commit bedfa5b0598a77224fc2399a7a691b7ead5e79d6 Author: Fabro Date: Sun May 24 13:26:19 2026 -0400 init run ⚒️ Generated with [Fabro](https://fabro.sh) diff --git a/graph.fabro b/graph.fabro new file mode 100644 index 000000000..d4d99bf9d --- /dev/null +++ b/graph.fabro @@ -0,0 +1,35 @@ +digraph ImplementPlan { + graph [ + goal="Implement and simplify", + model_stylesheet=" + * { model: claude-opus-4-7; } + " + ] + rankdir=LR + + start [shape=Mdiamond, label="Start"] + exit [shape=Msquare, label="Exit"] + + toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] + preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] + preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] + fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] + implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] + simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] + simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] + verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] + fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] + + start -> toolchain + toolchain -> preflight_compile [condition="outcome=succeeded"] + toolchain -> exit + preflight_compile -> preflight_lint [condition="outcome=succeeded"] + preflight_compile -> exit + preflight_lint -> implement [condition="outcome=succeeded"] + preflight_lint -> fix_lints + fix_lints -> preflight_lint + implement -> simplify_opus -> simplify_gpt -> verify + verify -> exit [condition="outcome=succeeded"] + verify -> fixup + fixup -> verify +} diff --git a/run.json b/run.json new file mode 100644 index 000000000..f285ade0d --- /dev/null +++ b/run.json @@ -0,0 +1,514 @@ +{ + "title": "Server Sandbox Provider Enablement Implementation Plan", + "spec": { + "run_id": "01KSDGBEV87WMKH9NQ7301WCKA", + "settings": { + "project": { + "name": null, + "description": null, + "metadata": {} + }, + "workflow": { + "name": null, + "description": null, + "graph": "workflow.fabro", + "metadata": {} + }, + "run": { + "goal": { + "type": "inline", + "value": "# Server Sandbox Provider Enablement Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.\n\n**Goal:** Add server-owned sandbox provider enablement policy at `[server.sandbox.providers.]`, enforce it for launched runs, and make the installer write explicit provider policy entries.\n\n**Architecture:** Model sandbox provider policy as resolved server settings, separate from run environments. Missing config remains backward-compatible by resolving all providers to enabled, while explicit false values block the corresponding effective sandbox provider at server admission, preflight, and launch.\n\n**Tech Stack:** Rust, `serde`, existing `fabro-config` layer/resolve patterns, OpenAPI/progenitor, generated TypeScript API client, Axum server handlers, `cargo nextest`.\n\n---\n\n## File Structure\n\n- Modify `lib/crates/fabro-config/src/layers/server.rs`\n - Add sparse `[server.sandbox]` layer structs with closed `providers.local`, `providers.docker`, and `providers.daytona` tables.\n- Modify `lib/crates/fabro-config/src/resolve/server.rs`\n - Resolve missing sandbox provider policy to all providers enabled.\n- Modify `lib/crates/fabro-types/src/settings/server.rs`\n - Add resolved `ServerSandboxSettings`, `ServerSandboxProvidersSettings`, and `ServerSandboxProviderSettings` types under `ServerNamespace`.\n- Modify `lib/crates/fabro-install/src/lib.rs`\n - Make `write_sandbox_settings` write all three provider enablement tables with `enabled = true`.\n- Modify `lib/crates/fabro-server/src/run_manifest.rs` and `lib/crates/fabro-server/src/server/handler/runs.rs`\n - Add policy checks for run creation and preflight.\n- Modify `lib/crates/fabro-server/src/server.rs`\n - Add a launch-time recheck before sandbox setup.\n- Modify `docs/public/api-reference/fabro-api.yaml`\n - Include `server.sandbox` in the `ServerSettings` API shape.\n- Regenerate `lib/packages/fabro-api-client/src/models/*`\n - Include TypeScript client models for the new settings shape.\n- Modify docs:\n - `docs/public/administration/server-configuration.mdx`\n - `docs/public/administration/sandboxing.mdx`\n\n## Contract\n\nSupported TOML shape:\n\n```toml\n[server.sandbox.providers.local]\nenabled = true\n\n[server.sandbox.providers.docker]\nenabled = true\n\n[server.sandbox.providers.daytona]\nenabled = true\n```\n\nResolution rules:\n\n- Missing `[server.sandbox]` means all providers are enabled.\n- Missing `[server.sandbox.providers]` means all providers are enabled.\n- Missing individual provider tables mean that provider is enabled.\n- Missing individual `enabled` values mean that provider is enabled.\n- Unknown keys under `[server.sandbox]`, `[server.sandbox.providers]`, or provider tables are schema errors.\n\nPolicy rule:\n\n- The server checks the **effective** provider, after existing dry-run coercion from Docker/Daytona to Local.\n- Disabled-provider failures use this message:\n\n```text\nsandbox provider \"\" is disabled by server.sandbox.providers..enabled\n```\n\nInstaller rule:\n\n- Browser install and CLI/shared install persistence keep using the chosen sandbox provider as the default run environment.\n- Installer-generated `settings.toml` always writes all three sandbox provider entries with `enabled = true`.\n\n## Task 1: Add Server Config Types and Resolution\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/layers/server.rs`\n- Modify: `lib/crates/fabro-config/src/resolve/server.rs`\n- Modify: `lib/crates/fabro-types/src/settings/server.rs`\n- Test: `lib/crates/fabro-config/src/tests/resolve_server.rs`\n\n- [ ] **Step 1: Write failing config tests**\n\nAdd tests in `lib/crates/fabro-config/src/tests/resolve_server.rs`:\n\n```rust\n#[test]\nfn server_sandbox_defaults_all_providers_enabled() {\n let settings = super::server_settings_from_toml(\n r#\"\n_version = 1\n\n[server.auth]\nmethods = [\"dev-token\"]\n\"#,\n );\n\n let sandbox = settings.server.sandbox;\n assert!(sandbox.providers.local.enabled);\n assert!(sandbox.providers.docker.enabled);\n assert!(sandbox.providers.daytona.enabled);\n}\n\n#[test]\nfn server_sandbox_allows_partial_provider_overrides() {\n let settings = super::server_settings_from_toml(\n r#\"\n_version = 1\n\n[server.auth]\nmethods = [\"dev-token\"]\n\n[server.sandbox.providers.daytona]\nenabled = false\n\"#,\n );\n\n let sandbox = settings.server.sandbox;\n assert!(sandbox.providers.local.enabled);\n assert!(sandbox.providers.docker.enabled);\n assert!(!sandbox.providers.daytona.enabled);\n}\n\n#[test]\nfn parsing_rejects_unknown_server_sandbox_provider() {\n let err = fabro_config::ServerSettingsBuilder::from_toml(\n r#\"\n_version = 1\n\n[server.auth]\nmethods = [\"dev-token\"]\n\n[server.sandbox.providers.exe]\nenabled = true\n\"#,\n )\n .expect_err(\"unknown sandbox provider should be rejected\");\n\n assert!(\n err.to_string().contains(\"unknown field `exe`\"),\n \"unexpected error: {err}\"\n );\n}\n```\n\nRun:\n\n```bash\ncargo test -p fabro-config server_sandbox --quiet\ncargo test -p fabro-config parsing_rejects_unknown_server_sandbox_provider --quiet\n```\n\nExpected: tests fail because `server.sandbox` does not exist yet.\n\n- [ ] **Step 2: Add sparse config layer types**\n\nIn `lib/crates/fabro-config/src/layers/server.rs`, add `sandbox` to `ServerLayer`:\n\n```rust\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub sandbox: Option,\n```\n\nAdd the layer structs near the other server subdomain structs:\n\n```rust\n/// `[server.sandbox]` — server-owned sandbox provider policy.