fix(tools): empty execute_code capability set denies all sandbox tools

tests/agent/test_plugin_prompt_sections.py

@@ -41,7 +41,9 @@ def _install_test_section(manager: PluginManager, content) -> None:
     )
 
 
-def test_real_aiagent_freezes_section_within_life_and_rerenders_on_invalidate(monkeypatch):
+def test_real_aiagent_builds_section_once_and_keeps_it_out_of_static_prefix(
+    monkeypatch, tmp_path
+):
     # Pin the workspace snapshot: build_coding_workspace_block shells out to
     # live `git status`/`git log` on every build, and a git call failing or
     # timing out under xdist contention makes the two builds differ in the
@@ -61,6 +63,9 @@ def section(session_info):
     manager = PluginManager()
     _install_test_section(manager, section)
     monkeypatch.setattr(plugins, "_plugin_manager", manager)
+    # CI merge checkouts are detached HEAD; a second git probe can drop the
+    # branch line. This test is about plugin-section caching, not live git.
+    monkeypatch.setattr("agent.system_prompt.resolve_context_cwd", lambda: tmp_path)
     agent = _real_agent()
 
     first = build_system_prompt(agent)
@@ -168,10 +173,13 @@ def render(_session_info):
     )
 
     outputs = []
+    child_cwd = tmp_path / "child-workspace"
+    child_cwd.mkdir()
     for phase in ("first", "resume"):
         env = os.environ.copy()
         env.update(
             HERMES_HOME=str(tmp_path / "hermes-home"),
+            TERMINAL_CWD=str(child_cwd),
             TEST_DB=str(db_path),
             TEST_CALLS=str(calls_path),
             TEST_PHASE=phase,