skimpyclaw 0.3.14 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skimpyclaw",
-  "version": "0.3.14",
+  "version": "0.4.0",
   "description": "A lobster in a bikini",
   "type": "module",
   "main": "dist/index.js",
@@ -10,12 +10,31 @@
   },
   "files": [
     "dist",
-    "sandbox",
     "templates",
     "com.skimpyclaw.gateway.plist.example",
     "README.md",
     "LICENSE"
   ],
+  "scripts": {
+    "cli": "tsx src/cli.ts",
+    "start": "tsx src/index.ts",
+    "dev": "tsx watch src/index.ts",
+    "dashboard:dev": "pnpm --dir web/dashboard dev",
+    "dashboard:build": "pnpm --dir web/dashboard build",
+    "docs:dev": "pnpm --dir docs dev",
+    "docs:build": "pnpm --dir docs install --frozen-lockfile && pnpm --dir docs build",
+    "docs:preview": "pnpm --dir docs preview",
+    "setup": "tsx src/setup.ts",
+    "onboard": "tsx src/cli.ts onboard",
+    "clean": "rm -rf dist",
+    "build": "pnpm clean && tsc && pnpm dashboard:build",
+    "release:check": "pnpm build && pnpm test",
+    "release:local": "bash ./scripts/release.sh",
+    "lint": "eslint \"src/**/*.ts\"",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "ci": "pnpm run lint && pnpm run typecheck && pnpm run test"
+  },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.52.0",
     "@grammyjs/runner": "^2.0.3",
@@ -34,7 +53,17 @@
     "gray-matter": "^4.0.3",
     "mcporter": "^0.7.3",
     "openai": "^4.47.0",
-    "playwright": "^1.49.0"
+    "pdf-parse": "^2.4.5"
+  },
+  "pnpm": {
+    "overrides": {
+      "@eslint/config-array>minimatch": "3.1.2",
+      "@eslint/eslintrc>minimatch": "3.1.2",
+      "vite>rollup": "4.57.1"
+    },
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ]
   },
   "devDependencies": {
     "@eslint/js": "^9.39.2",
@@ -45,24 +74,5 @@
     "typescript": "^5.4.0",
     "typescript-eslint": "^8.54.0",
     "vitest": "^4.0.18"
-  },
-  "scripts": {
-    "cli": "tsx src/cli.ts",
-    "start": "tsx src/index.ts",
-    "dev": "tsx watch src/index.ts",
-    "dashboard:dev": "pnpm --dir web/dashboard dev",
-    "dashboard:build": "pnpm --dir web/dashboard install --frozen-lockfile && pnpm --dir web/dashboard build",
-    "docs:dev": "pnpm --dir docs dev",
-    "docs:build": "pnpm --dir docs install --frozen-lockfile && pnpm --dir docs build",
-    "docs:preview": "pnpm --dir docs preview",
-    "setup": "tsx src/setup.ts",
-    "onboard": "tsx src/cli.ts onboard",
-    "build": "tsc && pnpm dashboard:build",
-    "release:check": "pnpm build && pnpm test",
-    "release:local": "bash ./scripts/release.sh",
-    "lint": "eslint \"src/**/*.ts\"",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "ci": "pnpm run lint && pnpm run typecheck && pnpm run test"
   }
-}
+}

package/templates/TOOLS.md

@@ -175,33 +175,6 @@ Do not use for:
 
 ---
 
-## code_with_team
-
-Decompose a complex task into subtasks and run multiple `code_with_agent` instances in parallel.