\n#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize, fabro_macros::Combine)]\n#[serde(deny_unknown_fields)]\npub struct ServerSandboxLayer {\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n pub providers: Option,\n}\n\n#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize, fabro_macros::Combine)]\n#[serde(deny_unknown_fields)]\npub struct ServerSandboxProvidersLayer {\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n pub local: Option,\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n pub docker: Option,\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n pub daytona: Option,\n}\n\n#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize, fabro_macros::Combine)]\n#[serde(deny_unknown_fields)]\npub struct ServerSandboxProviderLayer {\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n pub enabled: Option,\n}\n```\n\n- [ ] **Step 3: Add resolved server settings types**\n\nIn `lib/crates/fabro-types/src/settings/server.rs`, add `sandbox` to `ServerNamespace` after `ip_allowlist` or before `storage`:\n\n```rust\npub sandbox: ServerSandboxSettings,\n```\n\nUpdate `ServerNamespace::test_default()` to initialize it:\n\n```rust\nsandbox: ServerSandboxSettings::default(),\n```\n\nAdd resolved structs:\n\n```rust\n#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\npub struct ServerSandboxSettings {\n pub providers: ServerSandboxProvidersSettings,\n}\n\nimpl Default for ServerSandboxSettings {\n fn default() -> Self {\n Self {\n providers: ServerSandboxProvidersSettings::default(),\n }\n }\n}\n\n#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\npub struct ServerSandboxProvidersSettings {\n pub local: ServerSandboxProviderSettings,\n pub docker: ServerSandboxProviderSettings,\n pub daytona: ServerSandboxProviderSettings,\n}\n\nimpl Default for ServerSandboxProvidersSettings {\n fn default() -> Self {\n Self {\n local: ServerSandboxProviderSettings::default(),\n docker: ServerSandboxProviderSettings::default(),\n daytona: ServerSandboxProviderSettings::default(),\n }\n }\n}\n\n#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\npub struct ServerSandboxProviderSettings {\n pub enabled: bool,\n}\n\nimpl Default for ServerSandboxProviderSettings {\n fn default() -> Self {\n Self { enabled: true }\n }\n}\n```\n\n- [ ] **Step 4: Resolve the new settings**\n\nIn `lib/crates/fabro-config/src/resolve/server.rs`, import the new layer and resolved types, then add `sandbox` to `ServerNamespace` construction:\n\n```rust\nsandbox: resolve_sandbox(layer.sandbox.as_ref()),\n```\n\nAdd resolver helpers:\n\n```rust\nfn resolve_sandbox(layer: Option<&ServerSandboxLayer>) -> ServerSandboxSettings {\n let providers = layer.and_then(|sandbox| sandbox.providers.as_ref());\n ServerSandboxSettings {\n providers: ServerSandboxProvidersSettings {\n local: resolve_sandbox_provider(providers.and_then(|providers| providers.local.as_ref())),\n docker: resolve_sandbox_provider(providers.and_then(|providers| providers.docker.as_ref())),\n daytona: resolve_sandbox_provider(providers.and_then(|providers| providers.daytona.as_ref())),\n },\n }\n}\n\nfn resolve_sandbox_provider(\n layer: Option<&ServerSandboxProviderLayer>,\n) -> ServerSandboxProviderSettings {\n ServerSandboxProviderSettings {\n enabled: layer.and_then(|provider| provider.enabled).unwrap_or(true),\n }\n}\n```\n\n- [ ] **Step 5: Run config tests**\n\nRun:\n\n```bash\ncargo test -p fabro-config server_sandbox --quiet\ncargo test -p fabro-config parsing_rejects_unknown_server_sandbox_provider --quiet\n```\n\nExpected: all tests pass.\n\n## Task 2: Enforce Policy in Server Run Paths\n\n**Files:**\n- Modify: `lib/crates/fabro-server/src/run_manifest.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/runs.rs`\n- Modify: `lib/crates/fabro-server/src/server.rs`\n- Test: `lib/crates/fabro-server/src/server/tests.rs`\n- Test: `lib/crates/fabro-server/tests/it/api/runs.rs`\n\n- [ ] **Step 1: Add the shared policy helper**\n\nIn `lib/crates/fabro-server/src/run_manifest.rs`, add this helper near `resolve_sandbox_provider`:\n\n```rust\npub(crate) fn sandbox_provider_policy_error(\n server_settings: &fabro_types::ServerSettings,\n provider: SandboxProvider,\n) -> Option {\n let enabled = match provider {\n SandboxProvider::Local => server_settings.server.sandbox.providers.local.enabled,\n SandboxProvider::Docker => server_settings.server.sandbox.providers.docker.enabled,\n SandboxProvider::Daytona => server_settings.server.sandbox.providers.daytona.enabled,\n };\n\n (!enabled).then(|| {\n format!(\n \"sandbox provider \\\"{provider}\\\" is disabled by server.sandbox.providers.{provider}.enabled\"\n )\n })\n}\n\npub(crate) fn effective_sandbox_provider(settings: &RunNamespace) -> SandboxProvider {\n let provider = resolve_sandbox_provider(settings);\n if settings.execution.mode == RunMode::DryRun && !provider.is_local() {\n SandboxProvider::Local\n } else {\n provider\n }\n}\n```\n\nReplace local duplicate dry-run effective-provider logic in `build_preflight_report` with `effective_sandbox_provider(&resolved_run)`.\n\n- [ ] **Step 2: Add preflight policy failure**\n\nIn `build_preflight_report`, after `sandbox_provider` is computed and before runtime sandbox checks:\n\n```rust\nif let Some(error) = sandbox_provider_policy_error(&server_settings, sandbox_provider) {\n checks.push(CheckResult {\n name: \"Sandbox Provider Policy\".into(),\n status: CheckStatus::Error,\n summary: error,\n details: Vec::new(),\n remediation: None,\n });\n return Ok((\n CheckReport {\n title: \"Run Preflight\".into(),\n sections: vec![CheckSection {\n title: String::new(),\n checks,\n }],\n },\n false,\n ));\n}\n```\n\n- [ ] **Step 3: Reject disabled providers at run creation**\n\nIn `lib/crates/fabro-server/src/server/handler/runs.rs`, after `prepared` is created and before parent validation:\n\n```rust\nlet provider = run_manifest::effective_sandbox_provider(&prepared.settings.run);\nif let Some(error) = run_manifest::sandbox_provider_policy_error(&state.server_settings(), provider)\n{\n return ApiError::bad_request(error).into_response();\n}\n```\n\nThis deliberately uses the resolved run settings already produced by `prepare_manifest_with_environment_defaults`; sandbox provider selection is not graph-dependent.\n\n- [ ] **Step 4: Recheck policy at launch**\n\nIn `lib/crates/fabro-server/src/server.rs`, after loading `persisted` and before resolving GitHub credentials:\n\n```rust\nlet effective_provider = run_manifest::effective_sandbox_provider(&persisted.run_spec().settings.run);\nif let Some(error) = run_manifest::sandbox_provider_policy_error(&server_settings, effective_provider)\n{\n tracing::error!(run_id = %run_id, error = %error, \"Sandbox provider disabled by server policy\");\n fail_run_before_execution(&state, run_id, FailureReason::LaunchFailed, error).await;\n return;\n}\n```\n\n- [ ] **Step 5: Test server behavior**\n\nAdd tests covering:\n\n```rust\n#[test]\nfn sandbox_provider_policy_error_reports_disabled_provider() {\n let settings = server_settings_from_toml(\n r#\"\n_version = 1\n\n[server.auth]\nmethods = [\"dev-token\"]\n\n[server.sandbox.providers.daytona]\nenabled = false\n\"#,\n );\n\n assert_eq!(\n crate::run_manifest::sandbox_provider_policy_error(\n &settings,\n fabro_sandbox::SandboxProvider::Daytona,\n )\n .as_deref(),\n Some(\n \"sandbox provider \\\"daytona\\\" is disabled by server.sandbox.providers.daytona.enabled\"\n )\n );\n}\n```\n\nAdd an API integration test in `lib/crates/fabro-server/tests/it/api/runs.rs` that creates a test app with Daytona disabled and a manifest selecting a Daytona environment. Assert `POST /api/v1/runs` returns `400` and the policy message.\n\nAdd a preflight test that sends the same manifest to `/api/v1/runs/preflight` and asserts `ok = false` plus a `Sandbox Provider Policy` error check.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server sandbox_provider_policy\ncargo nextest run -p fabro-server --test it runs::create_run_rejects_disabled_sandbox_provider\n```\n\nExpected: all new tests pass.