@boxes-dev/dvb 1.0.42 → 1.0.43

package/dist/devbox/commands/init/index.js

@@ -22,6 +22,7 @@ import { createSetupArtifacts, promptForPlanApproval, promptForServicesApproval,
 import { mergeServicesToml, splitShellCommand, } from "../servicesToml.js";
 import { checkSpriteExists, destroySpriteAndClearState, } from "../destroyShared.js";
 import { runInitStep } from "./progress.js";
+import { collectMissingSetupArtifacts, remapSelectedPathEntries, } from "./setupArtifactsValidation.js";
 const requireDaemonJsonOk = (response, label) => {
     if (response.status >= 200 && response.status < 300) {
         return response.body;
@@ -58,10 +59,25 @@ const ensurePrivateDir = async (dir) => {
     }
 };
 const DEFAULT_INIT_STEP_RETRIES = 3;
+const SETUP_ARTIFACT_REGEN_MAX_ATTEMPTS = 3;
 const INIT_STEP_RETRYABLE_STATUSES = new Set([
     408, 409, 425, 429, 500, 502, 503, 504,
 ]);
+const ALIAS_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const RESERVED_ALIAS_PATTERN = /^dvb-[a-f0-9]{12}-/;
 const delay = async (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const normalizeAlias = (value) => value.trim().toLowerCase();
+const validateAlias = (alias) => {
+    if (!alias) {
+        throw new Error("Alias is required.");
+    }
+    if (RESERVED_ALIAS_PATTERN.test(alias)) {
+        throw new Error(`Alias "${alias}" is reserved. Choose an alias that does not start with dvb-<12 hex>-.`);
+    }
+    if (!ALIAS_PATTERN.test(alias)) {
+        throw new Error(`Invalid alias "${alias}". Use lowercase letters, numbers, and dashes.`);
+    }
+};
 const computeRetryDelayMs = (retryIndex) => {
     // retryIndex is 1-based (1..N)
     const base = 500;
@@ -161,6 +177,8 @@ const migrateLegacyRepoDevboxDir = async ({ repoRoot, projectDir, }) => {
         "setup.json",
         "setup-artifacts.tgz",
         "setup-artifacts.json",
+        "setup-artifacts.parts",
+        "setup-artifacts.parts.json",
         "scans",
         "logs",
     ];
@@ -479,8 +497,7 @@ export const runInit = async (args) => {
                 parsed.force ||
                 parsed.yes ||
                 parsed.codexSetupOnly ||
-                parsed.alias ||
-                parsed.name) {
+                parsed.alias) {
                 throw new Error("`dvb init --status` cannot be combined with other init flags (except --json).");
             }
             const socketInfo = resolveSocketInfo();
@@ -769,13 +786,22 @@ export const runInit = async (args) => {
             }
             const localArtifactsBundlePath = path.join(setupDir, "setup-artifacts.tgz");
             const localArtifactsManifestPath = path.join(setupDir, "setup-artifacts.json");
+            const localArtifactsPartsDescriptorPath = path.join(setupDir, "setup-artifacts.parts.json");
             let artifactsBundlePath = null;
             let artifactsManifestPath = null;
+            let artifactsPartsDescriptorPath = null;
             try {
                 await fs.access(localArtifactsBundlePath);
                 await fs.access(localArtifactsManifestPath);
                 artifactsBundlePath = localArtifactsBundlePath;
                 artifactsManifestPath = localArtifactsManifestPath;
+                try {
+                    await fs.access(localArtifactsPartsDescriptorPath);
+                    artifactsPartsDescriptorPath = localArtifactsPartsDescriptorPath;
+                }
+                catch {
+                    // split artifacts descriptor is optional
+                }
             }
             catch {
                 // artifacts are optional in setup-only flow
@@ -834,6 +860,7 @@ export const runInit = async (args) => {
             const remoteSetupPath = path.posix.join(expandedWorkdir, ".devbox", "setup.json");
             const remoteArtifactsBundlePath = path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.tgz");
             const remoteArtifactsManifestPath = path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.json");
+            const remoteArtifactsPartsDescriptorPath = path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.parts.json");
             const pathSetup = 'export PATH="$(npm bin -g 2>/dev/null):$PATH"';
             await runInitStep({
                 enabled: progressEnabled,
@@ -858,12 +885,16 @@ export const runInit = async (args) => {
                         remoteSetupPath,
                         localArtifactsBundlePath: artifactsBundlePath,
                         localArtifactsManifestPath: artifactsManifestPath,
+                        localArtifactsPartsDescriptorPath: artifactsPartsDescriptorPath,
                         remoteArtifactsBundlePath: artifactsBundlePath
                             ? remoteArtifactsBundlePath
                             : null,
                         remoteArtifactsManifestPath: artifactsBundlePath
                             ? remoteArtifactsManifestPath
                             : null,
+                        remoteArtifactsPartsDescriptorPath: artifactsBundlePath
+                            ? remoteArtifactsPartsDescriptorPath
+                            : null,
                         status,
                     });
                 },
@@ -1036,13 +1067,15 @@ export const runInit = async (args) => {