-
-Parameters:
-
-- `task` (required, detailed and specific)
-- `team_size` (2-5, default 3)
-- `workdir` (optional)
-- `model` (optional)
-- `timeout_minutes` (optional, default 20, max 60)
-- `validate` (boolean, default true — runs once after all agents finish)
-
-Use when:
-
-- Multi-file refactors with independent parts
-- Cross-layer changes (frontend + backend + tests) that don't conflict
-- Tasks with clearly separable subtasks
-
-Do not use for:
-
-- Simple single-file changes (use code_with_agent)
-- Tightly coupled changes where agents would conflict on the same files
-- Non-coding tasks
-- Quick fixes or config edits
-
----
 
 ## Web Search
 

package/dist/__tests__/audit.test.js

@@ -1,122 +0,0 @@
-import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
-import { mkdirSync, rmSync, existsSync, readFileSync } from 'fs';
-import { join } from 'path';
-import { tmpdir } from 'os';
-const TEST_ROOT = join(tmpdir(), `skimpyclaw-audit-test-${Date.now()}`);
-const LOGS_DIR = join(TEST_ROOT, 'logs');
-// Mock config.ts to use test directories
-vi.mock('../config.js', () => ({
-    getLogsDir: () => LOGS_DIR,
-}));
-import { startTrace, addEvent, endTrace, getTraces, getTrace, getAuditDates } from '../audit.js';
-describe('audit', () => {
-    beforeAll(() => {
-        mkdirSync(LOGS_DIR, { recursive: true });
-    });
-    afterAll(() => {
-        rmSync(TEST_ROOT, { recursive: true, force: true });
-    });
-    describe('startTrace + endTrace', () => {
-        it('creates a trace and writes JSONL on endTrace', () => {
-            const traceId = startTrace('telegram', 'telegram:hello', 'main', 'claude-opus-4-6', '123');
-            expect(traceId).toBeTruthy();
-            expect(typeof traceId).toBe('string');
-            addEvent(traceId, 'message_in', 'hello world');
-            addEvent(traceId, 'model_call', 'anthropic/claude-opus-4-6', { durationMs: 1500 });
-            addEvent(traceId, 'message_out', 'hi there');
-            endTrace(traceId, 'success');
-            // Verify JSONL file was written
-            const date = new Date().toISOString().split('T')[0];
-            const filePath = join(LOGS_DIR, 'audit', `${date}.jsonl`);
-            expect(existsSync(filePath)).toBe(true);
-            const content = readFileSync(filePath, 'utf-8').trim();
-            const trace = JSON.parse(content.split('\n').pop());
-            expect(trace.traceId).toBe(traceId);
-            expect(trace.trigger).toBe('telegram');
-            expect(trace.triggerDetail).toBe('telegram:hello');
-            expect(trace.agentId).toBe('main');
-            expect(trace.model).toBe('claude-opus-4-6');
-            expect(trace.userId).toBe('123');
-            expect(trace.status).toBe('success');
-            expect(trace.finishedAt).toBeTruthy();
-            expect(trace.events).toHaveLength(3);
-            expect(trace.events[0].type).toBe('message_in');
-            expect(trace.events[1].type).toBe('model_call');
-            expect(trace.events[1].durationMs).toBe(1500);
-            expect(trace.events[2].type).toBe('message_out');
-        });
-        it('handles error traces', () => {
-            const traceId = startTrace('cron', 'cron:morning', 'main', 'claude-opus-4-6');
-            addEvent(traceId, 'model_call', 'failed', { status: 'error', error: 'API error' });
-            endTrace(traceId, 'error');
-            const trace = getTrace(traceId);
-            expect(trace).not.toBeNull();
-            expect(trace.status).toBe('error');
-            expect(trace.events[0].status).toBe('error');
-            expect(trace.events[0].error).toBe('API error');
-        });
-    });
-    describe('addEvent', () => {
-        it('silently ignores unknown traceIds', () => {
-            // Should not throw
-            addEvent('nonexistent', 'message_in', 'test');
-        });
-        it('adds events with detail and durationMs', () => {
-            const traceId = startTrace('api', 'model_switch', 'main', 'claude-opus-4-6');
-            addEvent(traceId, 'tool_call', 'Glob ~/vault/**/*.md', {
-                durationMs: 45,
-                detail: { tool: 'Glob', input: { pattern: '**/*.md' } },
-            });
-            endTrace(traceId, 'success');
-            const trace = getTrace(traceId);
-            expect(trace.events[0].durationMs).toBe(45);
