@atolis-hq/wake 0.1.23 → 0.2.0

package/dist/src/main.js

@@ -1,8 +1,11 @@
 #!/usr/bin/env node
 import { spawn } from 'node:child_process';
-import { dirname, resolve } from 'node:path';
+import { closeSync, existsSync, openSync } from 'node:fs';
+import { access, chmod, copyFile, mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+import { createInterface } from 'node:readline/promises';
 import { fileURLToPath } from 'node:url';
-import { createDockerCli } from './adapters/docker/docker-cli.js';
+import { createDockerCli, } from './adapters/docker/docker-cli.js';
 import { createFileBackedFakeTicketingSystem } from './adapters/fake/fake-ticketing-system.js';
 import { createFakeWorkspaceManager } from './adapters/fake/fake-workspace-manager.js';
 import { createGitWorkspaceManager } from './adapters/git/git-workspace-manager.js';
@@ -17,9 +20,12 @@ import { createGitHubClient } from './adapters/github/github-client.js';
 import { createGitHubIssuesWorkSource } from './adapters/github/github-issues-work-source.js';
 import { createGitHubPullRequestActivitySource } from './adapters/github/github-pull-request-activity-source.js';
 import { runCorrelateCommand } from './cli/correlate-command.js';
+import { runDoctorCommand } from './cli/doctor-command.js';
 import { runInitCommand } from './cli/init-command.js';
 import { runSandboxCommand } from './cli/sandbox-command.js';
-import { runStartupPreflight } from './cli/startup-preflight.js';
+import { runSandboxEntrypointCommand } from './cli/sandbox-entrypoint-command.js';
+import { runSandboxSetupCommand } from './cli/sandbox-setup-command.js';
+import { collectStartupPreflightFailures, runStartupPreflight } from './cli/startup-preflight.js';
 import { runUiCommand } from './cli/ui-command.js';
 import { loadWakeConfig } from './config/load-config.js';
 import { createControlPlane } from './core/control-plane.js';
@@ -44,8 +50,33 @@ export function readFlagBeforeCommandTerminator(name, args) {
     }
     return scopedArgs[index + 1];
 }
+// Walks up from this file's own directory until it finds a package.json,
+// rather than assuming a fixed number of directory levels — the file
+// running is `dist/src/main.js` for a built/packaged install (two levels
+// below the package root) but `src/main.ts` for a `tsx` dev invocation
+// (only one level below), so a fixed `resolve(..., '..', '..')` overshoots
+// the root by one directory in the latter case.
 function resolvePackageRoot() {
-    return resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
+    let dir = dirname(fileURLToPath(import.meta.url));
+    for (;;) {
+        if (existsSync(join(dir, 'package.json'))) {
+            return dir;
+        }
+        const parent = dirname(dir);
+        if (parent === dir) {
+            throw new Error(`Could not locate package root (no package.json found above ${dir})`);
+        }
+        dir = parent;
+    }
+}
+export async function hasDockerfile(wakeRoot) {
+    try {
+        await access(resolve(wakeRoot, 'docker', 'Dockerfile'));
+        return true;
+    }
+    catch {
+        return false;
+    }
 }
 function routesOnlyToFake(config) {
     return Object.values(config.tiers).every((candidates) => {
@@ -136,6 +167,130 @@ async function runCommandCapture(command, args) {
         });
     });
 }
+const codexBootstrapHome = '/home/wake/.codex';
+const codexRuntimeHome = '/home/wake/.codex-runtime';
+const sshHome = '/home/wake/.ssh';
+const sshKeyPath = join(sshHome, 'id_ed25519');
+async function prepareCodexHome() {
+    await mkdir(codexRuntimeHome, { recursive: true });
+    const bootstrapConfig = join(codexBootstrapHome, 'config.toml');
+    if (existsSync(bootstrapConfig)) {
