@atolis-hq/wake 0.4.24 → 0.4.26

package/dist/src/bootstrap/config/root-schema.d.ts

@@ -138,8 +138,8 @@ declare const hostConfigSchema: z.ZodDefault<z.ZodObject<{
         }>>;
     }, z.core.$strict>>;
     selfUpdate: z.ZodDefault<z.ZodObject<{
-        drainTimeoutMs: z.ZodDefault<z.ZodNumber>;
-        cancellationTimeoutMs: z.ZodDefault<z.ZodNumber>;
+        drainTimeoutMs: z.ZodOptional<z.ZodNumber>;
+        cancellationTimeoutMs: z.ZodOptional<z.ZodNumber>;
         npm: z.ZodDefault<z.ZodObject<{
             package: z.ZodDefault<z.ZodString>;
             distTag: z.ZodDefault<z.ZodString>;
@@ -439,8 +439,8 @@ export declare const rootConfigSchema: z.ZodObject<{
             }>>;
         }, z.core.$strict>>;
         selfUpdate: z.ZodDefault<z.ZodObject<{
-            drainTimeoutMs: z.ZodDefault<z.ZodNumber>;
-            cancellationTimeoutMs: z.ZodDefault<z.ZodNumber>;
+            drainTimeoutMs: z.ZodOptional<z.ZodNumber>;
+            cancellationTimeoutMs: z.ZodOptional<z.ZodNumber>;
             npm: z.ZodDefault<z.ZodObject<{
                 package: z.ZodDefault<z.ZodString>;
                 distTag: z.ZodDefault<z.ZodString>;

package/dist/src/bootstrap/config/root-schema.js

@@ -90,8 +90,10 @@ const hostConfigSchema = z
         .default({}),
     selfUpdate: z
         .object({
-        drainTimeoutMs: z.number().int().positive().default(30_000),
-        cancellationTimeoutMs: z.number().int().positive().default(30_000),
+        // Retained only so existing strict configs continue to load. Self-update
+        // now waits indefinitely for active Runs and never cancels them.
+        drainTimeoutMs: z.number().int().positive().optional(),
+        cancellationTimeoutMs: z.number().int().positive().optional(),
         npm: z
             .object({
             package: z.string().trim().min(1).default('@atolis-hq/wake'),
@@ -103,8 +105,6 @@ const hostConfigSchema = z
     })
         .strict()
         .default({
-        drainTimeoutMs: 30_000,
-        cancellationTimeoutMs: 30_000,
         npm: { package: '@atolis-hq/wake', distTag: 'latest' },
     }),
 })
@@ -121,8 +121,6 @@ const hostConfigSchema = z
     },
     development: {},
     selfUpdate: {
-        drainTimeoutMs: 30_000,
-        cancellationTimeoutMs: 30_000,
         npm: { package: '@atolis-hq/wake', distTag: 'latest' },
     },
 })

package/dist/src/bootstrap/initialise.js

@@ -470,6 +470,9 @@ EXPOSE 4317
 # accumulated runtime data.
 ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces /wake/.wake/auth; chown wake:wake /wake/.wake /wake/workspaces /wake/.wake/auth || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; find /wake/.wake/auth -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} + || true; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec wake sandbox-entrypoint'"]
 `;
+const userDockerfile = `# User-owned sandbox extension. Wake updates the managed runtime image separately.
+FROM wake-sandbox-runtime:managed
+`;
 /** Creates an immediately-valid, human-readable target Wake root. */
 export async function initialiseWakeRoot(wakeRoot) {
     const containerName = sanitizeContainerName(basename(wakeRoot));
@@ -479,8 +482,13 @@ export async function initialiseWakeRoot(wakeRoot) {
         'prompts/refine.md': refinePrompt,
         'prompts/implement.md': implementPrompt,
         'SETUP.md': setupMd,
-        'docker/Dockerfile': dockerfile,
-        'docker/Dockerfile.packaged': packagedDockerfile,
+        'docker/Dockerfile': userDockerfile,
+        'docker/Dockerfile.packaged': userDockerfile,
+        // Retained as inspected reference assets for a newly initialized home.
+        // Wake builds from its installed copies so future npm updates are not
+        // coupled to these user-visible files.
+        'docker/Dockerfile.runtime': dockerfile,
+        'docker/Dockerfile.runtime.packaged': packagedDockerfile,
     });
     return { wakeRoot };
 }

package/dist/src/bootstrap/npm-update-port.js

@@ -1,5 +1,6 @@
 import { execFile as nodeExecFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import { wakePackageVersion } from './version.js';
 const execFile = promisify(nodeExecFile);
 /** Resolves immutable published package versions. Installation is performed by the rollout. */
 export function createNpmUpdatePort(input) {
@@ -8,6 +9,7 @@ export function createNpmUpdatePort(input) {
     const registry = input.registry === undefined ? [] : [`--registry=${input.registry}`];
     return {
         isClean: async () => true,
+        currentTag: async () => wakePackageVersion,
         async latestTag() {
             const resolved = await resolveVersion();
             if (resolved === undefined)

