refactor(orchestrator): trim to interrupt-proof teardown; drop preservation-prune

Preservation-path pruning is covered downstream by coder_eval_uipath #57 and
isn't reachable on current configs; keep this PR to the teardown fix.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: bai-uipath

src/coder_eval/orchestrator.py

@@ -2116,16 +2116,11 @@ async def _cleanup(self) -> None:
                     logger.info(f"Sandbox preserved to: {preserved_path}")
                 elif self.preservation_mode == PreservationMode.DIRECT_WRITE and self.result:
                     # Sandbox already lives in run_dir/artifacts — nothing to move.
-                    # Set sandbox_path first, then prune capture-ignored entries
-                    # (MOVE_ON_WRITE gets this inside preserve_to; DIRECT_WRITE
-                    # never copies, so the raw workspace — agent-created
-                    # .venv/node_modules with sandbox-only symlinks, credential
-                    # stores — would otherwise persist in run_dir/artifacts and
-                    # break artifact publishing), then grant a+rX (a fallible
-                    # chmod) so artifacts written by a root-owned docker container
-                    # stay traversable across the host uid boundary.
+                    # Set sandbox_path first, then grant a+rX (a fallible chmod) so
+                    # artifacts written by a root-owned docker container stay
+                    # traversable across the host uid boundary (MOVE_ON_WRITE gets
+                    # this via preserve_to; DIRECT_WRITE skips it, so apply it here).
                     self.result.sandbox_path = str(self.sandbox.sandbox_dir)
-                    await asyncio.to_thread(self.sandbox.prune_preserved)
                     await asyncio.to_thread(self.sandbox.grant_read_access)
                     logger.info(f"Sandbox preserved (in-place): {self.sandbox.sandbox_dir}")
                 elif self.preservation_mode == PreservationMode.NONE and self.result:

src/coder_eval/sandbox.py

@@ -63,55 +63,6 @@
 )
 
 
-def _prune_capture_ignored(root: Path) -> list[str]:
-    """Remove :data:`_WORKSPACE_CAPTURE_IGNORE` entries from a preserved tree.
-
-    ``capture_to`` filters these at copy time (``shutil.ignore_patterns`` applies
-    at every directory level), but the other two preservation paths kept the raw
-    workspace: ``preserve_to`` is a ``shutil.move`` and DIRECT_WRITE never copies
-    at all. That leaks the same two classes the ignore tuple exists for — the
-    credential-store names, and agent-created ``.venv``/``node_modules`` bulk
-    whose ``bin/`` symlinks point at sandbox-only interpreter paths (dangling on
-    the host, they break artifact publishing: Azure DevOps'
-    PublishPipelineArtifact refuses ANY symlink). Walk the preserved tree with
-    the same matcher and drop every hit, so preserved workspaces look the same
-    regardless of which preservation path produced them.
-
-    Per-entry deletion failures are warning-logged and skipped — pruning is
-    hygiene and must never fail a preservation that already succeeded. Returns
-    the pruned paths relative to ``root`` (for the caller's log line).
-    """
-    if not root.is_dir():
-        return []
-    matcher = shutil.ignore_patterns(*_WORKSPACE_CAPTURE_IGNORE)
-    pruned: list[str] = []
-    for dirpath, dirnames, filenames in os.walk(root, topdown=True):
-        base = Path(dirpath)
-        for name in sorted(matcher(dirpath, dirnames + filenames)):
-            target = base / name
-            try:
-                # is_dir() follows symlinks: unlink a symlinked dir rather than
-                # rmtree THROUGH it into content outside the preserved tree.
-                if target.is_dir() and not target.is_symlink():
-                    shutil.rmtree(target)
-                else:
-                    target.unlink(missing_ok=True)
-            except OSError as exc:
-                logger.warning("Failed to prune %s from preserved workspace: %s", target, exc)
-                continue
-            pruned.append(str(target.relative_to(root)))
-            if name in dirnames:
-                dirnames.remove(name)  # deleted — don't descend into it
-    if pruned:
-        logger.info(
-            "Pruned %d capture-ignored entrie(s) from preserved workspace %s: %s",
-            len(pruned),
-            root,
-            ", ".join(pruned),
-        )
-    return pruned
-
-
 def _grant_read_traverse(root: Path) -> None:
     """Recursively apply ``chmod a+rX`` semantics under ``root``.
 
@@ -1086,21 +1037,6 @@ def grant_read_access(self) -> None:
         if self.sandbox_dir is not None and self.sandbox_dir.exists():
             _grant_read_traverse(self.sandbox_dir)
 
-    def prune_preserved(self) -> list[str]:
-        """Drop capture-ignored entries from the (preserved) sandbox tree, in place.
-
-        For DIRECT_WRITE preservation the sandbox already lives in the artifacts
-        dir, so neither ``capture_to``'s copy-time filter nor ``preserve_to``'s
-        post-move prune ever runs — agent-created ``.venv``/``node_modules``
-        (symlink-bearing bulk) and any credential-store names would persist in
-        ``run_dir/artifacts`` verbatim. Called by the orchestrator's DIRECT_WRITE
-        cleanup arm so all three preservation paths agree on what a preserved
-        workspace contains. Returns the pruned paths (relative), for callers/tests.
-        """
-        if self.sandbox_dir is None or not self.sandbox_dir.exists():
-            return []
-        return _prune_capture_ignored(self.sandbox_dir)
-
     def preserve_to(self, artifact_dir: Path) -> Path:
         """Preserve sandbox contents to an artifact directory.
 
@@ -1134,12 +1070,6 @@ def preserve_to(self, artifact_dir: Path) -> Path:
         old_sandbox_dir = self.sandbox_dir
         shutil.move(str(old_sandbox_dir), str(preserve_path))
 
-        # Match capture_to's filtering: the move carried the raw workspace,
-        # including capture-ignored entries (credential stores; .venv/node_modules
-        # bulk whose symlinks break artifact publishing). Prune them from the
-        # preserved copy — before the a+rX grant, so we don't chmod doomed files.
-        _prune_capture_ignored(preserve_path)
-
         # mkdtemp creates the sandbox root at 0700. Under driver:docker the
         # container runs as root, so the preserved tree lands on the host
         # bind-mount owned by root with that 0700 top dir -- the host user