@atolis-hq/wake 0.1.22 → 0.2.0

package/README.md

@@ -1,4 +1,48 @@
-# Wake
+<div align="center">
+
+
+  <img src="https://raw.githubusercontent.com/atolis-hq/wake/refs/heads/main/assets/wake-logo.svg" alt="logo" width="200" height="auto" />
+  <h1>Wake</h1>
+  
+  <p>
+    Autonomous software engineering control plane
+  </p>
+  
+  
+<!-- Badges -->
+<p>
+  <a href="https://github.com/atolis-hq/wake/commits/main">
+    <img src="https://img.shields.io/github/last-commit/atolis-hq/wake" alt="last update" />
+  </a>
+  <a href="https://github.com/atolis-hq/wake/actions/workflows/ci-cd.yml">
+    <img src="https://github.com/atolis-hq/wake/actions/workflows/ci-cd.yml/badge.svg" alt="CI/CD status" />
+  </a>
+  <!-- <a href="https://github.com/atolis-hq/wake/network/members">
+    <img src="https://img.shields.io/github/forks/atolis-hq/wake" alt="forks" />
+  </a>
+  <a href="https://github.com/atolis-hq/wake/stargazers">
+    <img src="https://img.shields.io/github/stars/atolis-hq/wake" alt="stars" />
+  </a> -->
+  <a href="https://github.com/atolis-hq/wake/issues/">
+    <img src="https://img.shields.io/github/issues/atolis-hq/wake" alt="open issues" />
+  </a>
+  <a href="https://github.com/atolis-hq/wake/blob/main/LICENSE">
+    <img src="https://img.shields.io/github/license/atolis-hq/wake.svg" alt="license" />
+  </a>
+  <a href="https://github.com/atolis-hq/wake/tags">
+    <img src="https://img.shields.io/github/v/tag/atolis-hq/wake" alt="latest tag" />
+  </a>
+  <a href="https://www.npmjs.com/package/@atolis-hq/wake">
+    <img src="https://img.shields.io/npm/v/%40atolis-hq%2Fwake" alt="npm version" />
+  </a>
+  <a href="docker/Dockerfile">
+    <img src="https://img.shields.io/badge/sandbox-docker-2496ED?logo=docker&logoColor=white" alt="runs in docker" />
+  </a>
+</p>
+</div>
+
+<br />
+
 
 Wake is a control plane for autonomous software engineering. It watches the
 channels your team already uses, coordinates agent activity and involves humans
@@ -10,7 +54,19 @@ asks for input when human judgment matters, proposes a plan, launches local
 coding-agent CLIs to implement changes, opens pull requests, and carries the
 conversation forward wherever the work is already happening.
 
-Wake owns coordination. Coding agents execute the work.
+
+## Table of Contents
+
+- [The Problem](#the-problem)
+- [Vision](#vision)
+- [Feature Overview](#feature-overview)
+- [Where the Work Happens](#where-the-work-happens)
+- [Supported Agent CLIs](#supported-agent-clis)
+- [Getting Started](#getting-started)
+- [Documentation](#documentation)
+- [Issues & Feature Requests](#issues--feature-requests)
+- [License](#license)
+
 
 ## The Problem
 
@@ -58,8 +114,10 @@ For more detail, see [docs/vision.md](docs/vision.md) and
 - **Event-sourced and restart-safe.** The durable record is an append-only event
   log; projections can be rebuilt, and the loop can crash and resume without
   losing its place.
-- **Local and inspectable.** Config, events, state, runs, workspaces, and prompts
-  live in a plain-file Wake home directory.
+- **Local and inspectable.** Everything lives in a plain-file Wake home
+  directory: `config.json`, `prompts/`, and `workspaces/` at the top level for
+  what you edit or browse day-to-day, with durable/internal state (events,
+  projections, runs, logs, sandbox auth) nested under a hidden `.wake/`.
 - **Sandbox-oriented execution.** Wake can run from a persistent Docker sandbox
   with durable auth state and mounted Wake home data.
 - **Runner agnostic.** Claude Code, Codex, Cursor, and fake runners sit behind
@@ -75,71 +133,67 @@ For more detail, see [docs/vision.md](docs/vision.md) and
 Current runner capability differences are documented in
 [docs/runner-comparison.md](docs/runner-comparison.md).
 