+        await copyFile(bootstrapConfig, join(codexRuntimeHome, 'config.toml'));
+    }
+    const bootstrapAuth = join(codexBootstrapHome, 'auth.json');
+    const runtimeAuth = join(codexRuntimeHome, 'auth.json');
+    if (existsSync(bootstrapAuth) && !existsSync(runtimeAuth)) {
+        await copyFile(bootstrapAuth, runtimeAuth);
+    }
+    process.env.CODEX_HOME = codexRuntimeHome;
+}
+async function ensureSshKey() {
+    if (!existsSync(sshKeyPath)) {
+        await mkdir(sshHome, { recursive: true, mode: 0o700 });
+        await chmod(sshHome, 0o700);
+        await runCommand('ssh-keygen', ['-t', 'ed25519', '-f', sshKeyPath, '-N', '']);
+    }
+    // Display the public key to the user
+    const publicKeyPath = join(sshHome, 'id_ed25519.pub');
+    const publicKey = await readFile(publicKeyPath, 'utf-8');
+    console.log(publicKey);
+}
+async function promptYesNo(message) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = (await rl.question(`${message} `)).trim().toLowerCase();
+        return answer === 'y' || answer === 'yes';
+    }
+    finally {
+        rl.close();
+    }
+}
+async function runSandboxSetup() {
+    await runSandboxSetupCommand({
+        prompt: promptYesNo,
+        runInteractive: (command, args) => runCommand(command, args),
+        ensureSshKey,
+        prepareCodexHome,
+        log: (message) => console.log(message),
+    });
+}
+const NGROK_TUNNELS_URL = 'http://127.0.0.1:4040/api/tunnels';
+const NGROK_DISCOVERY_ATTEMPTS = 30;
+const NGROK_DISCOVERY_INTERVAL_MS = 1000;
+async function discoverNgrokUrl() {
+    for (let attempt = 0; attempt < NGROK_DISCOVERY_ATTEMPTS; attempt++) {
+        try {
+            const response = await fetch(NGROK_TUNNELS_URL, { signal: AbortSignal.timeout(1000) });
+            if (response.ok) {
+                const body = (await response.json());
+                const tunnels = body.tunnels ?? [];
+                const httpsTunnel = tunnels.find((tunnel) => typeof tunnel.public_url === 'string' && tunnel.public_url.startsWith('https://'));
+                const anyTunnel = httpsTunnel ?? tunnels.find((tunnel) => typeof tunnel.public_url === 'string');
+                if (typeof anyTunnel?.public_url === 'string') {
+                    return anyTunnel.public_url;
+                }
+            }
+        }
+        catch {
+            // ignore and retry
+        }
+        await new Promise((resolveSleep) => setTimeout(resolveSleep, NGROK_DISCOVERY_INTERVAL_MS));
+    }
+    return undefined;
+}
+function createSandboxEntrypointDeps() {
+    const children = new Map();
+    return {
+        env: process.env,
+        spawnDetached: (command, args, options) => {
+            const logFd = options?.logFile !== undefined ? openSync(options.logFile, 'a') : 'ignore';
+            const child = spawn(command, args, {
+                cwd: process.cwd(),
+                env: process.env,
+                stdio: ['ignore', logFd, logFd],
+                detached: true,
+            });
+            if (typeof child.pid === 'number') {
+                children.set(child.pid, child);
+            }
+            // Registered here (at spawn time) so it runs before any exit listener
+            // waitForExit attaches later — though it wouldn't matter either way:
+            // waitForExit captures the ChildProcess reference synchronously from
+            // `children` when it's called (before the child can possibly have
+            // exited) and attaches its own listener directly to that reference,
+            // so it never re-reads `children` inside the exit callback. Deleting
+            // the map entry here is therefore safe regardless of ordering.
