[Duplicate Code] Bounded-query runtime availability checks are duplicated

[github-actions]

Duplicate Code Opportunity

Summary

• Pattern: The bounded-query preflight layer repeats the same runtime-availability control flow in two separate functions (sbx, docker, gvisor, and default Docker checks).
• Locations: src/bounded-query/preflight.ts:246-281 and src/bounded-query/preflight.ts:283-322.
• Impact: Roughly 70 lines of near-parallel security-gate logic, with separate error messages and branch handling that can drift over time in a fail-closed path.

Evidence

assertQueryRuntimeAvailable	assertPrimaryRuntimeAvailable
if (boundedQueries.runtime === 'sbx') { ... return; }	if (containerRuntime === 'sbx') { ... return; }
if (boundedQueries.runtime === 'docker') { if (!(await queryDockerAvailable())) throw ...; return; }	if (containerRuntime) { if (!(await queryDockerRuntime(containerRuntime))) throw ...; return; }
if (!(await queryDockerRuntime(GVISOR_DOCKER_RUNTIME))) throw ...;	if (containerRuntime === 'gvisor' || containerRuntime === 'runsc') { if (!(await queryDockerRuntime(GVISOR_DOCKER_RUNTIME))) throw ...; return; }
// bounded queries never fall back to another runtime	// bounded queries abort before staging and never fall back

Suggested Refactoring

Extract a shared runtime-availability helper that accepts:

• the requested runtime name
• the availability probes to run (docker, runsc, sbx)
• the per-scope error-message prefix

That would keep the policy table in one place and reduce the chance of the primary-agent and query-sandbox gates diverging.

Affected Files

• src/bounded-query/preflight.ts — lines 246-322

Effort Estimate

Low

---

Detected by Duplicate Code Detector workflow. Run date: 2026-07-31

Generated by Duplicate Code Detector · gpt54mini · 7.95 AIC · ⊞ 24.9K · ◷

• expires on Aug 30, 2026, 6:38 AM UTC