package/dist/src/bootstrap/self-update-application.d.ts

@@ -2,6 +2,8 @@ import type { UpdateLedger } from './update-ledger.js';
 import { UpdateMaintenancePhase, type UpdateMaintenanceState } from './update-maintenance-lease.js';
 export interface SourceUpdatePort {
     isClean(): Promise<boolean>;
+    /** The version currently running before any update starts, when available. */
+    currentTag?(): Promise<string | null>;
     latestTag(): Promise<string>;
     candidateTags(): Promise<readonly string[]>;
     checkout(tag: string): Promise<void>;
@@ -31,7 +33,8 @@ export interface SelfUpdateQuiescePort {
         readonly runId: string;
         readonly maintenanceCancellable: boolean;
     }[]>;
-    requestMaintenanceCancellation(runIds: readonly string[]): Promise<void>;
+    /** @deprecated Active Runs are never cancelled for maintenance. */
+    requestMaintenanceCancellation?(runIds: readonly string[]): Promise<void>;
     sleep(milliseconds: number): Promise<void>;
     now(): number;
     fail(error: unknown, attemptId?: string): Promise<void>;
@@ -43,7 +46,9 @@ export declare function createSelfUpdateApplication(input: {
     readonly source: SourceUpdatePort;
     readonly rollout?: SelfUpdateRolloutPort;
     readonly quiesce?: SelfUpdateQuiescePort;
+    /** @deprecated Draining is unbounded so active work can finish normally. */
     readonly drainTimeoutMs?: number;
+    /** @deprecated Active work is never cancelled for maintenance. */
     readonly cancellationTimeoutMs?: number;
 }): {
     update(tag: string, force?: boolean): Promise<boolean>;

package/dist/src/bootstrap/self-update-application.js

@@ -5,6 +5,8 @@ export function createSelfUpdateApplication(input) {
         async update(tag, force = false) {
             if (!force && (await input.ledger.isBad(tag)))
                 return false;
+            if (!force && !(await isLaterCandidate(input, tag)))
+                return false;
             return startUpdateAttempt(input, tag, force);
         },
         async updateLatest(force = false) {
@@ -12,13 +14,20 @@ export function createSelfUpdateApplication(input) {
             const [latestCandidate] = candidates;
             if (latestCandidate === undefined)
                 throw new Error('No update versions are available');
-            for (const tag of candidates) {
+            const current = await currentTag(input);
+            const currentIndex = current === null ? -1 : candidates.indexOf(current);
+            // Candidates are newest-first. The current healthy tag is a hard
+            // boundary: never enter maintenance to reapply or downgrade from it.
+            const laterCandidates = currentIndex === -1 ? candidates : candidates.slice(0, currentIndex);
+            for (const tag of laterCandidates) {
                 if (!force && (await input.ledger.isBad(tag))) {
                     continue;
                 }
                 let updated;
                 try {
-                    updated = await this.update(tag, force);
+                    // `laterCandidates` already established this tag is newer than the
+                    // current version, so do not rediscover candidates for each attempt.
+                    updated = await startUpdateAttempt(input, tag, force);
                 }
                 catch (error) {
                     if (error instanceof UpdateCandidateFailure)
@@ -28,17 +37,27 @@ export function createSelfUpdateApplication(input) {
                 if (updated) {
                     return { tag, updated: true };
                 }
-                // If update returned false (same tag or skipped), try the next candidate
-                if (!force && (await input.ledger.read()) === tag) {
-                    // Already on this tag, no need to try others
-                    return { tag, updated: false };
-                }
             }
-            // All candidates exhausted
             return { tag: latestCandidate, updated: false };
         },
     };
 }
+async function isLaterCandidate(input, tag) {
+    const candidates = await input.source.candidateTags();
+    const candidateIndex = candidates.indexOf(tag);
+    if (candidateIndex === -1)
+        return false;
+    const current = await currentTag(input);
+    if (current === null)
+        return candidateIndex === 0;
+    const currentIndex = candidates.indexOf(current);
+    if (currentIndex === -1)
+        return candidateIndex === 0;
+    return candidateIndex < currentIndex;
+}
+async function currentTag(input) {
+    return (await input.source.currentTag?.()) ?? (await input.ledger.read());
+}
 async function startUpdateAttempt(input, tag, force) {
     if (input.quiesce?.exclusive !== undefined)
         return input.quiesce.exclusive(tag, force, (lease) => updateAttempt(input, tag, force, lease));
@@ -81,7 +100,7 @@ function isStartableMaintenanceLease(lease, tag) {
 async function quiesceForUpdate(input) {
     if (input.quiesce === undefined)
         return;
-    await quiesceActiveRuns(input.quiesce, input.drainTimeoutMs ?? 30_000, input.cancellationTimeoutMs ?? 30_000);
+    await quiesceActiveRuns(input.quiesce);
 }
 async function runForwardUpdate(input, tag, attemptId, context) {
     if (!(await input.source.isClean()))
@@ -183,39 +202,14 @@ async function resumePendingMaintenance(input, lease) {
     await input.ledger.recordBad(lease.tag);
     await input.quiesce?.clear(lease.attemptId);
 }
-async function quiesceActiveRuns(quiesce, drainTimeoutMs, cancellationTimeoutMs) {
-    let remaining = await waitForActiveRunsToDrain(quiesce, drainTimeoutMs);
-    if (remaining.length === 0)
-        return;
-    const cancellationIds = remaining
-        .filter((run) => run.maintenanceCancellable)
-        .map((run) => run.runId);
-    let cancellationError;
-    try {
-        await quiesce.requestMaintenanceCancellation(cancellationIds);
-    }
-    catch (error) {
-        cancellationError = error;
+async function quiesceActiveRuns(quiesce) {
+    while ((await quiesce.activeRuns()).length > 0) {
+        await quiesce.sleep(100);
     }
-    remaining = await waitForActiveRunsToDrain(quiesce, cancellationTimeoutMs);
-    if (remaining.length === 0)
-        return;
-    if (cancellationError !== undefined)
-        throw cancellationError;
-    throw new Error(`active Runs remain after maintenance cancellation: ${remaining.map((run) => run.runId).join(', ')}`);
 }
 function formatError(error) {
     return error instanceof Error ? error.message : String(error);
 }
-async function waitForActiveRunsToDrain(quiesce, timeoutMs) {
-    const deadline = quiesce.now() + timeoutMs;
-    let activeRuns = await quiesce.activeRuns();
-    while (activeRuns.length > 0 && quiesce.now() < deadline) {
-        await quiesce.sleep(Math.min(100, deadline - quiesce.now()));
-        activeRuns = await quiesce.activeRuns();
-    }
-    return activeRuns;
-}
 async function recoverPendingUpdate(ledger, source) {
     const priorTag = await ledger.recover();
     if (priorTag === null)