                 throw new Error(`Repo already initialized (box: ${existingEntry.canonical}).`);
             }
         }
-        const alias = parsed.alias ?? initState?.alias ?? existingEntry?.alias ?? slug;
-        const canonicalHint = parsed.name ?? initState?.canonical ?? existingEntry?.canonical;
+        const alias = normalizeAlias(parsed.alias ?? initState?.alias ?? existingEntry?.alias ?? slug);
+        validateAlias(alias);
+        const canonicalHint = initState?.canonical ?? existingEntry?.canonical;
         const workdir = `~/${slug}`;
         const expandedWorkdir = expandHome(workdir);
         const remoteSetupPath = path.posix.join(expandedWorkdir, ".devbox", "setup.json");
         const remoteArtifactsBundlePath = path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.tgz");
         const remoteArtifactsManifestPath = path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.json");
+        const remoteArtifactsPartsDescriptorPath = path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.parts.json");
         const pathSetup = 'export PATH="$(npm bin -g 2>/dev/null):$PATH"';
         const { config, client, controlPlaneToken } = await runInitStep({
             enabled: progressEnabled,
@@ -1121,15 +1154,17 @@ export const runInit = async (args) => {
             });
             existingEntry = null;
         }
-        const username = os.userInfo().username;
         let canonical = (shouldResume && initState?.canonical ? initState.canonical : null) ??
             canonicalHint ??
-            `${username}-${slug}`;
+            alias;
         const knownAssociatedCanonicals = new Set([existingEntry?.canonical, initState?.canonical].filter((value) => typeof value === "string" && value.length > 0));
         const createSprite = async (name) => {
             try {
-                await client.createSprite(name);
-                return "created";
+                const created = await client.createSprite(name);
+                const canonical = typeof created.name === "string" && created.name.trim()
+                    ? created.name.trim()
+                    : name;
+                return { kind: "created", canonical };
             }
             catch (error) {
                 if (error instanceof SpritesApiError) {
@@ -1138,7 +1173,7 @@ export const runInit = async (args) => {
                         error.status === 409 ||
                         body.includes("exists") ||
                         body.includes("already")) {
-                        return "exists";
+                        return { kind: "exists" };
                     }
                 }
                 throw error;
@@ -1163,7 +1198,7 @@ export const runInit = async (args) => {
                 fn: async ({ status }) => {
                     let nextCanonical = canonical;
                     const createResult = await createSprite(nextCanonical);
-                    if (createResult === "exists") {
+                    if (createResult.kind === "exists") {
                         const associatedCanonical = knownAssociatedCanonicals.has(nextCanonical);
                         if (parsed.force) {
                             if (!associatedCanonical) {
@@ -1181,7 +1216,7 @@ export const runInit = async (args) => {
                                     throwInitCanceled();
                                 }
                                 if (!confirmedReuse) {
-                                    throw new Error(`Sprite reuse canceled: ${nextCanonical}. Choose a different --name.`);
+                                    throw new Error(`Sprite reuse canceled: ${nextCanonical}. Choose a different alias.`);
                                 }
                                 status.stage("Creating devbox");
                             }
@@ -1194,11 +1229,15 @@ export const runInit = async (args) => {
                             nextCanonical = `${nextCanonical}-${suffix}`;
                             status.stage("Resolving devbox name");
                             const second = await createSprite(nextCanonical);
-                            if (second === "exists") {
+                            if (second.kind === "exists") {
                                 throw new Error(`Sprite already exists: ${nextCanonical}`);
                             }
+                            nextCanonical = second.canonical;
                         }
                     }
+                    else {
+                        nextCanonical = createResult.canonical;
+                    }
                     await updateInitState({
                         canonical: nextCanonical,
                         alias,
@@ -1394,6 +1433,7 @@ export const runInit = async (args) => {
         const setupExternalScanPath = path.join(scansDir, "setup-external.json");
         const setupExtraArtifactsScanPath = path.join(scansDir, "setup-extra-artifacts.json");
         const servicesScanPath = path.join(scansDir, "services.json");
+        const scanThreadsPath = path.join(scansDir, "codex-scan-threads.json");
         let setupArtifacts = null;
         const nonInteractive = !process.stdin.isTTY || parsed.json;
         const skipSetupPlan = shouldResume && initState?.steps.setupPlanWritten;
