@boxes-dev/dvb 0.2.27 → 0.2.29

package/dist/devbox/commands/init/index.js

@@ -1,20 +1,19 @@
-import { randomUUID } from "node:crypto";
 import path from "node:path";
 import fs from "node:fs/promises";
 import os from "node:os";
 import { cancel as clackCancel, confirm as clackConfirm, isCancel, log as clackLog, note as clackNote, select as clackSelect, selectKey as clackSelectKey, taskLog as clackTaskLog, } from "@clack/prompts";
 import { resolveSocketInfo } from "@boxes-dev/core";
-import { createSecretStore, loadConfig, createSpritesClient, fingerprintFromOrigin, fingerprintFromRootCommit, normalizeGitRemoteUrl, resolveSpritesApiUrl, SpritesApiError, slugify, } from "@boxes-dev/core";
+import { createSecretStore, loadConfig, createSpritesClient, normalizeGitRemoteUrl, resolveSpritesApiUrl, resolveDevboxProjectDir, SpritesApiError, slugify, } from "@boxes-dev/core";
 import { DAEMON_TIMEOUT_MS, ensureDaemonRunning, requestJson, requireDaemonFeatures, } from "../../daemonClient.js";
 import { ensureSpritesToken } from "../../auth.js";
 import { fetchSpriteDaemonRelease, getConvexUrl, issueSpriteDaemonToken, } from "../../controlPlane.js";
 import { logger } from "../../logger.js";
 import { parseInitArgs } from "./args.js";
-import { confirmCopyWorktree, findRepoRoot, mapGlobalGitConfigDestinations, readGlobalGitConfigFiles, readHeadState, readNullSeparatedPaths, readRepoOrigin, readRootCommit, readWorktreeState, resolveGitCommonDir, runCommand, } from "./repo.js";
+import { confirmCopyWorktree, findRepoRoot, ensureRepoProjectId, mapGlobalGitConfigDestinations, readGlobalGitConfigFiles, readHeadState, readRepoOrigin, readWorktreeState, resolveGitCommonDir, runCommand, } from "./repo.js";
 import { createFileListArchive, createGitMetaArchive, writePatch } from "./packaging.js";
 import { bootstrapDevbox, ensureSpriteDaemonService, expandHome, ensureWeztermMuxService, installSpriteDaemon, shellQuote, stageRemoteSetupArtifacts, writeRemoteCodexConfig, } from "./remote.js";
 import { ensureWeztermMuxInstalled } from "../../../wezterm/ensureMux.js";
-import { ensureDevboxToml, readRepoMarker, writeRepoMarker } from "./registry.js";
+import { readRepoMarker, writeRepoMarker } from "./registry.js";
 import { INIT_STEP_KEYS, readInitState, writeInitState } from "./state.js";
 import { ensureSshConfig, ensureSshKey, copyToClipboard, openBrowser, parseGitRemote, readRemoteOrigin, setRemoteOrigin, verifySshAuth, } from "./ssh.js";
 import { ensureKnownHostsFile, ensureLocalMountKey, ensureRemoteMountAccess, ensureSshdService, readLocalMountPublicKey, } from "../mountSsh.js";
@@ -34,6 +33,54 @@ const mergeLocalPaths = (existing, repoRoot) => {
     merged.add(repoRoot);
     return [...merged];
 };
+const ensurePrivateDir = async (dir) => {
+    await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    try {
+        await fs.chmod(dir, 0o700);
+    }
+    catch {
+        // best effort on filesystems that do not support chmod
+    }
+};
+const migrateLegacyRepoDevboxDir = async ({ repoRoot, projectDir, }) => {
+    const legacyDir = path.join(repoRoot, ".devbox");
+    try {
+        const stat = await fs.stat(legacyDir);
+        if (!stat.isDirectory())
+            return;
+    }
+    catch {
+        return;
+    }
+    await ensurePrivateDir(projectDir);
+    const entries = [
+        "box.json",
+        "init-state.json",
+        "setup.json",
+        "services.json",
+        "setup-artifacts.tgz",
+        "setup-artifacts.json",
+        "scans",
+        "logs",
+    ];
+    for (const entry of entries) {
+        const src = path.join(legacyDir, entry);
+        const dest = path.join(projectDir, entry);
+        try {
+            await fs.access(dest);
+            continue;
+        }
+        catch {
+            // missing -> migrate
+        }
+        try {
+            await fs.cp(src, dest, { recursive: true });
+        }
+        catch {
+            // best effort
+        }
+    }
+};
 const buildServicesTomlUpdates = (services) => {
     const updates = {};
     for (const service of services) {
@@ -281,14 +328,14 @@ export const runInit = async (args) => {
                 // - `complete` must only be true when the setup is actually usable without
                 //   additional `dvb init --resume` work.