\n\n## Task 3: Update Installer Persistence\n\n**Files:**\n- Modify: `lib/crates/fabro-install/src/lib.rs`\n- Test: `lib/crates/fabro-install/src/lib.rs`\n- Test: `lib/crates/fabro-server/tests/it/api/install.rs`\n\n- [ ] **Step 1: Add installer unit assertions**\n\nExtend `write_sandbox_settings_records_docker_provider` and `write_sandbox_settings_records_daytona_provider` to assert all three provider policies:\n\n```rust\nfn sandbox_provider_enabled(doc: &toml::Value, provider: &str) -> Option {\n doc.get(\"server\")\n .and_then(toml::Value::as_table)\n .and_then(|server| server.get(\"sandbox\"))\n .and_then(toml::Value::as_table)\n .and_then(|sandbox| sandbox.get(\"providers\"))\n .and_then(toml::Value::as_table)\n .and_then(|providers| providers.get(provider))\n .and_then(toml::Value::as_table)\n .and_then(|provider| provider.get(\"enabled\"))\n .and_then(toml::Value::as_bool)\n}\n\nassert_eq!(sandbox_provider_enabled(&doc, \"local\"), Some(true));\nassert_eq!(sandbox_provider_enabled(&doc, \"docker\"), Some(true));\nassert_eq!(sandbox_provider_enabled(&doc, \"daytona\"), Some(true));\n```\n\nRun:\n\n```bash\ncargo test -p fabro-install write_sandbox_settings_records --quiet\n```\n\nExpected: tests fail because policy entries are not written yet.\n\n- [ ] **Step 2: Write all provider policy entries**\n\nAdd helper functions in `lib/crates/fabro-install/src/lib.rs`:\n\n```rust\nfn write_sandbox_provider_enabled(\n providers: &mut toml::Table,\n provider: &str,\n enabled: bool,\n) -> Result<()> {\n let table = ensure_table(providers, provider)?;\n table.insert(\"enabled\".to_string(), toml::Value::Boolean(enabled));\n Ok(())\n}\n\nfn write_sandbox_provider_policy(server: &mut toml::Table) -> Result<()> {\n let sandbox = ensure_table(server, \"sandbox\")?;\n let providers = ensure_table(sandbox, \"providers\")?;\n write_sandbox_provider_enabled(providers, \"local\", true)?;\n write_sandbox_provider_enabled(providers, \"docker\", true)?;\n write_sandbox_provider_enabled(providers, \"daytona\", true)?;\n Ok(())\n}\n```\n\nIn `write_sandbox_settings`, after obtaining the root table and before returning:\n\n```rust\nlet server = ensure_table(root, \"server\")?;\nwrite_sandbox_provider_policy(server)?;\n```\n\n- [ ] **Step 3: Update browser install finish tests**\n\nIn `lib/crates/fabro-server/tests/it/api/install.rs`, update Docker and Daytona install finish tests to assert:\n\n```rust\nassert!(settings.contains(\"[server.sandbox.providers.local]\"));\nassert!(settings.contains(\"[server.sandbox.providers.docker]\"));\nassert!(settings.contains(\"[server.sandbox.providers.daytona]\"));\nassert!(settings.contains(\"enabled = true\"));\n```\n\nAlso parse the generated settings with `ServerSettingsBuilder::from_toml` and assert all three resolved providers are enabled.\n\n- [ ] **Step 4: Run installer tests**\n\nRun:\n\n```bash\ncargo test -p fabro-install write_sandbox_settings_records --quiet\ncargo nextest run -p fabro-server --test it install::token_install_finish_persists_settings_env_and_vault\ncargo nextest run -p fabro-server --test it install::daytona_install_finish_writes_settings_and_vault_secret\n```\n\nExpected: all tests pass.\n\n## Task 4: Update API Schema, Generated Clients, and Docs\n\n**Files:**\n- Modify: `docs/public/api-reference/fabro-api.yaml`\n- Modify: `lib/crates/fabro-api/tests/server_settings_round_trip.rs`\n- Regenerate: `lib/packages/fabro-api-client/src/models/*`\n- Modify: `docs/public/administration/server-configuration.mdx`\n- Modify: `docs/public/administration/sandboxing.mdx`\n\n- [ ] **Step 1: Update OpenAPI server settings schema**\n\nIn `docs/public/api-reference/fabro-api.yaml`, add `sandbox` as required on `ServerNamespace` and define:\n\n```yaml\n ServerSandboxSettings:\n type: object\n required: [providers]\n properties:\n providers:\n $ref: \"#/components/schemas/ServerSandboxProvidersSettings\"\n\n ServerSandboxProvidersSettings:\n type: object\n required: [local, docker, daytona]\n properties:\n local:\n $ref: \"#/components/schemas/ServerSandboxProviderSettings\"\n docker:\n $ref: \"#/components/schemas/ServerSandboxProviderSettings\"\n daytona:\n $ref: \"#/components/schemas/ServerSandboxProviderSettings\"\n\n ServerSandboxProviderSettings:\n type: object\n required: [enabled]\n properties:\n enabled:\n type: boolean\n```\n\n- [ ] **Step 2: Update API round-trip test**\n\nIn `lib/crates/fabro-api/tests/server_settings_round_trip.rs`, add TOML to the sample:\n\n```toml\n[server.sandbox.providers.daytona]\nenabled = false\n```\n\nAdd JSON assertions:\n\n```rust\nassert_eq!(json[\"server\"][\"sandbox\"][\"providers\"][\"local\"][\"enabled\"], true);\nassert_eq!(json[\"server\"][\"sandbox\"][\"providers\"][\"docker\"][\"enabled\"], true);\nassert_eq!(json[\"server\"][\"sandbox\"][\"providers\"][\"daytona\"][\"enabled\"], false);\n```\n\n- [ ] **Step 3: Regenerate API artifacts**\n\nRun:\n\n```bash\ncargo build -p fabro-api\ncd lib/packages/fabro-api-client && bun run generate\n```\n\nExpected: generated Rust/API and TypeScript client types include the new sandbox settings models.\n\n- [ ] **Step 4: Update docs**\n\nIn `docs/public/administration/server-configuration.mdx`, add `[server.sandbox]` to the server-owned sections table and full reference:\n\n```toml\n[server.sandbox.providers.local]\nenabled = true\n\n[server.sandbox.providers.docker]\nenabled = true\n\n[server.sandbox.providers.daytona]\nenabled = true\n```\n\nAdd a short section:\n\n```md\n### `[server.sandbox.providers]` section\n\nControls which sandbox providers the server may launch. Missing provider entries default to `enabled = true` for backward compatibility. Disabling a provider rejects new runs whose effective provider is disabled; dry-run Docker/Daytona runs use the local provider and are governed by `server.sandbox.providers.local.enabled`.\n```\n\nIn `docs/public/administration/sandboxing.mdx`, add one paragraph pointing operators to `[server.sandbox.providers.]` for enable/disable policy.\n\n- [ ] **Step 5: Run API/docs tests**\n\nRun:\n\n```bash\ncargo test -p fabro-api server_settings_json_matches_openapi_shape --quiet\ncd apps/fabro-web && bun run typecheck\n```\n\nExpected: tests and typecheck pass.\n\n## Task 5: Final Verification\n\n**Files:**\n- No new files.\n\n- [ ] **Step 1: Run focused Rust tests**\n\nRun:\n\n```bash\ncargo test -p fabro-config server_sandbox --quiet\ncargo test -p fabro-install write_sandbox_settings_records --quiet\ncargo test -p fabro-api server_settings_json_matches_openapi_shape --quiet\ncargo nextest run -p fabro-server sandbox_provider_policy\n```\n\nExpected: all focused tests pass.\n\n- [ ] **Step 2: Run formatting and lint checks**\n\nRun:\n\n```bash\ncargo +nightly-2026-04-14 fmt --check --all\ncargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings\n```\n\nExpected: both pass.\n\n- [ ] **Step 3: Run frontend typecheck if generated TypeScript changed**\n\nRun:\n\n```bash\ncd apps/fabro-web && bun run typecheck\n```\n\nExpected: typecheck passes.\n\n- [ ] **Step 4: Commit**\n\nRun:\n\n```bash\ngit add lib/crates/fabro-config lib/crates/fabro-types lib/crates/fabro-install lib/crates/fabro-server docs/public lib/crates/fabro-api lib/packages/fabro-api-client apps/fabro-web\ngit commit -m \"feat: add server sandbox provider policy\"\n```\n\nExpected: commit succeeds with only intended files staged.