refactor(cli): group agent dashboard diagnostics and shields modules

[cv]

Summary

Moves the first low-risk feature clusters out of the flat src/lib namespace. Agent, dashboard, diagnostics, and shields helpers now live in feature folders that match the placement map introduced by the prior PR.

Changes

• Move agent definition/onboard/runtime helpers under src/lib/agent/** and update bin shims/imports.
• Move dashboard contract, health, and recovery helpers under src/lib/dashboard/**.
• Move debug collection and debug command parsing helpers under src/lib/diagnostics/**.
• Move shields implementation, timer, audit helper, and related tests under src/lib/shields/**.
• Update imports, source-shape tests, CodeRabbit path instructions, and legacy migration helper mappings for the new paths.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx prek run --all-files passes
• npm test passes
• Tests added or updated for new or changed behavior
• No secrets, API keys, or credentials committed
• Docs updated for user-facing behavior changes
• make docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Refactor
  • Reorganized internal module structure to improve code organization and maintainability. Updated import paths across the codebase to reflect new module locations. No changes to user-facing features or functionality.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

This PR reorganizes module structure by consolidating agent, dashboard, debug, and shields modules from flat files into organized subdirectories (agent/, dashboard/, diagnostics/, shields/). All import paths, re-export shims, and test imports are updated to reflect the new structure. No functional logic changes occur.

Changes

Module Reorganization: Directory Structure Consolidation

Layer / File(s)	Summary
Migration Configuration & Scripts .coderabbit.yaml, scripts/check-legacy-migrated-paths.ts, scripts/ts-migration-assist.ts	Configuration and scripts updated to define new module paths and migration rules for agent, dashboard, and debug modules.
Re-export Shim Updates bin/lib/agent-defs.js, bin/lib/agent-onboard.js, bin/lib/agent-runtime.js	CommonJS shims updated to target new compiled paths: dist/lib/agent/defs, dist/lib/agent/onboard, dist/lib/agent/runtime.
Agent Module Source Files src/lib/agent/defs.ts, src/lib/agent/onboard.ts, src/lib/agent/runtime.ts	Agent module sources reorganized to use new relative import paths for dependencies within agent/ subdirectory structure.
Agent Module Test Updates src/lib/agent/base-image.test.ts, src/lib/agent/defs.test.ts, src/lib/agent/onboard.test.ts, src/lib/agent/runtime.test.ts	Agent test files updated to import from new dist/lib/agent/ compiled module paths.
Agent Module Consumer Imports src/lib/actions/onboard.ts, src/lib/actions/sandbox/rebuild.ts, src/lib/policies.ts, src/lib/sandbox-version.ts, src/lib/state/sandbox.ts	Source files consuming agent modules updated to import from new agent/defs and agent/onboard paths.
Dashboard Module Path Updates src/lib/dashboard/contract.ts, src/lib/dashboard/health.ts, src/lib/dashboard/recover.ts	Dashboard modules consolidated under dashboard/contract, dashboard/health, dashboard/recover with all internal imports updated.
Dashboard Module Test Updates src/lib/dashboard/contract.test.ts, src/lib/dashboard/health.test.ts, src/lib/dashboard/recover.test.ts	Dashboard test files updated to import from new dist/lib/dashboard/ compiled module paths.
Debug/Diagnostics Module Reorganization src/lib/diagnostics/debug.ts, src/lib/commands/debug.ts	Debug modules relocated to diagnostics/ subdirectory with repoDir traversal adjusted and all imports updated.
Debug/Diagnostics Test Updates src/lib/diagnostics/debug-command.test.ts, src/lib/diagnostics/debug.test.ts, src/lib/commands/simple-global-oclif-adapters.test.ts	Debug test files updated to import from new dist/lib/diagnostics/ compiled module paths.
Shields Module Reorganization src/lib/shields/audit.ts, src/lib/shields/index.ts, src/lib/shields/timer.ts	Shields module split into subdirectory with audit.ts and timer.ts as separate modules; imports updated to parent-relative paths.
Shields Module Test Updates src/lib/shields/index.test.ts	Test mocks updated to resolve new shields module structure with corrected relative import paths and fixture locations.
Integration & Dashboard Consumer Imports src/lib/onboard.ts, src/lib/sandbox-config.ts, src/lib/verify-deployment.ts	Integration files updated to import dashboard and agent modules from new dashboard/contract and agent/defs paths.
Comprehensive Test Suite Updates test/sandbox-version.test.ts, test/verify-deployment.test.ts, test/config-set-nested-ssrf.test.ts, test/onboard.test.ts, test/repro-2681-group-writable.test.ts, test/secret-redaction.test.ts	Test suite updated with new compiled module paths for agent, dashboard, shields, and diagnostics across all integration scenarios.