-## Getting Started
+## Where the Work Happens
 
-Wake is distributed as the `@atolis-hq/wake` npm package. You can run the CLI
-with `npx` or install it globally:
+Wake has no chat UI you need to check for status. Your ticketing system is the
+interface: Wake posts progress updates, asks clarifying questions, and reports
+results as comments on the ticket, and reflects stage and status as labels on
+it. When it's ready, it opens a pull request against your repo the normal way.
+Reviewing, approving, and merging happen exactly where they already do today —
+nothing new to learn, no separate dashboard to babysit.
 
-```sh
-npx @atolis-hq/wake init ./wake-home
-```
+A local control-plane UI exists for operators who want to watch runs, inspect
+events, or resume a session directly, but it's a window into the same state —
+not a required part of the workflow.
 
-```sh
-npm install -g @atolis-hq/wake
-wake init ./wake-home
-```
+## Supported Agent CLIs
+
+Wake wraps existing coding-agent CLIs rather than replacing them. Runner
+adapters currently exist for:
 
-`wake init` creates a Wake home directory with `config.json`, prompt templates,
-Docker sandbox assets, runtime directories, and shell launchers:
+- **[Claude Code](https://claude.com/claude-code)**
+- **[Codex](https://openai.com/codex/)**
+- **[Cursor](https://cursor.com/cli)**
 
-- `wake.sh` for bash, Git Bash, WSL, and similar shells.
-- `wake.ps1` for PowerShell.
+Each runner sits behind the same `AgentRunner` contract, so Wake's routing,
+lifecycle, and sandbox behavior stay the same regardless of which CLI executes
+a given step. A fake runner adapter also exists for zero-token testing of the
+control plane itself. See [docs/runner-comparison.md](docs/runner-comparison.md)
+for capability differences between runners.
 
-Use the generated launcher from the Wake home for day-to-day operation. The
-launcher runs host setup commands locally and forwards runtime commands into the
-sandbox with the correct Wake home mounted at `/wake`.
+## Getting Started
 
 ```sh
+npm install -g @atolis-hq/wake
+cd ~/
+wake init ./wake-home
 cd ./wake-home
-./wake.sh sandbox build
-./wake.sh sandbox up
-./wake.sh sandbox setup
-./wake.sh tick
-./wake.sh start
+wake sandbox build
+wake sandbox up
+wake sandbox setup
+wake start
 ```
 
-The default sandbox image includes Node, Git, GitHub CLI, Claude Code, Codex,
-Cursor, and the Wake runtime. Treat the generated `docker/Dockerfile` as a
-starting point for your own environment: add the tools your repositories need,
-then rebuild with `./wake.sh sandbox build`. Wake writes the package location to
-`config.json` as `dev.repoRoot` so sandbox rebuilds use the same bundled assets;
-editing your generated Dockerfile or prompts is expected and future package
-upgrades should not overwrite that Wake home.
-
-Common commands:
-
-```sh
-./wake.sh ui
-./wake.sh tick
-./wake.sh start
-./wake.sh stop
-./wake.sh sandbox resume <session-id> --cwd "/wake/workspaces/<workId>"
-```
+Full setup instructions are in
+[docs/getting-started.md](docs/getting-started.md). Run `wake --help` at
+any time for the full command list.
 