\n" + }, + "working_dir": null, + "metadata": {}, + "inputs": {}, + "model": { + "provider": "anthropic", + "name": "claude-sonnet-4-6", + "fallbacks": [], + "controls": { + "reasoning_effort": null, + "speed": null + } + }, + "git": { + "author": null + }, + "prepare": { + "commands": [], + "timeout_ms": 300000 + }, + "execution": { + "mode": "normal", + "approval": "prompt" + }, + "checkpoint": { + "exclude_globs": [], + "skip_git_hooks": false + }, + "clone": { + "enabled": true + }, + "run_branch": { + "enabled": true, + "push": true + }, + "meta_branch": { + "enabled": true, + "push": true + }, + "environment": { + "id": "fabro-dev", + "provider": "daytona", + "image": { + "ref": "fabro-v12", + "dockerfile": { + "type": "inline", + "value": "FROM ubuntu:24.04\n\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n curl git ripgrep ca-certificates build-essential pkg-config libssl-dev unzip python3 \\\n xvfb xfce4 xfce4-terminal x11vnc novnc dbus-x11 \\\n libx11-6 libxrandr2 libxext6 libxrender1 libxfixes3 libxss1 libxtst6 libxi6 \\\n && rm -rf /var/lib/apt/lists/*\n\n# Install real Chromium (not the snap stub) via xtradeb PPA\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n software-properties-common curl gnupg \\\n && add-apt-repository -y ppa:xtradeb/apps \\\n && apt-get update \\\n && apt-get install -y --no-install-recommends chromium \\\n && rm -rf /var/lib/apt/lists/*\n\n# Wrapper: Chromium needs --no-sandbox when running as root in a container,\n# and --disable-dev-shm-usage avoids crashes from small /dev/shm\nRUN printf '#!/bin/bash\\nexec /usr/bin/chromium --no-sandbox --disable-dev-shm-usage \"$@\"\\n' \\\n > /usr/local/bin/chromium-wrapper \\\n && chmod +x /usr/local/bin/chromium-wrapper\n\n# Make the wrapper the default in the system .desktop file and via alternatives\nRUN sed -i 's|^Exec=.*|Exec=/usr/local/bin/chromium-wrapper %U|' \\\n /usr/share/applications/chromium.desktop \\\n && update-alternatives --install /usr/bin/x-www-browser x-www-browser \\\n /usr/local/bin/chromium-wrapper 100\n\n# Tell XFCE's exo-open that Chromium is the WebBrowser helper (system-wide)\nRUN mkdir -p /etc/xdg/xfce4 /usr/share/xfce4/helpers \\\n && printf 'WebBrowser=custom-WebBrowser\\n' > /etc/xdg/xfce4/helpers.rc \\\n && printf '[Desktop Entry]\\n\\\nVersion=1.0\\n\\\nType=X-XFCE-Helper\\n\\\nName=Chromium\\n\\\nIcon=chromium\\n\\\nX-XFCE-Category=WebBrowser\\n\\\nX-XFCE-CommandsWithParameter=/usr/local/bin/chromium-wrapper \"%%s\"\\n\\\nX-XFCE-Commands=/usr/local/bin/chromium-wrapper\\n' \\\n > /usr/share/xfce4/helpers/custom-WebBrowser.desktop\n\n# GitHub CLI\nRUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \\\n | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \\\n && echo \"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main\" \\\n | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \\\n && apt-get update && apt-get install -y --no-install-recommends gh \\\n && rm -rf /var/lib/apt/lists/*\n\n# Rust\nRUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y\nENV PATH=\"/root/.cargo/bin:${PATH}\"\nRUN rustup toolchain install nightly-2026-04-14 --profile minimal --component clippy,rustfmt\nRUN cargo install cargo-nextest --locked\nENV CARGO_INCREMENTAL=0\n\n# Bun\nRUN curl -fsSL https://bun.sh/install | bash\nENV PATH=\"/root/.bun/bin:${PATH}\"\n\nWORKDIR /root\n" + } + }, + "resources": { + "cpu": 8, + "memory": "16GB", + "disk": "20GB" + }, + "network": { + "mode": "allow_all", + "allow": [] + }, + "lifecycle": { + "preserve": false, + "stop_on_terminal": true, + "auto_stop": "30m" + }, + "labels": { + "repo": "fabro-sh/fabro" + }, + "volumes": [], + "env": {} + }, + "notifications": {}, + "interviews": { + "provider": null, + "slack": null + }, + "agent": { + "fabro_tools": false, + "permissions": null, + "mcps": {} + }, + "hooks": [], + "scm": { + "provider": null, + "owner": null, + "repository": null, + "github": null + }, + "pull_request": { + "enabled": true, + "draft": false, + "auto_merge": false, + "merge_strategy": "squash" + }, + "artifacts": { + "include": [] + }, + "integrations": { + "github": { + "permissions": {} + } + } + } + }, + "graph": { + "name": "ImplementPlan", + "nodes": { + "implement": { + "id": "implement", + "attrs": { + "prompt": { + "String": "Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD." + }, + "provider": { + "String": "openai" + }, + "label": { + "String": "Implement" + }, + "reasoning_effort": { + "String": "xhigh" + }, + "model": { + "String": "gpt-5.5" + } + } + }, + "exit": { + "id": "exit", + "attrs": { + "shape": { + "String": "Msquare" + }, + "model": { + "String": "claude-opus-4-7" + }, + "label": { + "String": "Exit" + }, + "provider": { + "String": "anthropic" + } + } + }, + "simplify_opus": { + "id": "simplify_opus", + "attrs": { + "label": { + "String": "Simplify (Opus)" + }, + "provider": { + "String": "anthropic" + }, + "model": { + "String": "claude-opus-4-7" + }, + "prompt": { + "String": "# Simplify: Code Review and Cleanup\n\nReview changes vs. origin for reuse, quality, and efficiency. Fix any issues found.\n\n## Phase 1: Identify Changes\n\nRun git diff (or git diff HEAD if there are staged changes) to see what changed. If there are no git changes, review the most recently modified files that the user mentioned or that you edited earlier in this conversation.\n\n## Phase 2: Launch Three Review Agents in Parallel\n\nUse the Agent tool to launch all three agents concurrently in a single message. Pass each agent the full diff so it has the complete context.\n\n### Agent 1: Code Reuse Review\n\nFor each change:\n\n1. Search for existing utilities and helpers that could replace newly written code. Use Grep to find similar patterns elsewhere in the codebase — common locations are utility directories, shared modules, and files adjacent to the changed ones.\n2. Flag any new function that duplicates existing functionality. Suggest the existing function to use instead.\n3. Flag any inline logic that could use an existing utility — hand-rolled string manipulation, manual path handling, custom environment checks, ad-hoc type guards, and similar patterns are common candidates.\n\nNote: This is a greenfield app, so focus on maximizing simplicity and don't worry about changing things to achieve it.\n\n### Agent 2: Code Quality Review\n\nReview the same changes for hacky patterns:\n\n1. Redundant state: state that duplicates existing state, cached values that could be derived, observers/effects that could be direct calls\n2. Parameter sprawl: adding new parameters to a function instead of generalizing or restructuring existing ones\n3. Copy-paste with slight variation: near-duplicate code blocks that should be unified with a shared abstraction\n4. Leaky abstractions: exposing internal details that should be encapsulated, or breaking existing abstraction boundaries\n5. Stringly-typed code: using raw strings where constants, enums (string unions), or branded types already exist in the codebase\n\nNote: This is a greenfield app, so be aggressive in optimizing quality.\n\n### Agent 3: Efficiency Review\n\nReview the same changes for efficiency:\n\n1. Unnecessary work: redundant computations, repeated file reads, duplicate network/API calls, N+1 patterns\n2. Missed concurrency: independent operations run sequentially when they could run in parallel\n3. Hot-path bloat: new blocking work added to startup or per-request/per-render hot paths\n4. Unnecessary existence checks: pre-checking file/resource existence before operating (TOCTOU anti-pattern) — operate directly and handle the error\n5. Memory: unbounded data structures, missing cleanup, event listener leaks\n6. Overly broad operations: reading entire files when only a portion is needed, loading all items when filtering for one\n\n## Phase 3: Fix Issues\n\nWait for all three agents to complete. Aggregate their findings and fix each issue directly. If a finding is a false positive or not worth addressing, note it and move on — do not argue with the finding, just skip it.\n\nWhen done, briefly summarize what was fixed (or confirm the code was already clean)." + } + } + }, + "fixup": { + "id": "fixup", + "attrs": { + "label": { + "String": "Fixup" + }, + "max_visits": { + "Integer": 3 + }, + "model": { + "String": "claude-opus-4-7" + }, + "provider": { + "String": "anthropic" + }, + "prompt": { + "String": "The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures." + } + } + }, + "toolchain": { + "id": "toolchain", + "attrs": { + "script": { + "String": "command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1" + }, + "label": { + "String": "Toolchain" + }, + "max_retries": { + "Integer": 0 + }, + "shape": { + "String": "parallelogram" + }, + "model": { + "String": "claude-opus-4-7" + }, + "provider": { + "String": "anthropic" + } + } + }, + "simplify_gpt": { + "id": "simplify_gpt", + "attrs": { + "prompt": { + "String": "# Simplify: Code Review and Cleanup\n\nReview changes vs. origin for reuse, quality, and efficiency. Fix any issues found.