refactor!: remove sandbox and support engines; simplify the CLI - #304
Merged
Merged
Conversation
- tui: clear inherited terminal env in DetectCapability test so a Ghostty/ Kitty host session cannot leak into the probe - acp: widen the test server deadline from 5s to 30s; a cold provider catalog lookup made the prompt exceed 5s under -race and surface as a spurious 'cancelled' stopReason - docs: fix broken relative links and stale 15-repo/nine-module claims to match the current 4-repo ecosystem.yaml manifest
Hawk no longer isolates agent command execution. Bash/PowerShell/Terminal run directly on the host, and the permission engine, tool layer, TUI, and CLI no longer carry a sandbox mode, isolation profile, or Docker container lifecycle. Removed: - internal/sandbox (11k LOC: seatbelt, landlock, seccomp, docker, egress proxy, devenv, code verifier, snapshots, approvals) - internal/engine/isolation_profile.go and the /isolation command - --sandbox flag, /autonomy sandbox, /autonomy isolation, DevEnv tool - Docker container boot, container-required tool gating, container footer - sandbox.mode event emission, settings.sandbox, container_network Kept: the diff sandbox (cmd/sandbox.go, internal/diffsandbox) for staged file-change review, and env sanitization (moved to internal/env). BREAKING CHANGE: host execution is now the only execution path; the fail-closed Docker guarantee is gone.
Hawk now depends only on eyrie. The five support engines whose GitHub repositories no longer exist are removed, along with the committed third_party/modproxy that existed solely to serve their unreachable pins. Removed: - harrier memory bridge and its graph-backed subsystems (auto-capture, proactive context, confidence, code links, session diff, cross-project, graph budget, shared mission memory, code index, /harrier, /dream) - kestrel review bridge and the kestrel-powered review run/analyze commands - merlin verification bridge and site-audit pipeline - swift CLI mount and correlation resolver - internal/token's external shrike dependency, replaced by a self-contained local engine (BPE token counting via tiktoken, compression, usage tracking, secret detection, code chunking, invariants, tool-catalog shrink, runtime-graph projection) - third_party/modproxy and the go.mod pins for all five engines The local memory subsystem (core, auto, evolving, zen, retrieval metrics, continuity, skill distillation, sleeptime) is retained. BREAKING CHANGE: hawk no longer integrates the support engines; graph exports lose harrier/kestrel/merlin/shrike observations and the /harrier, /review run|analyze, site-audit, and swift commands are gone.
The root help listed 64 commands alphabetically with no hierarchy. Cobra command groups now organize them into Core, Workflow, Context & memory, Configure, Diagnose, and Reference. Grouping is presentation-only — command names, flags, and behavior are unchanged, so scripts and tests keep working. Unknown/new commands fall into Reference so nothing is hidden from help. Also refresh stale engine references in the ecosystem and graph command descriptions.
Update the README, architecture docs, security model, and user guide to reflect that Hawk now depends only on eyrie, embeds its own token engine, and executes agent commands on the host rather than in a Docker sandbox. - README: drop Docker-only execution, support-engine mounts, and /autonomy sandbox; document host execution and the embedded token engine - architecture: replace the six-engine runtime graph with eyrie + embedded token engine; refresh control-plane, product-architecture, session decomposition, and execution-graph docs - security: replace the container isolation model with the permission engine - user guide: rewrite memory (local, not harrier), permissions, and configuration; rename 18-sandbox.md to 18-execution-and-permissions.md - mark ECOSYSTEM-CONFIG.md as a historical, unimplemented draft
The shared runServerWith helper used a 5s deadline; a cold provider catalog lookup makes the prompt exceed it under -race, cancelling the turn and surfacing as a missing session/update. Match the 30s deadline used by the other ACP test helper.
Hawk no longer depends on falcon; eyrie is its only external GrayCodeAI module. Update the advisory drift checker and its tests accordingly.
Restore gofumpt/gofmt cleanliness after the sandbox and engine removals; CI's format job is zero-tolerance.
Add unit tests for the self-contained token package that replaced shrike: token estimation, compression, usage tracking and thresholds, secret detection/redaction/masking, code chunking, JSON/log invariants, tool-catalog shrink, and runtime-graph projection (82.7% coverage). Also fix two bugs the tests surfaced: - ChunkCode reported token counts that disagreed with its budget check, letting chunks exceed MaxTokens - LintToolCatalog measured description size on the JSON-encoded value (including quotes) instead of the decoded string
- rename Shrike-named engine methods and comments to token-neutral names - rename the engine token facade file and drop stale Shrike references - remove the orphaned internal/bridge/swift package (no importers) - repoint internal/bench at the embedded token engine instead of the removed sibling engines - remove the dangling /harrier command from help, palette, and tips - wire the HUD memory section to the local memory manager (recalls, hit rate, sessions) instead of the removed harrier bridge - rename the ecosystem panel's shrike row to the token engine - add a memory round-trip integration test through MemoryService
Restructure the token-engine compression branch so the ratio is computed only after the original-token guard, avoiding a divide-by-zero when the input is empty.