package/dist/src/bootstrap/source-update-port.js

@@ -9,6 +9,15 @@ export function createSourceUpdatePort(input) {
         async isClean() {
             return (await execute('git', ['status', '--porcelain'], input.repoRoot)).trim().length === 0;
         },
+        async currentTag() {
+            try {
+                const tag = (await execute('git', ['describe', '--tags', '--exact-match'], input.repoRoot)).trim();
+                return tag.length === 0 ? null : tag;
+            }
+            catch {
+                return null;
+            }
+        },
         async latestTag() {
             const tag = (await candidateTags(execute, input.repoRoot)).at(0);
             if (tag === undefined)

package/dist/src/bootstrap/surface-cli-applications.js

@@ -7,7 +7,7 @@ import { createInterface } from 'node:readline/promises';
 import { promisify } from 'node:util';
 import { BuiltInActivityName, agentActivityDefinition } from '../activities/index.js';
 import { IntakeHost, ResidentHost, TickHost, } from '../control-plane/index.js';
-import { ExecutionCancellationReason, ExecutionFailureCode, RunStatus, isActiveRunStatus, loadPromptTemplate, } from '../execution/index.js';
+import { ExecutionFailureCode, RunStatus, isActiveRunStatus, loadPromptTemplate, } from '../execution/index.js';
 import { ResourceCorrelationRole, resourceId } from '../resources/index.js';
 import { DockerProcessError, createApiDispatcher, createLoggedDockerCli, createPackagedAssetSource, createPairingGrant, createProcessLogSink, createSandboxDockerPort, createSurfaceHttpServer, drainProcessOutput, loadOrCreateCredentials, promoteSandboxImage, redeemPairingGrant, replaceAccessKey, runDoctor, runSandbox, runSandboxEntrypoint, runSandboxSetup, runSelfUpdateLatestLoop, runTargetSmoke, verifyResidentStart, waitForActiveRuns, waitForever, } from '../surfaces/index.js';
 import { WorkStreamKind, workItemId } from '../work/index.js';
@@ -20,6 +20,7 @@ import { createSelfUpdateApplication, } from './self-update-application.js';
 import { createSelfUpdateFailureLog } from './self-update-failure-log.js';
 import { createSourceUpdatePort } from './source-update-port.js';
 import { createUpdateLedger } from './update-ledger.js';
+import { UpdateMaintenancePhase } from './update-maintenance-lease.js';
 import { resolveWakeVersion, wakePackageVersion } from './version.js';
 const execFile = promisify(nodeExecFile);
 export function createSurfaceCliApplications(root, api, now) {
@@ -384,10 +385,6 @@ export function createSelfUpdateQuiescePort(root) {
         acquire: (tag, retryFailed) => root.maintenance.acquire(tag, retryFailed),
         exclusive: (tag, retryFailed, operation) => root.maintenance.runExclusive(tag, retryFailed, operation),
         activeRuns: () => activeExecutionRuns(root),
-        requestMaintenanceCancellation: async (runIds) => {
-            for (const runId of runIds)
-                await root.execution.requestCancellation(runId, ExecutionCancellationReason.Maintenance);
-        },
         sleep: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
         now: () => Date.now(),
         fail: async (error, attemptId) => {
@@ -464,7 +461,14 @@ function createOperationalApplications(root) {
                 throw new Error('wake sandbox-setup accepts no arguments');
             await runSandboxSetup(createSandboxSetupDependencies(root.config.host.sandbox.containerHomeMountPath));
         },
-        sandbox: async (arguments_) => runSandbox(arguments_, await createSandboxDockerForCommand(root, arguments_)),
+        sandbox: async (arguments_) => {
+            await runSandbox(arguments_, await createSandboxDockerForCommand(root, arguments_));
+            // A manual sandbox replacement can recover a previously failed update,
+            // but never clear an in-progress self-update owned by another process.
+            if (arguments_[0] === 'update' &&
+                (await root.maintenance.read())?.phase === UpdateMaintenancePhase.Failed)
+                await root.maintenance.clear();
+        },
         sandboxEntrypoint: async () => {
             await runSandboxEntrypoint(createSandboxEntrypointDependencies(root));
         },
@@ -522,8 +526,6 @@ function createOperationalApplications(root) {
                     recordFailure: (failedTag, error) => failureLog.record(failedTag, error),
                 },
                 quiesce: createSelfUpdateQuiescePort(root),
-                drainTimeoutMs: root.config.host.selfUpdate.drainTimeoutMs,
-                cancellationTimeoutMs: root.config.host.selfUpdate.cancellationTimeoutMs,
             });
             const force = arguments_.includes('--force');
             if (arguments_.includes('--loop')) {

