@atolis-hq/wake 0.4.21 → 0.4.23

package/dist/src/bootstrap/initialise.js

@@ -401,7 +401,7 @@ ENV WAKE_MAIN_JS=/app/dist/src/main.js
 # Startup ownership repair is best effort because bind-mounted paths or host
 # permissions may prevent chown. The bounded direct-child pass avoids traversing
 # accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake; chown wake:wake /wake/.wake || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec node \\"$WAKE_MAIN_JS\\" sandbox-entrypoint --wake-root /wake'"]
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces; chown wake:wake /wake/.wake /wake/workspaces || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec node \\"$WAKE_MAIN_JS\\" sandbox-entrypoint --wake-root /wake'"]
 `;
 const packagedDockerfile = `# syntax=docker/dockerfile:1
 FROM node:24-bookworm-slim
@@ -468,7 +468,7 @@ EXPOSE 4317
 # Startup ownership repair is best effort because bind-mounted paths or host
 # permissions may prevent chown. The bounded direct-child pass avoids traversing
 # accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake; chown wake:wake /wake/.wake || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec wake sandbox-entrypoint'"]
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces; chown wake:wake /wake/.wake /wake/workspaces || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec wake sandbox-entrypoint'"]
 `;
 /** Creates an immediately-valid, human-readable target Wake root. */
 export async function initialiseWakeRoot(wakeRoot) {

package/dist/src/bootstrap/surface-cli-applications.js

@@ -9,7 +9,7 @@ import { BuiltInActivityName, agentActivityDefinition } from '../activities/inde
 import { IntakeHost, ResidentHost, TickHost, } from '../control-plane/index.js';
 import { ExecutionCancellationReason, ExecutionFailureCode, RunStatus, isActiveRunStatus, loadPromptTemplate, } from '../execution/index.js';
 import { ResourceCorrelationRole, resourceId } from '../resources/index.js';
-import { DockerProcessError, createApiDispatcher, createLoggedDockerCli, createPackagedAssetSource, createPairingGrant, createProcessLogSink, createSandboxDockerPort, createSurfaceHttpServer, drainProcessOutput, loadOrCreateCredentials, redeemPairingGrant, replaceAccessKey, runDoctor, runSandbox, runSandboxEntrypoint, runSandboxSetup, runSelfUpdateLatestLoop, runTargetSmoke, verifyResidentStart, waitForActiveRuns, waitForever, } from '../surfaces/index.js';
+import { DockerProcessError, createApiDispatcher, createLoggedDockerCli, createPackagedAssetSource, createPairingGrant, createProcessLogSink, createSandboxDockerPort, createSurfaceHttpServer, drainProcessOutput, loadOrCreateCredentials, promoteSandboxImage, redeemPairingGrant, replaceAccessKey, runDoctor, runSandbox, runSandboxEntrypoint, runSandboxSetup, runSelfUpdateLatestLoop, runTargetSmoke, verifyResidentStart, waitForActiveRuns, waitForever, } from '../surfaces/index.js';
 import { WorkStreamKind, workItemId } from '../work/index.js';
 import { loadConfig } from './config/load-config.js';
 import { createNpmUpdatePort } from './npm-update-port.js';
@@ -333,6 +333,18 @@ function sandboxDockerOptions(root, overrides) {
 function createSandboxDocker(root, overrides) {
     return createSandboxDockerPort(createDockerCliForRoot(root), sandboxDockerOptions(root, overrides));
 }
+async function createSandboxDockerForCommand(root, arguments_) {
+    if (arguments_[0] !== 'build' || root.config.host.development.mode === 'source')
+        return createSandboxDocker(root);
+    const buildVersion = await createNpmUpdatePort({
+        packageName: root.config.host.selfUpdate.npm.package,
+        distTag: root.config.host.selfUpdate.npm.distTag,
+        ...(root.config.host.selfUpdate.npm.registry === undefined
+            ? {}
+            : { registry: root.config.host.selfUpdate.npm.registry }),
+    }).latestTag();
+    return createSandboxDocker(root, { buildVersion });
+}
 async function resolveSandboxBuildVersion(root) {
     const development = root.config.host.development;
     return development.mode === 'source' && development.repoRoot !== undefined
@@ -422,6 +434,7 @@ async function deploySandboxTag(root, docker, tag, image, overrides) {
     await verifyResidentStart(docker, root.config.host.sandbox.containerName, [...wakeInvocation, 'start', '--wake-root', '/wake'].join(' '));
     await port.exec([...wakeInvocation, 'init', healthcheckRoot]);
     await port.exec([...wakeInvocation, 'tick', '--wake-root', healthcheckRoot, '--no-sandbox']);
+    await promoteSandboxImage(docker, image, root.config.host.sandbox.image);
 }
 async function rollbackSandboxTag(root, docker, image, development) {
     const port = createSandboxDockerPort(docker, sandboxDockerOptions(root, { image }));
@@ -430,6 +443,7 @@ async function rollbackSandboxTag(root, docker, image, development) {
         ? ['node', '/app/dist/src/main.js']
         : sandboxWakeInvocation(root);
     await verifyResidentStart(docker, root.config.host.sandbox.containerName, [...wakeInvocation, 'start', '--wake-root', '/wake'].join(' '));
+    await promoteSandboxImage(docker, image, root.config.host.sandbox.image);
 }
 function createOperationalApplications(root) {
     return {
@@ -450,7 +464,7 @@ function createOperationalApplications(root) {
                 throw new Error('wake sandbox-setup accepts no arguments');
             await runSandboxSetup(createSandboxSetupDependencies(root.config.host.sandbox.containerHomeMountPath));
         },
-        sandbox: async (arguments_) => runSandbox(arguments_, createSandboxDocker(root)),
+        sandbox: async (arguments_) => runSandbox(arguments_, await createSandboxDockerForCommand(root, arguments_)),
         sandboxEntrypoint: async () => {
             await runSandboxEntrypoint(createSandboxEntrypointDependencies(root));
         },