+            child.on('exit', () => {
+                if (typeof child.pid === 'number') {
+                    children.delete(child.pid);
+                }
+                if (logFd !== 'ignore') {
+                    closeSync(logFd);
+                }
+            });
+            return { pid: child.pid ?? -1 };
+        },
+        waitForExit: (pid) => new Promise((resolveExit) => {
+            const child = children.get(pid);
+            if (child === undefined) {
+                resolveExit(1);
+                return;
+            }
+            child.on('exit', (code) => resolveExit(code ?? 1));
+        }),
+        writeFile: (path, content) => writeFile(path, content, 'utf-8'),
+        sleep: (ms) => new Promise((resolveSleep) => setTimeout(resolveSleep, ms)),
+        discoverNgrokUrl,
+        log: (message) => console.log(message),
+        ensureDir: async (path) => {
+            await mkdir(path, { recursive: true });
+        },
+        removeFile: (path) => rm(path, { force: true }),
+    };
+}
+async function runSandboxEntrypoint() {
+    await runSandboxEntrypointCommand(createSandboxEntrypointDeps());
+}
 async function readTickRequestId(path) {
     try {
         const request = await readJsonFile(path);
@@ -181,8 +336,107 @@ async function inspectDockerContainer(containerName) {
         });
     });
 }
+async function dockerDaemonReachable() {
+    return await new Promise((resolveReachable) => {
+        const child = spawn('docker', ['info'], {
+            cwd: process.cwd(),
+            env: process.env,
+            stdio: 'ignore',
+        });
+        child.on('error', () => resolveReachable(false));
+        child.on('close', (exitCode) => resolveReachable(exitCode === 0));
+    });
+}
+/**
+ * Builds the same `DockerCli` client the `sandbox` command path uses, so
+ * `wake doctor`'s Docker/sandbox reachability checks reuse one Docker CLI
+ * invocation implementation instead of duplicating it.
+ */
+function createHostDockerCli() {
+    return createDockerCli({
+        // BuildKit is required for the Dockerfile's cache-mount syntax
+        // (`RUN --mount=type=cache`), which keeps `npm`/`apt` package
+        // caches warm across builds even when a layer above them changes.
+        run: (dockerArgs) => runCommand('docker', dockerArgs, { ...process.env, DOCKER_BUILDKIT: '1' }),
+        inspectImage: inspectDockerImage,
+        inspectContainer: inspectDockerContainer,
+        spawnExec: (dockerArgs) => {
+            const child = spawn('docker', dockerArgs, {
+                cwd: process.cwd(),
+                env: process.env,
+                stdio: ['inherit', 'pipe', 'pipe'],
+            });
+            // stdio: ['inherit', 'pipe', 'pipe'] guarantees stdout/stderr are
+            // non-null pipes; child_process's types don't encode that.
+            return child;
+        },
+    });
+}
+/**
+ * Runs `wake --version` inside the sandbox container via `docker exec` and
+ * returns the trimmed stdout, so `wake doctor` can compare it against the
+ * installed host CLI version. Stderr is discarded (surfaced only as an
+ * empty/mismatched version, which the caller already treats as a notice).
+ */
+async function execVersionInContainer(docker, containerName, devMode) {
+    let stdout = '';
+    const command = devMode === 'source' ? ['node', '/app/dist/src/main.js', '--version'] : ['wake', '--version'];
+    await docker.execCaptured(containerName, command, {
+        onStdout: (line) => {
+            stdout += line;
+        },
+        onStderr: () => { },
+    });
+    return stdout.trim();
+}
+async function readFileIfExists(path) {
+    try {
+        return await readFile(path, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Compares the wake-home's `prompts/*.md` and `docker/Dockerfile` (both
+ * user-owned files, never auto-overwritten after scaffolding — see
+ * `scaffold-assets.ts`/`sandbox-command.ts`'s `ensureDockerfile`) against the
+ * currently-shipped defaults under `resolvePackageRoot()`, byte-for-byte.
+ * Only files present in *both* locations are compared: a prompt file the
+ * user hasn't customized locally, or one only shipped in a newer/older CLI
+ * version, is not drift.
+ */
+async function diffPromptsAndDockerfile(input) {
+    const drifted = [];
+    let promptFileNames;
+    try {
+        promptFileNames = (await readdir(resolve(input.wakeRoot, 'prompts'))).filter((name) => name.endsWith('.md'));
+    }
+    catch {
+        promptFileNames = [];
+    }
+    for (const fileName of promptFileNames) {
+        const local = await readFileIfExists(resolve(input.wakeRoot, 'prompts', fileName));
+        const shipped = await readFileIfExists(resolve(input.packageRoot, 'prompts', fileName));
+        if (local !== null && shipped !== null && local !== shipped) {
+            drifted.push(`prompts/${fileName}`);
+        }
+    }
+    // Mirrors ensureDockerfile's template selection in sandbox-command.ts: a
+    // "source" dev mode wake-home was seeded from docker/Dockerfile, a
+    // "packaged" one from docker/Dockerfile.packaged.