\n\n## Phase 1: Identify Changes\n\nRun git diff (or git diff HEAD if there are staged changes) to see what changed. If there are no git changes, review the most recently modified files that the user mentioned or that you edited earlier in this conversation.\n\n## Phase 2: Launch Three Review Agents in Parallel\n\nUse the Agent tool to launch all three agents concurrently in a single message. Pass each agent the full diff so it has the complete context.\n\n### Agent 1: Code Reuse Review\n\nFor each change:\n\n1. Search for existing utilities and helpers that could replace newly written code. Use Grep to find similar patterns elsewhere in the codebase — common locations are utility directories, shared modules, and files adjacent to the changed ones.\n2. Flag any new function that duplicates existing functionality. Suggest the existing function to use instead.\n3. Flag any inline logic that could use an existing utility — hand-rolled string manipulation, manual path handling, custom environment checks, ad-hoc type guards, and similar patterns are common candidates.\n\nNote: This is a greenfield app, so focus on maximizing simplicity and don't worry about changing things to achieve it.\n\n### Agent 2: Code Quality Review\n\nReview the same changes for hacky patterns:\n\n1. Redundant state: state that duplicates existing state, cached values that could be derived, observers/effects that could be direct calls\n2. Parameter sprawl: adding new parameters to a function instead of generalizing or restructuring existing ones\n3. Copy-paste with slight variation: near-duplicate code blocks that should be unified with a shared abstraction\n4. Leaky abstractions: exposing internal details that should be encapsulated, or breaking existing abstraction boundaries\n5. Stringly-typed code: using raw strings where constants, enums (string unions), or branded types already exist in the codebase\n\nNote: This is a greenfield app, so be aggressive in optimizing quality.\n\n### Agent 3: Efficiency Review\n\nReview the same changes for efficiency:\n\n1. Unnecessary work: redundant computations, repeated file reads, duplicate network/API calls, N+1 patterns\n2. Missed concurrency: independent operations run sequentially when they could run in parallel\n3. Hot-path bloat: new blocking work added to startup or per-request/per-render hot paths\n4. Unnecessary existence checks: pre-checking file/resource existence before operating (TOCTOU anti-pattern) — operate directly and handle the error\n5. Memory: unbounded data structures, missing cleanup, event listener leaks\n6. Overly broad operations: reading entire files when only a portion is needed, loading all items when filtering for one\n\n## Phase 3: Fix Issues\n\nWait for all three agents to complete. Aggregate their findings and fix each issue directly. If a finding is a false positive or not worth addressing, note it and move on — do not argue with the finding, just skip it.\n\nWhen done, briefly summarize what was fixed (or confirm the code was already clean)." + }, + "model": { + "String": "gpt-5.5" + }, + "provider": { + "String": "openai" + }, + "label": { + "String": "Simplify (GPT-55)" + } + } + }, + "preflight_compile": { + "id": "preflight_compile", + "attrs": { + "provider": { + "String": "anthropic" + }, + "max_retries": { + "Integer": 0 + }, + "script": { + "String": "cargo check -q --workspace 2>&1" + }, + "model": { + "String": "claude-opus-4-7" + }, + "shape": { + "String": "parallelogram" + }, + "label": { + "String": "Preflight Compile" + } + } + }, + "start": { + "id": "start", + "attrs": { + "provider": { + "String": "anthropic" + }, + "model": { + "String": "claude-opus-4-7" + }, + "shape": { + "String": "Mdiamond" + }, + "label": { + "String": "Start" + } + } + }, + "verify": { + "id": "verify", + "attrs": { + "script": { + "String": "git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\\bActorRef\\b|\\bActorKind\\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\\s*==\\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1" + }, + "label": { + "String": "Verify" + }, + "retry_target": { + "String": "fixup" + }, + "model": { + "String": "claude-opus-4-7" + }, + "goal_gate": { + "Boolean": true + }, + "shape": { + "String": "parallelogram" + }, + "provider": { + "String": "anthropic" + } + } + }, + "fix_lints": { + "id": "fix_lints", + "attrs": { + "prompt": { + "String": "The preflight lint step failed. Read the build output from context and fix all clippy lint warnings." + }, + "label": { + "String": "Fix Lints" + }, + "model": { + "String": "claude-opus-4-7" + }, + "max_visits": { + "Integer": 3 + }, + "provider": { + "String": "anthropic" + } + } + }, + "preflight_lint": { + "id": "preflight_lint", + "attrs": { + "max_retries": { + "Integer": 0 + }, + "shape": { + "String": "parallelogram" + }, + "script": { + "String": "cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1" + }, + "label": { + "String": "Preflight Lint" + }, + "model": { + "String": "claude-opus-4-7" + }, + "provider": { + "String": "anthropic" + } + } + } + }, + "edges": [ + { + "from": "start", + "to": "toolchain", + "attrs": {} + }, + { + "from": "toolchain", + "to": "preflight_compile", + "attrs": { + "condition": { + "String": "outcome=succeeded" + } + } + }, + { + "from": "toolchain", + "to": "exit", + "attrs": {} + }, + { + "from": "preflight_compile", + "to": "preflight_lint", + "attrs": { + "condition": { + "String": "outcome=succeeded" + } + } + }, + { + "from": "preflight_compile", + "to": "exit", + "attrs": {} + }, + { + "from": "preflight_lint", + "to": "implement", + "attrs": { + "condition": { + "String": "outcome=succeeded" + } + } + }, + { + "from": "preflight_lint", + "to": "fix_lints", + "attrs": {} + }, + { + "from": "fix_lints", + "to": "preflight_lint", + "attrs": {} + }, + { + "from": "implement", + "to": "simplify_opus", + "attrs": {} + }, + { + "from": "simplify_opus", + "to": "simplify_gpt", + "attrs": {} + }, + { + "from": "simplify_gpt", + "to": "verify", + "attrs": {} + }, + { + "from": "verify", + "to": "exit", + "attrs": { + "condition": { + "String": "outcome=succeeded" + } + } + }, + { + "from": "verify", + "to": "fixup", + "attrs": {} + }, + { + "from": "fixup", + "to": "verify", + "attrs": {} + } + ], + "attrs": { + "goal": { + "String": "# Server Sandbox Provider Enablement Implementation Plan\n\n> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.\n\n**Goal:** Add server-owned sandbox provider enablement policy at `[server.sandbox.providers.]`, enforce it for launched runs, and make the installer write explicit provider policy entries.\n\n**Architecture:** Model sandbox provider policy as resolved server settings, separate from run environments. Missing config remains backward-compatible by resolving all providers to enabled, while explicit false values block the corresponding effective sandbox provider at server admission, preflight, and launch.\n\n**Tech Stack:** Rust, `serde`, existing `fabro-config` layer/resolve patterns, OpenAPI/progenitor, generated TypeScript API client, Axum server handlers, `cargo nextest`.\n\n---\n\n## File Structure\n\n- Modify `lib/crates/fabro-config/src/layers/server.rs`\n - Add sparse `[server.sandbox]` layer structs with closed `providers.local`, `providers.docker`, and `providers.daytona` tables.\n- Modify `lib/crates/fabro-config/src/resolve/server.rs`\n - Resolve missing sandbox provider policy to all providers enabled.