feat(worker): run terminals and agent turns as the box user

apps/agent-worker/tests/unit/claude-adapter.test.ts

@@ -1,7 +1,6 @@
 import { mkdtemp, readFile, rm, stat } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
-
 import { afterEach, describe, expect, test, vi } from 'vitest';
 
 import type { NormalizedAgentEvent } from '../../src/agent-events';
@@ -98,7 +97,9 @@ describe('ClaudeCodeAdapter prepareAuth', () => {
     tempDirs.push(homeDir);
 
     const adapter = createClaudeAdapter();
-    await adapter.prepareAuth(makeOAuthWorkspace(homeDir, 'anthropic_oauth_json'));
+    await adapter.prepareAuth(
+      makeOAuthWorkspace(homeDir, 'anthropic_oauth_json'),
+    );
 
     const credentialsPath = path.join(homeDir, '.claude', '.credentials.json');
     const contents = await readFile(credentialsPath, 'utf8');
@@ -111,7 +112,9 @@ describe('ClaudeCodeAdapter prepareAuth', () => {
     tempDirs.push(homeDir);
 
     const adapter = createClaudeAdapter();
-    await adapter.prepareAuth(makeOAuthWorkspace(homeDir, 'opencode_auth_json'));
+    await adapter.prepareAuth(
+      makeOAuthWorkspace(homeDir, 'opencode_auth_json'),
+    );
 
     const credentialsPath = path.join(homeDir, '.claude', '.credentials.json');
     await expect(stat(credentialsPath)).rejects.toThrow();
@@ -174,4 +177,16 @@ describe('ClaudeCodeAdapter', () => {
     expect(command[3]).toContain("'claude' '-p'");
     expect(command[3]).toContain("'--output-format' 'stream-json'");
   });
+
+  test('execs the turn as the box user, not root', async () => {
+    const { createClaudeAdapter } = await loadAdapter();
+    let capturedUser: string | undefined;
+    const execStream = vi.fn((args: { user?: string }) => {
+      capturedUser = args.user;
+      return Promise.resolve({ exitCode: 0, output: '' });
+    }) as unknown as ExecStreamFn;
+    const adapter = createClaudeAdapter({ execStream });
+    await adapter.runTurn(makeWorkspace(), 'do it', () => Promise.resolve());
+    expect(capturedUser).toBe('tester');
+  });
 });