feat(sandbox): persistent agent sessions for Claude Code

[larryro]

What

Transforms the sandbox from one-shot code execution into a persistent
"remote computer" that can run coding agents (Claude Code, OpenCode) — the
base service for "give an agent a task in a sandbox" (e.g. GitHub issue →
Claude Code → PR). Entry-point UI (chat tool / workflow node) is intentionally
out of scope per the agreed plan; the service API is entry-agnostic so any
entry reuses it.

How it fits together

• /v1/sessions API on the spawner (create/get/list/destroy + exec(SSE)/
  cancel/attach + env/files), proxied to runnerd — a small control daemon
  that is PID 1 of a long-lived session container (single-file runnerd.mjs,
  run by the image's Node 24). No kubectl exec anywhere; the K8s backend
  stays exec-free (Pod-IP HTTP). The registry is a cache; backend
  labels/annotations + runnerd's activity clock are the source of truth (boot
  re-adopt + TTL/idle sweep).
• Single runtime image extended (one-image decision): pinned Claude Code,
  OpenCode, gh, Playwright + Chromium + @playwright/mcp, git/rg/fd, plus an
  agent user (uid 10001, non-root so bypassPermissions is allowed) selected
  per profile. The one-shot path keeps uid 65534 and is byte-identical
  (docker-args snapshot unchanged).
• @tale/agent-adapters — entry-agnostic package: buildExec(spec) →
  session exec (argv/env/stdin), plus a parser turning each agent's native
  stdout (Claude stream-json, OpenCode JSONL) into one normalized AgentEvent
  union (usage deduped by message id).
• LLM gateway = Bifrost (OSS, Apache-2.0; pinned compose service): the only
  path from an in-sandbox agent to an LLM. Platform mints a session-scoped
  virtual key (budget + model allowlist), revoked on destroy. Raw provider keys
  never enter the sandbox.
• Platform Convex glue: sandboxSessions (polymorphic owner driving
  lifecycle/access/quota) + token/progress/credential-audit tables; reserve +
  watchdog mutations; session_client (HMAC platform→spawner), bifrost_admin
  (governance API), session_credentials (Tier-2 integration-credential broker
  → session env, audited), and run_agent (progress bridge: exec → adapter
  parser → throttled sandboxSessionOps so any entry renders live progress).
  usageLedger stays the single billing truth.

Tiered secret model is documented in services/sandbox/docs/sessions.md:
Tier-0 (platform secrets) never enter the sandbox; Tier-1 (LLM keys) proxied;
Tier-2 (integration creds) enter only via explicit per-session grant + broker +
audit + revoke-on-destroy.

Tests

• Unit/integration (all green): spawner 225, runnerd daemon 20, agent_adapters
  12 — runnerd exec/timeout/cancel/attach + file ops, docker-session-args &
  k8s-session-pod-spec snapshots, the session route layer against a fake
  runnerd, adapter golden fixtures + buildExec snapshots.
• Platform tsc 0 errors; convex codegen bundles clean (new node-runtime
  modules carry 'use node').

Needs live infra (follow-up, can't run in this env): docker-build image
conformance (tests/container-sandbox-runtime-test.sh, syntax-checked), kind
e2e for the K8s session lifecycle, and a secret-gated agent smoke (real
Bifrost + provider key).

Pre-PR checklist

• Ran bun run check. All workspaces this PR touches (sandbox, platform,
  agent_adapters, runnerd daemon) pass. The only failures are a known
  turbo-load mock.module flake in @tale/cli (pull-image.test.ts — passes
  6/6 in isolation, confirmed) and @tale/rag interrupted by a local timeout;
  neither workspace is touched by this PR.
• No hand-rolled skeletons / magic h-[…] — N/A (no UI in this PR).
• Updated services/platform/messages/{en,de,fr}.json — N/A (no UI message
  keys added).
• Updated /docs/{en,de,fr}/ — follow-up. This PR adds operator env
  vars + a compose service but no end-user-reachable surface (entry points
  deferred); operator docs for the Bifrost service + SANDBOX_*/BIFROST_*
  env land with the entry-point PR.
• Docs opening/closing prose — N/A (no docs pages touched).
• Ran docs lint/test — N/A.
• Updated READMEs — N/A (no user-facing feature surface yet).

Summary by CodeRabbit

Release Notes

• New Features

  • Added persistent sandbox sessions with long-lived environments and workspace state management.
  • Introduced agent adapter support for Claude Code and OpenCode workflows.
  • Implemented session credential provisioning and virtual key management.

• Infrastructure Updates

  • Integrated Bifrost LLM Gateway service for agent traffic routing.
  • Extended sandbox runtime with daemon mode for session lifecycle management.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR adds a new @tale/agent-adapters package with Claude Code and OpenCode adapters/parsers plus normalized event types and tests. It also introduces persistent sandbox-session support across the sandbox runtime, including a runnerd daemon, session routing and backends for Docker and Kubernetes, session-specific request validation and client helpers, and Convex tables/mutations for session state and credential access. Compose, Dockerfile, entrypoint, and related docs/tests are updated to wire in Bifrost, agent tooling, and the new runtime mode.

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/sandbox-agent-sessions

[coderabbitai]

Actionable comments posted: 24

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@compose.yml`:
- Around line 691-692: The compose entry uses an external image declaration
image: maximhq/bifrost:${BIFROST_VERSION:-1.4.8} but sets pull_policy:
${PULL_POLICY:-build}, which is invalid for external images; update the
pull_policy default to a valid external-image policy (e.g., change
${PULL_POLICY:-build} to ${PULL_POLICY:-if-not-present} or
${PULL_POLICY:-always}) and ensure the pull_policy key in the bifrost service no
longer defaults to "build" or relies on PULL_POLICY being "build".

In `@packages/agent_adapters/src/build-exec.test.ts`:
- Around line 11-16: The test fixture constant `base` is implicitly typed;
change its declaration to validate against `AgentRunSpec` using the TypeScript
`satisfies` operator (i.e., declare the object and append `satisfies
AgentRunSpec`) so the object is checked for conformance while preserving
inference — update the `base` definition in build-exec.test.ts accordingly and
remove any explicit casts or annotations if present.