-            expect(trace.events[0].detail).toEqual({ tool: 'Glob', input: { pattern: '**/*.md' } });
-        });
-    });
-    describe('getTraces', () => {
-        it('returns traces for today newest-first', () => {
-            const result = getTraces();
-            expect(result.traces.length).toBeGreaterThan(0);
-            expect(result.total).toBeGreaterThan(0);
-            // Verify newest first
-            if (result.traces.length >= 2) {
-                const first = new Date(result.traces[0].startedAt).getTime();
-                const second = new Date(result.traces[1].startedAt).getTime();
-                expect(first).toBeGreaterThanOrEqual(second);
-            }
-        });
-        it('returns empty for nonexistent date', () => {
-            const result = getTraces('1999-01-01');
-            expect(result.traces).toEqual([]);
-            expect(result.total).toBe(0);
-        });
-        it('supports pagination', () => {
-            const all = getTraces(undefined, 100, 0);
-            const page = getTraces(undefined, 1, 0);
-            expect(page.traces).toHaveLength(1);
-            expect(page.total).toBe(all.total);
-        });
-    });
-    describe('getTrace', () => {
-        it('finds a trace by ID from file', () => {
-            const traceId = startTrace('heartbeat', 'heartbeat', 'main', 'claude-opus-4-6');
-            addEvent(traceId, 'message_out', 'HEARTBEAT_OK');
-            endTrace(traceId, 'success');
-            const found = getTrace(traceId);
-            expect(found).not.toBeNull();
-            expect(found.traceId).toBe(traceId);
-            expect(found.trigger).toBe('heartbeat');
-        });
-        it('returns null for nonexistent traceId', () => {
-            expect(getTrace('does-not-exist')).toBeNull();
-        });
-    });
-    describe('getAuditDates', () => {
-        it('returns dates with today included', () => {
-            const dates = getAuditDates();
-            expect(dates.length).toBeGreaterThan(0);
-            const today = new Date().toISOString().split('T')[0];
-            expect(dates).toContain(today);
-        });
-    });
-});

package/dist/__tests__/code-agents-orchestrator.test.js

@@ -1,216 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-// Mock heavy deps
-vi.mock('../agent.js', () => ({
-    runAgentTurn: vi.fn(async () => '{"subtasks": [{"description": "task1", "dependsOn": []}, {"description": "task2", "dependsOn": [0]}]}'),
-}));
-vi.mock('../code-agents/registry.js', () => {
-    const tasks = new Map();
-    let counter = 0;
-    return {
-        getCodeAgentsDir: () => '/tmp/test-code-agents',
-        ensureCodeAgentsDir: vi.fn(),
-        writeCodeAgentTask: vi.fn((task) => tasks.set(task.id, { ...task })),
-        storeCodeAgentTask: vi.fn((task) => tasks.set(task.id, { ...task })),
-        getCodeAgent: vi.fn((id) => tasks.get(id) || null),
-        getNextCodeAgentId: vi.fn(() => `ca-${++counter}`),
-        setCodeAgentCanceller: vi.fn(),
-        deleteCodeAgentCanceller: vi.fn(),
-        _tasks: tasks,
-        _resetCounter: () => { counter = 0; },
-    };
-});
-vi.mock('../code-agents/executor.js', () => ({
-    runCodeAgentBackground: vi.fn(async () => { }),
-    runValidation: vi.fn(async () => ({ passed: true, output: 'PASS' })),
-}));
-vi.mock('../code-agents/utils.js', () => ({
-    buildCodeAgentArgs: vi.fn(() => ({ cmd: 'echo', args: ['hello'] })),
-    notifyCodeAgentResult: vi.fn(async () => { }),
-    resolveModelAlias: vi.fn((m) => m),
-}));
-vi.mock('../audit.js', () => ({
-    startTrace: vi.fn(() => 'trace-1'),
-    addEvent: vi.fn(),
-    endTrace: vi.fn(async () => { }),
-}));
-import { computeWaves, decomposeTask, synthesizeResults, gatherCodebaseContext } from '../code-agents/orchestrator.js';
-import { runAgentTurn } from '../agent.js';
-import { getCodeAgent, writeCodeAgentTask } from '../code-agents/registry.js';
-const mockRunAgentTurn = vi.mocked(runAgentTurn);
-const mockGetCodeAgent = vi.mocked(getCodeAgent);
-const mockWriteCodeAgentTask = vi.mocked(writeCodeAgentTask);
-describe('computeWaves', () => {
-    it('puts independent tasks in one wave', () => {
-        const waves = computeWaves([
-            { description: 'a', dependsOn: [] },
-            { description: 'b', dependsOn: [] },
