[PR] feat(setup): probe prek and uv in the sandbox doctor [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1362:
URL: https://github.com/apache/magpie/pull/1362

   ## Summary
   
   - The doctor skill's probes are meant to move in lock-step with `docs/setup/sandbox-troubleshooting.md`, but #1359 added the *`prek` or `uv` not found inside the sandbox* entry without a matching probe. **Probe 7** (`probe-7-dev-tools.sh`) now covers it:
     - ✓ when `prek` / `uv` run inside the sandbox and `~/.cache` is writable;
     - ✗ when they start but cannot write their cache.
     - Inside the sandbox a read-denied `~/.local/bin` looks exactly like an absent one. So when neither tool is found, the probe reads the worktree's `settings.local.json` (readable in the sandbox) to tell a missing grant (⚠) from a tool that is not installed (⊘).
   - **Follow-ups from #1359:**
     - The error-hint hook and `secure-agent-setup.md` now count seven probes.
     - The setup doc's hint-signature table gains the `command not found: prek|uv|uvx` row.
     - The troubleshooting entry no longer says the new paths apply only "from the next session". Measured: the harness applies `settings.local.json` changes from the next sandboxed command.
   
   ## Type of change
   
   - [x] Skill change (`.claude/skills/<name>/`) — eval fixtures updated below
   - [ ] Tool / bridge contract (`tools/<system>/*.md`)
   - [ ] Python package (`tools/*/` with `pyproject.toml`)
   - [ ] Groovy reference impl
   - [x] Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
   - [x] Documentation (`docs/`, `README.md`, `CONTRIBUTING.md`)
   - [ ] Project template (`projects/_template/`)
   - [ ] CI / dev loop (`prek`, workflows, validators)
   - [ ] Other:
   
   ## Test plan
   
   - [x] `prek run --all-files`, run **inside the sandbox**: every hook passes except the workspace pytest hook. Two suites fail there for sandbox reasons, and both pass outside it:
     - `agent-isolation`'s `test_agent_socket_rows_follow_the_connections_held_open` opens a Unix socket, which the Linux sandbox refuses.
     - `pr-management-stats` calls the real `gh`.
   - [x] Probe 7 run by hand in all four states on Linux (bubblewrap, Claude Code 2.1.280):
     - ✓: tools found, cache writable.
     - ✗: `HOME` pointing at an unwritable directory.
     - ⚠: tools off `PATH`, grant absent.
     - ⊘: tools off `PATH`, grant present.
   - [x] For skill changes: `setup-isolated-setup-doctor` eval suite, 23/23 with `magpie-run-evals.sh` (`claude -p`).
   - [x] For skill *behaviour* changes: `interpret-probes` grows a `dev_tools_status` field (`skip` when no `dev-tools` line is present, so existing fixtures expect `skip`) and the new fixture `case-16-dev-tools-not-granted`.
   - [ ] Other:
   
   ## RFC-AI-0004 compliance
   
   - [x] **Sandbox** — the probe is read-only apart from touching and removing one file in `~/.cache`, which the reference config already makes writable. It adds no host access.
   
   ## Linked issues
   
   Refs #1359
   
   ## Notes for reviewers (optional)
   
   - **Probe scope:** the probes still don't cover every catalogue entry. The signing-overlay entries need a live touch or a terminal, and `setup-isolated-setup-verify` check 10 covers them. The doctor's wording now says so instead of claiming the probes cover "the six failure modes the catalog documents".
   - **Token and fingerprint regeneration:** `docs/mode-economics.md` was regenerated with `skill-token-count --write`. The doctor's `surface_hash` was refreshed by the `skill-surface-hash` hook because its description now names `prek` and `uv`.
   
   ---
   
   Generative AI disclosure: this change was prepared with Claude Code (Claude Opus 5) and reviewed by the author before submission.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(setup): probe prek and uv in the sandbox doctor [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1362:
URL: https://github.com/apache/magpie/pull/1362


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org