A session cannot run the target repo's tests: no environment for its dependencies

[lorenzoliuzzo]

Found while running my-coder for real against a PyTorch project.

The prompt instructs every session:

Run the repo's own test suite and linter; leave them green.

A session structurally cannot do this for any repo with third-party dependencies:

1. Workspace gives the session a git worktree, which contains only tracked files. The target repo's .venv is gitignored, so it is not there.
2. ALLOWED_TOOLS (session.py:22) permits Bash(python3 -m venv*) but no installer — pip is deliberately excluded ("rm/pip/find stay off"). The session can create an empty venv and never populate it.
3. Whatever interpreter pytest resolves to is the ambient one, which has no reason to have the target's dependencies.

Measured: in the worktree for the target repo, import torch fails. Every test the session could write is unrunnable by the session that writes it, so it commits code it cannot verify, and --run-tests (once #12 is fixed) rejects it afterwards.

The same gap hits Coder._tests_pass, which runs self.test_command with the ambient interpreter. test_command is a constructor parameter the CLI never exposes, so an operator cannot point it at a prepared environment either.

The fleet's own repos hide this: their dependencies (mythings, myguard, ...) happen to be installed in the operator's ambient interpreter.

Decision taken

Allow the session to build its own environment — widen ALLOWED_TOOLS to permit install commands only (uv pip install*, pip install*, python3 -m pip install*), not arbitrary pip/uv subcommands.

This is a deliberate widening of the sandbox's blast radius: installing a package executes arbitrary code from the network inside the worktree. It is accepted because the alternative is a worker that writes unverifiable code, but it should be recorded as such and revisited if the fleet ever runs unattended against untrusted repos.

Acceptance criteria

• The session can install the target repo's dependencies and run its suite.
• The allowlist admits install subcommands only; bare pip/uv stays denied.
• --test-command is exposed on the CLI so an operator can point --run-tests at a prepared interpreter.
• Tests covering the widened allowlist and the new flag.
• CLAUDE.md records the widened blast radius.