@@ -1452,7 +1492,74 @@ export const runInit = async (args) => {
                     return null;
                 }
             };
+            const tryReadScanThreads = async () => {
+                try {
+                    const raw = await fs.readFile(scanThreadsPath, "utf8");
+                    const parsed = JSON.parse(raw);
+                    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+                        return {};
+                    }
+                    const record = parsed;
+                    return {
+                        ...(typeof record.envSecretsThreadId === "string"
+                            ? { envSecretsThreadId: record.envSecretsThreadId }
+                            : {}),
+                        ...(typeof record.externalThreadId === "string"
+                            ? { externalThreadId: record.externalThreadId }
+                            : {}),
+                        ...(typeof record.extraArtifactsThreadId === "string"
+                            ? { extraArtifactsThreadId: record.extraArtifactsThreadId }
+                            : {}),
+                        ...(typeof record.servicesThreadId === "string"
+                            ? { servicesThreadId: record.servicesThreadId }
+                            : {}),
+                    };
+                }
+                catch {
+                    return {};
+                }
+            };
+            let scanThreads = shouldResume
+                ? await tryReadScanThreads()
+                : {};
+            let scanThreadsDirty = false;
+            const persistScanThreads = async () => {
+                await fs.mkdir(scansDir, { recursive: true });
+                await fs.writeFile(scanThreadsPath, JSON.stringify(scanThreads, null, 2), "utf8");
+            };
+            const flushScanThreads = async () => {
+                if (!scanThreadsDirty)
+                    return;
+                await persistScanThreads();
+                scanThreadsDirty = false;
+            };
+            const saveScanThreadId = (key, threadId) => {
+                if (!threadId)
+                    return;
+                if (scanThreads[key] === threadId)
+                    return;
+                scanThreads = { ...scanThreads, [key]: threadId };
+                scanThreadsDirty = true;
+            };
             const shouldRetryCodexScan = (scanFullyCompleted, ...arrays) => !scanFullyCompleted && arrays.every((array) => array.length === 0);
+            const runCodexScanWithImmediateRetry = async ({ run, read, outputPath, update, shouldRetry, }) => {
+                try {
+                    await run();
+                    let out = await read();
+                    if (shouldRetry(out)) {
+                        update("retrying");
+                        await fs.rm(outputPath, { force: true });
+                        await run();
+                        out = await read();
+                    }
+                    update("done");
+                    return out;
+                }
+                catch (error) {
+                    update("failed");
+                    throw error;
+                }
+            };
             let setupPlan = skipSetupPlan || !shouldResume ? null : await tryReadSetupPlan();
             const needsSetupScan = !skipSetupPlan && !setupPlan;
             let servicesPlan = !needsSetupScan || !shouldResume ? null : await tryReadServicesPlan();
@@ -1516,39 +1623,24 @@ export const runInit = async (args) => {
                     if (needsSetupScan) {
                         await fs.mkdir(scansDir, { recursive: true });
                     }
-                    const runCodexScanWithImmediateRetry = async ({ run, read, outputPath, update, shouldRetry, }) => {
-                        try {
-                            await run();
-                            let out = await read();
-                            if (shouldRetry(out)) {
-                                update("retrying");
-                                await fs.rm(outputPath, { force: true });
-                                await run();
-                                out = await read();
-                            }
-                            update("done");
-                            return out;
-                        }
-                        catch (error) {
-                            update("failed");
-                            throw error;
-                        }
-                    };
                     const envSecretsPromise = !needsSetupScan
                         ? Promise.resolve(null)
                         : !needsEnvSecretsScan
                             ? Promise.resolve(envSecretsScan)
                             : runCodexScanWithImmediateRetry({
-                                run: async () => await runLocalSetupEnvSecretsScan({
-                                    cwd: repoRoot,
-                                    logDir,
-                                    schemaPath: envSecretsSchemaPath,
-                                    outputPath: setupEnvSecretsScanPath,
-                                    ...(initCodexProxyOptions
-                                        ? { proxyOptions: initCodexProxyOptions }
