@atolis-hq/wake 0.4.22 → 0.4.23

package/dist/src/bootstrap/initialise.js

@@ -401,7 +401,7 @@ ENV WAKE_MAIN_JS=/app/dist/src/main.js
 # Startup ownership repair is best effort because bind-mounted paths or host
 # permissions may prevent chown. The bounded direct-child pass avoids traversing
 # accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake; chown wake:wake /wake/.wake || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec node \\"$WAKE_MAIN_JS\\" sandbox-entrypoint --wake-root /wake'"]
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces; chown wake:wake /wake/.wake /wake/workspaces || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec node \\"$WAKE_MAIN_JS\\" sandbox-entrypoint --wake-root /wake'"]
 `;
 const packagedDockerfile = `# syntax=docker/dockerfile:1
 FROM node:24-bookworm-slim
@@ -468,7 +468,7 @@ EXPOSE 4317
 # Startup ownership repair is best effort because bind-mounted paths or host
 # permissions may prevent chown. The bounded direct-child pass avoids traversing
 # accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake; chown wake:wake /wake/.wake || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec wake sandbox-entrypoint'"]
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces; chown wake:wake /wake/.wake /wake/workspaces || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec wake sandbox-entrypoint'"]
 `;
 /** Creates an immediately-valid, human-readable target Wake root. */
 export async function initialiseWakeRoot(wakeRoot) {

package/dist/src/bootstrap/version.js

@@ -124,6 +124,6 @@ export function resolveWakeVersion(options = {}) {
         return `g${headHash.slice(0, 7)}`;
     return '0.1.0-dev';
 }
-export const wakeVersion = "v0.4.22";
+export const wakeVersion = "v0.4.23";
 /** The registry-installable version used by packaged sandbox images. */
 export const wakePackageVersion = packageVersion(defaultRepoRoot) ?? wakeVersion;

package/dist/src/surfaces/cli/infrastructure/docker-cli.js

@@ -1,6 +1,7 @@
 import { dirname, normalize } from 'node:path/posix';
 import { DockerProcessError, } from './docker-invocation.js';
 import { scrubProcessLog } from './process-log.js';
+import { ensureSandboxWorkspaceOwnership } from './sandbox-workspace-ownership.js';
 export { DockerProcessError, } from './docker-invocation.js';
 export { verifyResidentStart } from './resident-start.js';
 const emptyDockerInvocationResult = { stdout: '', stderr: '' };
@@ -82,13 +83,13 @@ export function createSandboxDockerPort(docker, options) {
         up: async () => {
             await requireImage(inspect, options.image);
             const state = await inspect.containerState(options.containerName);
-            if (state === 'live')
-                return;
             if (state === 'halted') {
                 await docker.invoke(['start', options.containerName]);
-                return;
             }
-            await createContainer(docker, options);
+            else if (state === null) {
+                await createContainer(docker, options);
+            }
+            await ensureSandboxWorkspaceOwnership(docker, options);
         },
         down: () => docker.invoke(['stop', '--time', '60', options.containerName]),
         update: async () => {
@@ -99,6 +100,7 @@ export function createSandboxDockerPort(docker, options) {
             if (state !== null)
                 await docker.invoke(['rm', options.containerName]);
             await createContainer(docker, options);
+            await ensureSandboxWorkspaceOwnership(docker, options);
         },
         exec: (command) => docker.invoke(command.length === 0
             ? ['exec', '-u', 'wake', '-it', options.containerName, 'bash']

package/dist/src/surfaces/cli/infrastructure/sandbox-workspace-ownership.d.ts

@@ -0,0 +1,10 @@
+interface RootDockerExecutor {
+    invoke(arguments_: readonly string[]): Promise<unknown>;
+}
+interface WorkspaceSandbox {
+    readonly containerName: string;
+    readonly wakeMountPath?: string;
+}
+/** Ensures the bind-mounted workspace root is usable by the unprivileged sandbox process. */
+export declare function ensureSandboxWorkspaceOwnership(docker: RootDockerExecutor, options: WorkspaceSandbox): Promise<void>;
+export {};

package/dist/src/surfaces/cli/infrastructure/sandbox-workspace-ownership.js

@@ -0,0 +1,14 @@
+/** Ensures the bind-mounted workspace root is usable by the unprivileged sandbox process. */
+export async function ensureSandboxWorkspaceOwnership(docker, options) {
+    await docker.invoke([
+        'exec',
+        '-u',
+        'root',
+        options.containerName,
+        'sh',
+        '-c',
+        'mkdir -p "$1" && chown wake:wake "$1"',
+        'wake-workspace-ownership',
+        `${options.wakeMountPath ?? '/wake'}/workspaces`,
+    ]);
+}

package/docker/Dockerfile

@@ -82,4 +82,4 @@ ENV WAKE_MAIN_JS=/app/dist/src/main.js
 # Startup ownership repair is best effort because bind-mounted paths or host
 # permissions may prevent chown. The bounded direct-child pass avoids traversing
 # accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake; chown wake:wake /wake/.wake || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; exec su wake -s /bin/sh -c 'if [ \"$WAKE_START_ENABLED\" = \"true\" ]; then exec node /app/dist/src/main.js start --wake-root /wake --no-sandbox; else exec sleep infinity; fi'"]
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces; chown wake:wake /wake/.wake /wake/workspaces || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; exec su wake -s /bin/sh -c 'if [ \"$WAKE_START_ENABLED\" = \"true\" ]; then exec node /app/dist/src/main.js start --wake-root /wake --no-sandbox; else exec sleep infinity; fi'"]

package/docker/Dockerfile.packaged

@@ -65,4 +65,4 @@ EXPOSE 4317
 # Startup ownership repair is best effort because bind-mounted paths or host
 # permissions may prevent chown. The bounded direct-child pass avoids traversing
 # accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake; chown wake:wake /wake/.wake || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; exec su wake -s /bin/sh -c 'exec wake sandbox-entrypoint'"]
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces; chown wake:wake /wake/.wake /wake/workspaces || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; exec su wake -s /bin/sh -c 'exec wake sandbox-entrypoint'"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atolis-hq/wake",
-  "version": "0.4.22",
+  "version": "0.4.23",
   "description": "Local autonomous agent control plane for software development",
   "license": "Apache-2.0",
   "repository": {