fix: address CodeRabbit feedback on Daytona headless PR

Drain spawn log streams before ending queues, remap skill paths for
projection shell commands, map Codex default ask to on-request, clarify
docs around sudo and policy isolation, tighten Daytona env/clone tests,
and bump the Daytona package changeset to minor for new surface.

Author: AlemTuzlak

.changeset/daytona-headless-edges.md

@@ -1,6 +1,6 @@
 ---
 '@tanstack/ai-sandbox': patch
-'@tanstack/ai-sandbox-daytona': patch
+'@tanstack/ai-sandbox-daytona': minor
 '@tanstack/ai-grok-build': patch
 '@tanstack/ai-codex': patch
 '@tanstack/ai-acp': patch

docs/sandbox/providers.md

@@ -199,7 +199,6 @@ const sandbox = defineSandbox({
   }),
   policy: defineSandboxPolicy({
     default: 'allow',
-    commands: { deny: ['rm -rf /'] },
   }),
 })
 
@@ -210,8 +209,8 @@ const stream = chat({
 })
 ```
 
-Grok Build and Codex do not enforce `commands.deny`. Isolation is the Daytona
-VM. Use Claude Code when you need command-level deny.
+Headless Grok Build and Codex stay on auto-approve with `default: 'allow'`.
+Isolation is the Daytona VM. Use Claude Code when you need command-level deny.
 
 ## Vercel
 

docs/sandbox/workspace.md

@@ -170,8 +170,10 @@ subshell (like the Grok CLI installer, `(curl … || curl …) | bash`) is not a
 valid argument to another command, and `sh` then fails at parse time with
 `syntax error: unexpected "("` (exit `2`) without running anything.
 
-Some providers run as a non-root user. Package installs on those providers
-need `sudo` in `setup`. See [Providers](./providers) and [Policy](./policy).
+Some providers run as a non-root user. Workspace-local installs such as
+`pnpm install` do not need sudo. System or global package installs on those
+providers need non-interactive `sudo -n` in `setup`. See
+[Providers](./providers) and [Policy](./policy).
 
 ## Scripts
 

packages/ai-acp/src/adapters/projection.ts

@@ -21,6 +21,7 @@ import {
   discoverSkillDirs,
   isSecretRef,
   resolveGitSkillDir,
+  resolveHarnessCwd,
 } from '@tanstack/ai-sandbox'
 import type {
   BearerRef,
@@ -127,10 +128,17 @@ export async function projectAcpWorkspace(
       // so the shell command resolves on every provider.
       await handle.fs.mkdir(`${projection.root}/${skillsDir}`)
       for (const skill of gitSkills) {
-        const source = skill.into ?? resolveGitSkillDir(projection.root, skill)
+        // Match bootstrap's remapped clone path so discovery and shell copy
+        // use the real provider workdir (e.g. Daytona).
+        const source = resolveHarnessCwd(
+          handle,
+          skill.into ?? resolveGitSkillDir(projection.root, skill),
+        )
         const discovered = await discoverSkillDirs(handle, source)
         for (const { name, dir } of discovered) {
-          const relSource = relativeToRoot(projection.root, dir)
+          const realDir = resolveHarnessCwd(handle, dir)
+          const realRoot = resolveHarnessCwd(handle, projection.root)
+          const relSource = relativeToRoot(realRoot, realDir)
           const relTarget = `${skillsDir}/${name}`
           const cp = await handle.process.exec(
             `cp -r ${shellQuote(relSource)} ${shellQuote(relTarget)}`,

packages/ai-claude-code/src/adapters/projection.ts

@@ -28,6 +28,7 @@ import {
   discoverSkillDirs,
   isSecretRef,
   resolveGitSkillDir,
+  resolveHarnessCwd,
 } from '@tanstack/ai-sandbox'
 import type {
   BearerRef,
@@ -133,14 +134,20 @@ async function projectGitSkills(
       await handle.fs.mkdir(skillsDir)
       madeDir = true
     }