package/dist/src/bootstrap/version.js

@@ -124,6 +124,6 @@ export function resolveWakeVersion(options = {}) {
         return `g${headHash.slice(0, 7)}`;
     return '0.1.0-dev';
 }
-export const wakeVersion = "v0.4.24";
+export const wakeVersion = "v0.4.26";
 /** The registry-installable version used by packaged sandbox images. */
 export const wakePackageVersion = packageVersion(defaultRepoRoot) ?? wakeVersion;

package/dist/src/orchestration/application/start-workflow.js

@@ -5,6 +5,7 @@ import { WorkflowInstanceKind, WorkflowStatus } from '../contracts/vocabulary.js
 import { validateChildProvenance } from '../domain/child-policy.js';
 import { workflowEventData } from '../domain/decision-events.js';
 import { startInstance } from '../domain/interpreter.js';
+import { appendWithIntentRecovery } from './durable-append.js';
 import { WorkflowDefinitionUnavailableError } from './workflow-definition-registry.js';
 const TERMINAL_OR_BLOCKED_STATUSES = new Set([
     WorkflowStatus.Blocked,
@@ -48,8 +49,17 @@ export class StartWorkflow {
             correlationId: context.correlationId,
             causationId: context.commandId,
         });
-        if (decision.kind === 'append')
-            await this.repository.append(command.workflowInstanceId, 0, decision.events);
+        if (decision.kind === 'append') {
+            const recovered = await appendWithIntentRecovery({
+                append: async () => {
+                    await this.repository.append(command.workflowInstanceId, 0, decision.events);
+                },
+                load: () => this.repository.load(command.workflowInstanceId),
+                alreadyApplied: (reloaded) => reloaded.view !== null,
+            });
+            if (recovered !== undefined)
+                return recovered.view;
+        }
         return (await this.repository.loadRequired(command.workflowInstanceId)).view;
     }
     async isWorkItemOpen(workItemId) {

package/dist/src/surfaces/cli/infrastructure/docker-cli.d.ts

@@ -59,7 +59,6 @@ export declare function createSandboxDockerPort(docker: DockerCli, options: Sand
     setup: () => Promise<DockerInvocationResult>;
     resume: ({ sessionId, cwd, cli }: SandboxResumeTarget) => Promise<DockerInvocationResult>;
 };
-/** Promotes a verified versioned sandbox image to the configured default image. */
 export declare function promoteSandboxImage(docker: DockerCli, sourceImage: string, defaultImage: string): Promise<void>;
 export interface SandboxResumeTarget {
     readonly sessionId: string;

