diff --git a/src/agents/sandbox-agent-config.test.ts b/src/agents/sandbox-agent-config.test.ts
index d233b451c..ef8401198 100644
--- a/src/agents/sandbox-agent-config.test.ts
+++ b/src/agents/sandbox-agent-config.test.ts
@@ -52,35 +52,39 @@ describe("Agent-specific sandbox config", () => {
     spawnCalls.length = 0;
   });
 
-  it("should use global sandbox config when no agent-specific config exists", async () => {
-    const { resolveSandboxContext } = await import("./sandbox.js");
+  it(
+    "should use global sandbox config when no agent-specific config exists",
+    { timeout: 15_000 },
+    async () => {
+      const { resolveSandboxContext } = await import("./sandbox.js");
 
-    const cfg: ClawdbotConfig = {
-      agents: {
-        defaults: {
-          sandbox: {
-            mode: "all",
-            scope: "agent",
+      const cfg: ClawdbotConfig = {
+        agents: {
+          defaults: {
+            sandbox: {
+              mode: "all",
+              scope: "agent",
+            },
           },
+          list: [
+            {
+              id: "main",
+              workspace: "~/clawd",
+            },
+          ],
         },
-        list: [
-          {
-            id: "main",
-            workspace: "~/clawd",
-          },
-        ],
-      },
-    };
+      };
 
-    const context = await resolveSandboxContext({
-      config: cfg,
-      sessionKey: "agent:main:main",
-      workspaceDir: "/tmp/test",
-    });
+      const context = await resolveSandboxContext({
+        config: cfg,
+        sessionKey: "agent:main:main",
+        workspaceDir: "/tmp/test",
+      });
 
-    expect(context).toBeDefined();
-    expect(context?.enabled).toBe(true);
-  });
+      expect(context).toBeDefined();
+      expect(context?.enabled).toBe(true);
+    },
+  );
 
   it("should allow agent-specific docker setupCommand overrides", async () => {
     const { resolveSandboxContext } = await import("./sandbox.js");
diff --git a/src/agents/sandbox-merge.test.ts b/src/agents/sandbox-merge.test.ts
index 904debcce..042a0ff96 100644
--- a/src/agents/sandbox-merge.test.ts
+++ b/src/agents/sandbox-merge.test.ts
@@ -1,16 +1,20 @@
 import { describe, expect, it } from "vitest";
 
 describe("sandbox config merges", () => {
-  it("resolves sandbox scope deterministically", async () => {
-    const { resolveSandboxScope } = await import("./sandbox.js");
+  it(
+    "resolves sandbox scope deterministically",
+    { timeout: 15_000 },
+    async () => {
+      const { resolveSandboxScope } = await import("./sandbox.js");
 
-    expect(resolveSandboxScope({})).toBe("agent");
-    expect(resolveSandboxScope({ perSession: true })).toBe("session");
-    expect(resolveSandboxScope({ perSession: false })).toBe("shared");
-    expect(resolveSandboxScope({ perSession: true, scope: "agent" })).toBe(
-      "agent",
-    );
-  });
+      expect(resolveSandboxScope({})).toBe("agent");
+      expect(resolveSandboxScope({ perSession: true })).toBe("session");
+      expect(resolveSandboxScope({ perSession: false })).toBe("shared");
+      expect(resolveSandboxScope({ perSession: true, scope: "agent" })).toBe(
+        "agent",
+      );
+    },
+  );
 
   it("merges sandbox docker env and ulimits (agent wins)", async () => {
     const { resolveSandboxDockerConfig } = await import("./sandbox.js");
diff --git a/src/commands/doctor.test.ts b/src/commands/doctor.test.ts
index 25753bb91..e6ef9905d 100644
--- a/src/commands/doctor.test.ts
+++ b/src/commands/doctor.test.ts
@@ -244,52 +244,56 @@ vi.mock("./doctor-state-migrations.js", () => ({
 }));
 
 describe("doctor", () => {
-  it("migrates routing.allowFrom to whatsapp.allowFrom", async () => {
-    readConfigFileSnapshot.mockResolvedValue({
-      path: "/tmp/clawdbot.json",
-      exists: true,
-      raw: "{}",
-      parsed: { routing: { allowFrom: ["+15555550123"] } },
-      valid: false,
-      config: {},
-      issues: [
-        {
-          path: "routing.allowFrom",
-          message: "legacy",
-        },
-      ],
-      legacyIssues: [
-        {
-          path: "routing.allowFrom",
-          message: "legacy",
-        },
-      ],
-    });
+  it(
+    "migrates routing.allowFrom to whatsapp.allowFrom",
+    { timeout: 15_000 },
+    async () => {
+      readConfigFileSnapshot.mockResolvedValue({
+        path: "/tmp/clawdbot.json",
+        exists: true,
+        raw: "{}",
+        parsed: { routing: { allowFrom: ["+15555550123"] } },
+        valid: false,
+        config: {},
+        issues: [
+          {
+            path: "routing.allowFrom",
+            message: "legacy",
+          },
+        ],
+        legacyIssues: [
+          {
+            path: "routing.allowFrom",
+            message: "legacy",
+          },
+        ],
+      });
 
-    const { doctorCommand } = await import("./doctor.js");
-    const runtime = {
-      log: vi.fn(),
-      error: vi.fn(),
-      exit: vi.fn(),
-    };
+      const { doctorCommand } = await import("./doctor.js");
+      const runtime = {
+        log: vi.fn(),
+        error: vi.fn(),
+        exit: vi.fn(),
+      };
 
-    migrateLegacyConfig.mockReturnValue({
-      config: { whatsapp: { allowFrom: ["+15555550123"] } },
-      changes: ["Moved routing.allowFrom → whatsapp.allowFrom."],
-    });
+      migrateLegacyConfig.mockReturnValue({
+        config: { whatsapp: { allowFrom: ["+15555550123"] } },
+        changes: ["Moved routing.allowFrom → whatsapp.allowFrom."],
+      });
 
-    await doctorCommand(runtime, { nonInteractive: true });
+      await doctorCommand(runtime, { nonInteractive: true });
 
-    expect(writeConfigFile).toHaveBeenCalledTimes(1);
-    const written = writeConfigFile.mock.calls[0]?.[0] as Record<
-      string,
-      unknown
-    >;
-    expect((written.whatsapp as Record<string, unknown>)?.allowFrom).toEqual([
-      "+15555550123",
-    ]);
-    expect(written.routing).toBeUndefined();
-  });
+      expect(writeConfigFile).toHaveBeenCalledTimes(1);
+      const written = writeConfigFile.mock.calls[0]?.[0] as Record<
+        string,
+        unknown
+      >;
+      expect((written.whatsapp as Record<string, unknown>)?.allowFrom).toEqual([
+        "+15555550123",
+      ]);
+      expect(written.routing).toBeUndefined();
+    },
+  );
 
   it("migrates legacy Clawdis services", async () => {
     readConfigFileSnapshot.mockResolvedValue({