package/dist/src/bootstrap/version.js

@@ -124,6 +124,6 @@ export function resolveWakeVersion(options = {}) {
         return `g${headHash.slice(0, 7)}`;
     return '0.1.0-dev';
 }
-export const wakeVersion = "v0.4.21";
+export const wakeVersion = "v0.4.23";
 /** The registry-installable version used by packaged sandbox images. */
 export const wakePackageVersion = packageVersion(defaultRepoRoot) ?? wakeVersion;

package/dist/src/surfaces/cli/infrastructure/docker-cli.d.ts

@@ -59,6 +59,8 @@ export declare function createSandboxDockerPort(docker: DockerCli, options: Sand
     setup: () => Promise<DockerInvocationResult>;
     resume: ({ sessionId, cwd, cli }: SandboxResumeTarget) => Promise<DockerInvocationResult>;
 };
+/** Promotes a verified versioned sandbox image to the configured default image. */
+export declare function promoteSandboxImage(docker: DockerCli, sourceImage: string, defaultImage: string): Promise<void>;
 export interface SandboxResumeTarget {
     readonly sessionId: string;
     readonly cwd: string;

package/dist/src/surfaces/cli/infrastructure/docker-cli.js

@@ -1,6 +1,7 @@
 import { dirname, normalize } from 'node:path/posix';
 import { DockerProcessError, } from './docker-invocation.js';
 import { scrubProcessLog } from './process-log.js';
+import { ensureSandboxWorkspaceOwnership } from './sandbox-workspace-ownership.js';
 export { DockerProcessError, } from './docker-invocation.js';
 export { verifyResidentStart } from './resident-start.js';
 const emptyDockerInvocationResult = { stdout: '', stderr: '' };
@@ -82,13 +83,13 @@ export function createSandboxDockerPort(docker, options) {
         up: async () => {
             await requireImage(inspect, options.image);
             const state = await inspect.containerState(options.containerName);
-            if (state === 'live')
-                return;
             if (state === 'halted') {
                 await docker.invoke(['start', options.containerName]);
-                return;
             }
-            await createContainer(docker, options);
+            else if (state === null) {
+                await createContainer(docker, options);
+            }
+            await ensureSandboxWorkspaceOwnership(docker, options);
         },
         down: () => docker.invoke(['stop', '--time', '60', options.containerName]),
         update: async () => {
@@ -99,6 +100,7 @@ export function createSandboxDockerPort(docker, options) {
             if (state !== null)
                 await docker.invoke(['rm', options.containerName]);
             await createContainer(docker, options);
+            await ensureSandboxWorkspaceOwnership(docker, options);
         },
         exec: (command) => docker.invoke(command.length === 0
             ? ['exec', '-u', 'wake', '-it', options.containerName, 'bash']
@@ -138,6 +140,12 @@ export function createSandboxDockerPort(docker, options) {
         },
     };
 }
+/** Promotes a verified versioned sandbox image to the configured default image. */
+export async function promoteSandboxImage(docker, sourceImage, defaultImage) {
