feat(#276): collect OpenShell logs before sandbox deletion

[fullsend-ai-coder]

Add log collection step to the sandbox cleanup flow so that OpenShell gateway and sandbox logs are preserved in the run output directory for post-mortem debugging and CI artifact collection.

Changes:

• sandbox.CollectLogs(): new function that runs
  openshell logs <name> --source <source> -n 0 with a 30s
  timeout to retrieve all available log lines
• collectOpenshellLogs(): orchestrator that collects both
  sandbox and gateway log sources, writing them to
  /logs/openshell-sandbox.log and
  /logs/openshell-gateway.log
• Log collection runs in the cleanup defer before
  sandbox.Delete(), ensuring logs are captured on both
  success and failure paths
• Failures are warned but never block the run (best-effort)

Note: pre-commit could not run due to network restrictions in the sandbox environment (exit code 3, 403 Forbidden on hook installation). The post-script runs an authoritative pre-commit check on the runner.

---

Closes #276

Post-script verification

• Branch is not main/master (agent/276-collect-openshell-logs)
• Secret scan passed (gitleaks — 94f67c43a41ec9974542ec6d6db660282c50120c..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[github-actions]

Site preview

Preview: https://79d56dfd-site.fullsend-ai.workers.dev

Commit: e46cdea1a43c333950575b590d37e8d5ce99c449

[fullsend-ai-review]

Review: #555

Head SHA: e46cdea
Timestamp: 2026-04-30T00:00:00Z
Outcome: approve

Summary

Clean, well-scoped change that adds best-effort OpenShell log collection to the sandbox cleanup flow, matching the intent and scope of issue #276. The implementation follows existing patterns in the codebase (exec.CommandContext with separate args, timeout handling, warn-but-don't-block error handling). No security, correctness, or injection concerns found.

Findings

Critical

None.

High

None.

Medium

None.

Low

• [correctness] internal/sandbox/sandbox.go:349 — CombinedOutput() mixes stdout and stderr, so diagnostic messages from openshell will appear in the collected log files. If clean log separation matters later, consider using separate Stdout/Stderr pipes. Acceptable for a best-effort debugging feature.

Info

• [style] internal/sandbox/sandbox_test.go:109-121 — Both TestCollectLogs_OpenshellNotInPath and TestCollectLogs_InvalidSource test the same condition (openshell not in PATH). The second test name suggests it tests source validation, but it actually tests the same binary-not-found path. Consider renaming or adding a test that exercises a real invalid-source scenario when openshell is available.

Footer

Outcome: approve
This review applies to SHA e46cdea1a43c333950575b590d37e8d5ce99c449. Any push to the PR head clears this review and requires a new evaluation.

[fullsend-ai-review]

See the review comment above for full details.