-    const source = skill.into ?? resolveGitSkillDir(projection.root, skill)
+    // Remap `/workspace` the same way bootstrap remaps clone dirs, so shell
+    // `ln`/`cp` targets match the real provider workdir (e.g. Daytona).
+    const source = resolveHarnessCwd(
+      handle,
+      skill.into ?? resolveGitSkillDir(projection.root, skill),
+    )
     const discovered = await discoverSkillDirs(handle, source)
     for (const { name, dir } of discovered) {
-      const target = `${skillsDir}/${name}`
-      const lnCmd = `ln -s ${shellQuote(dir)} ${shellQuote(target)}`
+      const target = resolveHarnessCwd(handle, `${skillsDir}/${name}`)
+      const realDir = resolveHarnessCwd(handle, dir)
+      const lnCmd = `ln -s ${shellQuote(realDir)} ${shellQuote(target)}`
       const result = await handle.process.exec(lnCmd, { cwd: projection.root })
       if (result.exitCode !== 0) {
-        const cpCmd = `cp -r ${shellQuote(dir)} ${shellQuote(target)}`
+        const cpCmd = `cp -r ${shellQuote(realDir)} ${shellQuote(target)}`
         const copied = await handle.process.exec(cpCmd, {
           cwd: projection.root,
         })

packages/ai-codex/src/adapters/policy-map.ts

@@ -13,10 +13,10 @@
  *   (`'allow'` → true, `'deny'` → false; unset leaves Codex's default).
  * - `approval_policy`: a fully-permissive policy (`default: 'allow'` with no
  *   `ask` rules) → `never`; a `default: 'deny'` policy → `untrusted`;
- *   anything with `ask` rules → `on-request`. A deny list alone is a hard
- *   block, not a human prompt, so it does not flip `on-request`. In `exec`
- *   mode Codex will refuse (rather than prompt for) actions that need
- *   approval.
+ *   `default: 'ask'` or any `commands.ask` rules → `on-request`. A deny list
+ *   alone is a hard block, not a human prompt, so it does not flip
+ *   `on-request`. In `exec` mode Codex will refuse (rather than prompt for)
+ *   actions that need approval.
  *
  * Returns only the knobs the policy actually constrains; the adapter merges
  * these with its own config (config/modelOptions still take precedence).
@@ -46,7 +46,7 @@ export function mapPolicyToCodexFlags(
   }
 
   const hasAsk = (policy.commands?.ask?.length ?? 0) > 0
-  if (hasAsk) {
+  if (hasAsk || policy.default === 'ask') {
     flags.approvalPolicy = 'on-request'
   } else if (policy.default === 'deny') {
     flags.approvalPolicy = 'untrusted'

packages/ai-codex/src/adapters/projection.ts

@@ -34,6 +34,7 @@ import {
   discoverSkillDirs,
   isSecretRef,
   resolveGitSkillDir,
+  resolveHarnessCwd,
 } from '@tanstack/ai-sandbox'
 import type {
   BearerRef,
@@ -174,14 +175,20 @@ async function projectGitSkills(
       await handle.fs.mkdir(skillsDir)
       madeDir = true
     }
-    const source = skill.into ?? resolveGitSkillDir(projection.root, skill)
+    // Remap `/workspace` the same way bootstrap remaps clone dirs, so shell
+    // `ln`/`cp` targets match the real provider workdir (e.g. Daytona).
+    const source = resolveHarnessCwd(
+      handle,
+      skill.into ?? resolveGitSkillDir(projection.root, skill),
+    )
     const discovered = await discoverSkillDirs(handle, source)
     for (const { name, dir } of discovered) {
-      const target = `${skillsDir}/${name}`
-      const lnCmd = `ln -s ${shellQuote(dir)} ${shellQuote(target)}`
+      const target = resolveHarnessCwd(handle, `${skillsDir}/${name}`)
+      const realDir = resolveHarnessCwd(handle, dir)
+      const lnCmd = `ln -s ${shellQuote(realDir)} ${shellQuote(target)}`
       const result = await handle.process.exec(lnCmd, { cwd: projection.root })
       if (result.exitCode !== 0) {
