fix(sandbox-daemon): don't panic on Classify(nil, nil)

packages/sandbox/daemon-go/internal/config/classify.go

@@ -44,6 +44,13 @@ type Transition struct {
 // runtime-change > pm-change > port-change > env-change >
 // git-credential-refresh > no-op.
 func Classify(before, after *TenantConfig) Transition {
+	// Every other nil-config case here goes through a nil-safe accessor
+	// method; the after==nil, before==nil path is the one that reaches a
+	// bare field access (after.Env below), so normalize it up front instead
+	// of leaving that one arm to panic on a caller that passes nil.
+	if after == nil {
+		after = &TenantConfig{}
+	}
 	beforeHasUrl := before.HasCloneUrl()
 	afterHasUrl := after.HasCloneUrl()
 	beforeUrl := before.CloneUrl()

packages/sandbox/daemon-go/internal/config/classify_test.go

@@ -152,6 +152,17 @@ func TestClassify(t *testing.T) {
 	}
 }
 
+// Classify is exported and every other nil-config combination goes through a
+// nil-safe accessor; nil-before/nil-after used to reach a bare `after.Env`
+// field access and panic instead of returning no-op like nil/&TenantConfig{}
+// does.
+func TestClassifyNilAfterDoesNotPanic(t *testing.T) {
+	got := Classify(nil, nil)
+	if got.Kind != KindNoOp {
+		t.Fatalf("Classify(nil, nil) = %q, want %q", got.Kind, KindNoOp)
+	}
+}
+
 func TestClassifyEnvDiffKeys(t *testing.T) {
 	before := withEnv(&TenantConfig{}, map[string]string{"A": "1", "B": "2"})
 	after := withEnv(&TenantConfig{}, map[string]string{"A": "changed", "C": "3"})