In `@packages/agent_adapters/src/claude_code/parse.ts`:
- Around line 117-125: Extract the model string once into a local variable
before constructing the events entry (e.g., const modelStr =
str(message?.model)) and use modelStr in both the conditional spread and the
value ({ ...(modelStr ? { model: modelStr } : {}) }) instead of calling
str(message?.model) twice; apply this change in the block that builds the events
object (where events.push is called and num(...) uses usage fields) to preserve
behavior and avoid duplicate calls.

In `@packages/agent_adapters/src/opencode/parse.ts`:
- Around line 67-85: The handler for type === 'tool_use' currently normalizes
events even when toolUseId is empty (toolUseId = str(part?.id) ??
str(part?.callID) ?? ''), which can corrupt correlations; change the logic in
the type === 'tool_use' branch (around maybeStart(ev), toolUseId, and AgentEvent
creation) to detect a missing/empty toolUseId and in that case avoid emitting
normalized 'tool-use' or 'tool-result' events — instead push the raw event (or
skip normalization) and return; if toolUseId is present, continue with the
existing normalization and creation of AgentEvent objects as before.

In `@packages/agent_adapters/src/types.ts`:
- Around line 15-34: OpenCodeAdapter.buildExec currently places
AgentRunSpec.prompt into argv (violating the SessionExecSpec contract that
prompt must be sent via stdin), so change OpenCodeAdapter.buildExec to set the
exec object's stdin to spec.prompt (matching ClaudeCodeAdapter) and remove the
prompt from the args array; update the corresponding test in build-exec.test.ts
to assert stdin contains the prompt instead of it appearing in argv and ensure
any helper/constructors that build the SessionExecSpec still omit prompt from
argv.

In `@services/platform/convex/node_only/sandbox/helpers/session_client.ts`:
- Around line 252-258: The parseData helper currently swallows JSON.parse errors
silently; update the parseData<T>(data: string): T | null function to either log
the parse error at debug/trace level using the module logger (include the raw
data and error.message) or, if silence is intentional, add a clear comment
explaining that malformed SSE payloads are expected and why they should be
ignored; reference the parseData function to implement the change so debugging
information is available when needed.

In `@services/platform/convex/node_only/sandbox/run_agent.ts`:
- Around line 116-143: The AbortController instance named controller is created
but never triggered; either wire it into cancellation or remove it: if you
intend to cancel the sessionExec early (e.g., on args.timeoutMs expiry or an
external cancel), call controller.abort() at the appropriate place (for example
from a timeout handler or by exposing controller to the caller) so sessionExec
receives an abort; otherwise remove the controller and stop passing
controller.signal to sessionExec to avoid unused overhead. Ensure references are
to AbortController, controller, sessionExec, and args.timeoutMs when making the
change.
- Around line 49-54: The return schema currently uses v.string() for the status
field which is too permissive; change the schema in the returns object (the
validator in run_agent.ts that defines status) to
v.union(v.literal('completed'), v.literal('cancelled'), v.literal('failed')) so
the Convex boundary enforces only the three implemented statuses (the code paths
returning 'completed','cancelled','failed' around the existing return logic);
update the status validator accordingly to catch invalid values at validation
time.
- Around line 55-68: The handler currently force-casts args.agentSlug to
AgentSlug for getAgentAdapter which violates the no-"as" rule; add a type guard
function (e.g., isAgentSlug(value): value is AgentSlug) that checks the runtime
string against the allowed AgentSlug union, use that guard to validate
args.agentSlug before calling getAgentAdapter, and handle the invalid case
(throw an error or return a clear Convex-friendly failure) instead of using
"as"; update the handler to call getAgentAdapter(args.agentSlug) only after the
guard passes so the compile-time type is correct.

In `@services/platform/convex/node_only/sandbox/session_credentials.ts`:
- Around line 22-28: Remove the unused ResolvedCredential interface to avoid
dead code: locate the ResolvedCredential type declaration and delete it (it
isn’t referenced anywhere; the resolveSessionCredentials action returns { env,
git } directly), or alternatively change resolveSessionCredentials’s return type
to explicitly use ResolvedCredential if you intend to keep the interface; prefer
removing the interface unless you plan to use it elsewhere or add a comment
explaining its future purpose.
- Around line 92-99: getDecryptedCredentials can throw and currently will abort
the whole operation; wrap the call to getDecryptedCredentials(...) (the block
producing `decrypted` and then calling `pickSecret(decrypted)`) in a try-catch,
log a warning including the grant `slug` and the error (matching the existing
missing-credential warning pattern), and continue the loop when decryption fails
so one corrupted credential won’t break session creation.

In `@services/platform/convex/sandbox/wire.ts`:
- Around line 166-179: Add a compile-time parity guard that asserts the exported
SandboxSessionProfile union matches the cross-service literal definition
(sandboxSessionProfileLiterals) using the project's Equal<> pattern; import the
Equal helper if needed and place the assertion after the
SandboxSessionProfile/type export so TypeScript fails the build if the two
literal sets drift.

In `@services/sandbox-runtime/daemon/src/env-store.ts`:
- Around line 17-23: The constructor(seed?: Record<string,string>) is currently
only applying isDeniedEnvName filtering and bypasses the same caps enforced by
patch(), causing oversized values or too many entries at startup; update the
constructor to enforce the same entry count and value-size limits used by
patch(): iterate seed entries honoring isDeniedEnvName, then for each entry
check the max entries cap (same limit used by patch()), enforce per-value size
limit (same byte/char limit and trimming/rejection behavior), and stop/skip
additional entries once the cap is reached so the in-memory this.store is
populated under the same constraints as patch() to keep behavior consistent with
the patch() logic.