-            { description: 'c', dependsOn: [] },
-        ]);
-        expect(waves).toEqual([[0, 1, 2]]);
-    });
-    it('creates sequential waves for dependencies', () => {
-        const waves = computeWaves([
-            { description: 'a', dependsOn: [] },
-            { description: 'b', dependsOn: [0] },
-            { description: 'c', dependsOn: [1] },
-        ]);
-        expect(waves).toEqual([[0], [1], [2]]);
-    });
-    it('handles cycle detection without infinite loop', () => {
-        // Tasks that depend on each other (cycle)
-        const waves = computeWaves([
-            { description: 'a', dependsOn: [1] },
-            { description: 'b', dependsOn: [0] },
-        ]);
-        // Should force them into one wave rather than looping forever
-        expect(waves.length).toBeGreaterThan(0);
-        const allIndices = waves.flat();
-        expect(allIndices).toContain(0);
-        expect(allIndices).toContain(1);
-    });
-    it('handles mixed dependencies', () => {
-        const waves = computeWaves([
-            { description: 'a', dependsOn: [] },
-            { description: 'b', dependsOn: [] },
-            { description: 'c', dependsOn: [0, 1] },
-        ]);
-        expect(waves).toEqual([[0, 1], [2]]);
-    });
-});
-describe('decomposeTask', () => {
-    it('pads with "Additional part of:" when model returns fewer subtasks', async () => {
-        mockRunAgentTurn.mockResolvedValueOnce('{"subtasks": [{"description": "only one task", "dependsOn": []}]}');
-        const config = { providers: {} };
-        const result = await decomposeTask('Build a full app with tests', 3, config);
-        expect(result).toHaveLength(3);
-        expect(result[0].description).toBe('only one task');
-        // Padded entries should use "Additional part of:" not duplicate the last description
-        expect(result[1].description).toMatch(/^Additional part of:/);
-        expect(result[2].description).toMatch(/^Additional part of:/);
-    });
-    it('falls back to numbered splitting on parse error', async () => {
-        mockRunAgentTurn.mockResolvedValueOnce('not valid json at all');
-        const config = { providers: {} };
-        const result = await decomposeTask('my task', 2, config);
-        expect(result).toHaveLength(2);
-        expect(result[0].description).toContain('Part 1 of 2');
-        expect(result[1].description).toContain('Part 2 of 2');
-    });
-});
-describe('synthesizeResults', () => {
-    it('uses structured context (summary capped at 500 chars, not raw 1000)', async () => {
-        const longOutput = 'x'.repeat(1000);
-        mockRunAgentTurn.mockResolvedValueOnce('Synthesis complete');
-        const config = { providers: {} };
-        await synthesizeResults('original task', [
-            { subtask: 'sub1', status: 'completed', output: longOutput },
-        ], config);
-        const call = mockRunAgentTurn.mock.calls[mockRunAgentTurn.mock.calls.length - 1];
-        const prompt = call[1];
-        // Summary should be capped at 500 chars, not the full 1000
-        expect(prompt).toContain('x'.repeat(500));
-        expect(prompt).not.toContain('x'.repeat(501));
-        // Should use the structured format (Summary: prefix)
-        expect(prompt).toContain('Summary:');
-    });
-});
-describe('orchestrator - cancellation after wave spawn', () => {
-    it('cancels just-spawned children when parent is cancelled', async () => {
-        // This is tested structurally by reading the source
-        const { readFileSync } = await vi.importActual('fs');
-        const src = readFileSync(new URL('../../src/code-agents/orchestrator.ts', import.meta.url).pathname.replace('/.worktrees/hardening-code-agents/src/__tests__/../../', '/.worktrees/hardening-code-agents/'), 'utf-8');
-        // Verify the cancellation check exists after wave spawn
-        expect(src).toContain("// Check cancellation after spawning");
-        expect(src).toContain("if (getCodeAgent(parentId)?.status === 'cancelled')");
-        // Verify it sets children to cancelled
-        expect(src).toContain("status: 'cancelled'");
-        expect(src).toContain("error: CANCELLED_MESSAGE");
-    });
-});
-describe('orchestrator - spawn failure marks child as failed', () => {
-    it('catch handler updates child task status on spawn error', async () => {
