feat: doctor checks for the Docker Sandboxes host state

pti commented

2026-11-03 00:06:12 +01:00

Owner

Phase 2 of design/harness/docker-sandbox-runtime.md section 7. wraptool doctor now reports the sbx host state that up --runtime=sbx refuses or warns on. env.sbx-cli reports presence always and, with probing, the version against the R1 floor and the sign-in state from sbx ls --quiet, warning when either would stop up. exposure.sbx-agent-forwarding warns when ssh.agentForwardingEnabled is not false and treats unverifiable output as the same warn. exposure.sbx-secrets warns on global secrets that are not model-provider keys, named by scope, type and name only, reports unparseable output as not checked rather than silence, and skips when sbx is signed out. exposure.sbx-policy-preset runs sbx policy check network localhost:22 and the review UI port when admin.listen is set, with no sandbox, and warns when the global policy reports Allowed, the allow-all shape. sbx has no command that names the active preset so the check asks the policy directly. env.no-backend-with-project counts sbx on PATH as a backend. Because the doctor Env seam executes nothing by design, the process boundary and every sbx output parser moved from cmd/sbxpreflight.go into the new leaf package internal/sbx, so up, down and doctor read sbx output through one implementation. doctor receives a sbx.Capturer on Input.Sbx, nil in every MapEnv-backed test and the same minimal-environment client up uses in production. Every check that executes sbx is probe-gated so --no-probe disables it. The parser tests moved with the code. Docs touched: doctor group table and the --no-probe flag row, a pointer on the comparison page, the sbx design section 7 and 17 status, the doctor design sections 5, 7.1 and 7.3, the plan file map, CLAUDE.md and the changelog. Not verified against a real sbx host from this devcontainer. Full local gate green: vet, tests, gofmt, golangci-lint. 🤖 Generated with Claude Code

pti added 1 commit

2026-11-03 00:06:12 +01:00

feat(doctor): add the Docker Sandboxes checks and share the sbx parsers

Lint / lint (pull_request) Successful in 1m57s

Details

Lint / sonarqube (pull_request) Has been skipped

Details

ce8be50035

wraptool doctor now reports the sbx host state that `up --runtime=sbx`
refuses or warns on (design/harness/docker-sandbox-runtime.md §7, Phase 2):

- env.sbx-cli: presence always; with probing, `sbx version` against R1's
  floor and sign-in from `sbx ls --quiet`, warn when either would stop up.
- exposure.sbx-agent-forwarding: ssh.agentForwardingEnabled not false
  (R14); unverifiable output is the same warn, never a pass.
- exposure.sbx-secrets: global non-model-provider secrets (R3/R16), named
  by scope/type/name only; unparseable output is "not checked" (info);
  skipped when signed out.
- exposure.sbx-policy-preset: `sbx policy check network localhost:22` (and
  the review UI port when admin.listen is set) with no --sandbox reports
  Allowed — the allow-all shape. sbx has no command that names the active
  preset, so the check asks the policy directly; a failing command or
  unrecognised output is a warn too.
- env.no-backend-with-project counts sbx on PATH as a backend.

doctor's Env seam executes nothing by design, so the process boundary and
every parser moved from cmd/sbxpreflight.go into the new leaf package
internal/sbx (Runner, ExecRunner, MinimalEnv, Client/Capturer,
CheckVersion, CheckAgentForwarding with ErrAgentForwardingOn,
ClassifySecrets, NotSignedIn, ClassifyPolicyCheck, PolicyCheckArgs). up,
down and doctor now read sbx output through one implementation. doctor
receives a sbx.Capturer on Input.Sbx — nil in every MapEnv-backed test,
the same minimal-environment client up uses in production — and every
check that executes sbx is probe-gated, so --no-probe disables it. The
parser tests moved with the code; cmd keeps the preflight sequence tests.

Docs: doctor group table and --no-probe row, comparison page pointer,
design §7 and §17 status, doctor design §5/§7.1/§7.3, plan file map,
CLAUDE.md, CHANGELOG.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

pti merged commit 5e72fd6daa into main

2026-11-03 09:54:34 +01:00

pti deleted branch feat/sbx-doctor-checks

2026-11-03 09:54:35 +01:00

pti referenced this pull request from a commit

2026-11-03 09:54:36 +01:00

Merge pull request 'feat: doctor checks for the Docker Sandboxes host state' (#123) from feat/sbx-doctor-checks into main

Rows
Columns

feat: doctor checks for the Docker Sandboxes host state #123