claudiomaradonna/agent-foundry
claudiomaradonna/agent-foundry
Template
1
0
Fork 0
Code Issues 5 Pull requests Activity

fix(diagnose): sandbox reproductions from outside text #154

Merged
claudiomaradonna merged 3 commits from fix/repro-sandbox into main 2026-10-20 18:13:20 +02:00
Conversation 0 Commits 3 Files changed 5 +38 -23
motoko commented 2026-10-20 18:10:15 +02:00
Collaborator
Copy link

Why

A reproduction built from someone else's issue should run only where it
cannot reach the user's files, credentials, or network, as review-pr
and check-issue already run outside code.

What changed

  • diagnose step 2 commits a reproduction built from text from
    outside, such as an issue someone else filed or a check-issue
    verdict, and runs it, there and in step 4, only through the main
    checkout's run-sandboxed.sh. A run the sandbox cannot do counts as
    not run and goes to route-back. A reproduction from the user's own
    report, or a failing test, runs as before.
  • diagnose step 3 offers a bisect only for a reproduction not built
    from text from outside.
  • check-issue step 3 also names the main checkout's copy of the
    script.
  • The diagnose page, the fix-bug page, and the README's bubblewrap
    line say where such a reproduction runs.

How to verify

  • sed -n '/^2\. /,/^3\. /p' .agents/skills/diagnose/SKILL.md | tr -s '[:space:]' ' ' | grep -c run-sandboxed
    prints 1, and 0 on main.
  • On the tip, bash tests/verify-agent-config.sh (266 passed),
    bash tests/check-work-folder.sh (46), .agents/hooks/shellcheck.sh repo, prettier --check '**/*.md', scripts/verify-agent-config.sh,
    and git diff --check main pass.
  • Not run: the behavioral evals, and a sandboxed reproduction end to
    end.
## Why A reproduction built from someone else's issue should run only where it cannot reach the user's files, credentials, or network, as `review-pr` and `check-issue` already run outside code. ## What changed - `diagnose` step 2 commits a reproduction built from text from outside, such as an issue someone else filed or a `check-issue` verdict, and runs it, there and in step 4, only through the main checkout's `run-sandboxed.sh`. A run the sandbox cannot do counts as not run and goes to `route-back`. A reproduction from the user's own report, or a failing test, runs as before. - `diagnose` step 3 offers a bisect only for a reproduction not built from text from outside. - `check-issue` step 3 also names the main checkout's copy of the script. - The `diagnose` page, the `fix-bug` page, and the README's bubblewrap line say where such a reproduction runs. ## How to verify - `sed -n '/^2\. /,/^3\. /p' .agents/skills/diagnose/SKILL.md | tr -s '[:space:]' ' ' | grep -c run-sandboxed` prints `1`, and `0` on `main`. - On the tip, `bash tests/verify-agent-config.sh` (266 passed), `bash tests/check-work-folder.sh` (46), `.agents/hooks/shellcheck.sh repo`, `prettier --check '**/*.md'`, `scripts/verify-agent-config.sh`, and `git diff --check main` pass. - Not run: the behavioral evals, and a sandboxed reproduction end to end. 
A reproduction built from text from outside, such as an issue someone
else filed or a check-issue verdict, is committed and run only through
run-sandboxed.sh, as check-issue step 3 does, and is not bisected.
The diagnose page says a reproduction built from text from outside runs
only in a bubblewrap sandbox, gets no bisect, and stops for the user
when the sandbox cannot run it; the fix-bug page links there, and the
README names diagnose among bubblewrap's users.
check-issue step 3 runs its reproduction through the main checkout's
run-sandboxed.sh, the copy diagnose step 2 now names too.
claudiomaradonna deleted branch fix/repro-sandbox 2026-10-20 18:13:24 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
claudiomaradonna/agent-foundry!154
No description provided.