+    const dockerfileTemplateName = (input.devMode ?? 'packaged') === 'source' ? 'Dockerfile' : 'Dockerfile.packaged';
+    const localDockerfile = await readFileIfExists(resolve(input.wakeRoot, 'docker', 'Dockerfile'));
+    const shippedDockerfile = await readFileIfExists(resolve(input.packageRoot, 'docker', dockerfileTemplateName));
+    if (localDockerfile !== null &&
+        shippedDockerfile !== null &&
+        localDockerfile !== shippedDockerfile) {
+        drifted.push('docker/Dockerfile');
+    }
+    return drifted;
+}
 export async function buildRuntime(args) {
-    const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', args) ?? resolve(process.cwd(), '.wake'));
+    const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', args) ?? process.cwd());
     const stateStore = createStateStore({ wakeRoot });
     await stateStore.ensureWakeRoot();
     const config = await loadWakeConfig({
@@ -351,7 +605,7 @@ function resolveSmokEntry(config, kind) {
     return null;
 }
 async function runUi(args) {
-    const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', args) ?? resolve(process.cwd(), '.wake'));
+    const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', args) ?? process.cwd());
     const stateStore = createStateStore({ wakeRoot });
     await stateStore.ensureWakeRoot();
     const config = await loadWakeConfig({
@@ -373,7 +627,7 @@ async function runUi(args) {
     await new Promise(() => { });
 }
 async function runCorrelate(args) {
-    const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', args) ?? resolve(process.cwd(), '.wake'));
+    const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', args) ?? process.cwd());
     const stateStore = createStateStore({ wakeRoot });
     await stateStore.ensureWakeRoot();
     await runCorrelateCommand({
@@ -399,18 +653,98 @@ async function runSmoke(args) {
     const result = await runnerAdapter.smoke(smokeArgs);
     console.log(JSON.stringify(result, null, 2));
 }
+async function runDoctor(args) {
+    const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', args) ?? process.cwd());
+    const stateStore = createStateStore({ wakeRoot });
+    await stateStore.ensureWakeRoot();
+    const config = await loadWakeConfig({
+        wakeRoot,
+        configFile: stateStore.paths.configFile,
+    });
+    const docker = createHostDockerCli();
+    const packageRoot = resolvePackageRoot();
+    const containerName = config.sandbox.containerName;
+    const image = config.sandbox.image;
+    const workspaceManager = createGitWorkspaceManager({ wakeRoot });
+    const deps = {
+        collectPreflightFailures: (doctorConfig) => collectStartupPreflightFailures(doctorConfig, { workspaceManager }),
+        resolveGitHubToken,
+        hasDockerfile,
+        dockerReachable: dockerDaemonReachable,
+        inspectImage: async (imageToInspect) => {
+            try {
+                return await inspectDockerImage(imageToInspect);
+            }
+            catch {
+                return false;
+            }
+        },
+        wakeRoot,
+        image,
+        containerRunning: async () => (await inspectDockerContainer(containerName)) === 'running',
+        execVersionInContainer: () => execVersionInContainer(docker, containerName, config.dev?.mode),
+        installedVersion: wakeVersion,
+        diffPromptsAndDockerfile: () => diffPromptsAndDockerfile({ wakeRoot, packageRoot, devMode: config.dev?.mode }),
+    };
+    const report = await runDoctorCommand(config, deps);
+    if (report.failures.length > 0) {
+        console.log('Failures:');
+        for (const failure of report.failures) {
+            console.log(`  - ${failure}`);
+        }
+    }
+    if (report.notices.length > 0) {
+        console.log('Notices:');
+        for (const notice of report.notices) {
