fix(sdk): address remaining tooling review findings

packages/sdk/helper/tests/documents.spec.ts

@@ -74,8 +74,11 @@ describe('structured project documents', () => {
 
   it('round-trips Cordis comments and !!js while editing owned fields', () => {
     const created = CordisYamlFile.create().clone()
-    created.addEntry({ id: 'created', name: 'created-package' })
+    created.addEntry({ id: 'created', name: 'created-package' }, `Uncomment this example.
+config:
+  value: true`)
     expect(created.serialize()).toMatch(/^- id: created/m)
+    expect(created.serialize()).toContain('  # Uncomment this example.\n  # config:\n  #   value: true')
     expect(created.serialize()).not.toMatch(/^\[/)
     const flow = CordisYamlFile.parse('[{ id: flow, name: flow-package, config: { root: ./flow } }]\n')
     expect(flow.serialize()).toContain('- id: flow\n  name: flow-package\n  config:\n    root: ./flow')
@@ -205,6 +208,20 @@ describe('structured project documents', () => {
     invalid.addPackage(' ')
     expect(() => { invalid.validate() }).toThrow('must not be empty')
     expect(PnpmWorkspaceFile.parse('packages: []\n').serialize()).not.toContain('autoInstallPeers')
+    const preserved = PnpmWorkspaceFile.parse(`# keep workspace settings
+packages:
+  - apps/*
+catalog:
+  react: ^19.0.0
+overrides:
+  legacy: modern
+`)
+    preserved.disableAutoInstallPeers()
+    const preservedText = preserved.clone().serialize()
+    expect(preservedText).toContain('# keep workspace settings')
+    expect(preservedText).toContain('catalog:\n  react: ^19.0.0')
+    expect(preservedText).toContain('overrides:\n  legacy: modern')
+    expect(preservedText).toContain('autoInstallPeers: false')
   })
 
   it('renders strict complete-file templates without escaping code text', () => {

packages/sdk/helper/tests/project.spec.ts

@@ -52,6 +52,7 @@ function request(
   extra: readonly FeatureSelection[] = [],
   plugins: readonly LocalPluginBlueprint[] = [],
   app: 'acp' | 'stdio' | 'embed' = 'stdio',
+  bash: 'local' | 'sandbox' = 'local',
 ): ProjectCreationRequest {
   return {
     name: 'test-agent',
@@ -61,7 +62,7 @@ function request(
     releaseVersion: '0.0.1',
     features: [
       selection('provider', ['deepseek'], { apiKey: 'test-key' }),
-      selection('bash', ['local']),
+      selection('bash', [bash]),
       selection('app', [app]),
       selection('persistence', ['jsonl']),
       ...extra,
@@ -203,6 +204,24 @@ describe('SdkProject and ProjectEditSession', () => {
     expect(committed.cordis.entry('stdio')).toBeUndefined()
   })
 
+  it('emits the sandbox workspace-write example as inactive Cordis config', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'dsh-sandbox-bash-'))
+    temporary.push(root)
+    const creation = request([], [], 'stdio', 'sandbox')
+    const project = SdkProject.create(root, creation)
+    const registry = createBuiltinRegistry(project.profile)
+    const edit = project.edit(registry)
+    for (const item of creation.features) edit.installFeature(registry.get(item.id), item)
+    await edit.commit()
+    const cordis = await readFile(join(root, 'cordis.yml'), 'utf8')
+    expect(cordis).toContain(`- id: bash
+  name: "@deepseek-ai/dsh-bash-sandbox"
+  # Uncomment to allow writes under the project workspace.
+  # config:
+  #   mode: workspace-write
+  #   workspaceRoot: !!js process.cwd()`)
+  })
+
   it('round-trips the custom pi-ai provider with explicit endpoint and default model', async () => {
     const root = await mkdtemp(join(tmpdir(), 'dsh-custom-provider-'))
     temporary.push(root)
@@ -285,6 +304,14 @@ describe('SdkProject and ProjectEditSession', () => {
       .toContain('missing package.json script dev')
   })
 
+  it('rejects enabled features that do not apply to the target app interface', async () => {
+    const project = await createCommitted([selection('ask-user', ['default'])])
+    const registry = createBuiltinRegistry(project.profile)
+    const edit = project.edit(registry)
+    edit.configureFeature(registry.get(featureId('app')), selection('app', ['embed']))
+    await expect(edit.commit()).rejects.toThrow('feature ask-user is not available for embed')
+  })
+
   it('supports disabled feature reconfiguration and rejects invalid state operations', async () => {
     const project = await createCommitted([selection('todo', ['default'])])
     const registry = createBuiltinRegistry(project.profile)