\n- Modify `lib/crates/fabro-types/src/settings/server.rs`\n - Add resolved `ServerSandboxSettings`, `ServerSandboxProvidersSettings`, and `ServerSandboxProviderSettings` types under `ServerNamespace`.\n- Modify `lib/crates/fabro-install/src/lib.rs`\n - Make `write_sandbox_settings` write all three provider enablement tables with `enabled = true`.\n- Modify `lib/crates/fabro-server/src/run_manifest.rs` and `lib/crates/fabro-server/src/server/handler/runs.rs`\n - Add policy checks for run creation and preflight.\n- Modify `lib/crates/fabro-server/src/server.rs`\n - Add a launch-time recheck before sandbox setup.\n- Modify `docs/public/api-reference/fabro-api.yaml`\n - Include `server.sandbox` in the `ServerSettings` API shape.\n- Regenerate `lib/packages/fabro-api-client/src/models/*`\n - Include TypeScript client models for the new settings shape.\n- Modify docs:\n - `docs/public/administration/server-configuration.mdx`\n - `docs/public/administration/sandboxing.mdx`\n\n## Contract\n\nSupported TOML shape:\n\n```toml\n[server.sandbox.providers.local]\nenabled = true\n\n[server.sandbox.providers.docker]\nenabled = true\n\n[server.sandbox.providers.daytona]\nenabled = true\n```\n\nResolution rules:\n\n- Missing `[server.sandbox]` means all providers are enabled.\n- Missing `[server.sandbox.providers]` means all providers are enabled.\n- Missing individual provider tables mean that provider is enabled.\n- Missing individual `enabled` values mean that provider is enabled.\n- Unknown keys under `[server.sandbox]`, `[server.sandbox.providers]`, or provider tables are schema errors.\n\nPolicy rule:\n\n- The server checks the **effective** provider, after existing dry-run coercion from Docker/Daytona to Local.\n- Disabled-provider failures use this message:\n\n```text\nsandbox provider \"\" is disabled by server.sandbox.providers..enabled\n```\n\nInstaller rule:\n\n- Browser install and CLI/shared install persistence keep using the chosen sandbox provider as the default run environment.\n- Installer-generated `settings.toml` always writes all three sandbox provider entries with `enabled = true`.\n\n## Task 1: Add Server Config Types and Resolution\n\n**Files:**\n- Modify: `lib/crates/fabro-config/src/layers/server.rs`\n- Modify: `lib/crates/fabro-config/src/resolve/server.rs`\n- Modify: `lib/crates/fabro-types/src/settings/server.rs`\n- Test: `lib/crates/fabro-config/src/tests/resolve_server.rs`\n\n- [ ] **Step 1: Write failing config tests**\n\nAdd tests in `lib/crates/fabro-config/src/tests/resolve_server.rs`:\n\n```rust\n#[test]\nfn server_sandbox_defaults_all_providers_enabled() {\n let settings = super::server_settings_from_toml(\n r#\"\n_version = 1\n\n[server.auth]\nmethods = [\"dev-token\"]\n\"#,\n );\n\n let sandbox = settings.server.sandbox;\n assert!(sandbox.providers.local.enabled);\n assert!(sandbox.providers.docker.enabled);\n assert!(sandbox.providers.daytona.enabled);\n}\n\n#[test]\nfn server_sandbox_allows_partial_provider_overrides() {\n let settings = super::server_settings_from_toml(\n r#\"\n_version = 1\n\n[server.auth]\nmethods = [\"dev-token\"]\n\n[server.sandbox.providers.daytona]\nenabled = false\n\"#,\n );\n\n let sandbox = settings.server.sandbox;\n assert!(sandbox.providers.local.enabled);\n assert!(sandbox.providers.docker.enabled);\n assert!(!sandbox.providers.daytona.enabled);\n}\n\n#[test]\nfn parsing_rejects_unknown_server_sandbox_provider() {\n let err = fabro_config::ServerSettingsBuilder::from_toml(\n r#\"\n_version = 1\n\n[server.auth]\nmethods = [\"dev-token\"]\n\n[server.sandbox.providers.exe]\nenabled = true\n\"#,\n )\n .expect_err(\"unknown sandbox provider should be rejected\");\n\n assert!(\n err.to_string().contains(\"unknown field `exe`\"),\n \"unexpected error: {err}\"\n );\n}\n```\n\nRun:\n\n```bash\ncargo test -p fabro-config server_sandbox --quiet\ncargo test -p fabro-config parsing_rejects_unknown_server_sandbox_provider --quiet\n```\n\nExpected: tests fail because `server.sandbox` does not exist yet.\n\n- [ ] **Step 2: Add sparse config layer types**\n\nIn `lib/crates/fabro-config/src/layers/server.rs`, add `sandbox` to `ServerLayer`:\n\n```rust\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub sandbox: Option,\n```\n\nAdd the layer structs near the other server subdomain structs:\n\n```rust\n/// `[server.sandbox]` — server-owned sandbox provider policy.\n#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize, fabro_macros::Combine)]\n#[serde(deny_unknown_fields)]\npub struct ServerSandboxLayer {\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n pub providers: Option,\n}\n\n#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize, fabro_macros::Combine)]\n#[serde(deny_unknown_fields)]\npub struct ServerSandboxProvidersLayer {\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n pub local: Option,\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n pub docker: Option,\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n pub daytona: Option,\n}\n\n#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize, fabro_macros::Combine)]\n#[serde(deny_unknown_fields)]\npub struct ServerSandboxProviderLayer {\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n pub enabled: Option,\n}\n```\n\n- [ ] **Step 3: Add resolved server settings types**\n\nIn `lib/crates/fabro-types/src/settings/server.rs`, add `sandbox` to `ServerNamespace` after `ip_allowlist` or before `storage`:\n\n```rust\npub sandbox: ServerSandboxSettings,\n```\n\nUpdate `ServerNamespace::test_default()` to initialize it:\n\n```rust\nsandbox: ServerSandboxSettings::default(),\n```\n\nAdd resolved structs:\n\n```rust\n#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\npub struct ServerSandboxSettings {\n pub providers: ServerSandboxProvidersSettings,\n}\n\nimpl Default for ServerSandboxSettings {\n fn default() -> Self {\n Self {\n providers: ServerSandboxProvidersSettings::default(),\n }\n }\n}\n\n#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\npub struct ServerSandboxProvidersSettings {\n pub local: ServerSandboxProviderSettings,\n pub docker: ServerSandboxProviderSettings,\n pub daytona: ServerSandboxProviderSettings,\n}\n\nimpl Default for ServerSandboxProvidersSettings {\n fn default() -> Self {\n Self {\n local: ServerSandboxProviderSettings::default(),\n docker: ServerSandboxProviderSettings::default(),\n daytona: ServerSandboxProviderSettings::default(),\n }\n }\n}\n\n#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\npub struct ServerSandboxProviderSettings {\n pub enabled: bool,\n}\n\nimpl Default for ServerSandboxProviderSettings {\n fn default() -> Self {\n Self { enabled: true }\n }\n}\n```\n\n- [ ] **Step 4: Resolve the new settings**\n\nIn `lib/crates/fabro-config/src/resolve/server.rs`, import the new layer and resolved types, then add `sandbox` to `ServerNamespace` construction:\n\n```rust\nsandbox: resolve_sandbox(layer.sandbox.as_ref()),\n```\n\nAdd resolver helpers:\n\n```rust\nfn resolve_sandbox(layer: Option<&ServerSandboxLayer>) -> ServerSandboxSettings {\n let providers = layer.and_then(|sandbox| sandbox.providers.as_ref());\n ServerSandboxSettings {\n providers: ServerSandboxProvidersSettings {\n local: resolve_sandbox_provider(providers.and_then(|providers| providers.local.as_ref())),\n docker: resolve_sandbox_provider(providers.and_then(|providers| providers.docker.as_ref())),\n daytona: resolve_sandbox_provider(providers.and_then(|providers| providers.daytona.as_ref())),\n },\n }\n}\n\nfn resolve_sandbox_provider(\n layer: Option<&ServerSandboxProviderLayer>,\n) -> ServerSandboxProviderSettings {\n ServerSandboxProviderSettings {\n enabled: layer.and_then(|provider| provider.enabled).unwrap_or(true),\n }\n}\n```\n\n- [ ] **Step 5: Run config tests**\n\nRun:\n\n```bash\ncargo test -p fabro-config server_sandbox --quiet\ncargo test -p fabro-config parsing_rejects_unknown_server_sandbox_provider --quiet\n```\n\nExpected: all tests pass.