In `@services/sandbox-runtime/daemon/src/exec-manager.ts`:
- Around line 195-200: The empty catch blocks in exec-manager.ts around the
process.kill call (when negative pid is used to signal a process group) and the
other similar block at the 231-235 region must not swallow errors; update those
catches to log the exception with context (include child.pid, signal, and
operation like "kill process group" or "stdio wiring/timeout cancel") using
console.warn or console.error and include the error.stack or message, or rethrow
if the caller must handle it; reference the child.pid/child and signal variables
and ensure the log provides clear context so failures in kill/stdio/timeout
paths are visible.
- Around line 240-255: The stdout/stderr handlers (child.stdout.on and
child.stderr.on) allow a chunk that crosses the byte cap to be emitted in full
because they check bytes >= req.*MaxBytes before adding chunk.byteLength; update
the logic to compute remaining = req.*MaxBytes - currentBytes and if remaining
<= 0 set *Trunc = true and return, otherwise if chunk.byteLength > remaining
emit only the first 'remaining' bytes (mark *Trunc = true after emitting the
truncated portion) and add remaining to currentBytes; use Buffer.slice or
equivalent to emit the truncated chunk via ringEmit and ensure
stdoutBytes/stderrBytes reflect the actual bytes emitted.
- Around line 327-332: Replace the unsafe assertion in emitRingLine by parsing
into unknown, performing a discriminator-based narrowing on the parsed value
(check it's an object, has a string 't' property matching the RunnerdExecEvent
discriminator and the required fields for that event shape), and only call
emit(...) with the now-narrowed RunnerdExecEvent; remove the eslint suppression.
Implement this as a small type-guard or runtime validator for RunnerdExecEvent
(referencing the RunnerdExecEvent type and its 't' discriminator) and use it to
validate the JSON.parse result before emitting, handling invalid data in the
catch/error path instead of asserting.

In `@services/sandbox-runtime/daemon/src/file-ops.ts`:
- Around line 70-80: The code currently fully buffers the response with await
res.arrayBuffer() before checking size which can OOM; update the fetch handling
around the fetch(item.url) response by first checking
res.headers.get('content-length') against FETCH_MAX_BYTES and skipping if too
large, then use res.body?.getReader() to stream-read chunks while maintaining a
running byte count and canceling/aborting the reader when total >
FETCH_MAX_BYTES (pushing skipped with { path: item.path, reason: 'too_large' }),
handle the case where res.body is missing by pushing skipped with { path:
item.path, reason: 'no_body' }, and only construct the final Buffer from
accumulated chunks when the size check passes.

In `@services/sandbox-runtime/daemon/src/main.ts`:
- Around line 239-250: The JSON parsed from readBody is assigned to a typed
variable without runtime validation, risking malformed input to envStore.patch;
update the POST /env handler to treat JSON.parse result as unknown, validate
that the parsed value has optional properties "set" as Record<string,string> and
"unset" as string[] (or sanitize them) before calling envStore.patch, and return
400 on invalid shapes (use the existing sendJson to respond). Reference
readBody, the local variable body, envStore.patch, touch, and sendJson when
locating and updating the handler.

In `@services/sandbox-runtime/daemon/src/protocol.ts`:
- Line 22: The denylist check uses an `as` cast which violates the TS rule
banning `as`; remove the cast and perform a cast-free check by replacing
`(RUNNERD_ENV_DENYLIST as readonly string[]).includes(name)` with a type-safe
alternative such as using `RUNNERD_ENV_DENYLIST.some(v => v === name)` or widen
the declaration of RUNNERD_ENV_DENYLIST so `includes(name)` is already valid;
update the condition in the function that references `name` and
`RUNNERD_ENV_DENYLIST` accordingly.

In `@services/sandbox-runtime/Dockerfile`:
- Around line 81-85: The Dockerfile currently swallows all Playwright install
failures by ending the fallback chain with "|| true", risking an image without
Chromium; update the RUN block that sets PLAYWRIGHT_BROWSERS_PATH and runs
"/opt/agents/bin/mcp-server-playwright --help" and the two "playwright install
chromium" commands to remove the final "|| true" and add a verification step
(e.g., test for the Chromium binary under PLAYWRIGHT_BROWSERS_PATH or run "npx
--prefix /opt/agents playwright --version" / "playwright show-trace" equivalent)
and exit non‑zero if verification fails so the build fails when Chromium is not
installed.

In `@services/sandbox/docs/sessions.md`:
- Around line 44-50: Update the "Tier 2 — managed-entry credentials" paragraph
to remove the claim that git credentials are fetched per-operation with
immediate revocation; instead state the current v1 helper is env-backed and that
per-operation fetching is a planned follow-up, and clarify that revocation
timing depends on the env-backed lifecycle rather than being immediate.
Reference the "Tier 2 — managed-entry credentials" heading and the audited event
name "sandboxCredentialAccess" so reviewers can locate and adjust the sentence
that currently asserts per-operation fetch and immediate revocation.

In `@services/sandbox/src/backend/docker/docker-session-backend.ts`:
- Around line 52-53: Ensure uid/gid are validated instead of silently parsing
profile.user: add strict validation in config.ts when reading SANDBOX_AGENT_USER
(use a /^\d+:\d+$/ match, parse uid/gid, ensure both >= 1 and throw a clear
Error if invalid) and export the validated "user" string and numeric uid/gid;
then update docker-session-backend.ts to consume the validated values (replace
the raw Number(profile.user.split(...)) logic) and add a defensive check before
calling chown (verify Number.isInteger(uid) && Number.isInteger(gid) && uid >= 1
&& gid >= 1) to avoid NaN or root defaults in runtime.

In `@services/sandbox/src/backend/kubernetes/k8s-session-backend.ts`:
- Around line 86-99: The timeout budget is not shared: change the flow after
waitForEndpoint to compute remainingMs = spec.createdAtMs +
this.cfg.session.createHealthTimeoutMs - Date.now(), throw a timeout error (or
immediately destroy and throw) if remainingMs <= 0, and pass remainingMs into
waitForRunnerd instead of this.cfg.session.createHealthTimeoutMs (keep using {
baseUrl: endpoint, token: this.tokenFor(spec.sessionId) } and the same error
handling around destroySession); use the waitForEndpoint and waitForRunnerd
symbols and spec.createdAtMs/cfg.session.createHealthTimeoutMs to locate the
code to update.