-For a source checkout development workflow, use:
+## Documentation
 
-- [docs/development.md](docs/development.md)
+- [docs/getting-started.md](docs/getting-started.md) — packaged-install setup, sandbox lifecycle, `wake doctor`.
+- [docs/vision.md](docs/vision.md) — the rationale and long-term direction for Wake.
+- [docs/architecture.md](docs/architecture.md) — module boundaries and the event-sourced core.
+- [docs/workflows.md](docs/workflows.md) — how stages, prompts, and runner routes are configured.
+- [docs/prompts.md](docs/prompts.md) — how prompt templates map to workflow stages.
+- [docs/configuration.md](docs/configuration.md) — `config.json` options and the operator correlation escape hatch.
+- [docs/development.md](docs/development.md) — source-checkout dev setup (`wake-dev`), npm scripts, formatting, self-update, GitHub polling.
+- [docs/runner-comparison.md](docs/runner-comparison.md) — capability differences between supported runners.
 
-Recommended local practices:
+## Issues & Feature Requests
 
-- Use a separate git identity for Wake-managed agent work so automated commits
-  and human commits are easy to distinguish.
-- Prefer the prebuilt sandbox flow when running real agent work locally.
-- Treat the default Dockerfile as a starting point. It includes common tooling
-  such as Node, but it is expected to be edited for the repositories and agents
-  you want Wake to operate on.
+Found a bug or have an idea for Wake? [Open an issue](https://github.com/atolis-hq/wake/issues/new) —
+bug reports and feature requests are both welcome.
 
-## Development
+## License
 
-Local setup, commands, sandbox operation, auth setup, UI notes, and GitHub
-polling details are documented in [docs/development.md](docs/development.md).
+Wake is licensed under the [Apache License 2.0](LICENSE).

package/dist/src/adapters/docker/docker-cli.js

@@ -1,3 +1,5 @@
+import { createInterface } from 'node:readline';
+import { scrubSecrets } from '../../cli/sandbox-exec-logging.js';
 function buildStopArgs(containerName, timeoutSeconds) {
     return [
         'stop',
@@ -50,7 +52,19 @@ function buildRunArgs(input) {
 export function createDockerCli(deps) {
     return {
         async build(input) {
-            await deps.run(['build', '-t', input.image, '-f', input.dockerfile, input.contextDir]);
+            const buildArgFlags = Object.entries(input.buildArgs ?? {}).flatMap(([key, value]) => [
+                '--build-arg',
+                `${key}=${value}`,
+            ]);
+            await deps.run([
+                'build',
+                '-t',
+                input.image,
+                '-f',
+                input.dockerfile,
+                ...buildArgFlags,
+                input.contextDir,
+            ]);
         },
         async up(input) {
             const imageExists = await deps.inspectImage(input.image);
@@ -90,6 +104,36 @@ export function createDockerCli(deps) {
                 ? ['exec', interactive ? '-it' : '-i', containerName, ...command]
                 : ['exec', '-it', containerName, 'bash']);
         },
+        /**
+         * Runs `docker exec -i <containerName> <command>` with piped (not
+         * inherited) stdio, line-buffers stdout/stderr, scrubs secrets from each
+         * line, and forwards it to the caller's handlers in real time. Used by
+         * `sandbox exec` so live output is observed and redacted on the host
+         * instead of being wrapped by a mounted in-container script.
+         */
+        async execCaptured(containerName, command, handlers) {
+            if (deps.spawnExec === undefined) {
+                throw new Error('docker cli adapter was not configured with spawnExec');
+            }
+            const args = ['exec', '-i', containerName, ...command];
+            const child = deps.spawnExec(args);
+            const stdoutReader = createInterface({ input: child.stdout });
+            stdoutReader.on('line', (line) => handlers.onStdout(scrubSecrets(line)));
+            const stderrReader = createInterface({ input: child.stderr });
+            stderrReader.on('line', (line) => handlers.onStderr(scrubSecrets(line)));
+            await new Promise((resolveExec, reject) => {
+                child.on('error', reject);
+                child.on('close', (exitCode) => {
+                    stdoutReader.close();
+                    stderrReader.close();
+                    if (exitCode === 0) {
+                        resolveExec();
+                        return;
+                    }
+                    reject(new Error(`docker ${args.join(' ')} failed with exit code ${exitCode ?? 1}`));
+                });
+            });
+        },
         async logs(containerName, tailLines) {
             await deps.run(['logs', '--tail', String(tailLines), containerName]);
         },