-                                        : {}),
-                                    onProgress: updateEnvSecrets,
-                                }),
+                                run: async () => {
+                                    const threadId = await runLocalSetupEnvSecretsScan({
+                                        cwd: repoRoot,
+                                        logDir,
+                                        schemaPath: envSecretsSchemaPath,
+                                        outputPath: setupEnvSecretsScanPath,
+                                        ...(initCodexProxyOptions
+                                            ? { proxyOptions: initCodexProxyOptions }
+                                            : {}),
+                                        onProgress: updateEnvSecrets,
+                                    });
+                                    await saveScanThreadId("envSecretsThreadId", threadId);
+                                },
                                 read: async () => await readSetupEnvSecretsPlan(setupEnvSecretsScanPath),
                                 outputPath: setupEnvSecretsScanPath,
                                 update: updateEnvSecrets,
@@ -1559,17 +1651,20 @@ export const runInit = async (args) => {
                         : !needsExternalScan
                             ? Promise.resolve(externalScan)
                             : runCodexScanWithImmediateRetry({
-                                run: async () => await runLocalSetupExternalScan({
-                                    cwd: repoRoot,
-                                    logDir,
-                                    schemaPath: externalSchemaPath,
-                                    outputPath: setupExternalScanPath,
-                                    homeDir: localHomeDir,
-                                    ...(initCodexProxyOptions
-                                        ? { proxyOptions: initCodexProxyOptions }
-                                        : {}),
-                                    onProgress: updateExternal,
-                                }),
+                                run: async () => {
+                                    const threadId = await runLocalSetupExternalScan({
+                                        cwd: repoRoot,
+                                        logDir,
+                                        schemaPath: externalSchemaPath,
+                                        outputPath: setupExternalScanPath,
+                                        homeDir: localHomeDir,
+                                        ...(initCodexProxyOptions
+                                            ? { proxyOptions: initCodexProxyOptions }
+                                            : {}),
+                                        onProgress: updateExternal,
+                                    });
+                                    await saveScanThreadId("externalThreadId", threadId);
+                                },
                                 read: async () => await readSetupExternalPlan(setupExternalScanPath),
                                 outputPath: setupExternalScanPath,
                                 update: updateExternal,
@@ -1580,16 +1675,19 @@ export const runInit = async (args) => {
                         : !needsExtraArtifactsScan
                             ? Promise.resolve(extraArtifactsScan)
                             : runCodexScanWithImmediateRetry({
-                                run: async () => await runLocalSetupExtraArtifactsScan({
-                                    cwd: repoRoot,
-                                    logDir,
-                                    schemaPath: extraArtifactsSchemaPath,
-                                    outputPath: setupExtraArtifactsScanPath,
-                                    ...(initCodexProxyOptions
-                                        ? { proxyOptions: initCodexProxyOptions }
-                                        : {}),
-                                    onProgress: updateExtraArtifacts,
-                                }),
+                                run: async () => {
+                                    const threadId = await runLocalSetupExtraArtifactsScan({
+                                        cwd: repoRoot,
+                                        logDir,
+                                        schemaPath: extraArtifactsSchemaPath,
+                                        outputPath: setupExtraArtifactsScanPath,
+                                        ...(initCodexProxyOptions
+                                            ? { proxyOptions: initCodexProxyOptions }
+                                            : {}),
+                                        onProgress: updateExtraArtifacts,
+                                    });
+                                    await saveScanThreadId("extraArtifactsThreadId", threadId);
+                                },
                                 read: async () => await readSetupExtraArtifactsPlan(setupExtraArtifactsScanPath),
                                 outputPath: setupExtraArtifactsScanPath,
                                 update: updateExtraArtifacts,