In `@services/sandbox/src/session/session-routes.ts`:
- Around line 88-113: The catch in sweepExpired (inside
services/sandbox/src/session/session-routes.ts) swallows runnerdHealth
errors—update the catch to log the error (e.g., console.warn or console.error)
including context like the session id and endpoint returned from registry.list()
and the error object, but keep the current behavior of not re-throwing so
reaping is unchanged; reference the tokenFor, runnerdHealth, registry.list, and
backend.destroySession usages to locate the block to modify.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 361ef54a-e4ea-40a2-a6a2-d5bb8871e6bb

📥 Commits

Reviewing files that changed from the base of the PR and between a95071c and 23011e1.

⛔ Files ignored due to path filters (3)

• bun.lock is excluded by !**/*.lock
• services/platform/convex/_generated/api.d.ts is excluded by !**/_generated/**
• services/sandbox-runtime/daemon/bun.lock is excluded by !**/*.lock

📒 Files selected for processing (73)

• compose.yml
• package.json
• packages/agent_adapters/.oxlintrc.json
• packages/agent_adapters/README.md
• packages/agent_adapters/fixtures/claude_code/issue-to-pr.jsonl
• packages/agent_adapters/fixtures/opencode/issue-to-pr.jsonl
• packages/agent_adapters/package.json
• packages/agent_adapters/scripts/record-fixture.md
• packages/agent_adapters/src/build-exec.test.ts
• packages/agent_adapters/src/claude_code/adapter.ts
• packages/agent_adapters/src/claude_code/parse.test.ts
• packages/agent_adapters/src/claude_code/parse.ts
• packages/agent_adapters/src/events.ts
• packages/agent_adapters/src/index.ts
• packages/agent_adapters/src/jsonl.ts
• packages/agent_adapters/src/opencode/adapter.ts
• packages/agent_adapters/src/opencode/parse.test.ts
• packages/agent_adapters/src/opencode/parse.ts
• packages/agent_adapters/src/registry.ts
• packages/agent_adapters/src/types.ts
• packages/agent_adapters/tsconfig.json
• services/platform/convex/node_only/sandbox/bifrost_admin.ts
• services/platform/convex/node_only/sandbox/helpers/session_client.ts
• services/platform/convex/node_only/sandbox/run_agent.ts
• services/platform/convex/node_only/sandbox/session_credentials.ts
• services/platform/convex/sandbox/session_mutations.ts
• services/platform/convex/sandbox/sessions_schema.ts
• services/platform/convex/sandbox/wire.ts
• services/platform/convex/schema.ts
• services/sandbox-egress/entrypoint.sh
• services/sandbox-runtime/Dockerfile
• services/sandbox-runtime/daemon/.oxlintrc.json
• services/sandbox-runtime/daemon/package.json
• services/sandbox-runtime/daemon/src/env-store.test.ts
• services/sandbox-runtime/daemon/src/env-store.ts
• services/sandbox-runtime/daemon/src/exec-manager.test.ts
• services/sandbox-runtime/daemon/src/exec-manager.ts
• services/sandbox-runtime/daemon/src/file-ops.test.ts
• services/sandbox-runtime/daemon/src/file-ops.ts
• services/sandbox-runtime/daemon/src/main.ts
• services/sandbox-runtime/daemon/src/protocol.ts
• services/sandbox-runtime/daemon/tsconfig.json
• services/sandbox-runtime/entrypoint.sh
• services/sandbox-runtime/managed-settings.json
• services/sandbox-runtime/tale-git-credential
• services/sandbox/docs/sessions.md
• services/sandbox/src/backend/docker/docker-session-backend.ts
• services/sandbox/src/backend/index.ts
• services/sandbox/src/backend/kubernetes/exec-spec.test.ts
• services/sandbox/src/backend/kubernetes/k8s-backend.test.ts
• services/sandbox/src/backend/kubernetes/k8s-pod-spec.test.ts
• services/sandbox/src/backend/kubernetes/k8s-session-backend.ts
• services/sandbox/src/backend/kubernetes/k8s-session-pod-spec.test.ts
• services/sandbox/src/backend/kubernetes/k8s-session-pod-spec.ts
• services/sandbox/src/backend/types.ts
• services/sandbox/src/config.ts
• services/sandbox/src/docker-args.test.ts
• services/sandbox/src/http-util.ts
• services/sandbox/src/server.ts
• services/sandbox/src/session/docker-session-args.test.ts
• services/sandbox/src/session/docker-session-args.ts
• services/sandbox/src/session/runnerd-client.ts
• services/sandbox/src/session/runnerd-protocol.ts
• services/sandbox/src/session/session-naming.ts
• services/sandbox/src/session/session-registry.ts
• services/sandbox/src/session/session-routes.test.ts
• services/sandbox/src/session/session-routes.ts
• services/sandbox/src/session/session-test-config.ts
• services/sandbox/src/session/validate-session.ts
• services/sandbox/src/sse.ts
• services/sandbox/src/types.ts
• services/sandbox/src/wire.ts
• tests/container-sandbox-runtime-test.sh

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

pull_policy: build is invalid for external images.

The bifrost service uses an external image (maximhq/bifrost) but inherits pull_policy: ${PULL_POLICY:-build}. The build policy is meaningless without a build: block — Docker Compose will fail or behave unexpectedly when PULL_POLICY=build.

For external images, use always or if-not-present:

🐛 Proposed fix

   bifrost:
     image: maximhq/bifrost:${BIFROST_VERSION:-1.4.8}
-    pull_policy: ${PULL_POLICY:-build}
+    pull_policy: always
     container_name: tale-bifrost

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	image: maximhq/bifrost:${BIFROST_VERSION:-1.4.8}
	pull_policy: ${PULL_POLICY:-build}
	image: maximhq/bifrost:${BIFROST_VERSION:-1.4.8}
	pull_policy: always

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@compose.yml` around lines 691 - 692, The compose entry uses an external image
declaration image: maximhq/bifrost:${BIFROST_VERSION:-1.4.8} but sets
pull_policy: ${PULL_POLICY:-build}, which is invalid for external images; update
the pull_policy default to a valid external-image policy (e.g., change
${PULL_POLICY:-build} to ${PULL_POLICY:-if-not-present} or
${PULL_POLICY:-always}) and ensure the pull_policy key in the bifrost service no
longer defaults to "build" or relies on PULL_POLICY being "build".

