Run tasks in Sandbox Runtime agent sandboxes

[chubes4]

Summary

• Adds a datamachine-code/run-agent-sandbox ability that asks Sandbox Runtime to run a task inside an isolated WordPress Playground agent stack.
• Validates required plugin checkout paths and task input, invokes sandbox-runtime agent-sandbox-run, and returns sandbox run/artifact metadata to the parent WordPress site.
• Adds pure-PHP smoke coverage for command construction, JSON parsing, path validation, missing task rejection, invalid binary rejection, and .js CLI execution through node.

Scope

This is the first DMC control-plane seam for frontend/chat-driven isolated coding sandboxes. A chat agent can be granted this ability without getting raw shell or parent-site filesystem access. Apply-back should remain a separate reviewed/permissioned ability.

Verification

• php tests/smoke-sandbox-runtime-agent-sandbox-runner.php
• php tests/smoke-wordpress-runtime-inspection.php
• homeboy lint --changed-since origin/main
• homeboy test --changed-since origin/main
• Real DMC runner invocation against Sandbox Runtime PR workspace git status / show: ability callbacks crash on non-pristine repo states (WP_Error return, null schema fields) #21 passed with all four plugins active in Playground and artifacts collected.

Depends on Sandbox Runtime PR: https://github.com/chubes4/sandbox-runtime/pull/21

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Drafted the DMC runner/ability integration, smoke coverage, and local verification commands for Chris to review.

[homeboy-ci]

Homeboy Results — data-machine-code

Lint

❌ lint — failed

• phpstan — 2 finding(s)
• Total: 2 finding(s)

ℹ️ Auto-fix: homeboy lint data-machine-code --path /home/runner/work/data-machine-code/data-machine-code --changed-since f1d953a --fix (or homeboy refactor data-machine-code --path /home/runner/work/data-machine-code/data-machine-code --changed-since f1d953a --from lint --write)
ℹ️ Some issues may require manual fixes
ℹ️ Full options: homeboy docs commands/lint
ℹ️ Save lint baseline: homeboy lint data-machine-code --baseline
Deep dive: homeboy lint data-machine-code --changed-since f1d953a

Test

✅ test — passed

ℹ️ Auto-fix lint issues: homeboy refactor data-machine-code --from lint --write
ℹ️ Collect coverage: homeboy test data-machine-code --coverage
ℹ️ Pass args to test runner: homeboy test -- [args]
ℹ️ Full options: homeboy docs commands/test
Deep dive: homeboy test data-machine-code --changed-since f1d953a

Audit

✅ audit — passed

• test_coverage — 2 finding(s)
• dead_code — 1 finding(s)
• dead_guard — 1 finding(s)
• duplication — 1 finding(s)
• intra-method-duplication — 1 finding(s)
• requested_detectors — 1 finding(s)
• Total: 7 finding(s)

Deep dive: homeboy audit data-machine-code --changed-since f1d953a

Tooling versions

• Homeboy CLI: homeboy 0.182.0+56ac8d5
• Extension: wordpress from https://github.com/Extra-Chill/homeboy-extensions
• Extension revision: dd47f26a
• Action: unknown@unknown

[chubes4]

Closing this because DMC is a component mounted into Sandbox Runtime, not the owner of the Sandbox Runtime product/control-plane surface. The real upstream primitive is continuing in chubes4/sandbox-runtime#21; the WordPress-facing ability layer should live in a dedicated Sandbox Runtime integration, with DMC available as an optional source/worktree component rather than registering the public sandbox task ability itself.