package/dist/src/surfaces/cli/infrastructure/docker-cli.js

@@ -1,5 +1,6 @@
 import { dirname, normalize } from 'node:path/posix';
 import { DockerProcessError, } from './docker-invocation.js';
+import { managedRuntimeDockerfile, managedRuntimeImage } from './managed-runtime-image.js';
 import { scrubProcessLog } from './process-log.js';
 import { ensureSandboxWorkspaceOwnership } from './sandbox-workspace-ownership.js';
 export { DockerProcessError, } from './docker-invocation.js';
@@ -46,17 +47,13 @@ function mergeDockerOutput(result, captured) {
         stderr: result.stderr.length === 0 ? captured.stderr : result.stderr,
     };
 }
-/** Bounded target sandbox lifecycle; domain modules never name Docker. */
-const dockerRunCommand = String.fromCharCode(114, 117, 110);
-// The bounded lifecycle is intentionally co-located for command parity.
 // eslint-disable-next-line max-lines-per-function
 export function createSandboxDockerPort(docker, options) {
     const inspect = options.inspect ?? unknownSandboxInspection;
     return {
         build: async () => {
-            const source = options.development?.mode === 'source';
-            const packaged = !source;
-            const context = source ? options.development?.repoRoot : options.wakeRoot;
+            const packaged = options.development?.mode !== 'source';
+            const context = packaged ? options.wakeRoot : options.development?.repoRoot;
             if (context === undefined)
                 throw new Error('source sandbox build requires host.development.repoRoot');
             // Stamps the image with the resolved wake version so a running
@@ -67,9 +64,15 @@ export function createSandboxDockerPort(docker, options) {
             const buildArgs = buildVersion === undefined
                 ? []
                 : ['--build-arg', `${packaged ? 'WAKE_VERSION' : 'WAKE_BUILD_TAG'}=${buildVersion}`];
-            // Dockerfile always comes from the target Wake home, not the source
-            // checkout, so it stays user-customizable per home; only the build
-            // context (what COPY can see) varies with dev mode.
+            await docker.invoke([
+                'build',
+                '-t',
+                managedRuntimeImage,
+                '-f',
+                managedRuntimeDockerfile(packaged),
+                ...buildArgs,
+                context,
+            ]);
             return docker.invoke([
                 'build',
                 '-t',
@@ -140,7 +143,6 @@ export function createSandboxDockerPort(docker, options) {
         },
     };
 }
-/** Promotes a verified versioned sandbox image to the configured default image. */
 export async function promoteSandboxImage(docker, sourceImage, defaultImage) {
     if (sourceImage === defaultImage)
         return;
@@ -149,10 +151,7 @@ export async function promoteSandboxImage(docker, sourceImage, defaultImage) {
 function shellQuote(value) {
     return `'${value.replaceAll("'", `'\\''`)}'`;
 }
-// The Cursor CLI's own first subcommand, not the ActivityExecutionKind/EventActorKind
-// vocabulary word "agent" — spelled indirectly so it isn't misread as that domain term.
 const cursorCliSubcommand = String.fromCharCode(97, 103, 101, 110, 116);
-/** Static per-agent-CLI resume argv; mirrors each CLI's own resume flag shape. */
 function buildResumeCommandForCli(cli, sessionId) {
     const normalized = cli.trim().toLowerCase();
     if (normalized === 'claude')
@@ -178,7 +177,7 @@ async function createContainer(docker, options) {
         `${mount.source}:${mount.target}${mount.readOnly === true ? ':ro' : ''}`,
     ]);
     await docker.invoke([
-        dockerRunCommand,
+        String.fromCharCode(114, 117, 110),
         '-d',
         // Bounds the container's own json-file log driver so its internal log
         // storage can't grow unbounded; independent of process-log.ts's rotation

package/dist/src/surfaces/cli/infrastructure/managed-runtime-image.d.ts

@@ -0,0 +1,2 @@
+export declare const managedRuntimeImage = "wake-sandbox-runtime:managed";
+export declare function managedRuntimeDockerfile(packaged: boolean): string;

package/dist/src/surfaces/cli/infrastructure/managed-runtime-image.js

@@ -0,0 +1,5 @@
+import { fileURLToPath } from 'node:url';
+export const managedRuntimeImage = 'wake-sandbox-runtime:managed';
+export function managedRuntimeDockerfile(packaged) {
+    return fileURLToPath(new URL(`../../../../docker/Dockerfile.runtime${packaged ? '.packaged' : ''}`, import.meta.url));
+}

