feat(FN-4640): wire sandbox auditor through executor and merger

Fusion-Task-Id: FN-4640
Fusion-Task-Lineage: 4a91265f-1714-4854-b08d-7ddb06074253

packages/engine/src/__tests__/sandbox-wiring-audit.test.ts

@@ -0,0 +1,65 @@
+import { describe, expect, it } from "vitest";
+import type { RunAuditEventInput, TaskStore } from "@fusion/core";
+import { __runConfiguredCommandForTests } from "../executor.js";
+import { __executePostMergeScriptStepForTests } from "../merger.js";
+import { createRunAuditor } from "../run-audit.js";
+
+class AuditStoreStub {
+  events: RunAuditEventInput[] = [];
+  recordRunAuditEvent(event: RunAuditEventInput): void {
+    this.events.push(event);
+  }
+}
+
+describe("sandbox wiring audit emissions", () => {
+  it("emits sandbox:run on successful configured command", async () => {
+    const store = new AuditStoreStub();
+    const auditor = createRunAuditor(store as unknown as TaskStore, {
+      runId: "run-exec-1",
+      agentId: "executor",
+      taskId: "FN-4640",
+      phase: "execute",
+    });
+
+    const result = await __runConfiguredCommandForTests("node -e \"process.stdout.write('ok')\"", process.cwd(), 20_000, undefined, auditor);
+    expect(result.exitCode).toBe(0);
+
+    expect(store.events.some((event) => event.domain === "sandbox" && event.mutationType === "sandbox:run")).toBe(true);
+  });
+
+  it("emits sandbox:failure when configured command exits non-zero", async () => {
+    const store = new AuditStoreStub();
+    const auditor = createRunAuditor(store as unknown as TaskStore, {
+      runId: "run-exec-2",
+      agentId: "executor",
+      taskId: "FN-4640",
+      phase: "execute",
+    });
+
+    await __runConfiguredCommandForTests("node -e \"process.exit(7)\"", process.cwd(), 20_000, undefined, auditor);
+
+    expect(store.events.some((event) => event.domain === "sandbox" && event.mutationType === "sandbox:failure")).toBe(true);
+  });
+
+  it("emits sandbox:run for merger script-mode execution", async () => {
+    const store = new AuditStoreStub();
+    const auditor = createRunAuditor(store as unknown as TaskStore, {
+      runId: "run-merge-1",
+      agentId: "merger",
+      taskId: "FN-4640",
+      phase: "merge",
+    });
+
+    const response = await __executePostMergeScriptStepForTests(
+      {} as TaskStore,
+      "FN-4640",
+      { id: "ws-1", name: "post", type: "script", scriptName: "ok" } as any,
+      process.cwd(),
+      { scripts: { ok: "node -e \"process.stdout.write('ok')\"" } } as any,
+      auditor,
+    );
+
+    expect(response.success).toBe(true);
+    expect(store.events.some((event) => event.domain === "sandbox" && event.mutationType === "sandbox:run")).toBe(true);
+  });
+});

packages/engine/src/executor.ts

@@ -365,8 +365,8 @@ function configuredCommandErrorMessage(result: RunCommandResult): string {
   return parts.length ? parts.join("\n") : "Command failed";
 }
 
-function getConfiguredCommandSandboxBackend(): SandboxBackend {
-  return resolveSandboxBackend();
+function getConfiguredCommandSandboxBackend(auditor?: RunAuditor): SandboxBackend {
+  return resolveSandboxBackend({ auditor });
 }
 
 async function runConfiguredCommand(
@@ -374,8 +374,9 @@ async function runConfiguredCommand(
   cwd: string,
   timeoutMs: number,
   extraEnv?: NodeJS.ProcessEnv,
+  auditor?: RunAuditor,
 ): Promise<RunCommandResult> {
-  const backend = getConfiguredCommandSandboxBackend();
+  const backend = getConfiguredCommandSandboxBackend(auditor);
   const result = await backend.run(command, {
     cwd,
     timeoutMs,
@@ -400,8 +401,9 @@ export async function __runConfiguredCommandForTests(
   cwd: string,
   timeoutMs: number,
   extraEnv?: NodeJS.ProcessEnv,
+  auditor?: RunAuditor,
 ): Promise<RunCommandResult> {
-  return runConfiguredCommand(command, cwd, timeoutMs, extraEnv);
+  return runConfiguredCommand(command, cwd, timeoutMs, extraEnv, auditor);
 }
 