[coderabbitai]

🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Prefer satisfies for test fixture type validation.

The base test fixture uses implicit typing. Per coding guidelines, test fixtures should use the satisfies operator to validate type conformance while preserving inference.

♻️ Proposed fix

-const base: AgentRunSpec = {
+const base = {
   prompt: 'Fix issue `#1` and open a PR',
   model: 'claude-sonnet-4-6',
   gateway: { baseUrl: 'http://bifrost:8080', token: 'sk-bf-test' },
   workdir: '/workspace/repo',
-};
+} satisfies AgentRunSpec;

Based on learnings: In TypeScript test fixtures, prefer the 'satisfies' operator over 'as' type assertions or explicit annotations for config objects and test data. 'Satisfies' provides compile-time validation that the value conforms to the type without altering the inferred type, improving type safety.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	const base: AgentRunSpec = {
	prompt: 'Fix issue #1 and open a PR',
	model: 'claude-sonnet-4-6',
	gateway: { baseUrl: 'http://bifrost:8080', token: 'sk-bf-test' },
	workdir: '/workspace/repo',
	};
	const base = {
	prompt: 'Fix issue `#1` and open a PR',
	model: 'claude-sonnet-4-6',
	gateway: { baseUrl: 'http://bifrost:8080', token: 'sk-bf-test' },
	workdir: '/workspace/repo',
	} satisfies AgentRunSpec;

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/agent_adapters/src/build-exec.test.ts` around lines 11 - 16, The
test fixture constant `base` is implicitly typed; change its declaration to
validate against `AgentRunSpec` using the TypeScript `satisfies` operator (i.e.,
declare the object and append `satisfies AgentRunSpec`) so the object is checked
for conformance while preserving inference — update the `base` definition in
build-exec.test.ts accordingly and remove any explicit casts or annotations if
present.

Source: Learnings

[coderabbitai]

🧹 Nitpick | 🔵 Trivial | 💤 Low value

Minor: str(message?.model) called twice.

The model string extraction is performed twice in the same expression. Extract to a variable for clarity and efficiency:

+        const model = str(message?.model);
         events.push({
           type: 'usage',
-          ...(str(message?.model) ? { model: str(message?.model) } : {}),
+          ...(model ? { model } : {}),
           inputTokens: num(usage.input_tokens),

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	events.push({
	type: 'usage',
	...(str(message?.model) ? { model: str(message?.model) } : {}),
	inputTokens: num(usage.input_tokens),
	outputTokens: num(usage.output_tokens),
	cacheReadTokens: num(usage.cache_read_input_tokens),
	cacheWriteTokens: num(usage.cache_creation_input_tokens),
	});
	}
	const model = str(message?.model);
	events.push({
	type: 'usage',
	...(model ? { model } : {}),
	inputTokens: num(usage.input_tokens),
	outputTokens: num(usage.output_tokens),
	cacheReadTokens: num(usage.cache_read_input_tokens),
	cacheWriteTokens: num(usage.cache_creation_input_tokens),
	});
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/agent_adapters/src/claude_code/parse.ts` around lines 117 - 125,
Extract the model string once into a local variable before constructing the
events entry (e.g., const modelStr = str(message?.model)) and use modelStr in
both the conditional spread and the value ({ ...(modelStr ? { model: modelStr }
: {}) }) instead of calling str(message?.model) twice; apply this change in the
block that builds the events object (where events.push is called and num(...)
uses usage fields) to preserve behavior and avoid duplicate calls.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Do not emit normalized tool events with an empty toolUseId.

Line 71 falls back to '' when both part.id and part.callID are missing. That can corrupt downstream tool-use/tool-result correlation by merging malformed events under the same key. Treat missing IDs as non-normalizable (e.g., emit raw and skip normalized tool events).

Proposed fix

-      const toolUseId = str(part?.id) ?? str(part?.callID) ?? '';
+      const toolUseId = str(part?.id) ?? str(part?.callID);
+      if (!toolUseId) {
+        events.push({ type: 'raw', agent: 'opencode', payload: ev });
+        return events;
+      }
       if (status === 'completed' || status === 'error') {
         const out: AgentEvent = { type: 'tool-result', toolUseId };

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/agent_adapters/src/opencode/parse.ts` around lines 67 - 85, The
handler for type === 'tool_use' currently normalizes events even when toolUseId
is empty (toolUseId = str(part?.id) ?? str(part?.callID) ?? ''), which can
corrupt correlations; change the logic in the type === 'tool_use' branch (around
maybeStart(ev), toolUseId, and AgentEvent creation) to detect a missing/empty
toolUseId and in that case avoid emitting normalized 'tool-use' or 'tool-result'
events — instead push the raw event (or skip normalization) and return; if
toolUseId is present, continue with the existing normalization and creation of
AgentEvent objects as before.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check how prompts are passed to agents in both adapters

echo "=== Checking Claude Code adapter ==="
rg -A5 'buildExec.*prompt' packages/agent_adapters/src/claude_code/

echo "=== Checking OpenCode adapter ==="
rg -A5 'buildExec.*prompt|argv\.push.*prompt' packages/agent_adapters/src/opencode/

echo "=== Checking if stdin is used for prompts ==="
rg 'stdin.*prompt|prompt.*stdin' packages/agent_adapters/src/