package/docker/Dockerfile

@@ -1,85 +1,2 @@
-# syntax=docker/dockerfile:1
-FROM node:24-bookworm-slim
-
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
-  apt-get update \
-  && apt-get install -y --no-install-recommends git openssh-client ca-certificates curl gnupg \
-  && mkdir -p /etc/apt/keyrings \
-  && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
-    | gpg --dearmor -o /etc/apt/keyrings/githubcli-archive-keyring.gpg \
-  && chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
-  && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
-    > /etc/apt/sources.list.d/github-cli.list \
-  && apt-get update \
-  && apt-get install -y --no-install-recommends gh
-
-RUN --mount=type=cache,target=/root/.npm \
-  npm install -g @anthropic-ai/claude-code @openai/codex
-
-RUN useradd --create-home --shell /bin/bash wake \
-  && mkdir -p /home/wake/.codex-runtime \
-  && mkdir -p /home/wake/.cursor \
-  && chown -R wake:wake /home/wake/.codex-runtime \
-  && chown -R wake:wake /home/wake/.cursor
-
-ENV CODEX_HOME=/home/wake/.codex-runtime
-ENV PATH=/home/wake/.local/bin:$PATH
-
-# Bump this date to force a fresh cursor.com/install instead of an indefinitely cached one.
-ARG CURSOR_CACHE_BUST=2026-07-26
-RUN echo "cursor cache bust: ${CURSOR_CACHE_BUST}" \
-  && curl https://cursor.com/install -fsS | HOME=/home/wake bash \
-  && printf '#!/bin/bash\n[ "$1" = "agent" ] && shift\nexec ~/.local/bin/agent "$@"\n' \
-     > /home/wake/.local/bin/cursor \
-  && chmod +x /home/wake/.local/bin/cursor \
-  && chown -R wake:wake /home/wake/.local
-
-WORKDIR /app
-COPY package*.json ./
-COPY packages/eventing/package.json packages/eventing/package.json
-COPY packages/eventing-filesystem/package.json packages/eventing-filesystem/package.json
-COPY src/surfaces/web/package.json src/surfaces/web/package.json
-RUN --mount=type=cache,target=/root/.npm \
-  if [ -f package-lock.json ]; then npm ci --include=dev; else npm install; fi
-
-COPY tsconfig.json tsconfig.base.json tsconfig.app.json tsconfig.docker.json ./
-COPY packages/ packages/
-COPY scripts/embed-version.mjs scripts/embed-version.mjs
-COPY scripts/embed-runtime-workspaces.mjs scripts/embed-runtime-workspaces.mjs
-COPY assets/ assets/
-COPY src/ src/
-ARG WAKE_BUILD_TAG
-RUN WAKE_BUILD_TAG="$WAKE_BUILD_TAG" npm run build:docker
-
-RUN mkdir -p /etc/codex /usr/local/lib/wake \
-  && cp /app/dist/src/execution/infrastructure/codex-stop-hook.js /usr/local/lib/wake/codex-stop-hook.js \
-  && printf '%s\n' \
-    '[features]' \
-    'hooks = true' \
-    '' \
-    '[hooks]' \
-    'managed_dir = "/usr/local/lib/wake"' \
-    '' \
-    '[[hooks.Stop]]' \
-    '[[hooks.Stop.hooks]]' \
-    'type = "command"' \
-    'command = "node /usr/local/lib/wake/codex-stop-hook.js"' \
-    'timeout = 10' \
-    > /etc/codex/requirements.toml
-
-USER root
-WORKDIR /home/wake
-
-EXPOSE 4317
-
-# Baked at build time so wake sandbox-entrypoint (and anything it spawns) can
-# find the compiled CLI without hardcoding /app in multiple places. Docker's
-# exec-form ENTRYPOINT below does not expand env vars, so it stays literal —
-# that's fine since it's the very first thing that runs.
-ENV WAKE_MAIN_JS=/app/dist/src/main.js
-
-# Startup ownership repair is best effort because bind-mounted paths or host
-# permissions may prevent chown. The bounded direct-child pass avoids traversing
-# accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces /wake/.wake/auth; chown wake:wake /wake/.wake /wake/workspaces /wake/.wake/auth || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; find /wake/.wake/auth -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} + || true; exec su wake -s /bin/sh -c 'if [ \"$WAKE_START_ENABLED\" = \"true\" ]; then exec node /app/dist/src/main.js start --wake-root /wake --no-sandbox; else exec sleep infinity; fi'"]
+# User-owned sandbox extension. Wake updates the managed runtime image separately.
+FROM wake-sandbox-runtime:managed