                 // See: apps/cli/docs/INIT_RECOVERABILITY.md
-                const repoMarker = await readRepoMarker(repoRoot);
+                const projectId = await ensureRepoProjectId(repoRoot);
+                const projectDir = resolveDevboxProjectDir(projectId, localHomeDir);
+                await migrateLegacyRepoDevboxDir({ repoRoot, projectDir });
+                const repoMarker = await readRepoMarker(projectDir);
                 const origin = await readRepoOrigin(repoRoot);
                 const normalizedOrigin = origin ? normalizeGitRemoteUrl(origin) : null;
-                const fingerprint = origin
-                    ? fingerprintFromOrigin(origin)
-                    : repoMarker?.fingerprint ??
-                        fingerprintFromRootCommit(await readRootCommit(repoRoot), randomUUID());
-                let initState = await readInitState(repoRoot);
+                const fingerprint = projectId;
+                let initState = await readInitState(projectDir);
                 const initFingerprintMismatch = Boolean(initState?.fingerprint) &&
                     initState?.fingerprint !== fingerprint;
                 if (!initFingerprintMismatch &&
@@ -298,13 +345,15 @@ export const runInit = async (args) => {
                     // been applied yet. Treat this as incomplete so `dvb init --resume` can
                     // recover.
                     initState = { ...initState, complete: false };
-                    await writeInitState(repoRoot, initState);
+                    await writeInitState(projectDir, initState);
                 }
                 return {
                     repoRoot,
                     repoName,
                     slug,
                     localHomeDir,
+                    projectId,
+                    projectDir,
                     repoMarker,
                     origin,
                     normalizedOrigin,
@@ -314,7 +363,7 @@ export const runInit = async (args) => {
                 };
             },
         });
-        const { repoRoot, repoName, slug, localHomeDir, repoMarker, origin, normalizedOrigin, fingerprint, } = detected;
+        const { repoRoot, repoName, slug, localHomeDir, projectId, projectDir, repoMarker, origin, normalizedOrigin, fingerprint, } = detected;
         let initState = detected.initState;
         const initFingerprintMismatch = detected.initFingerprintMismatch;
         if (parsed.status) {
@@ -346,25 +395,28 @@ export const runInit = async (args) => {
                 (!initState || initFingerprintMismatch) &&
                 Boolean(registryProject?.initStatus && registryProject.initStatus !== "complete");
             const lines = [];
+            const markerPath = path.join(projectDir, "box.json");
+            const checkpointPath = path.join(projectDir, "init-state.json");
             lines.push("INIT STATUS");
             lines.push("");
             lines.push("Repo");
             lines.push(`  root: ${repoRoot}`);
             lines.push(`  origin: ${normalizedOrigin ?? origin ?? "(none)"}`);
-            lines.push(`  fingerprint: ${fingerprint}`);
+            lines.push(`  projectId (git config devbox.projectId): ${projectId}`);
+            lines.push(`  local state dir: ${projectDir}`);
             lines.push("");
             lines.push("Local state");
             if (repoMarker?.canonical) {
-                lines.push(`  box marker (.devbox/box.json): present (alias: ${repoMarker.alias ?? "(none)"}, box: ${repoMarker.canonical})`);
+                lines.push(`  box marker (${markerPath}): present (alias: ${repoMarker.alias ?? "(none)"}, box: ${repoMarker.canonical})`);
             }
             else {
-                lines.push("  box marker (.devbox/box.json): missing");
+                lines.push(`  box marker (${markerPath}): missing`);
             }
             if (initState) {
                 const completeText = initFingerprintMismatch
-                    ? `${String(Boolean(initState.complete))} (fingerprint mismatch)`
+                    ? `${String(Boolean(initState.complete))} (projectId mismatch)`
                     : String(Boolean(initState.complete));
-                lines.push(`  init checkpoint (.devbox/init-state.json): present (updated: ${initState.updatedAt}, complete: ${completeText})`);
+                lines.push(`  init checkpoint (${checkpointPath}): present (updated: ${initState.updatedAt}, complete: ${completeText})`);
                 if (initState.canonical || initState.alias || initState.workdir) {
                     lines.push(`    box: ${initState.canonical ?? "(unknown)"} (alias: ${initState.alias ?? "(unknown)"})`);
                     lines.push(`    workdir: ${initState.workdir ?? "(unknown)"}`);
@@ -390,7 +442,7 @@ export const runInit = async (args) => {