+            console.log(`  - ${notice}`);
+        }
+    }
+    if (report.failures.length === 0 && report.notices.length === 0) {
+        console.log('wake doctor: no issues found');
+    }
+    if (report.failures.length > 0) {
+        process.exitCode = 1;
+    }
+}
+export class CliUsageError extends Error {
+}
+export function printUsage(stream) {
+    stream.write([
+        'Wake — an autonomous agent control plane for software development.',
+        '',
+        'Usage:',
+        '  wake init <path>           Scaffold a new Wake home directory',
+        '  wake sandbox <subcommand>  Build/run/manage the Docker sandbox (build, up, update, down, stop, self-update, setup, exec, logs, resume)',
+        '  wake tick                  Run one control-plane tick',
+        '  wake start                 Run the resident loop',
+        '  wake stop                  Stop the sandbox container gracefully',
+        '  wake smoke                 Smoke-test the configured runner',
+        '  wake ui                    Run the control-plane UI server',
+        '  wake correlate             Manually correlate a resource to a work item',
+        '  wake doctor                Diagnose config/GitHub/Docker/sandbox setup problems',
+        '  wake --version             Print the installed Wake version',
+        '  wake --help                Show this message',
+        '',
+        'Getting started:',
+        '  1. wake init ./wake-home',
+        '  2. cd wake-home && wake start',
+        '',
+        'Runtime commands (tick/start/ui/smoke/correlate) auto-delegate into the sandbox',
+        'when docker/Dockerfile exists at --wake-root (i.e. after `wake sandbox build`),',
+        'defaulting --wake-root to the current directory. Pass --no-sandbox to run',
+        'directly on the host instead.',
+        '',
+    ].join('\n'));
+}
+const runtimeCommands = new Set(['tick', 'start', 'ui', 'smoke', 'correlate']);
 export async function dispatchMainCommand(input) {
-    const command = input.args[0] ?? 'tick';
-    if (command === '--version' || command === '-v' || command === 'version') {
+    const command = input.args[0] ?? 'help';
+    if (command === '--version' || command === '-v') {
         console.log(wakeVersion);
         return;
     }
-    if (command === 'tick') {
-        await input.runTick(input.args.slice(1));
-        return;
-    }
-    if (command === 'start') {
-        await input.runStart(input.args.slice(1));
+    if (command === '--help' || command === '-h' || command === 'help') {
+        printUsage(process.stdout);
         return;
     }
     if (command === 'init') {
@@ -421,26 +755,147 @@ export async function dispatchMainCommand(input) {
         await input.runSandbox(input.args.slice(1));
         return;
     }
-    if (command === 'stop') {
-        await input.runSandbox(['stop', ...input.args.slice(1)]);
+    if (command === 'sandbox-setup') {
+        await input.runSandboxSetup(input.args.slice(1));
         return;
     }
-    if (command === 'smoke') {
-        await input.runSmoke(input.args.slice(1));
+    if (command === 'sandbox-entrypoint') {
+        await input.runSandboxEntrypoint(input.args.slice(1));
         return;
     }
-    if (command === 'ui') {
-        await input.runUi(input.args.slice(1));
+    if (command === 'stop') {
+        await input.runSandbox(['stop', ...input.args.slice(1)]);
         return;
     }
-    if (command === 'correlate') {
-        await input.runCorrelate(input.args.slice(1));
+    if (command === 'doctor') {
+        // Host-only, like init/sandbox/stop above: doctor's job is to report on
+        // sandbox reachability from the outside, so it must never auto-delegate
+        // into the sandbox the way runtimeCommands below does.
