feat(local-agent): execute uninstall_teamai commands via sync + ack (sandbox-safe)

[m0Nst3r873]

Summary

Implement the clawpro three-phase uninstall_teamai command in the HTTP source sync channel. The backend pushes an uninstall_teamai command carrying a cmd string (a single teamai subcommand); the local agent runs it once and reports the result via the existing ack channel. Delivery, ack, and retry semantics are reused unchanged.

{ "id": 42, "type": "uninstall_teamai", "cmd": "teamai uninstall --force --agent codebuddy" }

Resolves #235. Converged to the clawpro ch.7 unified cmds[] contract (implemented in #261): the interface models "push a one-shot teamai command" as the specific type uninstall_teamai, so this PR routes only that type and does not add a generic type:"cmd" (which is not in the ch.7 enum and the backend does not send). Commands flow through the unified cmds[] parser from #261 (falls back to legacy commands[]).

Behavior

• feat(local-agent): read unified cmds[] from sync response #261 skipped uninstall_teamai (placed it in UNIMPLEMENTED_COMMAND_TYPES, since no execution path existed). This PR adds the execution path and removes it from that set. Hook rule types (install_hook_rule / uninstall_hook_rule) stay skipped — out of scope.
• Execution goes through runCmdCommand.

Security boundary (runCmdCommand)

• teamai subcommands only — argv[0] must strictly equal teamai; anything else is rejected (acked failed) and never executed. No arbitrary-shell surface.
• No shell — execFile(process.execPath, [entry, ...args]); shell metacharacters are literal, no PATH dependency (works in bundled-node sandboxes).
• Timeout / limits — 120s timeout, 4 MiB maxBuffer, error detail capped at 200 chars.
• Kill switch — TEAMAI_DISABLE_REMOTE_CMD=1 short-circuits and acks failed with remote cmd disabled by client.

Sandbox delivery

Changes the CloudStudio sandbox guard from "skip report + sync" to "skip report, still run sync + processCommands", so sandboxed agents can receive the pushed uninstall. Report-side bookkeeping (plugin reconcile, binding prune, config save) stays gated behind the report path to avoid pruning host bindings not mounted in the container. TEAMAI_ALLOW_SANDBOX_REPORT=1 keeps its original meaning.

Test Plan

• npx tsc --noEmit — clean
• npx vitest run — full suite green (1844 tests); new/updated tests cover the parseTeamaiCmd tokenizer, non-teamai rejection, TEAMAI_DISABLE_REMOTE_CMD kill switch, subcommand non-zero exit, uninstall_teamai execution + success ack, and the sandbox no-prune guarantee.
• npm run build — success
• End-to-end: drove the built binary via teamai hook-dispatch session-start --tool codebuddy against a mock backend returning an uninstall_teamai command in cmds[] — the cmd actually executed and acked success (previously, under feat(local-agent): read unified cmds[] from sync response #261 alone, it was silently skipped).

🤖 Generated with Claude Code