Publish harness and TUI open-source

initial sync from the monorepo

crates/codegen/xai-grok-shell/tests/sandbox_requirements_pin.rs

@@ -0,0 +1,22 @@
+//! Verify `requirements.toml` can pin the base sandbox `profile`.
+
+use xai_grok_shell::agent::config::{ConfigSource, SandboxSettingsConfig};
+
+#[test]
+fn requirements_pin_profile() {
+    let config = SandboxSettingsConfig::default();
+    let resolved = config.resolve_profile(None, Some("strict"));
+    assert_eq!(resolved.value, "strict");
+    assert_eq!(resolved.source, ConfigSource::Requirement);
+}
+
+#[test]
+fn cli_flag_overrides_config_but_not_requirement() {
+    let config = SandboxSettingsConfig {
+        profile: Some("workspace".to_string()),
+        ..Default::default()
+    };
+    let resolved = config.resolve_profile(Some("read-only"), Some("strict"));
+    assert_eq!(resolved.value, "strict");
+    assert_eq!(resolved.source, ConfigSource::Requirement);
+}