test(e2e): cover fspy in agent sandboxes

crates/vite_task_bin/tests/e2e_snapshots/fixtures/sandboxed_fspy/claude-code-default-sandbox.json

@@ -0,0 +1,12 @@
+{
+  "network": {
+    "allowedDomains": [],
+    "deniedDomains": []
+  },
+  "filesystem": {
+    "denyRead": [],
+    "allowRead": [],
+    "allowWrite": ["."],
+    "denyWrite": []
+  }
+}

crates/vite_task_bin/tests/e2e_snapshots/fixtures/sandboxed_fspy/input.txt

@@ -0,0 +1 @@
+tracked input

crates/vite_task_bin/tests/e2e_snapshots/fixtures/sandboxed_fspy/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "sandboxed-fspy",
+  "private": true
+}

crates/vite_task_bin/tests/e2e_snapshots/fixtures/sandboxed_fspy/snapshots.toml

@@ -0,0 +1,78 @@
+[[e2e]]
+name = "fspy_under_codex_sandbox"
+comment = """
+Runs `vt run inner` under Codex CLI's built-in `:workspace` permission profile, representing its default workspace-editing posture for a trusted repository. The profile makes the workspace roots and system temp directories writable without adding network or Unix socket access. See [Codex permissions](https://learn.chatgpt.com/docs/permissions#define-and-select-a-profile).
+
+The nested `vt` enables fspy for automatic input inference; changing the file read inside the sandbox checks whether it invalidates the cache.
+"""
+platform = "macos"
+ignore = true
+steps = [
+  [
+    "codex",
+    "sandbox",
+    "-P",
+    ":workspace",
+    "vt",
+    "run",
+    "inner",
+  ],
+  [
+    "vtt",
+    "replace-file-content",
+    "input.txt",
+    "tracked",
+    "modified",
+  ],
+  [
+    "codex",
+    "sandbox",
+    "-P",
+    ":workspace",
+    "vt",
+    "run",
+    "inner",
+  ],
+]
+
+[[e2e]]
+name = "fspy_under_anthropic_sandbox_runtime"
+comment = """
+Runs `vt run inner` under a profile matching Claude Code's default enabled Bash sandbox: the working directory and session temp directory are writable, with no pre-allowed network domains or extra Unix socket access. See [Claude Code sandboxing](https://code.claude.com/docs/en/sandboxing#filesystem-isolation).
+
+Claude Code normally creates the writable session temp before invoking Sandbox Runtime, so the harness creates the runtime's default `/tmp/claude` directory before calling `srt` directly. The fixture profile provides only `allowWrite: ["."]`; Sandbox Runtime supplies `/tmp/claude` and its other built-in compatibility paths. See [`getDefaultWritePaths` and `generateProxyEnvVars`](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/sandbox-utils.ts).
+
+The nested `vt` enables fspy for automatic input inference; changing the file read inside the sandbox checks whether it invalidates the cache.
+"""
+platform = "macos"
+ignore = true
+steps = [
+  { argv = [
+    "mkdir",
+    "-p",
+    "/tmp/claude",
+  ], comment = "create the session temp that Claude Code supplies before sandboxed Bash commands" },
+  [
+    "srt",
+    "--settings",
+    "claude-code-default-sandbox.json",
+    "vt",
+    "run",
+    "inner",
+  ],
+  [
+    "vtt",
+    "replace-file-content",
+    "input.txt",
+    "tracked",
+    "modified",
+  ],
+  [
+    "srt",
+    "--settings",
+    "claude-code-default-sandbox.json",
+    "vt",
+    "run",
+    "inner",
+  ],
+]

crates/vite_task_bin/tests/e2e_snapshots/fixtures/sandboxed_fspy/snapshots/fspy_under_anthropic_sandbox_runtime.md

@@ -0,0 +1,37 @@
+# fspy_under_anthropic_sandbox_runtime
+
+Runs `vt run inner` under a profile matching Claude Code's default enabled Bash sandbox: the working directory and session temp directory are writable, with no pre-allowed network domains or extra Unix socket access. See [Claude Code sandboxing](https://code.claude.com/docs/en/sandboxing#filesystem-isolation).
+
+Claude Code normally creates the writable session temp before invoking Sandbox Runtime, so the harness creates the runtime's default `/tmp/claude` directory before calling `srt` directly. The fixture profile provides only `allowWrite: ["."]`; Sandbox Runtime supplies `/tmp/claude` and its other built-in compatibility paths. See [`getDefaultWritePaths` and `generateProxyEnvVars`](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/sandbox-utils.ts).
+
+The nested `vt` enables fspy for automatic input inference; changing the file read inside the sandbox checks whether it invalidates the cache.
+
+## `mkdir -p /tmp/claude`
+
+create the session temp that Claude Code supplies before sandboxed Bash commands
+
+```
+```
+
+## `srt --settings claude-code-default-sandbox.json vt run inner`
+
+**Exit code:** 1
+
+```
+$ vtt print-file input.txt
+✗ Failed to set up task communication: Operation not permitted (os error 1)
+```
+
+## `vtt replace-file-content input.txt tracked modified`
+
+```
+```
+
+## `srt --settings claude-code-default-sandbox.json vt run inner`
+
+**Exit code:** 1
+
+```
+$ vtt print-file input.txt
+✗ Failed to set up task communication: Operation not permitted (os error 1)
+```

crates/vite_task_bin/tests/e2e_snapshots/fixtures/sandboxed_fspy/snapshots/fspy_under_codex_sandbox.md

@@ -0,0 +1,28 @@
+# fspy_under_codex_sandbox
+
+Runs `vt run inner` under Codex CLI's built-in `:workspace` permission profile, representing its default workspace-editing posture for a trusted repository. The profile makes the workspace roots and system temp directories writable without adding network or Unix socket access. See [Codex permissions](https://learn.chatgpt.com/docs/permissions#define-and-select-a-profile).
+
+The nested `vt` enables fspy for automatic input inference; changing the file read inside the sandbox checks whether it invalidates the cache.
+
+## `codex sandbox -P :workspace vt run inner`
+
+**Exit code:** 1
+
+```
+$ vtt print-file input.txt
+✗ Failed to set up task communication: Operation not permitted (os error 1)
+```
+
+## `vtt replace-file-content input.txt tracked modified`
+
+```
+```
+
+## `codex sandbox -P :workspace vt run inner`
+
+**Exit code:** 1
+
+```
+$ vtt print-file input.txt
+✗ Failed to set up task communication: Operation not permitted (os error 1)
+```

crates/vite_task_bin/tests/e2e_snapshots/fixtures/sandboxed_fspy/vite-task.json

@@ -0,0 +1,14 @@
+{
+  "tasks": {
+    "inner": {
+      "command": "vtt print-file input.txt",
+      "cache": true,
+      "input": [
+        {
+          "auto": true
+        }
+      ],
+      "output": []
+    }
+  }
+}

packages/tools/package.json

@@ -3,6 +3,8 @@
   "private": true,
   "type": "module",
   "dependencies": {
+    "@anthropic-ai/sandbox-runtime": "catalog:",
+    "@openai/codex": "catalog:",
     "@playwright/browser-chromium": "catalog:",
     "@vitest/browser-playwright": "catalog:",
     "@voidzero-dev/vite-task-client": "workspace:*",