package/dist/src/adapters/fs/state-store.js

@@ -58,7 +58,7 @@ function shouldArchiveIssueState(item, options) {
     return Number.isFinite(ageMs) && ageMs > options.archiveFreshnessDays * 24 * 60 * 60 * 1000;
 }
 export async function listRunRecords(wakeRoot) {
-    const runsRoot = join(wakeRoot, 'runs');
+    const runsRoot = join(createWakePaths(wakeRoot).dataRoot, 'runs');
     const recordsById = new Map();
     try {
         const files = (await readdir(runsRoot)).filter((file) => file.endsWith('.json')).sort();
@@ -93,7 +93,7 @@ export async function listRunRecords(wakeRoot) {
     return [...recordsById.values()].sort((left, right) => left.startedAt.localeCompare(right.startedAt));
 }
 async function listRunRecordsForDate(wakeRoot, date) {
-    const runsRoot = join(wakeRoot, 'runs');
+    const runsRoot = join(createWakePaths(wakeRoot).dataRoot, 'runs');
     const recordsById = new Map();
     const bucketFiles = (await readdir(join(runsRoot, 'by-date', date)).catch(() => []))
         .filter((file) => file.endsWith('.json'))
@@ -118,7 +118,7 @@ async function listRunRecordsForDate(wakeRoot, date) {
     return [...recordsById.values()].sort((left, right) => left.startedAt.localeCompare(right.startedAt));
 }
 async function listRecentRunRecords(wakeRoot, limit) {
-    const runsRoot = join(wakeRoot, 'runs');
+    const runsRoot = join(createWakePaths(wakeRoot).dataRoot, 'runs');
     const recordsById = new Map();
     const dateDirs = (await readdir(join(runsRoot, 'by-date')).catch(() => [])).sort().reverse();
     for (const dateDir of dateDirs) {
@@ -227,7 +227,7 @@ export function createStateStore({ wakeRoot }) {
             }
         },
         async listIssueStates(options = {}) {
-            const stateRoot = join(wakeRoot, 'state');
+            const stateRoot = join(paths.dataRoot, 'state');
             try {
                 const items = [];
                 const includeArchived = options.includeArchived ?? false;
@@ -284,7 +284,7 @@ export function createStateStore({ wakeRoot }) {
             }
         },
         async listEventEnvelopes() {
-            const eventsRoot = join(wakeRoot, 'events');
+            const eventsRoot = join(paths.dataRoot, 'events');
             try {
                 const files = (await readdir(eventsRoot)).sort();
                 const envelopes = [];
@@ -299,7 +299,7 @@ export function createStateStore({ wakeRoot }) {
         },
         async listRecentEventEnvelopes(filter = {}) {
             const limit = filter.limit ?? 200;
-            const eventsRoot = join(wakeRoot, 'events');
+            const eventsRoot = join(paths.dataRoot, 'events');
             const files = (await readdir(eventsRoot).catch(() => []))
                 .filter((file) => file.endsWith('.jsonl'))
                 .sort()

package/dist/src/adapters/github/github-issues-work-source.js

@@ -1,10 +1,10 @@
 import { readFile } from 'node:fs/promises';
-import { resolve } from 'node:path';
 import { defaultAgentIdentity } from '../../domain/schema.js';
 import { buildResourceUri } from '../../domain/resource-uri.js';
 import { wakeStageLabelPrefix } from '../../domain/stages.js';
 import { wakeWorkflowLabelPrefix } from '../../domain/workflows.js';
 import { createEventEnvelope, createUnkeyedEventEnvelope } from '../../lib/event-log.js';
+import { createWakePaths } from '../../lib/paths.js';
 import { wakeVersion } from '../../version.js';
 import { buildResumeCommandForCli } from '../runner/runner-cli-adapter.js';
 const wakeStatusLabelPrefix = 'wake:status.';
@@ -173,7 +173,7 @@ function formatControlPlaneLink(url) {
 }
 export async function readControlPlaneUiUrl(wakeRoot) {
     try {
-        const raw = await readFile(resolve(wakeRoot, 'control-plane-ui-url'), 'utf8');
+        const raw = await readFile(createWakePaths(wakeRoot).controlPlaneUiUrlFile, 'utf8');
         return formatControlPlaneLink(raw.trim()) ?? undefined;
     }
     catch {

