An agent's remotes carry the forge's public URL, and the sandbox is a boundary #21

Found when the crew stopped landing anything after the 0.7.59 roll: every run ended "no changes pushed: git push can't reach the remote (http://localhost:8080/trevato/forge.git refuses connections from the sandbox)". A diagnostic run showed why. Inside the shell sandbox, Claude Code sets no_proxy=localhost,127.0.0.1,… and routes named hosts through its proxy; localhost is the sandbox's own network namespace and reaches nothing (the sandboxing docs say so for Linux: "a direct connection to localhost or 127.0.0.1 doesn't reach servers on the host"). The crew's remotes pointed at the forge's local address, so a plain push had nowhere to go — and the earlier runs that did land pulls say in their own words that they ran git push with the sandbox off. The boundary had a door in it; this afternoon the door closed, and the pushes stopped with it.

The fix. The forge still clones and fetches an agent's tree over its local address (fast, on this machine). The remotes it leaves the agent carry forgeUrl, the forge as the agent is told it: origin fetches from the repository and pushes to the agent's fork, both through the sandbox's proxy. test/crew-remotes.test.ts (new, in the gate) starts a crew with a forgeUrl that names the same server differently from localUrl, has the stand-in agent write down its remotes and push plainly, and proves the remotes carry the public URL and the pull opens.

The boundary, said plainly. Claude Code's settings now carry allowUnsandboxedCommands: false (no command runs outside the sandbox on request) and failIfUnavailable on a host that was going to enforce it (fail the run rather than run the shell open). test/crew-sandbox.test.ts pins both.

Left for its own issue: the crew cannot run the forge's own test suite inside the sandbox (its test servers listen on unix sockets, which the sandbox refuses), so a forge agent cannot see its gate green before pushing. That is why the escapes were tempting; it needs a sandbox that lets a run bind sockets in its own temp directory.

Typecheck clean; crew-remotes, crew-sandbox, crew-wrapup, crew, crew-interrupted, check-list, hollow green locally (80 tests).

🤖 Generated with Claude Code