@@ -1598,17 +1696,20 @@ export const runInit = async (args) => {
                     const servicesPromise = !needsServicesScan
                         ? Promise.resolve(servicesPlan)
                         : runCodexScanWithImmediateRetry({
-                            run: async () => await runLocalServicesScan({
-                                cwd: repoRoot,
-                                logDir,
-                                schemaPath: servicesSchemaPath,
-                                outputPath: servicesScanPath,
-                                homeDir: localHomeDir,
-                                ...(initCodexProxyOptions
-                                    ? { proxyOptions: initCodexProxyOptions }
-                                    : {}),
-                                onProgress: updateServices,
-                            }),
+                            run: async () => {
+                                const threadId = await runLocalServicesScan({
+                                    cwd: repoRoot,
+                                    logDir,
+                                    schemaPath: servicesSchemaPath,
+                                    outputPath: servicesScanPath,
+                                    homeDir: localHomeDir,
+                                    ...(initCodexProxyOptions
+                                        ? { proxyOptions: initCodexProxyOptions }
+                                        : {}),
+                                    onProgress: updateServices,
+                                });
+                                await saveScanThreadId("servicesThreadId", threadId);
+                            },
                             read: async () => await readServicesPlan(servicesScanPath),
                             outputPath: servicesScanPath,
                             update: updateServices,
@@ -1620,6 +1721,7 @@ export const runInit = async (args) => {
                         extraArtifactsPromise,
                         servicesPromise,
                     ]);
+                    await flushScanThreads();
                     if (needsServicesScan) {
                         if (!services) {
                             throw new Error("Services scan missing.");
@@ -1779,6 +1881,136 @@ export const runInit = async (args) => {
                     await updateInitState({ steps: backfillStepUpdate });
                 }
             }
+            const formatMissingSetupArtifact = (entry) => {
+                const categoryLabel = entry.category === "envFiles" || entry.category === "secretFiles"
+                    ? "env/secrets"
+                    : entry.category === "externalConfigs"
+                        ? "external"
+                        : "extra artifacts";
+                return `${categoryLabel}: ${entry.path}`;
+            };
+            const buildMissingPathsFeedback = (categoryLabel, entries) => [
+                `Your previous ${categoryLabel} scan output included path(s) that do not exist on disk right now.`,
+                "Fix the result and return corrected JSON. Only include paths that currently exist.",
+                "Missing paths:",
+                ...entries.map((entry) => `- ${entry.path} (resolved: ${toRepoRelativePath(repoRoot, entry.resolvedPath)})`),
+            ].join("\n");
+            const regenerateSetupPlanForMissingArtifacts = async ({ plan, missingArtifacts, status, }) => {
+                const categories = new Set(missingArtifacts.map((entry) => entry.category));
+                const needsEnvSecrets = categories.has("envFiles") || categories.has("secretFiles");
+                const needsExternal = categories.has("externalConfigs");
+                const needsExtraArtifacts = categories.has("extraArtifacts");
+                let nextPlan = plan;
+                if (needsEnvSecrets) {
+                    const envSecretsMissing = missingArtifacts.filter((entry) => entry.category === "envFiles" || entry.category === "secretFiles");
+                    const envSecretsSchemaPath = await writeSetupEnvSecretsSchema(setupTempDir);
+                    envSecretsScan = await runCodexScanWithImmediateRetry({
+                        run: async () => {
+                            const threadId = await runLocalSetupEnvSecretsScan({
+                                cwd: repoRoot,
+                                logDir,
+                                schemaPath: envSecretsSchemaPath,
+                                outputPath: setupEnvSecretsScanPath,
+                                ...(scanThreads.envSecretsThreadId
+                                    ? { resumeThreadId: scanThreads.envSecretsThreadId }
+                                    : {}),
+                                retryFeedback: buildMissingPathsFeedback("env/secrets", envSecretsMissing),
+                                ...(initCodexProxyOptions
+                                    ? { proxyOptions: initCodexProxyOptions }
+                                    : {}),
+                                onProgress: (message) => status.stage(`Regenerating env/secrets scan — ${message}`),
+                            });
+                            await saveScanThreadId("envSecretsThreadId", threadId);