package/dist/src/cli/doctor-command.js

@@ -0,0 +1,48 @@
+export async function runDoctorCommand(config, deps) {
+    const failures = [...(await deps.collectPreflightFailures(config))];
+    const notices = [];
+    if (config.sources.github.enabled) {
+        try {
+            await deps.resolveGitHubToken();
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            failures.push(`GitHub token could not be resolved: ${message}`);
+        }
+    }
+    if (await deps.hasDockerfile(deps.wakeRoot)) {
+        const reachable = await deps.dockerReachable();
+        if (!reachable) {
+            failures.push('Docker daemon is not reachable');
+        }
+        else {
+            const imageExists = await deps.inspectImage(deps.image);
+            if (!imageExists) {
+                failures.push(`sandbox image "${deps.image}" not found — run \`wake sandbox build\``);
+            }
+        }
+    }
+    try {
+        if (await deps.containerRunning()) {
+            const sandboxVersion = await deps.execVersionInContainer();
+            if (sandboxVersion !== '' && sandboxVersion !== deps.installedVersion) {
+                notices.push(`sandbox is running version ${sandboxVersion}, installed CLI is ${deps.installedVersion} — run \`wake sandbox build && wake sandbox update\` to sync`);
+            }
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        notices.push(`could not check sandbox version: ${message}`);
+    }
+    try {
+        const driftedFiles = await deps.diffPromptsAndDockerfile();
+        for (const file of driftedFiles) {
+            notices.push(`${file} differs from the currently-shipped default (not auto-overwritten)`);
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        notices.push(`could not check prompt/Dockerfile drift: ${message}`);
+    }
+    return { failures, notices };
+}

package/dist/src/cli/init-command.js

@@ -1,11 +1,18 @@
 import { resolve } from 'node:path';
 import { assertEmptyDirectory, scaffoldWakeHome } from './scaffold-assets.js';
 export async function runInitCommand(input) {
-    const wakeRoot = resolve(input.cwd, input.args[0] ?? '.');
+    const positionalArgs = input.args.filter((arg) => arg !== '--dev' && arg !== '--packaged');
+    const wakeRoot = resolve(input.cwd, positionalArgs[0] ?? '.');
+    const devModeOverride = input.args.includes('--dev')
+        ? 'source'
+        : input.args.includes('--packaged')
+            ? 'packaged'
+            : undefined;
     await assertEmptyDirectory(wakeRoot);
     await scaffoldWakeHome({
         wakeRoot,
         repoRoot: input.repoRoot,
+        ...(devModeOverride === undefined ? {} : { devModeOverride }),
     });
     return { wakeRoot };
 }

