Add web auth, infinite-scroll, agent admission and review fixes across agent/server/web

agent/internal/runner/runner_test.go

@@ -2,6 +2,7 @@ package runner
 
 import (
 	"context"
+	"runtime"
 	"strings"
 	"testing"
 	"time"
@@ -114,3 +115,41 @@ func TestRunNoExec(t *testing.T) {
 		t.Fatalf("got %+v", r)
 	}
 }
+
+func TestRunCommandWithLimitsOK(t *testing.T) {
+	r := RunCommand(context.Background(), "echo ok", 2*time.Second, ResourceLimits{
+		CPUTime:   time.Second,
+		OpenFiles: 64,
+	})
+	if r.Status != StatusOK || r.ExitCode != 0 {
+		t.Fatalf("got %+v", r)
+	}
+	if !strings.Contains(r.Output, "ok") {
+		t.Fatalf("output: %q", r.Output)
+	}
+}
+
+func TestRunCommandCPULimitExceeded(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("ulimit is Unix-only")
+	}
+	r := RunCommand(context.Background(), "while :; do :; done", 5*time.Second, ResourceLimits{
+		CPUTime: time.Second,
+	})
+	if r.Status != StatusCritical || r.ExitCode != 2 {
+		t.Fatalf("got %+v", r)
+	}
+	if !strings.Contains(r.Output, "CPU time limit exceeded") {
+		t.Fatalf("output: %q", r.Output)
+	}
+}
+
+func TestDetectLimitFailureBoundsResourceLabel(t *testing.T) {
+	resource, ok := detectLimitFailure(limitFailPrefix + "dynamic-user-output")
+	if !ok {
+		t.Fatal("expected limit failure")
+	}
+	if resource != "unknown" {
+		t.Fatalf("resource label must be bounded, got %q", resource)
+	}
+}