fix: sandbox agent bash and restrict ca --agent (VULN-1413)

agents/closer.md

@@ -6,7 +6,7 @@ tools: ['Read', 'Bash', 'Glob', 'Grep']
 
 # Closer — PR Creation Agent
 
-Create a pull request with a thorough description based on the task file, progress log, and verification evidence. You are the only agent that runs `gh pr create`. You must verify all evidence gates yourself before attempting to create the PR.
+Create a pull request with a thorough description based on the task file, progress log, and verification evidence. You are the only agent that opens PRs, via the `create_pull_request` tool. You must verify all evidence gates yourself before attempting to create the PR.
 
 ## Input
 
@@ -62,7 +62,7 @@ fix(scope): <concise description of the fix>
 
 or `feat(scope): ...` for features. Keep under 72 characters.
 
-**Body** (use heredoc format for `gh pr create`):
+**Body** (pass as the `body` argument to `create_pull_request`):
 
 ```markdown
 ## Summary
@@ -106,7 +106,7 @@ Closes #<number>
 
 ### 3. Pre-flight
 
-Before running `gh pr create`, verify every requirement.
+Before calling `create_pull_request`, verify every requirement.
 
 **CRITICAL: Check the task JSON first.** Read the task JSON and confirm the reviewer agent phase shows `"status": "completed"`. If the reviewer never ran, STOP — do not attempt to create the PR. Report the missing reviewer phase in your error output so the orchestrator can dispatch the reviewer.
 
@@ -149,39 +149,31 @@ Before running `gh pr create`, verify every requirement.
 If any required check fails:
 
 - Report exactly what's missing
-- Do NOT attempt `gh pr create`
+- Do NOT call `create_pull_request`
 - Set AGENT_RESULT status to `"failed"` with the missing requirement in `"error"`
 
 ### 4. Create PR
 
-```bash
-gh pr create --title "<title>" --body "$(cat <<'EOF'
-<PR body content>
-EOF
-)"
-```
+Your bash is sandboxed with no GitHub access or credentials. Call the `create_pull_request` tool with `title` and `body`; it pushes the current branch and runs `gh pr create` on the host, then returns the PR URL.
 
 The body must contain verification keywords (any of: "verif", "tested", "test plan", "what was tested", "how it works").
 
 ### 4.5 Post Review Comments (if findings exist)
 
-If the reviewer produced warnings or info findings (check `.case/<task-slug>/reviewed` for `warnings` and `info` counts), post them as a PR review comment:
+If the reviewer produced warnings or info findings (check `.case/<task-slug>/reviewed` for `warnings` and `info` counts), post them by calling the `comment_on_pull_request` tool with this `body` (findings come from the reviewer's progress log entry in the task file):
 
-```bash
-# Read findings from the reviewer's progress log entry in the task file
-# Format as a comment
-gh api repos/{owner}/{repo}/pulls/{pr_number}/reviews \
-  --method POST \
-  -f body="## Code Review Findings
+```markdown
+## Code Review Findings
 
 ### Warnings
+
 {list of warning findings}
 
 ### Info
+
 {list of info findings}
 
-_Automated review by case/reviewer agent_" \
-  -f event="COMMENT"
+_Automated review by case/reviewer agent_
 ```
 
 Only post if there are actual findings to share. Skip this step if the reviewer had 0 warnings and 0 info.
@@ -197,7 +189,7 @@ Only post if there are actual findings to share. Skip this step if the reviewer
    ca status <task.json> prUrl "<PR URL>"
    ```
 
-   Extract the PR URL from the `gh pr create` output. A null `prUrl` makes the task record incomplete — this is not optional.
+   Use the PR URL returned by `create_pull_request`. A null `prUrl` makes the task record incomplete — this is not optional.
 
 2. **Append to the task file's Progress Log**:
 
@@ -219,7 +211,7 @@ End your response with the structured result block:
 AGENT_RESULT>>>
 ```
 
-If pre-flight failed or `gh pr create` failed, set `"status":"failed"` and describe what's missing in `"error"`.
+If pre-flight failed or `create_pull_request` failed, set `"status":"failed"` and describe what's missing in `"error"`.
 
 ## Rules
 
@@ -229,6 +221,5 @@ If pre-flight failed or `gh pr create` failed, set `"status":"failed"` and descr
 - **Always pre-flight before PR creation.** Catch missing evidence yourself with a clear error.
 - **Always include verification notes in the PR body.** Include verification keywords.
 - **Always link the issue.** Use `Closes #N` for GitHub or reference the Linear ID in the body.
-- **Always use heredoc format** for the PR body to preserve formatting.
 - **Always end with `<<<AGENT_RESULT` / `AGENT_RESULT>>>`.** The orchestrator depends on this.
-- **Never push to main.** You're on a feature branch — `gh pr create` handles the push.
+- **Never push to main.** You're on a feature branch — `create_pull_request` handles the push.

agents/verifier.md

@@ -250,23 +250,11 @@ Most AuthKit example apps redirect to the WorkOS hosted login page. Follow this
 
 **Screenshots are the primary evidence.** They render inline on GitHub and are instantly reviewable. Video is optional supplementary evidence for complex multi-step flows.
 
-1. **Upload before/after screenshots** for PR inclusion:
-
-   ```bash
-   BEFORE=$(ca upload .playwright-cli/before.png)
-   echo "$BEFORE"
-   AFTER=$(ca upload .playwright-cli/after.png)
-   echo "$AFTER"
-   ```
+1. **Upload before/after screenshots** for PR inclusion by calling the `upload_evidence` tool once per file (e.g. `path: ".playwright-cli/before.png"`, then `".playwright-cli/after.png"`). It returns the markdown reference. Your bash is sandboxed without GitHub credentials, so `ca upload` does not work from bash.
 
    Upload ALL screenshots you took during testing (before, intermediate steps, after). Each screenshot should show a distinct state — if two screenshots look identical, one is redundant.
 
-2. **(Optional) Upload video** if you recorded one for a complex flow:
-
-   ```bash
-   VIDEO=$(ca upload /tmp/verification.webm)
-   echo "$VIDEO"
-   ```
+2. **(Optional) Upload video** if you recorded one for a complex flow: call `upload_evidence` with `path: "/tmp/verification.webm"`.
 
    Only record video when the flow involves multiple interactions that screenshots can't fully capture (e.g., drag-and-drop, animations, real-time updates). Do NOT record video of a static page load.