fix: infrastructure bugs in 5 feature task Dockerfiles and F1 scorers

- tensorrt-mxfp4: add clone-as-claude pattern (agent couldn't write to /workspace)
- vscode-stale-diagnostics: add clone-as-claude pattern + npm install in test.sh
  for sg_only clone-at-verify (npx tsc fails without node_modules)
- servo-scrollend: add libclang-dev to both Dockerfile and Dockerfile.sg_only
  (cargo check fails because bindgen requires libclang.so)
- k8s-runtime-object + envoy-grpc: add normalize_repo() to F1 scorer to handle
  sg-evals mirror names (sg-evals/api--f32ed1d6 → api matches kubernetes/api)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: sjarmak

benchmarks/ccb_feature/envoy-grpc-server-impl-001/tests/test.sh

@@ -137,10 +137,45 @@ try:
         write_reward(0.0)
         sys.exit(0)
 
+    # ── Repo name normalization ────────────────────────────────────────────
+    def normalize_repo(name):
+        """Normalize repo names to a canonical short form for matching.
+
+        Handles sg-evals mirror names and upstream org/repo names by
+        extracting just the repo basename (last path segment).
+
+        sg-evals/istio--2300e245       -> istio
+        github.com/sg-evals/istio--h   -> istio
+        istio/istio                    -> istio
+        envoyproxy/go-control-plane    -> go-control-plane
+        emissary-ingress/emissary      -> emissary
+        """
+        n = name.strip()
+        # Strip URL prefixes
+        for prefix in ("github.com/", "https://github.com/"):
+            if n.startswith(prefix):
+                n = n[len(prefix):]
+        # Strip sg-evals/ prefix
+        if n.startswith("sg-evals/"):
+            n = n[len("sg-evals/"):]
+        # Strip --hexhash suffix (8+ hex chars after --)
+        n = re.sub(r'--[0-9a-f]{7,}$', '', n)
+        # Take just the last path segment (repo basename)
+        if "/" in n:
+            n = n.rsplit("/", 1)[-1]
+        return n
+
     # ── Build composite keys ─────────────────────────────────────────────
     def make_key(entry, fields):
-        """Build a composite key tuple from an entry's field values."""
-        return tuple(str(entry.get(f, "")).strip() for f in fields)
+        """Build a composite key tuple from an entry's field values.
+        Normalizes 'repo' field to handle sg-evals mirror names."""
+        parts = []
+        for f in fields:
+            val = str(entry.get(f, "")).strip()
+            if f == "repo":
+                val = normalize_repo(val)
+            parts.append(val)
+        return tuple(parts)
 
     expected_keys = [make_key(e, key_fields) for e in expected]
     reported_keys = [make_key(r, key_fields) for r in reported]

benchmarks/ccb_feature/k8s-runtime-object-impl-001/tests/test.sh

@@ -137,10 +137,44 @@ try:
         write_reward(0.0)
         sys.exit(0)
 
+    # ── Repo name normalization ────────────────────────────────────────────
+    def normalize_repo(name):
+        """Normalize repo names to a canonical short form for matching.
+
+        Handles sg-evals mirror names and upstream org/repo names by
+        extracting just the repo basename (last path segment).
+
+        sg-evals/api--f32ed1d6         -> api
+        github.com/sg-evals/api--hash  -> api
+        kubernetes/api                 -> api
+        envoyproxy/go-control-plane    -> go-control-plane
+        """
+        n = name.strip()
+        # Strip URL prefixes
+        for prefix in ("github.com/", "https://github.com/"):
+            if n.startswith(prefix):
+                n = n[len(prefix):]
+        # Strip sg-evals/ prefix
+        if n.startswith("sg-evals/"):
+            n = n[len("sg-evals/"):]
+        # Strip --hexhash suffix (8+ hex chars after --)
+        n = re.sub(r'--[0-9a-f]{7,}$', '', n)
+        # Take just the last path segment (repo basename)
+        if "/" in n:
+            n = n.rsplit("/", 1)[-1]
+        return n
+
     # ── Build composite keys ─────────────────────────────────────────────
     def make_key(entry, fields):
-        """Build a composite key tuple from an entry's field values."""
-        return tuple(str(entry.get(f, "")).strip() for f in fields)
+        """Build a composite key tuple from an entry's field values.
+        Normalizes 'repo' field to handle sg-evals mirror names."""
+        parts = []
+        for f in fields:
+            val = str(entry.get(f, "")).strip()
+            if f == "repo":
+                val = normalize_repo(val)
+            parts.append(val)
+        return tuple(parts)
 