-        const { readFileSync } = await vi.importActual('fs');
-        const src = readFileSync(new URL('../../src/code-agents/orchestrator.ts', import.meta.url).pathname.replace('/.worktrees/hardening-code-agents/src/__tests__/../../', '/.worktrees/hardening-code-agents/'), 'utf-8');
-        // Verify the catch handler updates child status
-        expect(src).toContain("const child = getCodeAgent(childId);");
-        expect(src).toContain("if (child && child.status === 'running')");
-        expect(src).toContain("status: 'failed'");
-        expect(src).toContain("error: toErrorMessage(err)");
-    });
-});
-describe('orchestrator - skip redundant parent writes', () => {
-    it('only writes parent status when liveOutput changes', async () => {
-        const { readFileSync } = await vi.importActual('fs');
-        const src = readFileSync(new URL('../../src/code-agents/orchestrator.ts', import.meta.url).pathname.replace('/.worktrees/hardening-code-agents/src/__tests__/../../', '/.worktrees/hardening-code-agents/'), 'utf-8');
-        // Verify the dedup pattern
-        expect(src).toContain("let lastLiveOutput = ''");
-        expect(src).toContain('if (newLiveOutput !== lastLiveOutput)');
-        expect(src).toContain('lastLiveOutput = newLiveOutput');
-    });
-});
-describe('gatherCodebaseContext', () => {
-    it('returns a non-empty string for the project root', () => {
-        // Use this project's own root as the workdir
-        const { resolve } = require('path');
-        const projectRoot = resolve(__dirname, '..', '..');
-        const context = gatherCodebaseContext(projectRoot);
-        // Should contain at least scripts or source files
-        expect(context.length).toBeGreaterThan(0);
-        expect(context.length).toBeLessThanOrEqual(2000);
-    });
-    it('returns empty string for nonexistent directory', () => {
-        const context = gatherCodebaseContext('/tmp/nonexistent-dir-12345');
-        // Should not throw, just return empty or minimal context
-        expect(typeof context).toBe('string');
-    });
-});
-describe('decomposeTask with workdir', () => {
-    it('passes workdir context to the decomposition prompt', async () => {
-        mockRunAgentTurn.mockResolvedValueOnce('{"subtasks": [{"description": "sub1", "dependsOn": []}, {"description": "sub2", "dependsOn": []}]}');
-        const config = { providers: {} };
-        const result = await decomposeTask('test task', 2, config, '/tmp');
-        expect(result).toHaveLength(2);
-        // Check the prompt sent to the model includes the richer decomposition instructions
-        const call = mockRunAgentTurn.mock.calls[mockRunAgentTurn.mock.calls.length - 1];
-        const prompt = call[1];
-        expect(prompt).toContain('task decomposition expert');
-        expect(prompt).toContain('git worktree');
-    });
-});
-describe('synthesizeResults with workdir', () => {
-    it('includes git diff info when workdir is a git repo', async () => {
-        mockRunAgentTurn.mockResolvedValueOnce('Synthesis complete');
-        const { resolve } = require('path');
-        const projectRoot = resolve(__dirname, '..', '..');
-        const config = { providers: {} };
-        await synthesizeResults('original task', [
-            { subtask: 'sub1', status: 'completed', output: 'done' },
-        ], config, projectRoot);
-        const call = mockRunAgentTurn.mock.calls[mockRunAgentTurn.mock.calls.length - 1];
-        const prompt = call[1];
-        // Should include the success/failure counts
-        expect(prompt).toContain('1 succeeded, 0 failed');
-    });
-});
-describe('orchestrator - per-wave validation and retry', () => {
-    it('source includes per-wave validation logic', async () => {
-        const { readFileSync } = await vi.importActual('fs');
-        const src = readFileSync(new URL('../../src/code-agents/orchestrator.ts', import.meta.url).pathname.replace('/.worktrees/hardening-code-agents/src/__tests__/../../', '/.worktrees/hardening-code-agents/'), 'utf-8');
-        // Verify per-wave validation exists
-        expect(src).toContain('Per-wave validation: run build after each wave');
-        expect(src).toContain('wave_validation');
-        // Verify retry logic
-        expect(src).toContain('wave_retry_complete');
-        expect(src).toContain('retryPrompt');