                 }
             }
             else {
-                lines.push("  init checkpoint (.devbox/init-state.json): missing");
+                lines.push(`  init checkpoint (${checkpointPath}): missing`);
             }
             lines.push("");
             lines.push("Registry");
@@ -462,7 +514,7 @@ export const runInit = async (args) => {
         }
         if (parsed.resume) {
             if (initFingerprintMismatch) {
-                throw new Error("Init state does not match this repo. Remove .devbox/init-state.json and run `dvb init` again.");
+                throw new Error(`Init state does not match this repo. Remove ${path.join(projectDir, "init-state.json")} and run \`dvb init\` again.`);
             }
             if (!initState) {
                 throw new Error("No init state to resume. Run `dvb init` to start a new init.");
@@ -508,7 +560,7 @@ export const runInit = async (args) => {
                 },
                 updatedAt: new Date().toISOString(),
             };
-            await writeInitState(repoRoot, initState);
+            await writeInitState(projectDir, initState);
         };
         const recordCodexCheckpoint = async ({ client, canonical, phase, }) => {
             const createdAt = new Date().toISOString();
@@ -571,14 +623,14 @@ export const runInit = async (args) => {
             if (!repoMarker?.canonical) {
                 throw new Error("Repo is not initialized. Run `dvb init` first.");
             }
-            const setupDir = path.join(repoRoot, ".devbox");
+            const setupDir = projectDir;
             const setupPath = path.join(setupDir, "setup.json");
             const servicesPath = path.join(setupDir, "services.json");
             try {
                 await fs.access(setupPath);
             }
             catch {
-                throw new Error("Missing .devbox/setup.json. Run `dvb init` first.");
+                throw new Error(`Missing setup plan (${setupPath}). Run \`dvb init\` first.`);
             }
             const localArtifactsBundlePath = path.join(setupDir, "setup-artifacts.tgz");
             const localArtifactsManifestPath = path.join(setupDir, "setup-artifacts.json");
@@ -1040,10 +1092,11 @@ export const runInit = async (args) => {
                 }
             },
         });
-        const setupDir = path.join(repoRoot, ".devbox");
+        const setupDir = projectDir;
         const setupPath = path.join(setupDir, "setup.json");
         const servicesPath = path.join(setupDir, "services.json");
         const scansDir = path.join(setupDir, "scans");
+        const logDir = path.join(setupDir, "logs");
         const setupEnvSecretsScanPath = path.join(scansDir, "setup-env-secrets.json");
         const setupExternalScanPath = path.join(scansDir, "setup-external.json");
         const setupExtraArtifactsScanPath = path.join(scansDir, "setup-extra-artifacts.json");
@@ -1059,7 +1112,13 @@ export const runInit = async (args) => {
         let approvedServices = null;
         const setupTempDir = await fs.mkdtemp(path.join(os.tmpdir(), "devbox-setup-"));
         try {
-            await fs.mkdir(setupDir, { recursive: true });
+            await fs.mkdir(setupDir, { recursive: true, mode: 0o700 });
+            try {
+                await fs.chmod(setupDir, 0o700);
+            }
+            catch {
+                // best effort on filesystems that do not support chmod
+            }
             const tryReadSetupPlan = async () => {
                 try {
                     return await readSetupPlan(setupPath);
@@ -1189,6 +1248,7 @@ export const runInit = async (args) => {
                             : runCodexScanWithImmediateRetry({
                                 run: async () => await runLocalSetupEnvSecretsScan({
                                     cwd: repoRoot,
+                                    logDir,
                                     schemaPath: envSecretsSchemaPath,
                                     outputPath: setupEnvSecretsScanPath,
                                     onProgress: updateEnvSecrets,
@@ -1205,6 +1265,7 @@ export const runInit = async (args) => {
                             : runCodexScanWithImmediateRetry({
                                 run: async () => await runLocalSetupExternalScan({
                                     cwd: repoRoot,
+                                    logDir,
                                     schemaPath: externalSchemaPath,
                                     outputPath: setupExternalScanPath,
                                     homeDir: localHomeDir,
@@ -1222,6 +1283,7 @@ export const runInit = async (args) => {
                             : runCodexScanWithImmediateRetry({
                                 run: async () => await runLocalSetupExtraArtifactsScan({
