A crew run can open its own repository's app and previews: the sandbox allows that repo's app hosts #3663

A crew run on repository R can now reach R's own app from its shell: production and the preview of each of R's open pulls. It still cannot reach any other repository's app. The brief lists those URLs, so checks that need the running app (end-to-end runs, screenshots, the public launch check) can be done in the run instead of being parked.

• src/crew/app_hosts.ts (new): ownApp(app, repo) builds R's URLs from R's own slug and pull numbers, using the same urlFor the runtime serves them at (so a verified custom domain is used for production). There are no wildcards: a pattern like arm--* would also match an unrelated app whose slug happens to start with arm--.
• src/crew/sandbox.ts: sandboxPolicy takes a new appUrls input and allows each one by host and port together. This matters when the app domain is localhost: allowing a bare arm.localhost would open every local port.
• src/crew/runner.ts: the list is rebuilt on every invocation, like the rest of the policy, so a pull opened between the work and the wrap-up can be reached from the wrap-up.
• src/crew/brief.ts: adds one line naming production and each open preview, and the "It cannot reach…" sandbox line now mentions the app. docs/THREATS.md is updated to match.

Not done: a run on a new issue has no pull yet, so its own preview only becomes reachable in later runs on that pull (feedback, a failed check). I didn't add a case to test/crew-sandbox-real.test.ts: whether the sandbox's proxy resolves *.localhost names can't be checked here, so the coverage is a policy-level test instead.

Tests: test/crew-app-hosts.test.ts sets up two app repos, arm and armory, each with an open pull. It checks that a run on arm allows arm… and arm--N… but nothing starting with armory, that an app on loopback is allowed only with its port, and that the brief names the URLs. It passes, along with the type check and the sandbox, brief, plan and apps-api suites. crew-sandbox-real did not run here because ripgrep isn't installed in this shell; the forge's check runs it.

🤖 Generated with Claude Code

Closes #3658

A crew run on repository R can now reach R's own app from its shell: production and the preview of each of R's open pulls. It still cannot reach any other repository's app. The brief lists those URLs, so checks that need the running app (end-to-end runs, screenshots, the public launch check) can be done in the run instead of being parked.

• src/crew/app_hosts.ts (new): ownApp(app, repo) builds R's URLs from R's own slug and pull numbers, using the same urlFor the runtime serves them at (so a verified custom domain is used for production). There are no wildcards: a pattern like arm--* would also match an unrelated app whose slug happens to start with arm--.
• src/crew/sandbox.ts: sandboxPolicy takes a new appUrls input and allows each one by host and port together. This matters when the app domain is localhost: allowing a bare arm.localhost would open every local port.
• src/crew/runner.ts: the list is rebuilt on every invocation, like the rest of the policy, so a pull opened between the work and the wrap-up can be reached from the wrap-up.
• src/crew/brief.ts: adds one line naming production and each open preview, and the "It cannot reach…" sandbox line now mentions the app. docs/THREATS.md is updated to match.

Not done: a run on a new issue has no pull yet, so its own preview only becomes reachable in later runs on that pull (feedback, a failed check). I didn't add a case to test/crew-sandbox-real.test.ts: whether the sandbox's proxy resolves *.localhost names can't be checked here, so the coverage is a policy-level test instead.

Tests: test/crew-app-hosts.test.ts sets up two app repos, arm and armory, each with an open pull. It checks that a run on arm allows arm… and arm--N… but nothing starting with armory, that an app on loopback is allowed only with its port, and that the brief names the URLs. It passes, along with the type check and the sandbox, brief, plan and apps-api suites. crew-sandbox-real did not run here because ripgrep isn't installed in this shell; the forge's check runs it.

🤖 Generated with Claude Code

A crew run can now reach its own repository's running app: the production URL and the preview of each open pull. Before this, a run that needed the running app (end-to-end tests, screenshots, the public launch check) hit the sandbox, ended without a pull and was retried, as trevato/arm#34 was twice.

• src/crew/app_hosts.ts (new) works out the run's own repository's production host and the preview host of each open pull, matched by exact host and port. No wildcards, and no other repository's app.
• src/crew/sandbox.ts adds those hosts to the shell's network allow-list. The list is worked out again on every shell command, so a preview opened or closed during the run is picked up.
• src/crew/runner.ts passes the repository into the sandbox.
• src/crew/brief.ts lists those URLs in the run's brief, so the crew knows what it can open.
• docs/THREATS.md records the wider reach: a run can reach only its own repository's apps, and each of those apps already runs that repository's code.

Not done: a run still cannot reach any other repository's app, and its reach stays the forge, the package registry and these hosts. The latest comment on the issue is the automatic triage asking for a pillar; that's left to a person to choose and changes no code. The branch merges into the current main without conflicts.

Try it: bun test test/crew-app-hosts.test.ts checks that a run on repo R can fetch R's preview and that a run on R cannot fetch another repo's app. It and bun x tsc --noEmit both pass.

🤖 Generated with Claude Code