-            name,
-            image: this.design.config.sandbox.image,
-            ...this.access({ claude: false, aws: checks.some((c) => c.needs.length > 0) }),
-            command: ['sleep', 'infinity'],
-        });
+        // In use from before its creation to after its removal, so the dashboard never offers to delete it.
+        this.checking.set(name, gitRef.replace(/^refs\/(heads\/)?/, ''));
         try {
-            await this.repo.bundle(gitRef, join(dir, 'candidate.bundle'));
-            await this.driver.upload(name, join(dir, 'candidate.bundle'), p.harness);
-            const fetch = await this.exec(name, [
-                `git init --quiet ${sh(p.work)}`,
-                `cd ${sh(p.work)}`,
-                `git fetch --quiet ${sh(`${p.harness}/candidate.bundle`)} ${sh(`${gitRef}:refs/heads/candidate`)}`,
-                'git checkout --quiet candidate',
-            ].join(' && '));
-            if (fetch.code !== 0)
-                throw new Error(`could not check out the candidate: ${fetch.stderr.trim()}`);
-            const init = await initEnvironment(this.driver, name, p.work);
-            if (init && init.exit !== 0)
-                return [init];
-            return await runChecks(this.driver, name, p.work, checks, this.checkOptions(name));
+            await this.driver.remove(name);
+            await this.driver.create({
+                name,
+                image: this.design.config.sandbox.image,
+                ...this.access({ claude: false, aws: checks.some((c) => c.needs.length > 0) }),
+                command: ['sleep', 'infinity'],
+            });
+            try {
+                await this.repo.bundle(gitRef, join(dir, 'candidate.bundle'));
+                await this.uploadBundle(name, join(dir, 'candidate.bundle'), p.harness);
+                const fetch = await this.exec(name, [
+                    `git init --quiet ${sh(p.work)}`,
+                    `cd ${sh(p.work)}`,
+                    `git fetch --quiet ${sh(`${p.harness}/candidate.bundle`)} ${sh(`${gitRef}:refs/heads/candidate`)}`,
+                    'git checkout --quiet candidate',
+                ].join(' && '));
+                if (fetch.code !== 0)
+                    throw new Error(`could not check out the candidate: ${fetch.stderr.trim()}`);
+                const init = await initEnvironment(this.driver, name, p.work);
+                if (init && init.exit !== 0)
+                    return [init];
+                return await runChecks(this.driver, name, p.work, checks, this.checkOptions(name));
+            }
+            finally {
+                await this.driver.remove(name);
+            }
         }
         finally {
-            await this.driver.remove(name);
+            this.checking.delete(name);
         }
     }
     // ── Outcomes and brakes (§7.4) ───────────────────────────────────────────────
@@ -1370,6 +1436,7 @@ export class Orchestrator {
     }
     /** Not the Developer's fault: doesn't count, except from the third interruption of the same feature. */
     async interrupt(state, attempt, reason) {
+        await this.keepRefusals(state, attempt);
         const counts = interruptions(state, attempt.definitionHash) >= 2;
         this.record({ type: 'ATTEMPT_INTERRUPTED', ref: refOf(state, attempt), payload: { reason, counts } });
         // Followers start again when their stream ends: one left on a removed sandbox would go on trying.
@@ -1379,6 +1446,7 @@ export class Orchestrator {
     }
     /** Claude Code exited before writing anything: a flag, the token or the image is wrong, and retrying can't help. */
     async agentDidNotStart(state, attempt, stderr) {
+        await this.keepRefusals(state, attempt);
         const reason = `Claude Code did not start: ${clip(stderr.trim().replace(/\s+/g, ' ') || 'it wrote nothing', 400)}`;
         this.record({ type: 'ATTEMPT_INTERRUPTED', ref: refOf(state, attempt), payload: { reason, counts: false } });
         this.pausePipeline(`environment: ${reason}`);
@@ -1387,6 +1455,8 @@ export class Orchestrator {
         return 'progress';
     }
     async baselineFailed(state, attempt, reason, results) {
+        // init.sh runs in the attempt's sandbox: a dependency it couldn't fetch shows here.