Repository: tale-project/tale

Length of output: 1045

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Locate SessionExecSpec and related fields ==="
rg -n "export interface SessionExecSpec|interface SessionExecSpec|SessionExecSpec" packages/agent_adapters/src/types.ts
echo "--- types.ts (around SessionExecSpec) ---"
sed -n '1,120p' packages/agent_adapters/src/types.ts | nl -ba

echo "=== Inspect OpenCode adapter around argv.push(spec.prompt) ==="
rg -n "argv\.push\(spec\.prompt\)|buildExec|stdin:" packages/agent_adapters/src/opencode/adapter.ts
echo "--- opencode/adapter.ts (relevant section) ---"
sed -n '1,220p' packages/agent_adapters/src/opencode/adapter.ts | nl -ba

echo "=== Inspect build-exec test expectations and implementation ==="
rg -n "prompt rides stdin|stdin\).*base\.prompt|buildExec" packages/agent_adapters/src/build-exec.test.ts
echo "--- build-exec.test.ts (relevant section) ---"
sed -n '1,220p' packages/agent_adapters/src/build-exec.test.ts | nl -ba

rg -n "function buildExec|buildExec\(" packages/agent_adapters/src | head -n 50
echo "=== If build-exec.ts exists, show it ==="
ls -1 packages/agent_adapters/src | rg "build-exec|buildExec"
if [ -f packages/agent_adapters/src/build-exec.ts ]; then
  sed -n '1,240p' packages/agent_adapters/src/build-exec.ts | nl -ba
fi
if [ -f packages/agent_adapters/src/build-exec.tsx ]; then
  sed -n '1,240p' packages/agent_adapters/src/build-exec.tsx | nl -ba
fi

echo "=== Inspect Claude Code adapter how it sets stdin ==="
rg -n "stdin:\s*spec\.prompt|argv.*spec\.prompt|buildExec" packages/agent_adapters/src/claude_code/adapter.ts
echo "--- claude_code/adapter.ts (relevant section) ---"
sed -n '1,240p' packages/agent_adapters/src/claude_code/adapter.ts | nl -ba

Repository: tale-project/tale

Length of output: 305

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== List agent_adapters/src ==="
ls -la packages/agent_adapters/src

echo "=== types.ts: show SessionExecSpec + AgentRunSpec contracts ==="
sed -n '1,120p' packages/agent_adapters/src/types.ts | cat -n

echo "=== Show SessionExecSpec usage/buildExec ==="
rg -n "buildExec\\(spec: AgentRunSpec\\)|SessionExecSpec" packages/agent_adapters/src/types.ts packages/agent_adapters/src -S

echo "=== opencode/adapter.ts: show relevant argv/stdin handling ==="
sed -n '1,220p' packages/agent_adapters/src/opencode/adapter.ts | cat -n

echo "=== claude_code/adapter.ts: show relevant argv/stdin handling ==="
sed -n '1,220p' packages/agent_adapters/src/claude_code/adapter.ts | cat -n

echo "=== build-exec.*: show implementation + tests ==="
ls -la packages/agent_adapters/src | rg -n "build-exec"
rg -n "buildExec\\(" packages/agent_adapters/src -S
sed -n '1,220p' packages/agent_adapters/src/build-exec.test.ts | cat -n

echo "=== locate any build-exec implementation file ==="
fd -t f "build-exec*" packages/agent_adapters/src
fd -t f "buildExec*" packages/agent_adapters/src

Repository: tale-project/tale

Length of output: 15791

---

Avoid passing AgentRunSpec.prompt via argv in OpenCodeAdapter (process-list data leak).

• SessionExecSpec contract explicitly says the prompt is on stdin, never argv (packages/agent_adapters/src/types.ts).
• OpenCodeAdapter.buildExec violates this by pushing the prompt as a trailing positional argument (packages/agent_adapters/src/opencode/adapter.ts), and build-exec.test.ts asserts this behavior—whereas ClaudeCodeAdapter correctly uses stdin: spec.prompt.
• Change OpenCodeAdapter to pass the prompt via stdin (and update the corresponding test) so sensitive prompts don’t end up in process arguments.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/agent_adapters/src/types.ts` around lines 15 - 34,
OpenCodeAdapter.buildExec currently places AgentRunSpec.prompt into argv
(violating the SessionExecSpec contract that prompt must be sent via stdin), so
change OpenCodeAdapter.buildExec to set the exec object's stdin to spec.prompt
(matching ClaudeCodeAdapter) and remove the prompt from the args array; update
the corresponding test in build-exec.test.ts to assert stdin contains the prompt
instead of it appearing in argv and ensure any helper/constructors that build
the SessionExecSpec still omit prompt from argv.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Silent Playwright install failure may leave image without Chromium.

The fallback chain terminates with || true, so the build succeeds even if all three install attempts fail. Consider adding a verification step or removing the final || true so the build fails if Chromium isn't installed.

💡 Suggested verification

 # Chromium for Playwright MCP (system deps already apt-installed above).
 RUN PLAYWRIGHT_BROWSERS_PATH=/opt/ms-playwright \
       /opt/agents/bin/mcp-server-playwright --help >/dev/null 2>&1 || true \
     && npx --prefix /opt/agents playwright install chromium 2>/dev/null \
     || node /opt/agents/lib/node_modules/@playwright/mcp/node_modules/.bin/playwright install chromium 2>/dev/null \
-    || true
+    || true \
+    && test -d /opt/ms-playwright/chromium-* \
+    && echo "Chromium installed successfully"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/sandbox-runtime/Dockerfile` around lines 81 - 85, The Dockerfile
currently swallows all Playwright install failures by ending the fallback chain
with "|| true", risking an image without Chromium; update the RUN block that
sets PLAYWRIGHT_BROWSERS_PATH and runs "/opt/agents/bin/mcp-server-playwright
--help" and the two "playwright install chromium" commands to remove the final
"|| true" and add a verification step (e.g., test for the Chromium binary under
PLAYWRIGHT_BROWSERS_PATH or run "npx --prefix /opt/agents playwright --version"
/ "playwright show-trace" equivalent) and exit non‑zero if verification fails so
the build fails when Chromium is not installed.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Align Tier-2 git revocation docs with current implementation.

Line 49 currently claims per-operation git credential fetch with immediate revocation, but the helper implementation is env-backed in v1 and explicitly calls per-operation fetch a follow-up. Please update this section to avoid overstating current security guarantees.