\n\n## Task 2: Enforce Policy in Server Run Paths\n\n**Files:**\n- Modify: `lib/crates/fabro-server/src/run_manifest.rs`\n- Modify: `lib/crates/fabro-server/src/server/handler/runs.rs`\n- Modify: `lib/crates/fabro-server/src/server.rs`\n- Test: `lib/crates/fabro-server/src/server/tests.rs`\n- Test: `lib/crates/fabro-server/tests/it/api/runs.rs`\n\n- [ ] **Step 1: Add the shared policy helper**\n\nIn `lib/crates/fabro-server/src/run_manifest.rs`, add this helper near `resolve_sandbox_provider`:\n\n```rust\npub(crate) fn sandbox_provider_policy_error(\n server_settings: &fabro_types::ServerSettings,\n provider: SandboxProvider,\n) -> Option {\n let enabled = match provider {\n SandboxProvider::Local => server_settings.server.sandbox.providers.local.enabled,\n SandboxProvider::Docker => server_settings.server.sandbox.providers.docker.enabled,\n SandboxProvider::Daytona => server_settings.server.sandbox.providers.daytona.enabled,\n };\n\n (!enabled).then(|| {\n format!(\n \"sandbox provider \\\"{provider}\\\" is disabled by server.sandbox.providers.{provider}.enabled\"\n )\n })\n}\n\npub(crate) fn effective_sandbox_provider(settings: &RunNamespace) -> SandboxProvider {\n let provider = resolve_sandbox_provider(settings);\n if settings.execution.mode == RunMode::DryRun && !provider.is_local() {\n SandboxProvider::Local\n } else {\n provider\n }\n}\n```\n\nReplace local duplicate dry-run effective-provider logic in `build_preflight_report` with `effective_sandbox_provider(&resolved_run)`.\n\n- [ ] **Step 2: Add preflight policy failure**\n\nIn `build_preflight_report`, after `sandbox_provider` is computed and before runtime sandbox checks:\n\n```rust\nif let Some(error) = sandbox_provider_policy_error(&server_settings, sandbox_provider) {\n checks.push(CheckResult {\n name: \"Sandbox Provider Policy\".into(),\n status: CheckStatus::Error,\n summary: error,\n details: Vec::new(),\n remediation: None,\n });\n return Ok((\n CheckReport {\n title: \"Run Preflight\".into(),\n sections: vec![CheckSection {\n title: String::new(),\n checks,\n }],\n },\n false,\n ));\n}\n```\n\n- [ ] **Step 3: Reject disabled providers at run creation**\n\nIn `lib/crates/fabro-server/src/server/handler/runs.rs`, after `prepared` is created and before parent validation:\n\n```rust\nlet provider = run_manifest::effective_sandbox_provider(&prepared.settings.run);\nif let Some(error) = run_manifest::sandbox_provider_policy_error(&state.server_settings(), provider)\n{\n return ApiError::bad_request(error).into_response();\n}\n```\n\nThis deliberately uses the resolved run settings already produced by `prepare_manifest_with_environment_defaults`; sandbox provider selection is not graph-dependent.\n\n- [ ] **Step 4: Recheck policy at launch**\n\nIn `lib/crates/fabro-server/src/server.rs`, after loading `persisted` and before resolving GitHub credentials:\n\n```rust\nlet effective_provider = run_manifest::effective_sandbox_provider(&persisted.run_spec().settings.run);\nif let Some(error) = run_manifest::sandbox_provider_policy_error(&server_settings, effective_provider)\n{\n tracing::error!(run_id = %run_id, error = %error, \"Sandbox provider disabled by server policy\");\n fail_run_before_execution(&state, run_id, FailureReason::LaunchFailed, error).await;\n return;\n}\n```\n\n- [ ] **Step 5: Test server behavior**\n\nAdd tests covering:\n\n```rust\n#[test]\nfn sandbox_provider_policy_error_reports_disabled_provider() {\n let settings = server_settings_from_toml(\n r#\"\n_version = 1\n\n[server.auth]\nmethods = [\"dev-token\"]\n\n[server.sandbox.providers.daytona]\nenabled = false\n\"#,\n );\n\n assert_eq!(\n crate::run_manifest::sandbox_provider_policy_error(\n &settings,\n fabro_sandbox::SandboxProvider::Daytona,\n )\n .as_deref(),\n Some(\n \"sandbox provider \\\"daytona\\\" is disabled by server.sandbox.providers.daytona.enabled\"\n )\n );\n}\n```\n\nAdd an API integration test in `lib/crates/fabro-server/tests/it/api/runs.rs` that creates a test app with Daytona disabled and a manifest selecting a Daytona environment. Assert `POST /api/v1/runs` returns `400` and the policy message.\n\nAdd a preflight test that sends the same manifest to `/api/v1/runs/preflight` and asserts `ok = false` plus a `Sandbox Provider Policy` error check.\n\nRun:\n\n```bash\ncargo nextest run -p fabro-server sandbox_provider_policy\ncargo nextest run -p fabro-server --test it runs::create_run_rejects_disabled_sandbox_provider\n```\n\nExpected: all new tests pass.\n\n## Task 3: Update Installer Persistence\n\n**Files:**\n- Modify: `lib/crates/fabro-install/src/lib.rs`\n- Test: `lib/crates/fabro-install/src/lib.rs`\n- Test: `lib/crates/fabro-server/tests/it/api/install.rs`\n\n- [ ] **Step 1: Add installer unit assertions**\n\nExtend `write_sandbox_settings_records_docker_provider` and `write_sandbox_settings_records_daytona_provider` to assert all three provider policies:\n\n```rust\nfn sandbox_provider_enabled(doc: &toml::Value, provider: &str) -> Option {\n doc.get(\"server\")\n .and_then(toml::Value::as_table)\n .and_then(|server| server.get(\"sandbox\"))\n .and_then(toml::Value::as_table)\n .and_then(|sandbox| sandbox.get(\"providers\"))\n .and_then(toml::Value::as_table)\n .and_then(|providers| providers.get(provider))\n .and_then(toml::Value::as_table)\n .and_then(|provider| provider.get(\"enabled\"))\n .and_then(toml::Value::as_bool)\n}\n\nassert_eq!(sandbox_provider_enabled(&doc, \"local\"), Some(true));\nassert_eq!(sandbox_provider_enabled(&doc, \"docker\"), Some(true));\nassert_eq!(sandbox_provider_enabled(&doc, \"daytona\"), Some(true));\n```\n\nRun:\n\n```bash\ncargo test -p fabro-install write_sandbox_settings_records --quiet\n```\n\nExpected: tests fail because policy entries are not written yet.\n\n- [ ] **Step 2: Write all provider policy entries**\n\nAdd helper functions in `lib/crates/fabro-install/src/lib.rs`:\n\n```rust\nfn write_sandbox_provider_enabled(\n providers: &mut toml::Table,\n provider: &str,\n enabled: bool,\n) -> Result<()> {\n let table = ensure_table(providers, provider)?;\n table.insert(\"enabled\".to_string(), toml::Value::Boolean(enabled));\n Ok(())\n}\n\nfn write_sandbox_provider_policy(server: &mut toml::Table) -> Result<()> {\n let sandbox = ensure_table(server, \"sandbox\")?;\n let providers = ensure_table(sandbox, \"providers\")?;\n write_sandbox_provider_enabled(providers, \"local\", true)?;\n write_sandbox_provider_enabled(providers, \"docker\", true)?;\n write_sandbox_provider_enabled(providers, \"daytona\", true)?;\n Ok(())\n}\n```\n\nIn `write_sandbox_settings`, after obtaining the root table and before returning:\n\n```rust\nlet server = ensure_table(root, \"server\")?;\nwrite_sandbox_provider_policy(server)?;\n```\n\n- [ ] **Step 3: Update browser install finish tests**\n\nIn `lib/crates/fabro-server/tests/it/api/install.rs`, update Docker and Daytona install finish tests to assert:\n\n```rust\nassert!(settings.contains(\"[server.sandbox.providers.local]\"));\nassert!(settings.contains(\"[server.sandbox.providers.docker]\"));\nassert!(settings.contains(\"[server.sandbox.providers.daytona]\"));\nassert!(settings.contains(\"enabled = true\"));\n```\n\nAlso parse the generated settings with `ServerSettingsBuilder::from_toml` and assert all three resolved providers are enabled.\n\n- [ ] **Step 4: Run installer tests**\n\nRun:\n\n```bash\ncargo test -p fabro-install write_sandbox_settings_records --quiet\ncargo nextest run -p fabro-server --test it install::token_install_finish_persists_settings_env_and_vault\ncargo nextest run -p fabro-server --test it install::daytona_install_finish_writes_settings_and_vault_secret\n```\n\nExpected: all tests pass.