                                     cwd: repoRoot,
+                                    logDir,
                                     schemaPath: extraArtifactsSchemaPath,
                                     outputPath: setupExtraArtifactsScanPath,
                                     onProgress: updateExtraArtifacts,
@@ -1236,6 +1298,7 @@ export const runInit = async (args) => {
                         : runCodexScanWithImmediateRetry({
                             run: async () => await runLocalServicesScan({
                                 cwd: repoRoot,
+                                logDir,
                                 schemaPath: servicesSchemaPath,
                                 outputPath: servicesPath,
                                 homeDir: localHomeDir,
@@ -1644,7 +1707,6 @@ export const runInit = async (args) => {
         else if (!skipProvision || !skipSetupUpload) {
             const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "devbox-init-"));
             const bundlePath = path.join(tempDir, "repo.bundle");
-            const archivePath = path.join(tempDir, "repo.tgz");
             const gitMetaPath = path.join(tempDir, "git-meta.tgz");
             const gitMetaListPath = path.join(tempDir, "git-meta.list");
             const stagedPatchPath = path.join(tempDir, "staged.patch");
@@ -1655,12 +1717,11 @@ export const runInit = async (args) => {
             const globalGitConfigMappings = mapGlobalGitConfigDestinations(globalGitConfigSources, localHomeDir);
             try {
                 const remoteBundlePath = "/home/sprite/.devbox/upload.bundle";
-                const remoteArchivePath = "/home/sprite/.devbox/upload.tgz";
                 const remoteGitMetaPath = "/home/sprite/.devbox/git-meta.tgz";
                 const remoteStagedPatchPath = "/home/sprite/.devbox/staged.patch";
                 const remoteUnstagedPatchPath = "/home/sprite/.devbox/unstaged.patch";
                 const remoteUntrackedPath = "/home/sprite/.devbox/untracked.tgz";
-                const remoteHasGit = await runInitStep({
+                await runInitStep({
                     enabled: progressEnabled,
                     title: "Preparing remote directories",
                     fn: async ({ status }) => {
@@ -1670,10 +1731,14 @@ export const runInit = async (args) => {
                             "-lc",
                             "git --version",
                         ]);
-                        const remoteHasGit = gitCheck.exitCode === 0;
+                        if (gitCheck.exitCode !== 0) {
+                            const details = gitCheck.stderr || gitCheck.stdout || "";
+                            throw new Error(details
+                                ? `Remote git unavailable: ${details.trim()}`
+                                : "Remote git unavailable");
+                        }
                         const remoteDirs = new Set();
                         remoteDirs.add(path.posix.dirname(remoteBundlePath));
-                        remoteDirs.add(path.posix.dirname(remoteArchivePath));
                         remoteDirs.add(path.posix.dirname(remoteGitMetaPath));
                         remoteDirs.add(path.posix.dirname(remoteStagedPatchPath));
                         remoteDirs.add(path.posix.dirname(remoteUnstagedPatchPath));
@@ -1692,7 +1757,6 @@ export const runInit = async (args) => {
                                 throw new Error(prepResult.stderr || "Failed to prepare remote dirs");
                             }
                         }
-                        return remoteHasGit;
                     },
                 });
                 const { headState, gitCommonDir, worktreeState, copyWorktree } = await runInitStep({
@@ -1730,43 +1794,20 @@ export const runInit = async (args) => {
                         let stagedPatchCreated = false;
                         let unstagedPatchCreated = false;
                         let untrackedCreated = false;
-                        if (remoteHasGit) {
-                            status.stage("Packaging repo bundle");
-                            await runCommand(repoRoot, "git", [
-                                "bundle",
-                                "create",
-                                bundlePath,
-                                "--all",
-                            ]);
-                            status.stage("Packaging git metadata");
-                            gitMetaCreated = await createGitMetaArchive(gitCommonDir, gitMetaPath, gitMetaListPath);
-                            if (copyWorktree) {
-                                status.stage("Packaging repo changes");
-                                stagedPatchCreated = await writePatch(repoRoot, ["diff", "--binary", "--cached"], stagedPatchPath);
