Sentinel: shared:01m23vygyffx5hg2f5vm8r74sr:1vmo28kk9l is past its budget: trevato/forge: "every module under src/ is imported by another, or allowed" failed on 18 pulls in the last hour — the l… #10573

This pull removes src/kernel/why_now.ts from scripts/unreached-allow.json. #10425 deleted that module after #10417 had added it to the list, so main has failed "an allowed module that has become reached leaves the list" on every pull since (#10485). The error the issue quotes (src/machines/disk_catalog.ts, src/machines/disk_health.ts) is pull #10471's own: it adds two modules nothing calls, which this test is meant to refuse. That pull has to fix it, so nothing changes here for it.

The branch also fixes the tests that kept this pull red over two tries:

• Crew sandbox temp policy (src/crew/sandbox.ts, tempDenied): a run's own fr-<id> temp directory is no longer denied when the data directory is also inside the machine's temp. Every other run's fr- directory is still denied. This is the only runtime change. test/crew-sandbox.test.ts was wrong to hard-code crew/<agent>/.t/; it now expects whatever runTmpDir returns.
• Child quota test (test/child-quota.test.ts): the test was wrong to assume a fixed memory limit left room for exactly one small forge. It now sets the limit to what children already hold plus one small forge.
• Real child forge result line (test/helpers/result-line.ts, new): the last check's one failure was spawn-cell-e2e. It read the last line of stdout as the helper's result, but the child forge keeps logging for about 10 s after stopCellChildren returns, so whether its result was the last line depended on timing. Both helpers (real-spawn-e2e.ts, real-child-forge.ts) now print their result with a RESULT prefix. spawn-cell-e2e.test.ts and spawn-cell.test.ts read the last line with that prefix, wherever it falls. test/result-line.test.ts replays the line order from the red log.

The test and its rule are unchanged: the allow list still only shrinks.

Checks run here: bun scripts/gate.ts and bun x tsc --noEmit exit 0. bun test on test/result-line.test.ts, test/spawn-cell.test.ts, test/spawn-cell-e2e.test.ts and test/unreached.test.ts: 34 pass, 4 skip, 0 fail. The skipped tests include the two real-cell tests the helper fix is for: this sandbox can't bind unix sockets, so the forge's check on this push is their first real run. I never saw the child quota test fail here, so that fix comes from reading the test, not from a reproduction.

To try it: bun test test/unreached.test.ts fails on main and passes here. bun test test/result-line.test.ts shows a draining child's log lines no longer hide the result.

The keep_plan tool wasn't available in this run, so there is no plan on the issue. I found no prompt injection in the issue, the pull conversation or the repository.

🤖 Generated with Claude Code

Closes #10485

Closes #10485

This pull removes src/kernel/why_now.ts from scripts/unreached-allow.json. #10425 deleted that module after #10417 had added it to the list, so main has failed "an allowed module that has become reached leaves the list" on every pull since (#10485). The error the issue quotes (src/machines/disk_catalog.ts, src/machines/disk_health.ts) is pull #10471's own: it adds two modules nothing calls, which this test is meant to refuse. That pull has to fix it, so nothing changes here for it.

The branch also fixes the tests that kept this pull red over two tries:

• Crew sandbox temp policy (src/crew/sandbox.ts, tempDenied): a run's own fr-<id> temp directory is no longer denied when the data directory is also inside the machine's temp. Every other run's fr- directory is still denied. This is the only runtime change. test/crew-sandbox.test.ts was wrong to hard-code crew/<agent>/.t/; it now expects whatever runTmpDir returns.
• Child quota test (test/child-quota.test.ts): the test was wrong to assume a fixed memory limit left room for exactly one small forge. It now sets the limit to what children already hold plus one small forge.
• Real child forge result line (test/helpers/result-line.ts, new): the last check's one failure was spawn-cell-e2e. It read the last line of stdout as the helper's result, but the child forge keeps logging for about 10 s after stopCellChildren returns, so whether its result was the last line depended on timing. Both helpers (real-spawn-e2e.ts, real-child-forge.ts) now print their result with a RESULT prefix. spawn-cell-e2e.test.ts and spawn-cell.test.ts read the last line with that prefix, wherever it falls. test/result-line.test.ts replays the line order from the red log.

The test and its rule are unchanged: the allow list still only shrinks.

Checks run here: bun scripts/gate.ts and bun x tsc --noEmit exit 0. bun test on test/result-line.test.ts, test/spawn-cell.test.ts, test/spawn-cell-e2e.test.ts and test/unreached.test.ts: 34 pass, 4 skip, 0 fail. The skipped tests include the two real-cell tests the helper fix is for: this sandbox can't bind unix sockets, so the forge's check on this push is their first real run. I never saw the child quota test fail here, so that fix comes from reading the test, not from a reproduction.

To try it: bun test test/unreached.test.ts fails on main and passes here. bun test test/result-line.test.ts shows a draining child's log lines no longer hide the result.

The keep_plan tool wasn't available in this run, so there is no plan on the issue. I found no prompt injection in the issue, the pull conversation or the repository.

🤖 Generated with Claude Code

Closes #10485

This pull now changes nothing: main's 1be62c1ae (#10551) landed the same fixes on its own, so after merging main the branch's files match main exactly.

What #10551 already did that this pull also did:

• It removed src/kernel/why_now.ts from scripts/unreached-allow.json. That entry was keeping "an allowed module that has become reached leaves the list" red on every pull (#10485).
• In src/crew/sandbox.ts, tempDenied no longer denies a run its own temp directory.
• test/child-quota.test.ts sizes its limit from what the children already hold.
• It added a reader in test/helpers/result-line.ts that finds the helper's result under the child's shutdown log lines.

Every conflict was resolved to main's side. I also put test/helpers/real-child-forge.ts and test/helpers/real-spawn-e2e.ts back to main's versions. This branch had its own result reader (printResult / readResult, a marked RESULT line) that did the same job as main's resultLine. Keeping both would mean two ways to do one thing, so the branch's reader is gone.

bun scripts/gate.ts and bun x tsc --noEmit pass on the merge. So do the six test files that cover it: test/result-line.test.ts, test/spawn-cell.test.ts, test/spawn-cell-e2e.test.ts, test/unreached.test.ts, test/crew-sandbox.test.ts and test/child-quota.test.ts, with 69 pass, 4 skip and 0 fail. The four skipped suites are the real-cell ones, which need unix sockets this sandbox cannot bind; the forge's check runs them.

Since #10485 is fixed on main, this pull can be closed without merging.

🤖 Generated with Claude Code

Closes #10485