🎯 2 (Simple) | ⏱️ ~10 minutes

🐰 A rabbit hops through the code so fine,
Organizing modules in a neat design,
Agent, dashboard, shields all in place,
No logic changed, just structure to embrace!
Imports rewired with careful grace. 🌿

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: refactoring to reorganize agent, dashboard, diagnostics, and shields modules into feature-specific folders within src/lib.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/lib-feature-clusters

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[prekshivyas]

Mechanical move-only refactor implementing step 2 of the #3189 migration sequence. 23 of 44 files are git-detected renames (similarity 87-100%); the other 21 are import-path-only updates in callers and tooling.

Spot-checked the following for non-mechanical drift and found none:

• src/lib/agent/onboard.ts: identifier-by-identifier identical to the old agent-onboard.ts; only changes are sibling/parent relative-path adjustments (./agent-defs → ./defs, ./runner → ../runner, ./adapters/docker → ../adapters/docker).
• src/lib/agent/runtime.ts: same pattern, no logic changes.
• src/lib/shields/index.test.ts (largest delta at 12+/18-): pure path adjustments — vi.mock(\"../../src/lib/runner\") → vi.mock(\"../runner\"), dynamic import(\"../src/lib/domain/duration.js\") → import(\"../domain/duration.js\"), path.join(..., \"src\", \"lib\", \"shields.ts\") → path.join(..., \"index.ts\"). The net -6 is just simpler path.join calls now that the test sits next to its source.

Tooling correctly updated alongside the moves:

• .coderabbit.yaml glob src/lib/shields*.ts → src/lib/shields/**.
• scripts/check-legacy-migrated-paths.ts REMOVED_SHIM_MOVES entry for bin/lib/debug.js retargeted to src/lib/diagnostics/debug.ts.
• scripts/ts-migration-assist.ts SPECIAL_REWRITES entries for debug paths now point at src/lib/diagnostics/debug-command.
• bin/lib/agent-{defs,onboard,runtime}.js re-export shims retargeted at dist/lib/agent/... so external callers via the bin/lib entrypoints still work.
• All in-tree callers (src/lib/onboard.ts, src/lib/policies.ts, src/lib/sandbox-config.ts, src/lib/state/sandbox.ts, src/lib/actions/onboard.ts, src/lib/actions/sandbox/rebuild.ts, src/lib/commands/debug.ts, src/lib/verify-deployment.ts, src/lib/sandbox-version.ts, multiple test files) updated symmetrically.

Tests moved alongside their source (test/shields.test.ts → src/lib/shields/index.test.ts, test/shields-audit.test.ts → src/lib/shields/audit.test.ts), consistent with the colocation pattern in the placement map.

CI: pr.yaml rollup checks pass (commit-lint, dco, layer-boundary, check-hash, changes, get-pr-info, block edits to migrated legacy paths and removed shims). 1 prior pr-self-hosted run success on pull-request/3191. CodeRabbit / checks / macos-e2e / wsl-e2e / build-sandbox-images and current self-hosted run still in progress at approval time.