-                                unstagedPatchCreated = await writePatch(repoRoot, ["diff", "--binary"], unstagedPatchPath);
-                                untrackedCreated = await createFileListArchive(repoRoot, worktreeState.untracked, untrackedPath, untrackedListPath);
-                            }
-                        }
-                        else {
-                            status.stage("Packaging repo archive");
-                            if (copyWorktree) {
-                                const workingFiles = await readNullSeparatedPaths(repoRoot, [
-                                    "ls-files",
-                                    "--cached",
-                                    "--others",
-                                    "--exclude-standard",
-                                ]);
-                                await createFileListArchive(repoRoot, workingFiles, archivePath, untrackedListPath);
-                            }
-                            else {
-                                await runCommand(repoRoot, "git", [
-                                    "archive",
-                                    "--format=tar.gz",
-                                    "-o",
-                                    archivePath,
-                                    "HEAD",
-                                ]);
-                            }
+                        status.stage("Packaging repo bundle");
+                        await runCommand(repoRoot, "git", [
+                            "bundle",
+                            "create",
+                            bundlePath,
+                            "--all",
+                        ]);
+                        status.stage("Packaging git metadata");
+                        gitMetaCreated = await createGitMetaArchive(gitCommonDir, gitMetaPath, gitMetaListPath);
+                        if (copyWorktree) {
+                            status.stage("Packaging repo changes");
+                            stagedPatchCreated = await writePatch(repoRoot, ["diff", "--binary", "--cached"], stagedPatchPath);
+                            unstagedPatchCreated = await writePatch(repoRoot, ["diff", "--binary"], unstagedPatchPath);
+                            untrackedCreated = await createFileListArchive(repoRoot, worktreeState.untracked, untrackedPath, untrackedListPath);
                         }
                         return {
                             gitMetaCreated,
@@ -1780,31 +1821,25 @@ export const runInit = async (args) => {
                     enabled: progressEnabled,
                     title: "Uploading repo",
                     fn: async ({ status }) => {
-                        if (remoteHasGit) {
-                            status.stage("Uploading repo bundle");
-                            const bundleData = await fs.readFile(bundlePath);
-                            await client.writeFile(canonical, remoteBundlePath, bundleData);
-                            if (packaged.gitMetaCreated) {
-                                status.stage("Uploading git metadata");
-                                const gitMetaData = await fs.readFile(gitMetaPath);
-                                await client.writeFile(canonical, remoteGitMetaPath, gitMetaData);
-                            }
-                            if (packaged.stagedPatchCreated) {
-                                status.stage("Uploading staged changes");
-                                await client.writeFile(canonical, remoteStagedPatchPath, await fs.readFile(stagedPatchPath));
-                            }
-                            if (packaged.unstagedPatchCreated) {
-                                status.stage("Uploading unstaged changes");
-                                await client.writeFile(canonical, remoteUnstagedPatchPath, await fs.readFile(unstagedPatchPath));
-                            }
-                            if (packaged.untrackedCreated) {
-                                status.stage("Uploading untracked files");
-                                await client.writeFile(canonical, remoteUntrackedPath, await fs.readFile(untrackedPath));
-                            }
+                        status.stage("Uploading repo bundle");
+                        const bundleData = await fs.readFile(bundlePath);
+                        await client.writeFile(canonical, remoteBundlePath, bundleData);
+                        if (packaged.gitMetaCreated) {
+                            status.stage("Uploading git metadata");
+                            const gitMetaData = await fs.readFile(gitMetaPath);
+                            await client.writeFile(canonical, remoteGitMetaPath, gitMetaData);
                         }
-                        else {