+    if (sourceImage === defaultImage)
+        return;
+    await docker.invoke(['tag', sourceImage, defaultImage]);
+}
 function shellQuote(value) {
     return `'${value.replaceAll("'", `'\\''`)}'`;
 }

package/dist/src/surfaces/cli/infrastructure/sandbox-workspace-ownership.d.ts

@@ -0,0 +1,10 @@
+interface RootDockerExecutor {
+    invoke(arguments_: readonly string[]): Promise<unknown>;
+}
+interface WorkspaceSandbox {
+    readonly containerName: string;
+    readonly wakeMountPath?: string;
+}
+/** Ensures the bind-mounted workspace root is usable by the unprivileged sandbox process. */
+export declare function ensureSandboxWorkspaceOwnership(docker: RootDockerExecutor, options: WorkspaceSandbox): Promise<void>;
+export {};

package/dist/src/surfaces/cli/infrastructure/sandbox-workspace-ownership.js

@@ -0,0 +1,14 @@
+/** Ensures the bind-mounted workspace root is usable by the unprivileged sandbox process. */
+export async function ensureSandboxWorkspaceOwnership(docker, options) {
+    await docker.invoke([
+        'exec',
+        '-u',
+        'root',
+        options.containerName,
+        'sh',
+        '-c',
+        'mkdir -p "$1" && chown wake:wake "$1"',
+        'wake-workspace-ownership',
+        `${options.wakeMountPath ?? '/wake'}/workspaces`,
+    ]);
+}

package/docker/Dockerfile

@@ -82,4 +82,4 @@ ENV WAKE_MAIN_JS=/app/dist/src/main.js
 # Startup ownership repair is best effort because bind-mounted paths or host
 # permissions may prevent chown. The bounded direct-child pass avoids traversing
 # accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake; chown wake:wake /wake/.wake || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; exec su wake -s /bin/sh -c 'if [ \"$WAKE_START_ENABLED\" = \"true\" ]; then exec node /app/dist/src/main.js start --wake-root /wake --no-sandbox; else exec sleep infinity; fi'"]
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces; chown wake:wake /wake/.wake /wake/workspaces || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; exec su wake -s /bin/sh -c 'if [ \"$WAKE_START_ENABLED\" = \"true\" ]; then exec node /app/dist/src/main.js start --wake-root /wake --no-sandbox; else exec sleep infinity; fi'"]

package/docker/Dockerfile.packaged

@@ -65,4 +65,4 @@ EXPOSE 4317
 # Startup ownership repair is best effort because bind-mounted paths or host
 # permissions may prevent chown. The bounded direct-child pass avoids traversing
 # accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake; chown wake:wake /wake/.wake || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; exec su wake -s /bin/sh -c 'exec wake sandbox-entrypoint'"]
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces; chown wake:wake /wake/.wake /wake/workspaces || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; exec su wake -s /bin/sh -c 'exec wake sandbox-entrypoint'"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atolis-hq/wake",
-  "version": "0.4.21",
+  "version": "0.4.23",
   "description": "Local autonomous agent control plane for software development",
   "license": "Apache-2.0",
   "repository": {