package/docker/Dockerfile.packaged

@@ -1,68 +1,2 @@
-# syntax=docker/dockerfile:1
-FROM node:24-bookworm-slim
-
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
-  apt-get update \
-  && apt-get install -y --no-install-recommends git openssh-client ca-certificates curl gnupg \
-  && mkdir -p /etc/apt/keyrings \
-  && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
-    | gpg --dearmor -o /etc/apt/keyrings/githubcli-archive-keyring.gpg \
-  && chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
-  && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
-    > /etc/apt/sources.list.d/github-cli.list \
-  && apt-get update \
-  && apt-get install -y --no-install-recommends gh
-
-ARG WAKE_VERSION
-RUN test -n "$WAKE_VERSION" || (echo "WAKE_VERSION build arg is required" && exit 1)
-
-RUN --mount=type=cache,target=/root/.npm \
-  npm install -g @anthropic-ai/claude-code @openai/codex "@atolis-hq/wake@${WAKE_VERSION}"
-
-RUN mkdir -p /etc/codex /usr/local/lib/wake \
-  && cp /usr/local/lib/node_modules/@atolis-hq/wake/dist/src/execution/infrastructure/codex-stop-hook.js /usr/local/lib/wake/codex-stop-hook.js \
-  && printf '%s\n' \
-    '[features]' \
-    'hooks = true' \
-    '' \
-    '[hooks]' \
-    'managed_dir = "/usr/local/lib/wake"' \
-    '' \
-    '[[hooks.Stop]]' \
-    '[[hooks.Stop.hooks]]' \
-    'type = "command"' \
-    'command = "node /usr/local/lib/wake/codex-stop-hook.js"' \
-    'timeout = 10' \
-    > /etc/codex/requirements.toml
-
-RUN useradd --create-home --shell /bin/bash wake \
-  && mkdir -p /home/wake/.codex-runtime \
-  && mkdir -p /home/wake/.cursor \
-  && chown -R wake:wake /home/wake/.codex-runtime \
-  && chown -R wake:wake /home/wake/.cursor
-
-ENV CODEX_HOME=/home/wake/.codex-runtime
-ENV PATH=/home/wake/.local/bin:$PATH
-
-RUN curl https://cursor.com/install -fsS | HOME=/home/wake bash \
-  && printf '#!/bin/bash\n[ "$1" = "agent" ] && shift\nexec ~/.local/bin/agent "$@"\n' \
-     > /home/wake/.local/bin/cursor \
-  && chmod +x /home/wake/.local/bin/cursor \
-  && chown -R wake:wake /home/wake/.local
-
-USER root
-WORKDIR /home/wake
-
-EXPOSE 4317
-
-# No WAKE_MAIN_JS here: there is no /app in a packaged-mode image, and its
-# absence is the signal (see resolveWakeInvocation in
-# sandbox-entrypoint-command.ts) that the CLI should be invoked via the bare
-# `wake` binary that `npm install -g` puts on PATH, rather than a hardcoded
-# npm global lib path that varies by npm/OS setup.
-#
-# Startup ownership repair is best effort because bind-mounted paths or host
-# permissions may prevent chown. The bounded direct-child pass avoids traversing
-# accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces /wake/.wake/auth; chown wake:wake /wake/.wake /wake/workspaces /wake/.wake/auth || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; find /wake/.wake/auth -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} + || true; exec su wake -s /bin/sh -c 'exec wake sandbox-entrypoint'"]
+# User-owned sandbox extension. Wake updates the managed runtime image separately.
+FROM wake-sandbox-runtime:managed

package/docker/Dockerfile.runtime

@@ -0,0 +1,85 @@
+# syntax=docker/dockerfile:1
+FROM node:24-bookworm-slim
+
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+  apt-get update \
+  && apt-get install -y --no-install-recommends git openssh-client ca-certificates curl gnupg \
+  && mkdir -p /etc/apt/keyrings \
+  && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+    | gpg --dearmor -o /etc/apt/keyrings/githubcli-archive-keyring.gpg \
+  && chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
+  && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+    > /etc/apt/sources.list.d/github-cli.list \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends gh
+
+RUN --mount=type=cache,target=/root/.npm \
+  npm install -g @anthropic-ai/claude-code @openai/codex
+
+RUN useradd --create-home --shell /bin/bash wake \
+  && mkdir -p /home/wake/.codex-runtime \
+  && mkdir -p /home/wake/.cursor \
+  && chown -R wake:wake /home/wake/.codex-runtime \
+  && chown -R wake:wake /home/wake/.cursor
+
+ENV CODEX_HOME=/home/wake/.codex-runtime
+ENV PATH=/home/wake/.local/bin:$PATH
+
+# Bump this date to force a fresh cursor.com/install instead of an indefinitely cached one.
+ARG CURSOR_CACHE_BUST=2026-07-26
+RUN echo "cursor cache bust: ${CURSOR_CACHE_BUST}" \
+  && curl https://cursor.com/install -fsS | HOME=/home/wake bash \
+  && printf '#!/bin/bash\n[ "$1" = "agent" ] && shift\nexec ~/.local/bin/agent "$@"\n' \
+     > /home/wake/.local/bin/cursor \
+  && chmod +x /home/wake/.local/bin/cursor \
+  && chown -R wake:wake /home/wake/.local
+
+WORKDIR /app
+COPY package*.json ./
+COPY packages/eventing/package.json packages/eventing/package.json
+COPY packages/eventing-filesystem/package.json packages/eventing-filesystem/package.json
+COPY src/surfaces/web/package.json src/surfaces/web/package.json
+RUN --mount=type=cache,target=/root/.npm \
+  if [ -f package-lock.json ]; then npm ci --include=dev; else npm install; fi
+
+COPY tsconfig.json tsconfig.base.json tsconfig.app.json tsconfig.docker.json ./
+COPY packages/ packages/
+COPY scripts/embed-version.mjs scripts/embed-version.mjs
+COPY scripts/embed-runtime-workspaces.mjs scripts/embed-runtime-workspaces.mjs
+COPY assets/ assets/
+COPY src/ src/
+ARG WAKE_BUILD_TAG
+RUN WAKE_BUILD_TAG="$WAKE_BUILD_TAG" npm run build:docker
+
+RUN mkdir -p /etc/codex /usr/local/lib/wake \
+  && cp /app/dist/src/execution/infrastructure/codex-stop-hook.js /usr/local/lib/wake/codex-stop-hook.js \
+  && printf '%s\n' \
+    '[features]' \
+    'hooks = true' \
+    '' \
+    '[hooks]' \
+    'managed_dir = "/usr/local/lib/wake"' \
+    '' \
+    '[[hooks.Stop]]' \
+    '[[hooks.Stop.hooks]]' \
+    'type = "command"' \
+    'command = "node /usr/local/lib/wake/codex-stop-hook.js"' \
+    'timeout = 10' \
+    > /etc/codex/requirements.toml
+
+USER root
+WORKDIR /home/wake
+
+EXPOSE 4317
+
+# Baked at build time so wake sandbox-entrypoint (and anything it spawns) can
+# find the compiled CLI without hardcoding /app in multiple places. Docker's
+# exec-form ENTRYPOINT below does not expand env vars, so it stays literal —
+# that's fine since it's the very first thing that runs.
+ENV WAKE_MAIN_JS=/app/dist/src/main.js
+
+# Startup ownership repair is best effort because bind-mounted paths or host
+# permissions may prevent chown. The bounded direct-child pass avoids traversing
+# accumulated runtime data.
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces /wake/.wake/auth; chown wake:wake /wake/.wake /wake/workspaces /wake/.wake/auth || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; find /wake/.wake/auth -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} + || true; exec su wake -s /bin/sh -c 'if [ \"$WAKE_START_ENABLED\" = \"true\" ]; then exec node /app/dist/src/main.js start --wake-root /wake --no-sandbox; else exec sleep infinity; fi'"]

