Stage behavior-defined engine CLIs into the docker-sbx visible path

[Copilot]

Execute Crush CLI has failed on every Daily Code Metrics run since 2026-08-12 with spawnSync crush ENOENT, despite Install Crush and Verify Crush CLI installation passing on the host.

Root cause: the docker-sbx microVM mounts only the workspace, /tmp, ${RUNNER_TEMP}/gh-aw, /usr/local/bin and a few home dirs — not the runner tool cache. Behavior-defined engines install their CLI via npm install -g, which lands in the hostedtoolcache, so the binary is invisible inside the sandbox. Claude and Codex already stage a second copy into ${RUNNER_TEMP}/gh-aw/engine-cli; behavior-defined engines never got that treatment.

Changes

• pkg/workflow/behavior_defined_engine.go
  • GetInstallationSteps: on docker-sbx/cloud-hypervisor, appends GenerateDockerSbxNpmCLIInstallStep, preserving the engine's post-install-scripts and cooldown settings (Crush requires postinstall to fetch its Go binary).
  • buildFirewallCommand: prepends the staged bin dir to the sandbox PATH, keeping the Claude/Codex ordering (after the MCP CLI export, so the engine CLI wins).
• .github/workflows/shared/crush.md — the harness resolves the command on PATH before spawning, so a missing mount reports crush not found in sandbox PATH: <path> instead of a bare ENOENT, and logs the resolved path on success.
• Tests / lock files — TestDockerSbxBehaviorDefinedEngineCLIWiring covers both the microVM wiring and that other runtimes are unaffected; changeset added and the four affected .lock.yml files recompiled.

Generated diff for daily-code-metrics.lock.yml:

      - name: Install Crush in docker-sbx path
        run: |
          mkdir -p "${RUNNER_TEMP}/gh-aw/engine-cli/bin"
          npm install --prefix "${RUNNER_TEMP}/gh-aw/engine-cli" @charmland/crush@0.88.0
          ln -sf "../node_modules/.bin/crush" "${RUNNER_TEMP}/gh-aw/engine-cli/bin/crush"

- ... export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && export no_proxy=...
+ ... export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && export PATH="${RUNNER_TEMP}/gh-aw/engine-cli/bin:$PATH" && export no_proxy=...

smoke-crush (default runtime, tool cache mounted) only picks up the harness preflight change — its install path is unchanged.

• Fixes [aw-failures] [P0] Crush CLI ENOENT in sandboxed exec — Daily Code Metrics failing 2 days running #52571

---

Run: https://github.com/github/gh-aw/actions/runs/31767348894> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 23.3 AIC · ⌖ 5.78 AIC · ⊞ 8.5K · ◷

_{Comment /souschef to run again}

[github-actions]

PR Triage

Category: bug · Risk: medium · Priority: medium · Score: 53/100

Impact	Urgency	Quality
25/50	18/30	10/20

Recommended action: fast_track

Fixes Execute Crush CLI ENOENT failures in docker-sbx (missing tool-cache mount) that have broken every Daily Code Metrics run since 2026-08-12. Still in draft with no CI runs yet — needs to be undrafted and CI triggered before merge.

Generated by 🔧 PR Triage Agent · auto · 58.4 AIC · ⌖ 2.92 AIC · ⊞ 7.8K · ◷

[pelikhan]

@lpcox review

[Copilot]

Pull request overview

Stages behavior-defined npm engine CLIs in the microVM-visible path to prevent sandbox ENOENT failures.

Changes:

• Adds microVM CLI staging and PATH wiring.
• Adds Crush executable preflight diagnostics.
• Adds tests, generated workflows, and a changeset.

Show a summary per file

File	Description
pkg/workflow/behavior_defined_engine.go	Adds CLI staging and PATH setup.
pkg/workflow/docker_sbx_test.go	Tests behavior-defined engine wiring.
.github/workflows/shared/crush.md	Adds executable resolution preflight.
.github/workflows/smoke-crush.lock.yml	Regenerates Crush smoke workflow.
.github/workflows/daily-code-metrics.lock.yml	Stages Crush for docker-sbx.
.github/workflows/daily-arxiv-researcher.lock.yml	Stages Crush for docker-sbx.
.github/workflows/daily-code-debt-aider.lock.yml	Regenerates sandbox PATH wiring.
.changeset/fix-behavior-engine-docker-sbx-cli-path.md	Documents the patch.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 8/8 changed files
• Comments generated: 2
• Review effort level: Balanced

[gh-aw-bot]

@copilot Please resolve the blocking review feedback on this PR, refresh the branch if needed, and run the pr-finisher skill before handing this PR back to maintainers.

Outstanding review items (newest first):

• copilot-pull-request-reviewer: Stage behavior-defined engine CLIs into the docker-sbx visible path #52576 (comment)
• copilot-pull-request-reviewer: Stage behavior-defined engine CLIs into the docker-sbx visible path #52576 (comment)

Branch update was requested automatically for this run.
Run: https://github.com/github/gh-aw/actions/runs/31767348894

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 23.3 AIC · ⌖ 5.78 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please resolve the blocking review feedback on this PR, refresh the branch if needed, and run the pr-finisher skill before handing this PR back to maintainers.

Outstanding review items (ne...

Resolved both blocking review items in 7f56f02: staging now falls back to execution.command-name when binary-name is omitted, and the focused test covers both docker-sbx and cloud-hypervisor. Final impacted validation passed.

[github-actions]

Triage: bug / risk: medium

Score: 64/100 (impact+urgency+quality) · Priority: medium · Action: fast_track

Fixes daily Code Metrics failure: Crush CLI ENOENT in docker-sbx microVM by staging engine CLIs into visible path.

_{Automated PR triage — see full report issue for details.}

Generated by 🔧 PR Triage Agent · auto · 48.2 AIC · ⌖ 2.57 AIC · ⊞ 7.8K · ◷