-    });
-});
-describe('orchestrator - timeout budgeting', () => {
-    it('computes perChildTimeout based on wave count not team size', async () => {
-        const { readFileSync } = await vi.importActual('fs');
-        const src = readFileSync(new URL('../../src/code-agents/orchestrator.ts', import.meta.url).pathname.replace('/.worktrees/hardening-code-agents/src/__tests__/../../', '/.worktrees/hardening-code-agents/'), 'utf-8');
-        // Verify budget-aware timeout
-        expect(src).toContain('overheadMinutes');
-        expect(src).toContain('availableForChildren');
-        expect(src).toContain('Math.floor(availableForChildren / waves.length)');
-    });
-});

package/dist/__tests__/code-agents-sandbox.test.js

@@ -1,163 +0,0 @@
-import { describe, expect, it, vi, beforeEach } from 'vitest';
-// Mock heavy dependencies before importing
-vi.mock('../code-agents/registry.js', () => {
-    const tasks = new Map();
-    return {
-        getCodeAgentsDir: () => '/tmp/test-code-agents',
-        ensureCodeAgentsDir: vi.fn(),
-        writeCodeAgentTask: vi.fn((task) => tasks.set(task.id, { ...task })),
-        storeCodeAgentTask: vi.fn((task) => tasks.set(task.id, { ...task })),
-        getCodeAgent: vi.fn((id) => tasks.get(id) || null),
-        setCodeAgentCanceller: vi.fn(),
-        deleteCodeAgentCanceller: vi.fn(),
-        getNextCodeAgentId: vi.fn(() => 'ca-test-1'),
-        getActiveCodeAgents: vi.fn(() => []),
-        getRecentCodeAgents: vi.fn(() => []),
-        _tasks: tasks,
-    };
-});
-vi.mock('../code-agents/parser.js', () => ({
-    parseStreamJsonForLive: vi.fn((s) => s.slice(0, 200)),
-    parseClaudeOutput: vi.fn((s) => ({ text: s, totalCost: 0, inputTokens: 0, outputTokens: 0 })),
-    parseCodexOutput: vi.fn((s) => s),
-}));
-vi.mock('../code-agents/utils.js', () => ({
-    buildCodeAgentArgs: vi.fn(() => ({ cmd: 'echo', args: ['hello'] })),
-    notifyCodeAgentResult: vi.fn(async () => { }),
-    resolveModelAlias: vi.fn((m) => m || 'claude'),
-    resolveSelectedCodeAgent: vi.fn((_req, def) => def || 'claude'),
-    resolveWorkdir: vi.fn((_raw, _proj, root) => root),
-}));
-vi.mock('../audit.js', () => ({
-    startTrace: vi.fn(() => 'trace-1'),
-    addEvent: vi.fn(),
-    endTrace: vi.fn(async () => { }),
-}));
-vi.mock('../usage.js', () => ({
-    buildUsageRecord: vi.fn(() => ({})),
-    recordUsage: vi.fn(),
-}));
-vi.mock('fs', async () => {
-    const actual = await vi.importActual('fs');
-    return {
-        ...actual,
-        createWriteStream: vi.fn(() => ({
-            write: vi.fn(),
-            end: vi.fn(),
-        })),
-        existsSync: vi.fn(() => false),
-    };
-});
-vi.mock('../sandbox/index.js', () => ({
-    ensureContainer: vi.fn(async () => 'sandbox-code-test'),
-    SANDBOX_DEFAULTS: { image: 'skimpyclaw-sandbox:latest', runtime: 'docker' },
-    getRuntime: vi.fn(() => 'docker'),
-    execInContainer: vi.fn(async () => ({ exitCode: 0, stdout: 'PASS', stderr: '' })),
-}));
-describe('buildContainerEnvArgs', () => {
-    it('returns -e flags for allowlisted env vars that exist', async () => {
-        const { buildContainerEnvArgs } = await import('../code-agents/executor.js');
-        const env = {
-            ANTHROPIC_API_KEY: 'sk-test-123',
-            GH_TOKEN: 'ghp_abc',
-            HOME: '/home/sandbox',
-            SOME_OTHER_VAR: 'should-not-appear',
-            PATH: '/usr/bin:/usr/local/bin',
-        };
-        const result = buildContainerEnvArgs(env);
-        expect(result).toContain('-e');
-        expect(result).toContain('ANTHROPIC_API_KEY=sk-test-123');
-        expect(result).toContain('GH_TOKEN=ghp_abc');
-        expect(result).toContain('HOME=/home/sandbox');
-        expect(result).toContain('PATH=/usr/bin:/usr/local/bin');
-        // Non-allowlisted vars should not appear
-        expect(result.join(' ')).not.toContain('SOME_OTHER_VAR');
-    });
-    it('excludes empty and undefined values', async () => {
-        const { buildContainerEnvArgs } = await import('../code-agents/executor.js');
-        const env = {
-            ANTHROPIC_API_KEY: '',
-            GH_TOKEN: undefined,
-            GITHUB_TOKEN: 'ghp_123',
-        };
-        const result = buildContainerEnvArgs(env);
-        expect(result).toContain('GITHUB_TOKEN=ghp_123');