package/dist/src/cli/sandbox-command.js

@@ -1,10 +1,25 @@
-import { mkdir } from 'node:fs/promises';
+import { access, mkdir, readFile, writeFile } from 'node:fs/promises';
 import { posix, resolve } from 'node:path';
 import { createRunnerCliAdapter } from '../adapters/runner/runner-cli-adapter.js';
 import { runSandboxResumeCommand } from './sandbox-resume.js';
 import { runSelfUpdateCommand, runSelfUpdateLoop } from './self-update-command.js';
 import { runStopCommand } from './stop-command.js';
-import { buildSandboxLoggedCommand } from './sandbox-logging.js';
+import { wakeVersion } from '../version.js';
+async function ensureDockerfile(input) {
+    const targetPath = resolve(input.wakeRoot, 'docker', 'Dockerfile');
+    try {
+        await access(targetPath);
+        return; // already present — user-owned, never overwritten
+    }
+    catch {
+        // fall through to write it
+    }
+    const mode = input.devMode ?? 'packaged';
+    const templatePath = resolve(input.packagedTemplatesRoot, mode === 'source' ? 'Dockerfile' : 'Dockerfile.packaged');
+    const content = await readFile(templatePath, 'utf8');
+    await mkdir(resolve(input.wakeRoot, 'docker'), { recursive: true });
+    await writeFile(targetPath, content, 'utf8');
+}
 async function ensureContainerHomeMountParents(input) {
     for (const mount of input.extraMounts) {
         const relativeTarget = posix.relative(input.containerHomeMountPath, mount.target);
@@ -47,10 +62,17 @@ export async function runSandboxCommand(input) {
         if (repoRoot === undefined || repoRoot.length === 0) {
             throw new Error('Sandbox build requires config.dev.repoRoot');
         }
+        const effectiveDevMode = input.config.dev?.mode ?? 'packaged';
+        await ensureDockerfile({
+            wakeRoot: input.wakeRoot,
+            devMode: effectiveDevMode,
+            packagedTemplatesRoot: input.packagedTemplatesRoot,
+        });
         await input.docker.build({
             image: input.config.sandbox.image,
             dockerfile: resolve(input.wakeRoot, 'docker', 'Dockerfile'),
             contextDir: repoRoot,
+            ...(effectiveDevMode === 'packaged' ? { buildArgs: { WAKE_VERSION: wakeVersion } } : {}),
         });
         return;
     }
@@ -113,7 +135,8 @@ export async function runSandboxCommand(input) {
             throw new Error('Sandbox self-update requires config.dev.repoRoot');
         }
         if (input.selfUpdate === undefined) {
-            throw new Error('Sandbox self-update requires git/issueReporter/ledger dependencies');
+            throw new Error('Sandbox self-update requires dev.mode: "source". For a packaged install, update instead with:\n' +
+                '  npm install -g @atolis-hq/wake@latest && wake sandbox build && wake sandbox update');
         }
         const selfUpdateArgs = input.args.slice(1);
         const runSelfUpdate = selfUpdateArgs.includes('--loop')
@@ -146,7 +169,10 @@ export async function runSandboxCommand(input) {
         return;
     }
     if (subcommand === 'setup') {
-        await input.docker.exec(input.config.sandbox.containerName, ['bash', '/wake/docker/setup.sh'], {
+        const setupCommand = input.config.dev?.mode === 'source'
+            ? ['node', '/app/dist/src/main.js', 'sandbox-setup']
+            : ['wake', 'sandbox-setup'];
+        await input.docker.exec(input.config.sandbox.containerName, setupCommand, {
             interactive: true,
         });
         return;
@@ -154,15 +180,18 @@ export async function runSandboxCommand(input) {
     if (subcommand === 'exec') {
         const commandArgs = input.args.slice(1);
         const wrappedCommand = commandArgs[0] === '--' ? commandArgs.slice(1) : commandArgs;
-        await input.docker.exec(input.config.sandbox.containerName, wrappedCommand.length === 0
-            ? []
-            : buildSandboxLoggedCommand({
-                label: 'sandbox.exec',
-                config: input.config,
-                wakeRoot: input.wakeRoot,
-                containerHomeRoot: input.containerHomeRoot,
-                command: wrappedCommand,
-            }));
+        if (wrappedCommand.length === 0) {
+            // No command given: drop into an interactive shell with a real TTY,
+            // same as `docker exec -it ... bash`. That's a genuine interactive
+            // use case, so it stays on the inherited-stdio path rather than the
+            // piped/scrubbed one below (which would break TTY behavior).
+            await input.docker.exec(input.config.sandbox.containerName, []);
+            return;
+        }
+        await input.docker.execCaptured(input.config.sandbox.containerName, wrappedCommand, {
+            onStdout: (line) => input.logger.info(line),
+            onStderr: (line) => (input.logger.error ?? input.logger.info)(line),
+        });
         return;
     }
     if (subcommand === 'logs') {
@@ -186,6 +215,7 @@ export async function runSandboxCommand(input) {
             wakeRoot: input.wakeRoot,
             containerHomeRoot: input.containerHomeRoot,
             buildResumeCommand: runnerAdapter.buildResumeCommand,
+            logger: input.logger,
         });
         return;
     }