+        await input.runDoctor(input.args.slice(1));
         return;
     }
-    throw new Error(`Unknown command: ${input.args.join(' ')}`);
+    if (runtimeCommands.has(command)) {
+        const commandArgs = input.args.slice(1);
+        const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', commandArgs) ?? process.cwd());
+        const host = commandArgs.includes('--no-sandbox');
+        if (!host && (await hasDockerfile(wakeRoot))) {
+            await input.execIntoSandbox(input.args);
+            return;
+        }
+        const hostArgs = commandArgs.filter((arg) => arg !== '--no-sandbox');
+        if (command === 'tick') {
+            await input.runTick(hostArgs);
+        }
+        else if (command === 'start') {
+            await input.runStart(hostArgs);
+        }
+        else if (command === 'ui') {
+            await input.runUi(hostArgs);
+        }
+        else if (command === 'smoke') {
+            await input.runSmoke(hostArgs);
+        }
+        else {
+            await input.runCorrelate(hostArgs);
+        }
+        return;
+    }
+    printUsage(process.stderr);
+    throw new CliUsageError(`Unknown command: ${input.args.join(' ')}`);
 }
 async function main() {
     const args = process.argv.slice(2);
+    const runSandbox = async (commandArgs) => {
+        const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', commandArgs) ?? process.cwd());
+        const stateStore = createStateStore({ wakeRoot });
+        await stateStore.ensureWakeRoot();
+        const config = await loadWakeConfig({
+            wakeRoot,
+            configFile: stateStore.paths.configFile,
+        });
+        const docker = createHostDockerCli();
+        const repoRoot = config.dev?.repoRoot;
+        const selfUpdate = commandArgs[0] === 'self-update' &&
+            config.dev?.mode === 'source' &&
+            repoRoot !== undefined &&
+            repoRoot.length > 0
+            ? {
+                git: {
+                    latestTag: async () => {
+                        await runCommand('git', ['-C', repoRoot, 'fetch', '--tags']);
+                        const output = await runCommandCapture('git', [
+                            '-C',
+                            repoRoot,
+                            'tag',
+                            '--list',
+                            'v*',
+                            '--sort=-v:refname',
+                        ]);
+                        const [latest] = output.split('\n').filter((line) => line.trim().length > 0);
+                        if (latest === undefined) {
+                            throw new Error('No version tags found in repo');
+                        }
+                        return latest.trim();
+                    },
+                    isWorkingTreeClean: async () => {
+                        const output = await runCommandCapture('git', [
+                            '-C',
+                            repoRoot,
+                            'status',
+                            '--porcelain',
+                        ]);
+                        return output.trim().length === 0;
+                    },
+                    checkoutTag: async (tag) => {
+                        await runCommand('git', ['-C', repoRoot, 'checkout', tag]);
+                    },
+                },
+                issueReporter: {
+                    createIssue: async (issue) => {
+                        const remoteUrl = await runCommandCapture('git', [
+                            '-C',
+                            repoRoot,
+                            'remote',
+                            'get-url',
+                            'origin',
+                        ]);
+                        const repoSlug = parseGithubRepoSlug(remoteUrl);
+                        await runCommand('gh', [
+                            'issue',
+                            'create',
+                            '--repo',
+                            repoSlug,
+                            '--title',
+                            issue.title,
+                            '--body',
+                            issue.body,
+                        ]);
+                    },
+                },
+                readLedger: () => readSelfUpdateLedger(resolve(wakeRoot, 'self-update-ledger.json')),
+                writeLedger: (ledger) => writeSelfUpdateLedger(resolve(wakeRoot, 'self-update-ledger.json'), ledger),
+            }
+            : undefined;
+        await runSandboxCommand({
+            args: commandArgs,
+            config,
+            wakeRoot,
+            containerHomeRoot: stateStore.paths.containerHomeRoot,
+            docker,
+            packagedTemplatesRoot: resolve(resolvePackageRoot(), 'docker'),
+            stateStore,
+            sleep: (ms) => new Promise((resolveSleep) => setTimeout(resolveSleep, ms)),
+            logger: {
+                info(message) {
+                    console.log(message);
+                },
+                error(message) {
+                    console.error(message);
+                },
+            },
+            selfUpdate,
+        });
+    };
     await dispatchMainCommand({
         args,
         runInit: async (commandArgs) => {
@@ -450,7 +905,24 @@ async function main() {
                 repoRoot: resolvePackageRoot(),
             });
         },
-        runSandbox: async (commandArgs) => {
+        runSandbox,
+        runSandboxSetup: async () => {
+            await runSandboxSetup();
+        },
+        runSandboxEntrypoint: async () => {
+            await runSandboxEntrypoint();
+        },
+        runTick,
+        runStart,
+        runSmoke,
+        runUi,
+        runCorrelate,
+        execIntoSandbox: async (commandArgs) => {
+            const withoutBypassFlag = commandArgs.filter((arg) => arg !== '--no-sandbox');
+            const wakeRootIndex = withoutBypassFlag.indexOf('--wake-root');
+            const rewritten = wakeRootIndex === -1
+                ? [...withoutBypassFlag, '--wake-root', '/wake']
+                : withoutBypassFlag.map((arg, index) => (index === wakeRootIndex + 1 ? '/wake' : arg));
             const wakeRoot = resolve(readFlagBeforeCommandTerminator('--wake-root', commandArgs) ?? process.cwd());
             const stateStore = createStateStore({ wakeRoot });
             await stateStore.ensureWakeRoot();
@@ -458,100 +930,18 @@ async function main() {
                 wakeRoot,
                 configFile: stateStore.paths.configFile,
             });
-            const docker = createDockerCli({
-                // BuildKit is required for the Dockerfile's cache-mount syntax
-                // (`RUN --mount=type=cache`), which keeps `npm`/`apt` package
-                // caches warm across builds even when a layer above them changes.
