[earakely-scale]

Four unit test files create real local sandboxes (local_sandbox_host_ports_test, local_sandbox_test and the two network_policy_* tests). They create them in the default root, ~/.agent-env-sandboxes, and nothing removes them. So each run of the unit suite left about ten work dirs in the developer's home. One machine had collected about 20,000, roughly 700 a day, which every local sandbox lookup then scans.

The autouse isolated_state_root fixture already gives each unit test its own XDG_STATE_HOME. It now sets AGENT_ENV_LOCAL_SANDBOX_DIR to a temp dir as well. Tests that set their own root still do. The integration tiers are unchanged: on macOS, Docker can only bind-mount compose files from a shared path, which is why the default root is in the home dir.

Before / after: a full unit run added 10 work dirs to ~/.agent-env-sandboxes, and now adds 0. All 7,087 unit tests pass.

🤖 Generated with Claude Code

Confidence Score: 5/5

The PR appears safe to merge; no actionable issues were found.

Summary

Gives each unit test its own temporary local sandbox root through isolated_state_root.

• Each unit test keeps local sandbox work in a temporary folder.

No actionable issues were found. Tests were not run during this review.

_{Reviews (1) · Last reviewed commit: "Give every unit test its own local sandb..." · Reviewed by Greptile}