📝 Proposed doc correction

-  env/image/PodSpec) → audited (`sandboxCredentialAccess`) → revoked on
-  destroy (git creds fetched per-operation, so revocation is immediate).
+  env/image/PodSpec) → audited (`sandboxCredentialAccess`) → revoked on
+  destroy (v1 git creds are env-backed in-session; per-operation fetch is a
+  documented follow-up).

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	- **Tier 2 — managed-entry credentials** (integration secrets — git tokens,
	DB passwords, third-party API keys — that can't be transparently proxied):
	enter the sandbox, but only through one managed pipeline — explicit
	per-session grant (default empty) → broker fetch (never baked into
	env/image/PodSpec) → audited (`sandboxCredentialAccess`) → revoked on
	destroy (git creds fetched per-operation, so revocation is immediate).
	- **Tier 2 — managed-entry credentials** (integration secrets — git tokens,
	DB passwords, third-party API keys — that can't be transparently proxied):
	enter the sandbox, but only through one managed pipeline — explicit
	per-session grant (default empty) → broker fetch (never baked into
	env/image/PodSpec) → audited (`sandboxCredentialAccess`) → revoked on
	destroy (v1 git creds are env-backed in-session; per-operation fetch is a
	documented follow-up).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/sandbox/docs/sessions.md` around lines 44 - 50, Update the "Tier 2 —
managed-entry credentials" paragraph to remove the claim that git credentials
are fetched per-operation with immediate revocation; instead state the current
v1 helper is env-backed and that per-operation fetching is a planned follow-up,
and clarify that revocation timing depends on the env-backed lifecycle rather
than being immediate. Reference the "Tier 2 — managed-entry credentials" heading
and the audited event name "sandboxCredentialAccess" so reviewers can locate and
adjust the sentence that currently asserts per-operation fetch and immediate
revocation.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Validate uid/gid extraction to prevent silent failures.

The uid/gid extraction from profile.user assumes a valid "uid:gid" format but doesn't validate the result. If profile.user is malformed:

• "invalid" (no colon) → uid = Number("invalid") = NaN, causing chown to fail
• ":" (empty parts) → uid = gid = Number("") = 0 (root), a potential security issue

The chown failure is caught and logged (line 60-64) but the session continues, potentially with incorrect permissions.

🛡️ Proposed validation in config.ts

Add validation when loading SANDBOX_AGENT_USER in config.ts (around line 191):

// In config.ts, after line 191:
const agentUser = process.env.SANDBOX_AGENT_USER ?? '10001:10001';
const userMatch = agentUser.match(/^(\d+):(\d+)$/);
if (!userMatch) {
  throw new Error(
    `SANDBOX_AGENT_USER must be in 'uid:gid' format; got: ${JSON.stringify(agentUser)}`,
  );
}
const uid = Number(userMatch[1]);
const gid = Number(userMatch[2]);
if (uid < 1 || gid < 1) {
  throw new Error(
    `SANDBOX_AGENT_USER uid and gid must be >= 1 (non-root); got: ${agentUser}`,
  );
}
// Then use: user: agentUser

This validates at config load time rather than at runtime, providing clearer feedback to operators.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/sandbox/src/backend/docker/docker-session-backend.ts` around lines
52 - 53, Ensure uid/gid are validated instead of silently parsing profile.user:
add strict validation in config.ts when reading SANDBOX_AGENT_USER (use a
/^\d+:\d+$/ match, parse uid/gid, ensure both >= 1 and throw a clear Error if
invalid) and export the validated "user" string and numeric uid/gid; then update
docker-session-backend.ts to consume the validated values (replace the raw
Number(profile.user.split(...)) logic) and add a defensive check before calling
chown (verify Number.isInteger(uid) && Number.isInteger(gid) && uid >= 1 && gid
>= 1) to avoid NaN or root defaults in runtime.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Timeout budget is not shared between waitForEndpoint and waitForRunnerd.

waitForEndpoint consumes part of the timeout budget waiting for Pod IP assignment, but waitForRunnerd receives the full createHealthTimeoutMs rather than the remaining time. If Pod scheduling takes 15s of a 30s budget, runnerd still gets 30s instead of 15s, potentially doubling the effective timeout.

Proposed fix: pass remaining budget to waitForRunnerd

     // Poll runnerd readiness via the Pod IP (which appears once scheduled).
     try {
+      const deadline = spec.createdAtMs + this.cfg.session.createHealthTimeoutMs;
       const endpoint = await this.waitForEndpoint(
         spec.sessionId,
-        spec.createdAtMs + this.cfg.session.createHealthTimeoutMs,
+        deadline,
       );
+      const remainingMs = Math.max(0, deadline - Date.now());
       await waitForRunnerd(
         { baseUrl: endpoint, token: this.tokenFor(spec.sessionId) },
-        this.cfg.session.createHealthTimeoutMs,
+        remainingMs,
       );

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// Poll runnerd readiness via the Pod IP (which appears once scheduled).
	try {
	const endpoint = await this.waitForEndpoint(
	spec.sessionId,
	spec.createdAtMs + this.cfg.session.createHealthTimeoutMs,
	);
	await waitForRunnerd(
	{ baseUrl: endpoint, token: this.tokenFor(spec.sessionId) },
	this.cfg.session.createHealthTimeoutMs,
	);
	} catch (err) {
	await this.destroySession(spec.sessionId);
	throw err;
	}
	// Poll runnerd readiness via the Pod IP (which appears once scheduled).
	try {
	const deadline = spec.createdAtMs + this.cfg.session.createHealthTimeoutMs;
	const endpoint = await this.waitForEndpoint(
	spec.sessionId,
	deadline,
	);
	const remainingMs = Math.max(0, deadline - Date.now());
	await waitForRunnerd(
	{ baseUrl: endpoint, token: this.tokenFor(spec.sessionId) },
	remainingMs,
	);
	} catch (err) {
	await this.destroySession(spec.sessionId);
	throw err;
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/sandbox/src/backend/kubernetes/k8s-session-backend.ts` around lines
86 - 99, The timeout budget is not shared: change the flow after waitForEndpoint
to compute remainingMs = spec.createdAtMs +
this.cfg.session.createHealthTimeoutMs - Date.now(), throw a timeout error (or
immediately destroy and throw) if remainingMs <= 0, and pass remainingMs into
waitForRunnerd instead of this.cfg.session.createHealthTimeoutMs (keep using {
baseUrl: endpoint, token: this.tokenFor(spec.sessionId) } and the same error
handling around destroySession); use the waitForEndpoint and waitForRunnerd
symbols and spec.createdAtMs/cfg.session.createHealthTimeoutMs to locate the
code to update.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Log runnerd health check errors in the sweep.

