fix(runner): refuse a Claude-on-Daytona run whose tools are all client-kind

[mmabrouk]

Symptom

A Claude run on a Daytona sandbox that requests only client-kind tools (for example a single request_connection browser tool) passes validation, starts, and then runs with zero tools and returns ok: true. The user asked for tools; the agent silently got none.

Why

On Daytona a non-Pi harness receives its tools through the in-sandbox stdio MCP shim, which advertises only executable (gateway/callback) tools. Client tools are intentionally omitted (the shim's blocking relay call cannot pause for a browser round-trip yet).

The up-front gate in run-plan.ts only refused a remote-sandbox tool run when the provider was not Daytona:

if (!isPi && isRemoteSandbox && toolSpecs.length > 0) {
  if (!isDaytona) {
    return { ok: false, error: REMOTE_TOOLS_UNSUPPORTED_MESSAGE };
  }
}

So an all-client-tool set on Daytona fell through and advertised nothing. mcp.ts already knows this is wrong: its log for the case says "...run-plan should have refused this run", and its doc comment lists "client tools on Daytona" as one of the "undeliverable combinations run-plan.ts refuses before a session is ever built." The refusal was documented but never implemented. This is the F1 silent zero-tools drop, one configuration over.

Change

Implement the documented intent. Inside the Daytona branch of the same gate, refuse when nothing executable remains after excluding client-kind tools:

if (executableToolSpecsForRun.length === 0) {
  return { ok: false, error: DAYTONA_CLIENT_ONLY_TOOLS_UNSUPPORTED_MESSAGE };
}

The new message follows the REMOTE_TOOLS_UNSUPPORTED_MESSAGE style (states the constraint, the remedies, and the tracking doc). A mix of client + executable tools is unaffected: the executable ones are delivered and the client ones are dropped, exactly as before. Pi on Daytona is unaffected (it delivers client tools through its extension + file relay). Local Claude is unaffected (the loopback MCP channel carries client tools).

Tests

• Flipped the now-incorrect unit test allows claude x daytona x client-only tools to expect refusal, asserting the message and that it fails before any cwd is created (an up-front gate).
• Existing coverage already pins the unaffected cases: claude x daytona x mixed tools (allowed, keeps only executable specs), pi x daytona x client-only tools (allowed), claude x local x client-only tools (allowed).
• Full runner suite green: pnpm run typecheck clean, pnpm test 1158 passed across 75 files.

Scope / risk

Two files, additive gate branch plus one new message constant. No wire-shape change. Behavior change is strictly a loud up-front refusal replacing a silent zero-tools run.

https://claude.ai/code/session_01RZnMTx5et6hRo5EHN187tT

[coderabbitai]

📝 Walkthrough

Walkthrough

Daytona Claude runs with only client-kind tools now fail during run-plan construction when no executable tools remain. The change adds an exported error message and verifies that sandbox cwd creation is skipped.

Changes

Daytona tool delivery

Layer / File(s)	Summary
Client-only tool boundary refusal services/runner/src/engines/sandbox_agent/run-plan.ts, services/runner/tests/unit/sandbox-agent-run-plan.test.ts	The run-plan builder rejects Daytona non-Pi runs with zero executable tools, and tests verify the error message and that no Daytona cwd is created.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• [bug] Claude harness gets no tools on Daytona sandboxes (and fails silently) #4984 — Covers the Claude-on-Daytona fail-loud guard for runs with no deliverable executable tools.

Possibly related PRs

• Agenta-AI/agenta#4985 — Adds related Daytona non-Pi tool-delivery guards in run-plan.ts.
• Agenta-AI/agenta#5047 — Introduces the remote-tools gating logic extended by this change.
• Agenta-AI/agenta#4838 — Adds related harness capability checks for non-Pi tool runs.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	It clearly summarizes the main change: refusing Claude-on-Daytona runs when only client-kind tools are requested.
Description check	✅ Passed	It accurately describes the validation bug, the Daytona refusal change, and the affected test updates.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/runner-daytona-client-only-tools-gate

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agenta-documentation	Ready	Preview, Comment	Jul 17, 2026 8:37pm

[mmabrouk]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[github-actions]

Railway Preview Environment

Status	Destroyed (PR closed)

Updated at 2026-07-17T22:37:32.344Z