feat: add code agent sandbox skeleton

scripts/src/check.ts

@@ -33,6 +33,7 @@ const syntaxFiles = [
   "src/components/microservices/mdtodo/src/index.ts",
   "src/components/microservices/decision-center/src/index.ts",
   "src/components/microservices/code-queue-mgr/src/index.ts",
+  "src/components/microservices/code-agent-sandbox/src/index.ts",
 ];
 
 export interface CheckOptions {
@@ -165,6 +166,7 @@ function unifiedLogRotationItem(): CheckItem {
     "src/components/microservices/baidu-netdisk/src/index.ts",
     "src/components/microservices/oa-event-flow/src/index.ts",
     "src/components/microservices/decision-center/src/index.ts",
+    "src/components/microservices/code-agent-sandbox/src/index.ts",
   ];
   const offenders = serviceFiles.flatMap((path) => {
     const text = readFileSync(rootPath(path), "utf8");
@@ -189,13 +191,23 @@ function unifiedLogRotationItem(): CheckItem {
   };
 }
 
+function extractComposeServiceBlock(composeText: string, serviceName: string): string {
+  const lines = composeText.split("\n");
+  const startLine = lines.findIndex((line) => line === `  ${serviceName}:`);
+  if (startLine < 0) return "";
+  let endLine = lines.length;
+  for (let index = startLine + 1; index < lines.length; index += 1) {
+    if (/^  [A-Za-z0-9][A-Za-z0-9_-]*:$/u.test(lines[index])) {
+      endLine = index;
+      break;
+    }
+  }
+  return lines.slice(startLine, endLine).join("\n");
+}
+
 function codeQueueMgrHealthcheckItem(): CheckItem {
   const composeText = readFileSync(rootPath("docker-compose.yml"), "utf8");
-  const serviceStart = composeText.indexOf("\n  code-queue-mgr:");
-  const nextService = serviceStart >= 0 ? composeText.indexOf("\n  todo-note:", serviceStart + 1) : -1;
-  const serviceBlock = serviceStart >= 0
-    ? composeText.slice(serviceStart, nextService >= 0 ? nextService : undefined)
-    : "";
+  const serviceBlock = extractComposeServiceBlock(composeText, "code-queue-mgr");
   const dockerfileText = readFileSync(rootPath("src/components/microservices/code-queue-mgr/Dockerfile"), "utf8");
   const sourceText = readFileSync(rootPath("src/components/microservices/code-queue-mgr/src-rs/main.rs"), "utf8");
   const healthcheckUsesRustProbe = serviceBlock.includes("code-queue-mgr") && serviceBlock.includes("--healthcheck");
@@ -262,6 +274,7 @@ export function runChecks(config: UniDeskConfig, options: CheckOptions = default
       fileItem("src/components/microservices/mdtodo/src/index.ts"),
       fileItem("src/components/microservices/decision-center/src/index.ts"),
       fileItem("src/components/microservices/code-queue-mgr/src/index.ts"),
+      fileItem("src/components/microservices/code-agent-sandbox/src/index.ts"),
       fileItem("src/components/microservices/code-queue-mgr/src/prompt-observation.ts"),
       fileItem("scripts/src/deploy.ts"),
       fileItem("scripts/code-queue-issue3-regression-test.ts"),

scripts/src/help.ts

@@ -39,6 +39,7 @@ export function rootHelp(): unknown {
       { command: "deploy check|plan|apply [--file deploy.json|--env dev|prod] [--service id] [--commit full-sha] [--dry-run] [--force]", description: "Reconcile services from a repo+commit manifest; --env reads origin/master:deploy.json environments and applies supported dev target-side rollouts or reviewed D601 registry artifact consumers. code-queue artifact consumption is dev-only." },
       { command: "dev-env validate|prewarm-images", description: "Validate D601 unidesk-dev guardrails or prewarm dev foundation images into native k3s containerd through a bounded async job." },
       { command: "artifact-registry plan|render|status|health|install|deploy-backend-core|deploy-service", description: "Manage the D601 host-managed CNCF Distribution registry and run pull-only artifact CD for supported services, including D601 direct, k3s-managed, and code-queue dev-only consumers." },
+      { command: "code-agent-sandbox", description: "Independent Code Agent Sandbox service skeleton for adapter, mode, and credential-boundary diagnostics." },
       { command: "schedule list|get|runs|run|delete", description: "Manage backend-core scheduled tasks and run history; schedule run <id> supports --wait-ms N." },
       { command: "schedule upsert-pgdata-backup [--time HH:MM] [--remote-base /SERVER_DATA/UNIDESK_PG_DATA]", description: "Create or update the daily PGDATA physical backup task that uploads monthly rotated archives to Baidu Netdisk." },
       { command: "codex deploy <commitId> [--provider-id D601] [--timeout-ms N]", description: "Disabled legacy Code Queue deploy path; use the dev-only artifact consumer instead." },