 // ── Tool parameter schemas (module-level for reuse in ToolDefinition generics) ──
@@ -2689,7 +2691,7 @@ export class TaskExecutor {
         if (scriptCommand) {
           const setupStartedAt = Date.now();
           try {
-            const setupResult = await runConfiguredCommand(scriptCommand, worktreePath, 120_000, taskEnv);
+            const setupResult = await runConfiguredCommand(scriptCommand, worktreePath, 120_000, taskEnv, audit);
             if (setupResult.spawnError || setupResult.timedOut || setupResult.exitCode !== 0) {
               throw new Error(configuredCommandErrorMessage(setupResult));
             }
@@ -6758,7 +6760,12 @@ ${failureFeedback}
     await this.store.logEntry(task.id, `Workflow step '${workflowStep.name}' executing script '${scriptName}': ${scriptCommand}`);
 
     try {
-      const scriptResult = await runConfiguredCommand(scriptCommand, worktreePath, 120_000, extraEnv);
+      const scriptResult = await runConfiguredCommand(scriptCommand, worktreePath, 120_000, extraEnv, createRunAuditor(this.store, {
+        runId: this.currentRunContext?.runId ?? generateSyntheticRunId("exec-script", task.id),
+        agentId: this.currentRunContext?.agentId ?? (task.assignedAgentId ?? "executor"),
+        taskId: task.id,
+        phase: "execute",
+      }));
       if (scriptResult.spawnError || scriptResult.timedOut || scriptResult.exitCode !== 0) {
         return { success: false, error: configuredCommandErrorMessage(scriptResult) };
       }

packages/engine/src/merger.ts

@@ -7541,7 +7541,7 @@ export async function aiMergeTask(
     }
 
     try {
-      await runPostMergeWorkflowSteps(store, taskId, rootDir, postMergeCwd, settings, options);
+      await runPostMergeWorkflowSteps(store, taskId, rootDir, postMergeCwd, settings, options, audit);
     } catch (err: any) {
       rethrowIfMergeAborted(err);
       mergerLog.error(`${taskId}: post-merge workflow steps error: ${err.message}`);
@@ -9071,6 +9071,7 @@ async function runPostMergeWorkflowSteps(
   cwd: string,
   settings: Settings,
   mergeOptions: MergerOptions = {},
+  auditor?: RunAuditor,
 ): Promise<void> {
   throwIfAborted(mergeOptions.signal, taskId);
   const task = await store.getTask(taskId);
@@ -9130,7 +9131,7 @@ async function runPostMergeWorkflowSteps(
 
     try {
       const result = stepMode === "script"
-        ? await executePostMergeScriptStep(store, taskId, ws, cwd, settings)
+        ? await executePostMergeScriptStep(store, taskId, ws, cwd, settings, auditor)
         : await executePostMergePromptStep(store, taskId, ws, rootDir, cwd, settings, mergeOptions);
       const completedAt = new Date().toISOString();
 
@@ -9180,8 +9181,8 @@ async function runPostMergeWorkflowSteps(
   }
 }
 
-function getPostMergeScriptSandboxBackend(): SandboxBackend {
-  return resolveSandboxBackend();
+function getPostMergeScriptSandboxBackend(auditor?: RunAuditor): SandboxBackend {
+  return resolveSandboxBackend({ auditor });
 }
 
 /** Execute a script-mode post-merge workflow step in the provided execution directory. */
@@ -9191,6 +9192,7 @@ async function executePostMergeScriptStep(
   workflowStep: WorkflowStep,
   cwd: string,
   settings: Settings,
+  auditor?: RunAuditor,
 ): Promise<{ success: boolean; output?: string; error?: string }> {
   const scriptName = workflowStep.scriptName!.trim();
   const scripts = settings.scripts || {};
@@ -9200,7 +9202,7 @@ async function executePostMergeScriptStep(
     return { success: false, error: `Script '${scriptName}' not found in project settings` };
   }
 
-  const backend = getPostMergeScriptSandboxBackend();
+  const backend = getPostMergeScriptSandboxBackend(auditor);
   const result = await backend.run(scriptCommand, {
     cwd,
     encoding: "utf-8",
@@ -9232,8 +9234,9 @@ export async function __executePostMergeScriptStepForTests(
   workflowStep: WorkflowStep,
   cwd: string,
   settings: Settings,
+  auditor?: RunAuditor,
 ): Promise<{ success: boolean; output?: string; error?: string }> {
-  return executePostMergeScriptStep(store, taskId, workflowStep, cwd, settings);
+  return executePostMergeScriptStep(store, taskId, workflowStep, cwd, settings, auditor);
 }
 
 /** Execute a prompt-mode post-merge workflow step using an AI agent in the provided execution directory. */

packages/engine/src/routine-runner.ts

@@ -33,7 +33,9 @@ const MAX_BUFFER = 1024 * 1024;
 const MAX_OUTPUT_LENGTH = 10 * 1024;
 
 function getRoutineCommandSandboxBackend(): SandboxBackend {
-  return resolveSandboxBackend();
+  // FN-4640: routine-runner has no RunAuditor context yet; keep sandbox backend un-audited for now.
+  // Follow-up: FN-4689 wires routine-runner through RunAuditor for sandbox emissions.
+  return resolveSandboxBackend({ auditor: undefined });
 }
 
 /** Options for RoutineRunner constructor */