package/dist/src/cli/sandbox-entrypoint-command.js

@@ -0,0 +1,88 @@
+import { createWakePaths } from '../lib/paths.js';
+// The entrypoint always runs against the fixed in-container mount point
+// (/wake), so a literal wakeRoot here is safe.
+const CONTROL_PLANE_UI_URL_FILE = createWakePaths('/wake').controlPlaneUiUrlFile;
+const DEFAULT_UI_PORT = '4317';
+const DEFAULT_START_RESTART_DELAY_SECONDS = 10;
+/**
+ * Resolves how to invoke the wake CLI from inside the container.
+ *
+ * Source-mode images (docker/Dockerfile) bake `WAKE_MAIN_JS` at build time,
+ * pointing at the compiled entrypoint under /app. Packaged-mode images
+ * (docker/Dockerfile.packaged) have no /app directory at all — the CLI is
+ * installed globally via npm and exposed as a `wake` binary on PATH, so the
+ * absence of WAKE_MAIN_JS is the signal to invoke it bare.
+ */
+function resolveWakeInvocation(env) {
+    const mainJs = env.WAKE_MAIN_JS;
+    return mainJs !== undefined
+        ? { command: 'node', argsPrefix: [mainJs] }
+        : { command: 'wake', argsPrefix: [] };
+}
+async function discoverAndWriteNgrokUrl(deps) {
+    await deps.removeFile(CONTROL_PLANE_UI_URL_FILE);
+    const publicUrl = await deps.discoverNgrokUrl();
+    if (publicUrl !== undefined) {
+        await deps.writeFile(CONTROL_PLANE_UI_URL_FILE, `${publicUrl}\n`);
+        deps.log(`wake ui: ngrok tunnel available at ${publicUrl}`);
+        return;
+    }
+    deps.log('wake ui: ngrok tunnel started but public URL was not discovered; see /wake/.wake/logs/ngrok.log');
+}
+async function superviseWakeStart(deps, restartDelaySeconds) {
+    for (;;) {
+        deps.log('wake start: starting resident loop');
+        const { command, argsPrefix } = resolveWakeInvocation(deps.env);
+        // --no-sandbox: this already IS the sandbox — docker/Dockerfile is
+        // bind-mounted at /wake, so without this the process's own
+        // dispatchMainCommand would see it and try to auto-delegate into
+        // `docker exec`, which doesn't exist inside the container itself.
+        const { pid } = deps.spawnDetached(command, [...argsPrefix, 'start', '--wake-root', '/wake', '--no-sandbox'], { logFile: '/wake/.wake/logs/start.log' });
+        await deps.writeFile('/wake/.wake/logs/start.pid', String(pid));
+        const exitCode = await deps.waitForExit(pid);
+        deps.log(`wake start: resident loop exited with status ${exitCode}; restarting in ${restartDelaySeconds}s`);
+        await deps.sleep(restartDelaySeconds * 1000);
+    }
+}
+export async function runSandboxEntrypointCommand(deps) {
+    const { env } = deps;
+    await deps.ensureDir('/wake/.wake/logs');
+    if (env.WAKE_UI_ENABLED === 'true') {
+        const port = env.WAKE_UI_PORT ?? DEFAULT_UI_PORT;
+        deps.log(`wake ui: starting on 0.0.0.0:${port}`);
+        const { command, argsPrefix } = resolveWakeInvocation(env);
+        // --no-sandbox: same reason as the `wake start` spawn below — without
+        // it, this process would try to `docker exec` itself from inside the
+        // container it's already running in.
+        const uiArgs = [
+            ...argsPrefix,
+            'ui',
+            '--wake-root',
+            '/wake',
+            '--host',
+            '0.0.0.0',
+            '--port',
+            port,
+            '--no-sandbox',
+        ];
+        if (env.WAKE_UI_TOKEN) {
+            uiArgs.push('--token', env.WAKE_UI_TOKEN);
+        }
+        deps.spawnDetached(command, uiArgs, { logFile: '/wake/.wake/logs/ui.log' });
+        if (env.WAKE_UI_TUNNEL_ENABLED === 'true') {
+            if (env.NGROK_AUTHTOKEN) {
+                const { pid } = deps.spawnDetached('ngrok', ['config', 'add-authtoken', env.NGROK_AUTHTOKEN], { logFile: '/wake/.wake/logs/ngrok.log' });
+                await deps.waitForExit(pid);
+            }
+            deps.log(`wake ui: starting ngrok tunnel for 127.0.0.1:${port}`);
+            deps.spawnDetached('ngrok', ['http', `127.0.0.1:${port}`, '--log=stdout'], {
+                logFile: '/wake/.wake/logs/ngrok.log',
+            });
+            void discoverAndWriteNgrokUrl(deps);
+        }
+    }
+    if (env.WAKE_START_ENABLED === 'true') {
+        const restartDelaySeconds = Number(env.WAKE_START_RESTART_DELAY_SECONDS ?? DEFAULT_START_RESTART_DELAY_SECONDS);
+        void superviseWakeStart(deps, restartDelaySeconds);
+    }
+}