-        const cpCmd = `cp -r ${shellQuote(dir)} ${shellQuote(target)}`
+        const cpCmd = `cp -r ${shellQuote(realDir)} ${shellQuote(target)}`
         const copied = await handle.process.exec(cpCmd, {
           cwd: projection.root,
         })

packages/ai-codex/tests/policy-map.test.ts

@@ -49,6 +49,13 @@ describe('mapPolicyToCodexFlags', () => {
     ).toBe('on-request')
   })
 
+  it('maps default ask without ask command rules to on-request', () => {
+    expect(
+      mapPolicyToCodexFlags(defineSandboxPolicy({ default: 'ask' }))
+        .approvalPolicy,
+    ).toBe('on-request')
+  })
+
   // Headless `codex exec` refuses tools when approval_policy is on-request.
   // A deny list is a hard block, not a human prompt, so default: allow +
   // deny stays never. Issue #1081 item 1.

packages/ai-grok-build/src/adapters/projection.ts

@@ -38,6 +38,7 @@ import {
   discoverSkillDirs,
   isSecretRef,
   resolveGitSkillDir,
+  resolveHarnessCwd,
 } from '@tanstack/ai-sandbox'
 import type {
   BearerRef,
@@ -260,14 +261,20 @@ async function projectGitSkills(
       await handle.fs.mkdir(skillsDir)
       madeDir = true
     }
-    const source = skill.into ?? resolveGitSkillDir(projection.root, skill)
+    // Remap `/workspace` the same way bootstrap remaps clone dirs, so shell
+    // `ln`/`cp` targets match the real provider workdir (e.g. Daytona).
+    const source = resolveHarnessCwd(
+      handle,
+      skill.into ?? resolveGitSkillDir(projection.root, skill),
+    )
     const discovered = await discoverSkillDirs(handle, source)
     for (const { name, dir } of discovered) {
-      const target = `${skillsDir}/${name}`
-      const lnCmd = `ln -s ${shellQuote(dir)} ${shellQuote(target)}`
+      const target = resolveHarnessCwd(handle, `${skillsDir}/${name}`)
+      const realDir = resolveHarnessCwd(handle, dir)
+      const lnCmd = `ln -s ${shellQuote(realDir)} ${shellQuote(target)}`
       const result = await handle.process.exec(lnCmd, { cwd: projection.root })
       if (result.exitCode !== 0) {
-        const cpCmd = `cp -r ${shellQuote(dir)} ${shellQuote(target)}`
+        const cpCmd = `cp -r ${shellQuote(realDir)} ${shellQuote(target)}`
         const copied = await handle.process.exec(cpCmd, {
           cwd: projection.root,
         })

packages/ai-sandbox-daytona/src/handle.ts

@@ -344,12 +344,16 @@ export class DaytonaHandle implements SandboxHandle {
 
     // Stream logs over the WebSocket form. Still poll command status so
     // `kill()` can stop the client wait without waiting for the stream.
-    void this.sandbox.process.getSessionCommandLogs(
-      sessionId,
-      cmdId,
-      (chunk) => stdoutQ.push(chunk),
-      (chunk) => stderrQ.push(chunk),
-    )
+    // Keep the promise so we can drain trailing chunks and so a dropped
+    // socket cannot become an unhandled rejection.
+    const logStream = this.sandbox.process
+      .getSessionCommandLogs(
+        sessionId,
+        cmdId,
+        (chunk) => stdoutQ.push(chunk),
+        (chunk) => stderrQ.push(chunk),
+      )
+      .catch(() => undefined)
 
     const pump = (async (): Promise<void> => {
       try {
@@ -366,6 +370,8 @@ export class DaytonaHandle implements SandboxHandle {
         }
       } finally {
         opts?.signal?.removeEventListener('abort', onAbort)
+        // Let the log stream finish so trailing output is not dropped.
+        await Promise.race([logStream, sleep(1000)])
         stdoutQ.end()
         stderrQ.end()
         await this.sandbox.process.deleteSession(sessionId).catch(() => {})