-                run: (dockerArgs) => runCommand('docker', dockerArgs, { ...process.env, DOCKER_BUILDKIT: '1' }),
-                inspectImage: inspectDockerImage,
-                inspectContainer: inspectDockerContainer,
-            });
-            const repoRoot = config.dev?.repoRoot;
-            const selfUpdate = commandArgs[0] === 'self-update' && repoRoot !== undefined && repoRoot.length > 0
-                ? {
-                    git: {
-                        latestTag: async () => {
-                            await runCommand('git', ['-C', repoRoot, 'fetch', '--tags']);
-                            const output = await runCommandCapture('git', [
-                                '-C',
-                                repoRoot,
-                                'tag',
-                                '--list',
-                                'v*',
-                                '--sort=-v:refname',
-                            ]);
-                            const [latest] = output.split('\n').filter((line) => line.trim().length > 0);
-                            if (latest === undefined) {
-                                throw new Error('No version tags found in repo');
-                            }
-                            return latest.trim();
-                        },
-                        isWorkingTreeClean: async () => {
-                            const output = await runCommandCapture('git', [
-                                '-C',
-                                repoRoot,
-                                'status',
-                                '--porcelain',
-                            ]);
-                            return output.trim().length === 0;
-                        },
-                        checkoutTag: async (tag) => {
-                            await runCommand('git', ['-C', repoRoot, 'checkout', tag]);
-                        },
-                    },
-                    issueReporter: {
-                        createIssue: async (issue) => {
-                            const remoteUrl = await runCommandCapture('git', [
-                                '-C',
-                                repoRoot,
-                                'remote',
-                                'get-url',
-                                'origin',
-                            ]);
-                            const repoSlug = parseGithubRepoSlug(remoteUrl);
-                            await runCommand('gh', [
-                                'issue',
-                                'create',
-                                '--repo',
-                                repoSlug,
-                                '--title',
-                                issue.title,
-                                '--body',
-                                issue.body,
-                            ]);
-                        },
-                    },
-                    readLedger: () => readSelfUpdateLedger(resolve(wakeRoot, 'self-update-ledger.json')),
-                    writeLedger: (ledger) => writeSelfUpdateLedger(resolve(wakeRoot, 'self-update-ledger.json'), ledger),
-                }
-                : undefined;
-            await runSandboxCommand({
-                args: commandArgs,
-                config,
-                wakeRoot,
-                containerHomeRoot: stateStore.paths.containerHomeRoot,
-                docker,
-                stateStore,
-                sleep: (ms) => new Promise((resolveSleep) => setTimeout(resolveSleep, ms)),
-                logger: {
-                    info(message) {
-                        console.log(message);
-                    },
-                    error(message) {
-                        console.error(message);
-                    },
-                },
-                selfUpdate,
-            });
+            const wakeInvocation = config.dev?.mode === 'source' ? ['node', '/app/dist/src/main.js'] : ['wake'];
+            await runSandbox(['exec', '--', ...wakeInvocation, ...rewritten]);
         },
-        runTick,
-        runStart,
-        runSmoke,
-        runUi,
-        runCorrelate,
+        runDoctor,
     });
 }
 main().catch((error) => {
-    console.error(error);
+    if (error instanceof CliUsageError) {
+        console.error(error.message);
+    }
+    else {
+        console.error(error);
+    }
     process.exitCode = 1;
 });