bug(sandbox): ImportProfile passes positional arg instead of --file flag

[maruiz93]

ImportProfile in internal/sandbox/sandbox.go:123 invokes:

cmd := exec.CommandContext(importCtx, "openshell", "provider", "profile", "import", profilePath)

OpenShell expects --file <FILE> or --from <FROM>:

error: unexpected argument '.../.fullsend-cache/resources/sha256/.../content' found
Usage: openshell provider profile import [OPTIONS] <--file <FILE>|--from <FROM>>

The directory-based ImportProfiles (line 296) correctly uses --from dir. Only the single-file ImportProfile path is broken.

Fix:

cmd := exec.CommandContext(importCtx, "openshell", "provider", "profile", "import", "--file", profilePath)

Impact: Any harness using openshell: profiles: with URL-referenced profiles fails at import time. The profiles are fetched and cached correctly but the import command errors. Directory-based profiles (local profiles/ dir) are unaffected since they use ImportProfiles → --from dir.

Discovered via fullsend-ai/agents#211 — the first harness to use URL-referenced profiles.

Reproducer: Any harness YAML with:

openshell:
  profiles:
    - "https://...some-profile.yaml#sha256=..."

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 2:15 PM UTC · Completed 2:18 PM UTC
Commit: cc7a526 · View workflow run →

[fullsend-ai-triage]

Triage Summary

Severity: High · Category: Bug

Problem

ImportProfile in internal/sandbox/sandbox.go:123 passes the profile path as a bare positional argument to openshell provider profile import, but OpenShell requires --file <FILE> or --from <FROM>. This causes all URL-referenced profile imports to fail at sandbox startup.

The sibling function ImportProfiles (line 296) correctly uses --from dir, so only the single-file import codepath is broken.

Root Cause

The --file flag is missing from the exec.CommandContext args. This appears to be an oversight when the single-file import path was implemented.

Recommended Fix

// Before (broken)
cmd := exec.CommandContext(importCtx, "openshell", "provider", "profile", "import", profilePath)

// After (fixed)
cmd := exec.CommandContext(importCtx, "openshell", "provider", "profile", "import", "--file", profilePath)

Impact

Any harness using URL-referenced profiles fails at import time. Directory-based profiles are unaffected. This blocks the agents repo migration to portable URL-referenced providers/profiles.

Proposed Test Case

// Test that ImportProfile includes --file flag in the constructed command.
// Capture or mock the exec.CommandContext call and assert the args slice
// contains: [..., "profile", "import", "--file", expectedProfilePath]
//
// Also verify ImportProfiles continues to use "--from", "dir" for
// directory-based imports (regression guard).

---

Labels: This is a confirmed bug in the sandbox component affecting profile imports. The fix is a one-line change with a clear root cause, making it ready for implementation. High priority because it blocks all URL-referenced profile usage.

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 2:19 PM UTC · Completed 2:25 PM UTC
Commit: cc7a526 · View workflow run →