+        await this.keepRefusals(state, attempt);
         const ref = refOf(state, attempt);
         this.record({ type: 'BASELINE_FAILED', ref, payload: { reason, results } });
         this.record({ type: 'ATTEMPT_INTERRUPTED', ref, payload: { reason, counts: false } });
@@ -1395,6 +1465,38 @@ export class Orchestrator {
         await this.driver.remove(attempt.sandbox);
         return 'progress';
     }
+    /**
+     * Reads the sandbox's log for the requests its policy refused, at most once a minute
+     * unless `now`: OpenShell keeps only a sandbox's last lines, which a long attempt
+     * outgrows. Never throws; what was read before stays.
+     */
+    async readRefusals(sandbox, now = false) {
+        const known = this.refusals.get(sandbox) ?? { denials: new Denials(), readAt: 0 };
+        this.refusals.set(sandbox, known);
+        if (!now && this.now() - known.readAt < 60_000)
+            return known.denials;
+        known.readAt = this.now();
+        try {
+            known.denials.add(await this.driver.logs(sandbox, LOG_LINES));
+        }
+        catch (error) {
+            this.log(`the log of ${sandbox} could not be read: ${error.message}`);
+        }
+        return known.denials;
+    }
+    /**
+     * Before the attempt's sandbox goes, what its policy refused is recorded with the
+     * attempt: the Manager sees it with a failure, the owner on the attempt's card. Only
+     * while the sandbox is there, before its checks start; once per attempt.
+     */
+    async keepRefusals(state, attempt) {
+        if (attempt.refused || !['starting', 'running', 'collecting'].includes(attempt.status))
+            return;
+        const requests = (await this.readRefusals(attempt.sandbox, true)).list();
+        this.refusals.delete(attempt.sandbox);
+        if (requests.length > 0)
+            this.record({ type: 'NETWORK_REFUSED', ref: refOf(state, attempt), payload: { requests } });
+    }
     /** An error outside any attempt: logged, and the loop goes on. */
     async onStepError(error) {
         this.stepErrors = { key: 'idle', count: this.stepErrors.key === 'idle' ? this.stepErrors.count + 1 : 1 };
@@ -1547,6 +1649,28 @@ export class Orchestrator {
             mcpConfig: `${harness}/mcp.json`,
         };
     }
+    /**
+     * Uploads a git bundle the daemon wrote for a sandbox, then deletes it here: the
+     * sandbox clones or fetches from its own copy, and the daemon's repository has the
+     * history. Kept, they would grow without end, a copy per attempt and per review.
+     */
+    async uploadBundle(sandbox, file, remoteDir) {
+        try {
+            await this.driver.upload(sandbox, file, remoteDir);
+        }
+        finally {
+            rmSync(file, { force: true });
+        }
+    }
+    /** Fetches a bundle a sandbox made into `ref`, then deletes it: the ref holds its commits. */
+    async fetchBundle(file, ref) {
+        try {
+            return await this.repo.fetchBundle(file, ref);
+        }
+        finally {
+            rmSync(file, { force: true });
+        }
+    }
     /** The shim and the role's tools, so the agent can reach the daemon. */
     async uploadAgentFiles(sandbox, role, localDir) {
         const p = this.paths(sandbox);
@@ -1603,10 +1727,16 @@ export class Orchestrator {
      */
     access(options) {
         const aws = options.aws ? this.design.config.aws : undefined;
+        const limits = this.state.sandboxLimits;
         return {
             providers: [...(options.claude ? [this.design.config.sandbox.claudeProvider] : []), ...(aws ? [aws.provider] : [])],
             policyFile: this.policyFile({ allBundles: options.allBundles ?? false, aws: aws !== undefined }),
             env: this.sandboxEnv(),
+            // Every sandbox the daemon makes says whose it is: the dashboard tells them from other projects'.
+            labels: { [PROJECT_LABEL]: this.design.config.project.name },
+            // The owner's caps, so that agents and checks in parallel leave the machine usable.