package/docker/Dockerfile.runtime.packaged

@@ -0,0 +1,68 @@
+# syntax=docker/dockerfile:1
+FROM node:24-bookworm-slim
+
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+  apt-get update \
+  && apt-get install -y --no-install-recommends git openssh-client ca-certificates curl gnupg \
+  && mkdir -p /etc/apt/keyrings \
+  && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+    | gpg --dearmor -o /etc/apt/keyrings/githubcli-archive-keyring.gpg \
+  && chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
+  && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+    > /etc/apt/sources.list.d/github-cli.list \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends gh
+
+ARG WAKE_VERSION
+RUN test -n "$WAKE_VERSION" || (echo "WAKE_VERSION build arg is required" && exit 1)
+
+RUN --mount=type=cache,target=/root/.npm \
+  npm install -g @anthropic-ai/claude-code @openai/codex "@atolis-hq/wake@${WAKE_VERSION}"
+
+RUN mkdir -p /etc/codex /usr/local/lib/wake \
+  && cp /usr/local/lib/node_modules/@atolis-hq/wake/dist/src/execution/infrastructure/codex-stop-hook.js /usr/local/lib/wake/codex-stop-hook.js \
+  && printf '%s\n' \
+    '[features]' \
+    'hooks = true' \
+    '' \
+    '[hooks]' \
+    'managed_dir = "/usr/local/lib/wake"' \
+    '' \
+    '[[hooks.Stop]]' \
+    '[[hooks.Stop.hooks]]' \
+    'type = "command"' \
+    'command = "node /usr/local/lib/wake/codex-stop-hook.js"' \
+    'timeout = 10' \
+    > /etc/codex/requirements.toml
+
+RUN useradd --create-home --shell /bin/bash wake \
+  && mkdir -p /home/wake/.codex-runtime \
+  && mkdir -p /home/wake/.cursor \
+  && chown -R wake:wake /home/wake/.codex-runtime \
+  && chown -R wake:wake /home/wake/.cursor
+
+ENV CODEX_HOME=/home/wake/.codex-runtime
+ENV PATH=/home/wake/.local/bin:$PATH
+
+RUN curl https://cursor.com/install -fsS | HOME=/home/wake bash \
+  && printf '#!/bin/bash\n[ "$1" = "agent" ] && shift\nexec ~/.local/bin/agent "$@"\n' \
+     > /home/wake/.local/bin/cursor \
+  && chmod +x /home/wake/.local/bin/cursor \
+  && chown -R wake:wake /home/wake/.local
+
+USER root
+WORKDIR /home/wake
+
+EXPOSE 4317
+
+# No WAKE_MAIN_JS here: there is no /app in a packaged-mode image, and its
+# absence is the signal (see resolveWakeInvocation in
+# sandbox-entrypoint-command.ts) that the CLI should be invoked via the bare
+# `wake` binary that `npm install -g` puts on PATH, rather than a hardcoded
+# npm global lib path that varies by npm/OS setup.
+#
+# Startup ownership repair is best effort because bind-mounted paths or host
+# permissions may prevent chown. The bounded direct-child pass avoids traversing
+# accumulated runtime data.
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces /wake/.wake/auth; chown wake:wake /wake/.wake /wake/workspaces /wake/.wake/auth || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; find /wake/.wake/auth -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} + || true; exec su wake -s /bin/sh -c 'exec wake sandbox-entrypoint'"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atolis-hq/wake",
-  "version": "0.4.24",
+  "version": "0.4.26",
   "description": "Local autonomous agent control plane for software development",
   "license": "Apache-2.0",
   "repository": {