The catch block at lines 99-102 has only a comment but no logging, violating the coding guideline: "No empty catch blocks in JavaScript/TypeScript — log with console.warn/console.error or re-throw to avoid hiding bugs." While the comment explains the business logic for ignoring transient failures, logging the error would still aid debugging without changing the reaping behavior.

🔍 Proposed fix to add logging

         try {
           const health = await runnerdHealth({
             baseUrl: s.endpoint,
             token: this.tokenFor(s.sessionId),
           });
           expired = nowMs - health.lastActivityAtMs > s.idleTimeoutMs;
-        } catch {
+        } catch (err) {
+          console.warn('[sandbox.session] sweep health check failed (ignoring):', err);
           // runnerd unreachable — leave for a later sweep (a transient blip
           // shouldn't reap a session; the TTL is the hard backstop).
         }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	async sweepExpired(nowMs: number = Date.now()): Promise<number> {
	let reaped = 0;
	for (const s of this.registry.list()) {
	let expired = nowMs > s.expiresAtMs;
	if (!expired) {
	try {
	const health = await runnerdHealth({
	baseUrl: s.endpoint,
	token: this.tokenFor(s.sessionId),
	});
	expired = nowMs - health.lastActivityAtMs > s.idleTimeoutMs;
	} catch {
	// runnerd unreachable — leave for a later sweep (a transient blip
	// shouldn't reap a session; the TTL is the hard backstop).
	}
	}
	if (expired) {
	await this.backend.destroySession(s.sessionId).catch((err) => {
	console.warn('[sandbox.session] sweep destroy failed:', err);
	});
	this.registry.delete(s.sessionId);
	reaped += 1;
	}
	}
	return reaped;
	}
	async sweepExpired(nowMs: number = Date.now()): Promise<number> {
	let reaped = 0;
	for (const s of this.registry.list()) {
	let expired = nowMs > s.expiresAtMs;
	if (!expired) {
	try {
	const health = await runnerdHealth({
	baseUrl: s.endpoint,
	token: this.tokenFor(s.sessionId),
	});
	expired = nowMs - health.lastActivityAtMs > s.idleTimeoutMs;
	} catch (err) {
	console.warn('[sandbox.session] sweep health check failed (ignoring):', err);
	// runnerd unreachable — leave for a later sweep (a transient blip
	// shouldn't reap a session; the TTL is the hard backstop).
	}
	}
	if (expired) {
	await this.backend.destroySession(s.sessionId).catch((err) => {
	console.warn('[sandbox.session] sweep destroy failed:', err);
	});
	this.registry.delete(s.sessionId);
	reaped += 1;
	}
	}
	return reaped;
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/sandbox/src/session/session-routes.ts` around lines 88 - 113, The
catch in sweepExpired (inside services/sandbox/src/session/session-routes.ts)
swallows runnerdHealth errors—update the catch to log the error (e.g.,
console.warn or console.error) including context like the session id and
endpoint returned from registry.list() and the error object, but keep the
current behavior of not re-throwing so reaping is unchanged; reference the
tokenFor, runnerdHealth, registry.list, and backend.destroySession usages to
locate the block to modify.

Source: Coding guidelines

[larryro]

Worked through the CodeRabbit + CodeQL review against current main-rebased code in e44883b. Most findings predated ~40 commits of hardening, so each was re-verified before acting.

Fixed

• compose: bifrost is the only external-image service → pull_policy defaults to missing instead of the repo-wide build.
• agent_adapters: satisfies on the buildExec fixture; deduped str(message?.model); an OpenCode tool_use part with no id/callID now forwards as raw instead of normalizing under an empty toolUseId (+regression test).
• runnerd daemon: env seed now honours patch()'s entry/size caps; output byte-cap clips a cap-crossing chunk to the remaining budget instead of overshooting by a full pipe buffer (+regression test asserting exact-cap); dropped the as RunnerdExecEvent and as readonly string[] casts for real guards; URL fetches stream with a running byte cap instead of buffering the whole body; POST /env shape-validates before envStore.patch; logged the empty kill/stdin catches.
• platform convex: narrowed runAgentInSession's status validator + result type to the 4 statuses it returns; dropped the redundant as AgentSlug; credential broker warns+skips on a single grant's decrypt failure instead of aborting the whole create; added the missing Equal<> session-profile parity guard; commented the intentional SSE parseData silence.
• spawner: SANDBOX_AGENT_USER validated as uid:gid >= 1 at config load + chown guard (no silent root); k8s create shares one health deadline across waitForEndpoint/waitForRunnerd; sweep health-probe failures logged; Tier‑2 doc corrected to the env-backed v1 git-cred lifecycle.

Already resolved on-branch

AbortController is wired to three cancellation paths; the dead ResolvedCredential interface is gone; the Dockerfile already fails hard when Chromium is missing (fs.accessSync(..., X_OK)).

Deliberately not changed

• CodeQL "unknown directive 'use node'" — required by Convex for Node-runtime modules; removing it breaks deploy. False positive.
• CodeQL "useless conditional !drainActive" — a re-check after an await where the drain can resolve mid-await and flip the flag; genuinely reachable, not dead code (CodeQL misses the cross-await mutation).
• OpenCode prompt via argv — opencode run only accepts the prompt as a positional [message..]; it has no stdin prompt source like Claude Code, so the stdin contract can't apply. Documented in the adapter.

All touched workspaces pass typecheck + lint + tests (agent_adapters 26, sandbox 245, daemon 49, platform sandbox suites green).