+                        },
+                        read: async () => await readSetupEnvSecretsPlan(setupEnvSecretsScanPath),
+                        outputPath: setupEnvSecretsScanPath,
+                        update: (message) => status.stage(`Regenerating env/secrets scan — ${message}`),
+                        shouldRetry: (scan) => shouldRetryCodexScan(scan.scanFullyCompleted, scan.envFiles, scan.secretFiles),
+                    });
+                    nextPlan = {
+                        ...nextPlan,
+                        envFiles: remapSelectedPathEntries({
+                            selected: nextPlan.envFiles,
+                            refreshed: envSecretsScan.envFiles,
+                        }),
+                        secretFiles: remapSelectedPathEntries({
+                            selected: nextPlan.secretFiles,
+                            refreshed: envSecretsScan.secretFiles,
+                        }),
+                    };
+                }
+                if (needsExternal) {
+                    const externalMissing = missingArtifacts.filter((entry) => entry.category === "externalConfigs");
+                    const externalSchemaPath = await writeSetupExternalSchema(setupTempDir);
+                    externalScan = await runCodexScanWithImmediateRetry({
+                        run: async () => {
+                            const threadId = await runLocalSetupExternalScan({
+                                cwd: repoRoot,
+                                logDir,
+                                schemaPath: externalSchemaPath,
+                                outputPath: setupExternalScanPath,
+                                homeDir: localHomeDir,
+                                ...(scanThreads.externalThreadId
+                                    ? { resumeThreadId: scanThreads.externalThreadId }
+                                    : {}),
+                                retryFeedback: buildMissingPathsFeedback("external", externalMissing),
+                                ...(initCodexProxyOptions
+                                    ? { proxyOptions: initCodexProxyOptions }
+                                    : {}),
+                                onProgress: (message) => status.stage(`Regenerating external scan — ${message}`),
+                            });
+                            await saveScanThreadId("externalThreadId", threadId);
+                        },
+                        read: async () => await readSetupExternalPlan(setupExternalScanPath),
+                        outputPath: setupExternalScanPath,
+                        update: (message) => status.stage(`Regenerating external scan — ${message}`),
+                        shouldRetry: (scan) => shouldRetryCodexScan(scan.scanFullyCompleted, scan.externalDependencies, scan.externalConfigs),
+                    });
+                    nextPlan = {
+                        ...nextPlan,
+                        externalConfigs: remapSelectedPathEntries({
+                            selected: nextPlan.externalConfigs,
+                            refreshed: externalScan.externalConfigs,
+                        }),
+                    };
+                }
+                if (needsExtraArtifacts) {
+                    const extraArtifactsMissing = missingArtifacts.filter((entry) => entry.category === "extraArtifacts");
+                    const extraArtifactsSchemaPath = await writeSetupExtraArtifactsSchema(setupTempDir);
+                    extraArtifactsScan = await runCodexScanWithImmediateRetry({
+                        run: async () => {
+                            const threadId = await runLocalSetupExtraArtifactsScan({
+                                cwd: repoRoot,
+                                logDir,
+                                schemaPath: extraArtifactsSchemaPath,
+                                outputPath: setupExtraArtifactsScanPath,
+                                ...(scanThreads.extraArtifactsThreadId
+                                    ? { resumeThreadId: scanThreads.extraArtifactsThreadId }
+                                    : {}),
+                                retryFeedback: buildMissingPathsFeedback("extra artifacts", extraArtifactsMissing),
+                                ...(initCodexProxyOptions
+                                    ? { proxyOptions: initCodexProxyOptions }
+                                    : {}),
+                                onProgress: (message) => status.stage(`Regenerating extra artifacts scan — ${message}`),
+                            });
+                            await saveScanThreadId("extraArtifactsThreadId", threadId);
+                        },
+                        read: async () => await readSetupExtraArtifactsPlan(setupExtraArtifactsScanPath),
+                        outputPath: setupExtraArtifactsScanPath,
+                        update: (message) => status.stage(`Regenerating extra artifacts scan — ${message}`),
+                        shouldRetry: (scan) => shouldRetryCodexScan(scan.scanFullyCompleted, scan.extraArtifacts),
+                    });
+                    nextPlan = {
+                        ...nextPlan,
+                        extraArtifacts: remapSelectedPathEntries({