-                            status.stage("Uploading repo archive");
-                            await client.writeFile(canonical, remoteArchivePath, await fs.readFile(archivePath));
+                        if (packaged.stagedPatchCreated) {
+                            status.stage("Uploading staged changes");
+                            await client.writeFile(canonical, remoteStagedPatchPath, await fs.readFile(stagedPatchPath));
+                        }
+                        if (packaged.unstagedPatchCreated) {
+                            status.stage("Uploading unstaged changes");
+                            await client.writeFile(canonical, remoteUnstagedPatchPath, await fs.readFile(unstagedPatchPath));
+                        }
+                        if (packaged.untrackedCreated) {
+                            status.stage("Uploading untracked files");
+                            await client.writeFile(canonical, remoteUntrackedPath, await fs.readFile(untrackedPath));
                         }
                         if (globalGitConfigMappings.length > 0) {
                             status.stage("Uploading git config");
@@ -1820,77 +1855,48 @@ export const runInit = async (args) => {
                     title: "Provisioning workdir",
                     fn: async () => {
                         const backup = `${expandedWorkdir}.bak-${Date.now()}`;
-                        if (remoteHasGit) {
-                            const checkoutCommand = headState.branch
-                                ? `git checkout -B ${shellQuote(headState.branch)} ${shellQuote(headState.commit)}`
-                                : `git checkout --detach ${shellQuote(headState.commit)}`;
-                            const remoteCommand = [
-                                "set -euo pipefail",
-                                "unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE",
-                                `if [ -d ${shellQuote(expandedWorkdir)} ]; then`,
-                                parsed.force
-                                    ? `  mv ${shellQuote(expandedWorkdir)} ${shellQuote(backup)}`
-                                    : `  echo "Target exists: ${expandedWorkdir}" >&2; exit 1`,
-                                "fi",
-                                `mkdir -p ${shellQuote(path.dirname(expandedWorkdir))}`,
-                                `git init -b devbox-init ${shellQuote(expandedWorkdir)}`,
-                                `cd ${shellQuote(expandedWorkdir)}`,
-                                `git fetch ${shellQuote(remoteBundlePath)} 'refs/*:refs/*'`,
-                                `if [ -f ${shellQuote(remoteGitMetaPath)} ]; then`,
-                                `  tar -xzf ${shellQuote(remoteGitMetaPath)} -C .git`,
-                                "fi",
-                                checkoutCommand,
-                                `if [ -f ${shellQuote(remoteStagedPatchPath)} ]; then`,
-                                `  git apply --index ${shellQuote(remoteStagedPatchPath)}`,
-                                "fi",
-                                `if [ -f ${shellQuote(remoteUnstagedPatchPath)} ]; then`,
-                                `  git apply ${shellQuote(remoteUnstagedPatchPath)}`,
-                                "fi",
-                                `if [ -f ${shellQuote(remoteUntrackedPath)} ]; then`,
-                                `  tar -xzf ${shellQuote(remoteUntrackedPath)} -C .`,
-                                "fi",
-                            ].join("\n");
-                            const execResult = await client.exec(canonical, [
-                                "/bin/bash",
-                                "--noprofile",
-                                "--norc",
-                                "-e",
-                                "-u",
-                                "-o",
-                                "pipefail",
-                                "-c",
-                                remoteCommand,
-                            ]);
-                            if (execResult.exitCode !== 0) {
-                                throw new Error(execResult.stderr || "Remote init failed");
-                            }
-                        }
-                        else {
-                            const remoteCommand = [
-                                "set -euo pipefail",
-                                "unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE",
-                                `if [ -d ${shellQuote(expandedWorkdir)} ]; then`,
-                                parsed.force
-                                    ? `  mv ${shellQuote(expandedWorkdir)} ${shellQuote(backup)}`
-                                    : `  echo "Target exists: ${expandedWorkdir}" >&2; exit 1`,