\n\n## Task 4: Update API Schema, Generated Clients, and Docs\n\n**Files:**\n- Modify: `docs/public/api-reference/fabro-api.yaml`\n- Modify: `lib/crates/fabro-api/tests/server_settings_round_trip.rs`\n- Regenerate: `lib/packages/fabro-api-client/src/models/*`\n- Modify: `docs/public/administration/server-configuration.mdx`\n- Modify: `docs/public/administration/sandboxing.mdx`\n\n- [ ] **Step 1: Update OpenAPI server settings schema**\n\nIn `docs/public/api-reference/fabro-api.yaml`, add `sandbox` as required on `ServerNamespace` and define:\n\n```yaml\n ServerSandboxSettings:\n type: object\n required: [providers]\n properties:\n providers:\n $ref: \"#/components/schemas/ServerSandboxProvidersSettings\"\n\n ServerSandboxProvidersSettings:\n type: object\n required: [local, docker, daytona]\n properties:\n local:\n $ref: \"#/components/schemas/ServerSandboxProviderSettings\"\n docker:\n $ref: \"#/components/schemas/ServerSandboxProviderSettings\"\n daytona:\n $ref: \"#/components/schemas/ServerSandboxProviderSettings\"\n\n ServerSandboxProviderSettings:\n type: object\n required: [enabled]\n properties:\n enabled:\n type: boolean\n```\n\n- [ ] **Step 2: Update API round-trip test**\n\nIn `lib/crates/fabro-api/tests/server_settings_round_trip.rs`, add TOML to the sample:\n\n```toml\n[server.sandbox.providers.daytona]\nenabled = false\n```\n\nAdd JSON assertions:\n\n```rust\nassert_eq!(json[\"server\"][\"sandbox\"][\"providers\"][\"local\"][\"enabled\"], true);\nassert_eq!(json[\"server\"][\"sandbox\"][\"providers\"][\"docker\"][\"enabled\"], true);\nassert_eq!(json[\"server\"][\"sandbox\"][\"providers\"][\"daytona\"][\"enabled\"], false);\n```\n\n- [ ] **Step 3: Regenerate API artifacts**\n\nRun:\n\n```bash\ncargo build -p fabro-api\ncd lib/packages/fabro-api-client && bun run generate\n```\n\nExpected: generated Rust/API and TypeScript client types include the new sandbox settings models.\n\n- [ ] **Step 4: Update docs**\n\nIn `docs/public/administration/server-configuration.mdx`, add `[server.sandbox]` to the server-owned sections table and full reference:\n\n```toml\n[server.sandbox.providers.local]\nenabled = true\n\n[server.sandbox.providers.docker]\nenabled = true\n\n[server.sandbox.providers.daytona]\nenabled = true\n```\n\nAdd a short section:\n\n```md\n### `[server.sandbox.providers]` section\n\nControls which sandbox providers the server may launch. Missing provider entries default to `enabled = true` for backward compatibility. Disabling a provider rejects new runs whose effective provider is disabled; dry-run Docker/Daytona runs use the local provider and are governed by `server.sandbox.providers.local.enabled`.\n```\n\nIn `docs/public/administration/sandboxing.mdx`, add one paragraph pointing operators to `[server.sandbox.providers.]` for enable/disable policy.\n\n- [ ] **Step 5: Run API/docs tests**\n\nRun:\n\n```bash\ncargo test -p fabro-api server_settings_json_matches_openapi_shape --quiet\ncd apps/fabro-web && bun run typecheck\n```\n\nExpected: tests and typecheck pass.\n\n## Task 5: Final Verification\n\n**Files:**\n- No new files.\n\n- [ ] **Step 1: Run focused Rust tests**\n\nRun:\n\n```bash\ncargo test -p fabro-config server_sandbox --quiet\ncargo test -p fabro-install write_sandbox_settings_records --quiet\ncargo test -p fabro-api server_settings_json_matches_openapi_shape --quiet\ncargo nextest run -p fabro-server sandbox_provider_policy\n```\n\nExpected: all focused tests pass.\n\n- [ ] **Step 2: Run formatting and lint checks**\n\nRun:\n\n```bash\ncargo +nightly-2026-04-14 fmt --check --all\ncargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings\n```\n\nExpected: both pass.\n\n- [ ] **Step 3: Run frontend typecheck if generated TypeScript changed**\n\nRun:\n\n```bash\ncd apps/fabro-web && bun run typecheck\n```\n\nExpected: typecheck passes.\n\n- [ ] **Step 4: Commit**\n\nRun:\n\n```bash\ngit add lib/crates/fabro-config lib/crates/fabro-types lib/crates/fabro-install lib/crates/fabro-server docs/public lib/crates/fabro-api lib/packages/fabro-api-client apps/fabro-web\ngit commit -m \"feat: add server sandbox provider policy\"\n```\n\nExpected: commit succeeds with only intended files staged.\n" + }, + "rankdir": { + "String": "LR" + }, + "model_stylesheet": { + "String": "\n * { model: claude-opus-4-7; }\n " + } + } + }, + "graph_source": "digraph ImplementPlan {\n graph [\n goal=\"Implement and simplify\",\n model_stylesheet=\"\n * { model: claude-opus-4-7; }\n \"\n ]\n rankdir=LR\n\n start [shape=Mdiamond, label=\"Start\"]\n exit [shape=Msquare, label=\"Exit\"]\n\n toolchain [label=\"Toolchain\", shape=parallelogram, script=\"command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1\", max_retries=0]\n preflight_compile [label=\"Preflight Compile\", shape=parallelogram, script=\"cargo check -q --workspace 2>&1\", max_retries=0]\n preflight_lint [label=\"Preflight Lint\", shape=parallelogram, script=\"cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1\", max_retries=0]\n fix_lints [label=\"Fix Lints\", prompt=\"The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.\", max_visits=3]\n implement [label=\"Implement\", prompt=\"Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.\", model=\"gpt-55\", reasoning_effort=\"xhigh\"]\n simplify_opus [label=\"Simplify (Opus)\", prompt=\"@prompts/simplify.md\"]\n simplify_gpt [label=\"Simplify (GPT-55)\", prompt=\"@prompts/simplify.md\", model=\"gpt-55\"]\n verify [label=\"Verify\", shape=parallelogram, script=\"git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\\bActorRef\\b|\\bActorKind\\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\\s*==\\s*\\\"disabled\\\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1\", goal_gate=true, retry_target=\"fixup\"]\n fixup [label=\"Fixup\", prompt=\"The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.\", max_visits=3]\n\n start -> toolchain\n toolchain -> preflight_compile [condition=\"outcome=succeeded\"]\n toolchain -> exit\n preflight_compile -> preflight_lint [condition=\"outcome=succeeded\"]\n preflight_compile -> exit\n preflight_lint -> implement [condition=\"outcome=succeeded\"]\n preflight_lint -> fix_lints\n fix_lints -> preflight_lint\n implement -> simplify_opus -> simplify_gpt -> verify\n verify -> exit [condition=\"outcome=succeeded\"]\n verify -> fixup\n fixup -> verify\n}\n", + "workflow_slug": "implement-plan", + "source_directory": "/Users/bhelmkamp/p/fabro-sh/fabro", + "provenance": { + "server": { + "version": "0.243.0-nightly.1" + }, + "client": { + "user_agent": "fabro-cli/0.243.0-nightly.1", + "name": "fabro-cli", + "version": "0.243.0-nightly.1" + }, + "subject": { + "kind": "user", + "identity": { + "issuer": "https://github.com", + "subject": "19" + }, + "login": "brynary", + "auth_method": "github", + "avatar_url": "https://avatars.githubusercontent.com/u/19?v=4" + } + }, + "manifest_blob": "00ea7f2c1ff701eb9b6b6013a225d9285478ba2456dea1de2e61f6d3db430c35", + "definition_blob": "303626c83b308220ef99468ae5d93ca4e254084c746b7c13fb24072fe5b0bfb2", + "git": { + "origin_url": "https://github.com/fabro-sh/fabro", + "branch": "main", + "sha": "9d1f1709087ae1aeb0c5fe937417145d4bf33ada", + "dirty": "dirty", + "push_outcome": { + "type": "not_attempted" + } + } + }, + "web_url": "http://127.0.0.1:32276/runs/01KSDGBEV87WMKH9NQ7301WCKA", + "start": null, + "status": { + "kind": "starting" + }, + "status_updated_at": "2026-05-24T17:26:02.917861Z", + "last_event_at": "2026-05-24T17:26:18.696517Z", + "pending_control": null, + "checkpoints": [], + "conclusion": null, + "sandbox": { + "provider": "daytona", + "snapshot": "fabro-v12", + "runtime": { + "id": "fabro-01KSDGBEV87WMKH9NQ7301WCKA", + "working_directory": "/home/daytona/workspace/fabro", + "repo_cloned": true, + "clone_origin_url": "https://github.com/fabro-sh/fabro", + "clone_branch": "main", + "workspace_root": "/home/daytona/workspace", + "repos_root": "/home/daytona/repos", + "primary_repo_path": "/home/daytona/repos/fabro-sh/fabro", + "primary_repo_link": "/home/daytona/workspace/fabro" + } + }, + "pull_request": null, + "superseded_by": null, + "pending_interviews": {}, + "stages": {} +} \ No newline at end of file