-        // No git signing key passed, so no GIT_CONFIG overrides
-        expect(result.join(' ')).not.toContain('GIT_CONFIG');
-    });
-    it('includes git signing config overrides when gitSigningKey is provided', async () => {
-        const { buildContainerEnvArgs } = await import('../code-agents/executor.js');
-        const result = buildContainerEnvArgs({ ANTHROPIC_API_KEY: 'sk-test' }, { gitSigningKey: '/home/sandbox/.ssh/git_signing_ed25519' });
-        expect(result).toContain('GIT_CONFIG_COUNT=1');
-        expect(result).toContain('GIT_CONFIG_KEY_0=user.signingkey');
-        expect(result).toContain('GIT_CONFIG_VALUE_0=/home/sandbox/.ssh/git_signing_ed25519');
-    });
-    it('omits git signing config when gitSigningKey is not provided', async () => {
-        const { buildContainerEnvArgs } = await import('../code-agents/executor.js');
-        const result = buildContainerEnvArgs({ FOO: 'bar', BAZ: 'qux' });
-        expect(result).not.toContain('FOO=bar');
-        expect(result.join(' ')).not.toContain('GIT_CONFIG');
-        expect(result).toEqual([]);
-    });
-});
-describe('runValidation with sandbox', () => {
-    beforeEach(() => {
-        vi.clearAllMocks();
-    });
-    it('uses execInContainer when sandboxContainer is provided', async () => {
-        const { execInContainer } = await import('../sandbox/index.js');
-        const { runValidation } = await import('../code-agents/executor.js');
-        const result = await runValidation('/workspace', 'sandbox-test');
-        expect(execInContainer).toHaveBeenCalledWith('sandbox-test', expect.any(Array), expect.objectContaining({ timeout: expect.any(Number) }));
-        expect(result.passed).toBe(true);
-        expect(result.output).toBe('PASS');
-    });
-    it('returns failure when execInContainer returns non-zero exit', async () => {
-        const { execInContainer } = await import('../sandbox/index.js');
-        vi.mocked(execInContainer).mockResolvedValueOnce({
-            exitCode: 1,
-            stdout: 'Error: test failed',
-            stderr: 'FAIL',
-        });
-        const { runValidation } = await import('../code-agents/executor.js');
-        const result = await runValidation('/workspace', 'sandbox-fail');
-        expect(result.passed).toBe(false);
-        expect(result.output).toContain('VALIDATION FAILED');
-    });
-    it('returns failure when execInContainer throws', async () => {
-        const { execInContainer } = await import('../sandbox/index.js');
-        vi.mocked(execInContainer).mockRejectedValueOnce(new Error('container not found'));
-        const { runValidation } = await import('../code-agents/executor.js');
-        const result = await runValidation('/workspace', 'sandbox-crash');
-        expect(result.passed).toBe(false);
-        expect(result.output).toContain('sandbox exec error');
-        expect(result.output).toContain('container not found');
-    });
-});
-describe('sandbox config resolution in executeCodeWithAgent', () => {
-    it('resolves sandboxConfig from context.sandboxConfig', async () => {
-        // Test the resolution logic directly — the config should be picked up
-        // from context.sandboxConfig or context.fullConfig.sandbox
-        const contextWithSandbox = {
-            sandboxConfig: { enabled: true, image: 'test-image' },
-            fullConfig: { sandbox: { enabled: false } },
-        };
-        // sandboxConfig takes precedence over fullConfig.sandbox
-        const resolved = contextWithSandbox.sandboxConfig ?? contextWithSandbox.fullConfig?.sandbox;
-        expect(resolved).toEqual({ enabled: true, image: 'test-image' });
-    });
-    it('falls back to fullConfig.sandbox when context.sandboxConfig is absent', () => {
-        const contextFallback = {
-            fullConfig: { sandbox: { enabled: true, image: 'fallback-image' } },
-        };
-        const resolved = contextFallback.sandboxConfig ?? contextFallback.fullConfig?.sandbox;
-        expect(resolved).toEqual({ enabled: true, image: 'fallback-image' });
-    });
-    it('resolves to undefined when no sandbox config present', () => {
-        const contextNone = {
-            fullConfig: {},
-        };
-        const resolved = contextNone.sandboxConfig ?? contextNone.fullConfig?.sandbox;
-        expect(resolved).toBeUndefined();
-    });
-});