feat(BLK-013): real bounded CLI runner task on hardened docker sandbox

[Ghenghis]

Summary

Adds POST /api/code-operator/cli-runners/run-bounded-task and the backing
run_bounded_code_cli_task service. The endpoint executes a single
fixed prompt ("list top-level Python symbols in /workspace/{rel}") through
opencode/openhands inside a hardened docker sandbox.

This clears Wave 2026-05-09 hard gate 7 (real CLI runner work on the hardened
sandbox) without unlocking writes, network egress, or any host-secret mount.

Hardened docker invocation (non-negotiable)

docker run --rm --network=none --read-only \
  --tmpfs /tmp:size=64m,noexec,nosuid \
  --memory=512m --cpus=1 --pids-limit=128 \
  --cap-drop=ALL --security-opt=no-new-privileges \
  -v ${PROJECT_ROOT}:/workspace:ro \
  -w /workspace \
  ${sandbox.image} \
  ${runner_bin} --headless --json -t "${BOUNDED_TASK_PROMPT.format(rel=...)}"

Constants live in services/code_history.py:

• BOUNDED_TASK_PROMPT — single fixed prompt (callers cannot inject)
• BOUNDED_TASK_TIMEOUT_S = 30
• BOUNDED_TASK_MAX_STDOUT_BYTES = 8 * 1024

Output contract

• Stdout: redact_text(stdout) truncated to 8 KiB; full sha256 recorded as evidence.
• Stderr: returned only as sha256. Never appears in the response body even
  redacted (OpenHands/aider stderr commonly carries provider base-URLs and
  rate-limit headers).
• Timeout: container reaped, status="timeout", exit_code=-1.
• Sandbox not ready or runner not detected: status="blocked", no docker call.

Tests (6/6 pass; 52/52 adjacent regression pass)

04_testing/pytest/unit/test_cli_runner_bounded_task.py:

1. happy path — fake CompletedProcess returns ["foo","bar"]; evidence recorded.
2. sandbox not ready — returns blocked, no subprocess.run call.
3. runner not detected — returns blocked, no subprocess.run call.
4. timeout reaped — subprocess.TimeoutExpired -> status="timeout", exit_code=-1.
5. docker argv pin — --network=none, --read-only, --tmpfs ... noexec,nosuid,
   --memory=512m, --cpus=1, --pids-limit=128, --cap-drop=ALL,
   --security-opt=no-new-privileges all present in argv.
6. sandbox isolation — argv carries no -v G:/private, no ~/.aws, no ${HOME},
   no provider API key env-var pass-through, no -e flag at all.

Test plan

• python -m py_compile on all 3 touched files
• pytest 04_testing/pytest/unit/test_cli_runner_bounded_task.py -> 6/6 pass
• pytest 04_testing/pytest/unit/test_code_operator.py -> 52/52 pass
• FastAPI route enumeration shows /api/code-operator/cli-runners/run-bounded-task
• No G:/private, .env, *_API_KEY=value, or literal token in any diff hunk
• pre-push hook passes

MCP locks

Locked at start of task, will be released after merge:

• 03_implementation/src/hermes3d/services/code_history.py
• 03_implementation/src/hermes3d/api/routes/code_operator.py
• 04_testing/pytest/unit/test_cli_runner_bounded_task.py

Hermes evidence chain: PASS
Task ID: BLK-013-bounded-task
hermes_run_gate: lint+pytest (pre-push)

Online research (BLK-013 brief requirement)

• OpenHands --headless --json -t flag contract:
  https://docs.openhands.dev/openhands/usage/cli/headless
• Aider --message non-interactive scripting cross-comparison:
  https://aider.chat/docs/scripting.html

🤖 Generated with Claude Code

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b5ce7ccd-74dd-4a5e-81b4-3af049afc919

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/blk013-bounded-task-runner

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}