+            ...(limits?.cpu !== undefined ? { cpu: `${Math.round(limits.cpu * 1000)}m` } : {}),
+            ...(limits?.memoryGiB !== undefined ? { memory: `${Math.round(limits.memoryGiB * 1024)}Mi` } : {}),
         };
     }
     /** What checks need to plan with Terraform in a sandbox. */
@@ -1660,7 +1790,7 @@ export class Orchestrator {
             throw new Error(`could not bundle the attempt's commits: ${(bundle.stderr || bundle.stdout).trim()}`);
         const local = join(this.attemptDir(ref), 'result.bundle');
         await this.driver.download(attempt.sandbox, `${p.out}/result.bundle`, local);
-        return this.repo.fetchBundle(local, attemptRefName(ref));
+        return this.fetchBundle(local, attemptRefName(ref));
     }
     async killAgent(sandbox) {
         const p = this.paths(sandbox);

package/dist/daemon/review.js

@@ -87,7 +87,7 @@ async function prepare(o, plan, review) {
         command: ['sleep', 'infinity'],
     });
     await o.repo.bundle(`refs/heads/${plan.branch}`, join(dir, 'plan.bundle'));
-    await o.driver.upload(sandbox, join(dir, 'plan.bundle'), p.harness);
+    await o.uploadBundle(sandbox, join(dir, 'plan.bundle'), p.harness);
     const clone = await o.exec(sandbox, [
         `git clone --quiet --branch ${sh(plan.branch)} ${sh(`${p.harness}/plan.bundle`)} ${sh(p.work)}`,
         `cd ${sh(p.work)}`,

package/dist/daemon/sandboxes.js

@@ -0,0 +1,115 @@
+import { PROJECT_LABEL } from '../sandbox/driver.js';
+import { LOG_LINES, parseDenials } from '../sandbox/refusals.js';
+import { machineSize } from '../util.js';
+const LIVE_ATTEMPT = ['starting', 'running', 'collecting', 'checking', 'reviewing'];
+const ROLES = { arc: 'Architect', mgr: 'Manager', dev: 'Developer', rev: 'Reviewer', chk: 'Checks' };
+/** Every sandbox the state names, and the check runs under way, with what each is for and whether it is still meant to be there. */
+export function knownSandboxes(state, checking) {
+    const known = new Map();
+    for (const module of Object.values(state.modules)) {
+        // An Architect stays for as long as its module: the owner designs with it, and it answers the Managers.
+        known.set(module.architect.sandbox, { role: 'Architect', title: module.module, agent: `architect:${module.module}`, live: true });
+    }
+    for (const manager of Object.values(state.managers)) {
+        const key = manager.plan ? `${manager.module}/${manager.plan}` : manager.module;
+        known.set(manager.sandbox, { role: 'Manager', title: key, agent: `manager:${key}`, live: manager.status !== 'stopped' });
+    }
+    for (const feature of Object.values(state.features)) {
+        for (const attempt of feature.attempts) {
+            const key = `${feature.module}/${feature.plan}/${feature.feature}`;
+            known.set(attempt.sandbox, { role: 'Developer', title: `${key} #${attempt.n}`, agent: `developer:${key}/a${attempt.n}`, live: LIVE_ATTEMPT.includes(attempt.status) });
+        }
+    }
+    for (const plan of Object.values(state.plans)) {
+        for (const review of plan.reviews ?? []) {
+            const head = review.head.slice(0, 8);
+            known.set(review.sandbox, {
+                role: 'Reviewer', title: `${plan.module}/${plan.plan} · ${review.role} · ${head}`, agent: `${review.role}:${head}`, live: review.status === 'starting' || review.status === 'running',
+            });
+        }
+    }
+    for (const [name, ref] of checking)
+        known.set(name, { role: 'Checks', title: `checks on ${ref}`, live: true });
+    return known;
+}
+/** The gateway's sandboxes, each told apart as this project's in use, left over, or another's. Throws when OpenShell can't list them. */
+export async function sandboxRows(o) {
+    const listed = await o.driver.list();
+    const known = knownSandboxes(o.state, o.checking);
+    const project = o.design.config.project.name;
+    const order = { 'in use': 0, 'left over': 1, other: 2 };
+    return listed
+        .map((sandbox) => row(sandbox, known.get(sandbox.name), project))
+        .sort((a, b) => order[a.use] - order[b.use] || (a.createdAt ?? '').localeCompare(b.createdAt ?? '', 'en') || a.name.localeCompare(b.name, 'en'));
+}
+export async function sandboxOverview(o) {
+    const gateway = await o.driver.gateway();
+    const settings = { limits: o.state.sandboxLimits ?? {}, machine: machineSize() };
+    try {
+        return { gateway, sandboxes: await sandboxRows(o), ...settings };
+    }
+    catch (error) {
+        return { gateway, sandboxes: [], problem: error.message, ...settings };
+    }
+}
+/** The requests a sandbox of this project was refused, from the last lines OpenShell keeps of its log; undefined for any other sandbox. */
+export async function sandboxDenials(o, name) {
+    const found = (await sandboxRows(o)).find((s) => s.name === name && s.use !== 'other');
+    return found ? parseDenials(await o.driver.logs(name, LOG_LINES)) : undefined;
+}
+/**
+ * One reading of what the sandboxes use at a time, shared for a few seconds: each open
+ * dashboard asks every few seconds, and `docker stats` takes two. Never rejects.