package/dist/src/cli/sandbox-exec-logging.js

@@ -0,0 +1,7 @@
+const ENV_SECRET_PATTERN = /([A-Za-z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY)[A-Za-z0-9_]*=)[^\s]+/gi;
+const GITHUB_TOKEN_PATTERN = /(?:gho|ghp|github_pat)_[A-Za-z0-9_]+/g;
+export function scrubSecrets(line) {
+    return line
+        .replace(ENV_SECRET_PATTERN, '$1[REDACTED]')
+        .replace(GITHUB_TOKEN_PATTERN, '[REDACTED]');
+}

package/dist/src/cli/sandbox-resume.js

@@ -2,7 +2,13 @@ import { stdin as input, stdout as output } from 'node:process';
 import { createInterface } from 'node:readline/promises';
 import { join } from 'node:path';
 import { listRunRecords } from '../adapters/fs/state-store.js';
-import { buildSandboxLoggedCommand } from './sandbox-logging.js';
+function shellQuote(value) {
+    return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function buildCwdWrappedShellCommand(cwd, command) {
+    const shellCommand = `cd ${shellQuote(cwd)} && ${command.map(shellQuote).join(' ')}`;
+    return ['sh', '-c', shellCommand];
+}
 function readFlag(name, args) {
     const index = args.indexOf(name);
     if (index === -1) {
@@ -66,12 +72,8 @@ export async function runSandboxResumeCommand(input) {
         }
         throw new Error('No resumable sandbox session selected.');
     }
-    await input.docker.exec(input.config.sandbox.containerName, buildSandboxLoggedCommand({
-        label: 'sandbox.resume',
-        config: input.config,
-        wakeRoot: input.wakeRoot,
-        containerHomeRoot: input.containerHomeRoot,
-        cwd: target.workspacePath,
-        command: input.buildResumeCommand({ sessionId: target.sessionId }),
-    }));
+    await input.docker.execCaptured(input.config.sandbox.containerName, buildCwdWrappedShellCommand(target.workspacePath, input.buildResumeCommand({ sessionId: target.sessionId })), {
+        onStdout: (line) => input.logger.info(line),
+        onStderr: (line) => (input.logger.error ?? input.logger.info)(line),
+    });
 }