     expected_keys = [make_key(e, key_fields) for e in expected]
     reported_keys = [make_key(r, key_fields) for r in reported]

benchmarks/ccb_feature/servo-scrollend-event-feat-001/environment/Dockerfile

@@ -11,6 +11,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
     autoconf \
     pkg-config \
+    libclang-dev \
     && rm -rf /var/lib/apt/lists/*
 
 # Create claude user and writable work dirs before clone.

benchmarks/ccb_feature/servo-scrollend-event-feat-001/environment/Dockerfile.sg_only

@@ -12,6 +12,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
     python3 \
     curl \
+    libclang-dev \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /workspace

benchmarks/ccb_feature/tensorrt-mxfp4-quant-feat-001/environment/Dockerfile

@@ -11,17 +11,22 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     ninja-build \
     && rm -rf /var/lib/apt/lists/*
 
+# Create claude user and writable work dirs before clone.
+RUN (adduser --disabled-password --gecos '' claude 2>/dev/null || true) && \
+    mkdir -p /workspace /logs && \
+    chown -R claude:claude /workspace /logs
+
 # Clone the actual TensorRT-LLM repository at pinned commit
 # This ensures BOTH baseline and MCP agents have identical file access
+USER claude
 RUN git clone --depth 1 https://github.com/sg-evals/TensorRT-LLM--b98f3fca.git . && \
     git config user.email "agent@example.com" && \
     git config user.name "Agent"
+USER root
 
 # Install Python dependencies (basic setup only)
 # Full build may require CUDA and other deps, but we need the source files
 RUN pip install --upgrade pip && \
     pip install pybind11==2.13.6 2>&1 || true
 
-# Task setup complete
-# Note: Both baseline and MCP agents now have access to the real TensorRT-LLM source.
-# Baseline will use local grep/find/rg. MCP will use Sourcegraph semantic search.
+ENTRYPOINT []

benchmarks/ccb_feature/vscode-stale-diagnostics-feat-001/environment/Dockerfile

@@ -11,15 +11,20 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3-pip \
     && rm -rf /var/lib/apt/lists/*
 
+# Create claude user and writable work dirs before clone.
+RUN (adduser --disabled-password --gecos '' claude 2>/dev/null || true) && \
+    mkdir -p /workspace /logs && \
+    chown -R claude:claude /workspace /logs
+
 # Clone the actual VS Code repository at pinned commit (1.96.0)
 # This ensures BOTH baseline and MCP agents have identical file access
+USER claude
 RUN git clone --depth 1 https://github.com/sg-evals/vscode--138f619c.git . && \
     git config user.email "agent@example.com" && \
     git config user.name "Agent"
+USER root
 
 # Install VS Code dependencies (required for testing)
 RUN npm install --legacy-peer-deps 2>&1 | tail -10 || true
 
-# Task setup complete
-# Note: Both baseline and MCP agents now have access to the real VS Code source.
-# Baseline will use local grep/find/rg. MCP will use Sourcegraph semantic search.
+ENTRYPOINT []

benchmarks/ccb_feature/vscode-stale-diagnostics-feat-001/tests/test.sh

@@ -68,6 +68,12 @@ fi
 
 echo "Running VS Code test suite..."
 
+# ── Install dependencies if missing (needed after sg_only clone-at-verify) ─
+if [ ! -d "node_modules" ] && [ -f "package.json" ]; then
+    echo "Installing npm dependencies (post-clone)..."
+    npm install --legacy-peer-deps 2>&1 | tail -5 || true
+fi
+
 # ── TypeScript type-check ────────────────────────────────────────────────
 # VS Code uses its own tsconfig files. Run tsc --noEmit to verify the
 # modified TypeScript still type-checks. If it fails, score is 0.