- versioning/OTEL/monitoring/intelligent-cli: drop harrier/kestrel/merlin/ shrike/swift examples and the sandbox-v2 feature flag - architecture README: replace the six-engine target shape with eyrie plus the embedded token engine - mark the pre-2026-09 ecosystem docs as historical
- docker.yml: remove the sandbox-image build/scan/publish job and its path triggers; internal/sandbox no longer exists - verify-milestone.sh: drop the deleted internal/sandbox test invocation - CODEOWNERS: point security-sensitive rules at real paths and drop the removed sandbox/container entries - e2e-macos.sh: clarify the remaining 'sandbox status' is the diff sandbox - systemd unit: reword the process-hardening comment
…current eco - compatibility-matrix.json: reduce components to hawk + eyrie - platform-capabilities.json: drop the sandbox capability and collapse ecosystem_compatibility to hawk+eyrie - mark the Year 0 active track as superseded
The MCP server advertised hawk_memory_recall, hawk_memory_store, hawk_review, hawk_scan, and hawk_compress, but delegated to tool names that do not exist in the registry (core_memory, code_review, security_scan, compress), so every call failed at runtime. - memory recall/store now use the local memory store directly - compress now runs the embedded token engine directly and returns stats - remove hawk_review and hawk_scan: their kestrel/merlin engines are gone - memory persistence moves from .harrier/ to .hawk/ in retrieval metrics and continuity tracking - update MCP tests to the real 5-tool surface, including a store/recall round-trip
- harness evaluator: score the project's own test runners instead of hardcoded merlin/kestrel bridge flags; drop the bridge fields and the sandbox policy field from the assets contract - contracts/types: remove the unused FindingFromKestrel/FindingFromMerlin constructors and the stale review threshold comment
Replace stale harrier/kestrel/merlin references in doc comments, user-facing tool descriptions, and context-visualization labels with token-neutral wording.
The kestrel-powered review run command was removed with the engine, but the post-commit hook, 'hawk review refine', and the documented workflow still invoke it. Reimplement it on RunReviewPipeline (Hawk-owned, provider-only): it resolves the provider through the Eyrie boundary, runs the multi-concern review, and stores the neutral review contract.
- remove the always-true ShrikeAvailable skip guards now that the token engine is embedded - rename synthetic graph-fixture producers and session IDs away from the removed engine names - testaudit: check boundaries for eyrie only
Compression previously only hard-truncated at the budget, which the compaction path explicitly rejects as a non-summary. Add two structural layers and a head/tail budget enforcer: - collapse repeating line cycles (period 1-8) such as alternating user/assistant boilerplate - collapse near-duplicate line runs by normalized shape - enforce the budget by eliding the middle while preserving the head (goal/context) and tail (recent turns) SpecLinks was a stub: check listed IDs without verifying coverage and add returned 'not yet implemented'. check now reports per-requirement citation and test coverage; add writes an idempotent traceability checklist into tasks.md. Adds tests for both.
CodeSearch was advertised in the README and help but its backend (the harrier code index) was removed, so every call failed. Wire CodeSearchFn and RefreshCodeIndexFn to repomap's self-contained TF-IDF SemanticIndex, built lazily from the working directory and cached on the ToolService. Adds a search test.
- vim: 'u' was a no-op placeholder. Add a bounded (100-deep) text-snapshot
history recorded before every mutating command (x, X, ~, r, p, P, and
delete/change operators) and restore it on undo.
- mcp: remove the hawk://session resource, which advertised session
messages the stateless server cannot serve and returned a fake '{}'.
Remove four commands with no documentation or CI usage: - replay / tape (fxtape terminal-capture tooling) - schema (settings JSON-schema dump) - swift-report (private diagnostic report) and its internal/swift package Regenerate the golden root help. Command grouping drops the removed names.
CI pins gofumpt v0.10.0, which reformats multi-line []byte literals passed to os.WriteFile. Local gofmt did not flag it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes the sandbox/Docker execution model, the five support engines, and the
committed module proxy that existed only to serve them — then cleans up every
downstream reference, fixes latent bugs the removals exposed, and organizes the
CLI help surface.
23 commits · 340+ files · ~24k deletions. Hawk now depends only on
eyrie.1. Sandbox / isolation / Docker removal
internal/sandbox(11k LOC: seatbelt, landlock, seccomp, docker,egress proxy, devenv, code verifier, snapshots, approvals)
--sandbox,/autonomy sandbox,/isolation,DevEnv, container boot,sandbox.modeeventscmd/sandbox.go) and moved env sanitization tointernal/env2. Support-engine removal
third_party/modproxyinternal/tokenengine (BPE counting,compression, usage tracking, secret detection, chunking, invariants,
tool-catalog shrink, runtime-graph projection)
go.modnow depends only oneyrie3. Bug fixes surfaced by the audit
hawk_memory_recall/store,hawk_review,hawk_scan,hawk_compressdelegated to non-existent tools — every call failed. Memoryand compress now run locally; review/scan removed with their engines
repomap's local TF-IDF indexhawk review run: deleted with kestrel but still invoked by thepost-commit hook and
review refine— restored on Hawk's own pipelinenon-summary) — added cycle + near-duplicate collapsing and head/tail budget
enforcement
addreturned "not yet implemented" — now writes anidempotent traceability checklist;
checkreports citation/test coverageuwas a no-op placeholder — added bounded undo history.harrier/→.hawk/; harness evaluator no longerassumes removed bridges
4. CLI
Reference
replay,tape,schema,swift-report+internal/swift)5. Docs, CI, config
runtime; historical docs bannered
sandbox-imageDocker job; fixverify-milestone.sh,CODEOWNERS,e2e-macos.sh, systemd commenthawk+eyrieBreaking changes
is gone
lose their observations and
/harrier,/review run|analyze,site-audit,and
hawk swiftare removedreplay,tape,schema, andswift-reportcommands are removedVerification
go build ./...,go vet ./...,golangci-lint(0 issues)go test ./...and-racesuite greengo mod tidy -diff+verifyclean