-                                "fi",
-                                `mkdir -p ${shellQuote(expandedWorkdir)}`,
-                                `tar -xzf ${shellQuote(remoteArchivePath)} -C ${shellQuote(expandedWorkdir)}`,
-                            ].join("\n");
-                            const execResult = await client.exec(canonical, [
-                                "/bin/bash",
-                                "--noprofile",
-                                "--norc",
-                                "-e",
-                                "-u",
-                                "-o",
-                                "pipefail",
-                                "-c",
-                                remoteCommand,
-                            ]);
-                            if (execResult.exitCode !== 0) {
-                                throw new Error(execResult.stderr || "Remote init failed");
-                            }
+                        const checkoutCommand = headState.branch
+                            ? `git checkout -B ${shellQuote(headState.branch)} ${shellQuote(headState.commit)}`
+                            : `git checkout --detach ${shellQuote(headState.commit)}`;
+                        const remoteCommand = [
+                            "set -euo pipefail",
+                            "unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE",
+                            `if [ -d ${shellQuote(expandedWorkdir)} ]; then`,
+                            parsed.force
+                                ? `  mv ${shellQuote(expandedWorkdir)} ${shellQuote(backup)}`
+                                : `  echo "Target exists: ${expandedWorkdir}" >&2; exit 1`,
+                            "fi",
+                            `mkdir -p ${shellQuote(path.dirname(expandedWorkdir))}`,
+                            `git init -b devbox-init ${shellQuote(expandedWorkdir)}`,
+                            `cd ${shellQuote(expandedWorkdir)}`,
+                            `git fetch ${shellQuote(remoteBundlePath)} 'refs/*:refs/*'`,
+                            `if [ -f ${shellQuote(remoteGitMetaPath)} ]; then`,
+                            `  tar -xzf ${shellQuote(remoteGitMetaPath)} -C .git`,
+                            "fi",
+                            checkoutCommand,
+                            `if [ -f ${shellQuote(remoteStagedPatchPath)} ]; then`,
+                            `  git apply --index ${shellQuote(remoteStagedPatchPath)}`,
+                            "fi",
+                            `if [ -f ${shellQuote(remoteUnstagedPatchPath)} ]; then`,
+                            `  git apply ${shellQuote(remoteUnstagedPatchPath)}`,
+                            "fi",
+                            `if [ -f ${shellQuote(remoteUntrackedPath)} ]; then`,
+                            `  tar -xzf ${shellQuote(remoteUntrackedPath)} -C .`,
+                            "fi",
+                        ].join("\n");
+                        const execResult = await client.exec(canonical, [
+                            "/bin/bash",
+                            "--noprofile",
+                            "--norc",
+                            "-e",
+                            "-u",
+                            "-o",
+                            "pipefail",
+                            "-c",
+                            remoteCommand,
+                        ]);
+                        if (execResult.exitCode !== 0) {
+                            throw new Error(execResult.stderr || "Remote init failed");
                         }
                         await updateInitState({ steps: { workdirProvisioned: true } });
                     },
@@ -2243,8 +2249,7 @@ export const runInit = async (args) => {
             enabled: progressEnabled,
             title: "Writing local metadata",
             fn: async () => {
-                await ensureDevboxToml(repoRoot, repoName, slug);
-                await writeRepoMarker(repoRoot, { fingerprint, canonical, alias });
+                await writeRepoMarker(projectDir, { fingerprint, canonical, alias });
             },
         });
         await runInitStep({
@@ -2265,15 +2270,6 @@ export const runInit = async (args) => {
                 }
             },
         });
-        try {
-            const gitignore = await fs.readFile(path.join(repoRoot, ".gitignore"), "utf8");
-            if (!gitignore.includes(".devbox")) {
-                console.log("Note: add .devbox/ to .gitignore to keep local marker private.");
-            }
-        }
-        catch {
-            // ignore missing .gitignore
-        }
         const skipSetupArtifactsStage = skipCodexApply ||
             (shouldResume && initState?.steps.setupArtifactsStaged);
         if (!skipSetupArtifactsStage) {