+ */
+export function sharedReading(read, ttlMs = 3000, now = Date.now) {
+    let last;
+    return () => {
+        if (last && now() - last.at < ttlMs)
+            return last.reading;
+        const reading = read().catch((error) => ({ at: new Date(now()).toISOString(), sandboxes: {}, total: { cpu: 0, memoryBytes: 0 }, problem: error.message }));
+        last = { at: now(), reading };
+        return reading;
+    };
+}
+/**
+ * Deletes this project's left-over sandboxes, those the Sandboxes view offers to delete:
+ * a crash or a failed delete leaves them, each holding its container's disk. The daemon
+ * runs it when it starts and every hour, so a delete that failed is tried again. It
+ * spares an Architect's, which holds the owner's conversation with it: only a lost
+ * `.harness/` leaves one, and the owner deletes it from the view. Every sandbox is in
+ * the state, or among the check runs, before it is created, so none being made is
+ * taken for a left-over one. Returns the names deleted.
+ */
+export async function sweepLeftOvers(o) {
+    const leftOver = (await sandboxRows(o)).filter((s) => s.use === 'left over' && s.role !== 'Architect');
+    for (const sandbox of leftOver) {
+        await o.driver.remove(sandbox.name);
+        o.log(`deleting the left-over sandbox ${sandbox.name}${sandbox.role ? `, ${sandbox.role}${sandbox.title ? ` · ${sandbox.title}` : ''}` : ''}`);
+    }
+    return leftOver.map((s) => s.name);
+}
+/** Deletes a left-over sandbox of this project, judged afresh: never one in use, nor another project's. */
+export async function removeLeftOver(o, name) {
+    const found = (await sandboxRows(o)).find((s) => s.name === name);
+    if (!found)
+        return { done: false, error: 'the gateway has no such sandbox' };
+    if (found.use === 'in use')
+        return { done: false, error: 'it is in use' };
+    if (found.use === 'other')
+        return { done: false, error: "it isn't this project's" };
+    await o.driver.remove(name);
+    o.log(`the owner deleted the left-over sandbox ${name}`);
+    return { done: true };
+}
+function row(sandbox, known, project) {
+    const base = { name: sandbox.name, phase: sandbox.phase, ...(sandbox.createdAt ? { createdAt: sandbox.createdAt } : {}) };
+    if (known)
+        return { ...base, role: known.role, title: known.title, ...(known.agent ? { agent: known.agent } : {}), use: known.live ? 'in use' : 'left over' };
+    const label = sandbox.labels[PROJECT_LABEL];
+    // This project's, but the state no longer names it: what a crash or a failed delete leaves.
+    if (label === project) {
+        const role = ROLES[sandbox.name.split('-')[0] ?? ''];
+        return { ...base, ...(role ? { role } : {}), use: 'left over' };
+    }
+    return { ...base, use: 'other', ...(label ? { project: label } : {}) };
+}