+                            selected: nextPlan.extraArtifacts,
+                            refreshed: extraArtifactsScan.extraArtifacts,
+                        }),
+                    };
+                }
+                await flushScanThreads();
+                return nextPlan;
+            };
             if (nonInteractive) {
                 if (setupPlan)
                     approvedPlan = setupPlan;
@@ -1938,7 +2170,7 @@ export const runInit = async (args) => {
             if (!approvedPlan) {
                 throw new Error("Setup plan missing.");
             }
-            const ensuredPlan = approvedPlan;
+            let ensuredPlan = approvedPlan;
             if (!skipSetupPlan) {
                 await writeSetupPlan(setupPath, ensuredPlan);
                 await updateInitState({ steps: { setupPlanWritten: true } });
@@ -1947,13 +2179,54 @@ export const runInit = async (args) => {
                 setupArtifacts = await runInitStep({
                     enabled: progressEnabled,
                     title: "Packaging setup artifacts",
-                    fn: async () => await createSetupArtifacts({
-                        repoRoot,
-                        plan: ensuredPlan,
-                        outputDir: setupDir,
-                        tempDir: setupTempDir,
-                        homeDir: localHomeDir,
-                    }),
+                    fn: async ({ status }) => {
+                        let planForArtifacts = ensuredPlan;
+                        for (let attempt = 1; attempt <= SETUP_ARTIFACT_REGEN_MAX_ATTEMPTS + 1; attempt += 1) {
+                            const missingArtifacts = await collectMissingSetupArtifacts({
+                                repoRoot,
+                                homeDir: localHomeDir,
+                                plan: planForArtifacts,
+                            });
+                            if (missingArtifacts.length === 0) {
+                                ensuredPlan = planForArtifacts;
+                                approvedPlan = planForArtifacts;
+                                return await createSetupArtifacts({
+                                    repoRoot,
+                                    plan: planForArtifacts,
+                                    outputDir: setupDir,
+                                    tempDir: setupTempDir,
+                                    homeDir: localHomeDir,
+                                });
+                            }
+                            if (attempt > SETUP_ARTIFACT_REGEN_MAX_ATTEMPTS) {
+                                const lines = missingArtifacts
+                                    .map((entry) => `- ${formatMissingSetupArtifact(entry)}`)
+                                    .sort((a, b) => a.localeCompare(b));
+                                throw new Error([
+                                    "Setup artifact scan returned paths that do not exist locally.",
+                                    `Retried regeneration ${SETUP_ARTIFACT_REGEN_MAX_ATTEMPTS} time(s) and still found missing files:`,
+                                    ...lines,
+                                ].join("\n"));
+                            }
+                            const needsEnvSecrets = missingArtifacts.some((entry) => entry.category === "envFiles" ||
+                                entry.category === "secretFiles");
+                            const needsExternal = missingArtifacts.some((entry) => entry.category === "externalConfigs");
+                            const needsExtraArtifacts = missingArtifacts.some((entry) => entry.category === "extraArtifacts");
+                            const scanLabels = [
+                                ...(needsEnvSecrets ? ["env/secrets"] : []),
+                                ...(needsExternal ? ["external"] : []),
+                                ...(needsExtraArtifacts ? ["extra artifacts"] : []),
+                            ];
+                            status.stage(`Found ${missingArtifacts.length} missing setup artifact path(s); regenerating ${scanLabels.join(", ")} scan(s) (${attempt}/${SETUP_ARTIFACT_REGEN_MAX_ATTEMPTS})`);
+                            planForArtifacts = await regenerateSetupPlanForMissingArtifacts({
+                                plan: planForArtifacts,
+                                missingArtifacts,
+                                status,
+                            });
+                            await writeSetupPlan(setupPath, planForArtifacts);
+                        }
+                        throw new Error("Unreachable setup artifacts retry path.");
+                    },
                 });
             }
         }
@@ -1963,6 +2236,7 @@ export const runInit = async (args) => {
         if (!approvedPlan) {
             throw new Error("Setup plan missing.");
         }
+        const finalApprovedPlan = approvedPlan;
         const skipProvision = shouldResume && initState?.steps.workdirProvisioned;
         if (skipProvision && !skipSetupUpload) {
             await runInitStep({
@@ -1976,12 +2250,16 @@ export const runInit = async (args) => {
                         remoteSetupPath,
                         localArtifactsBundlePath: setupArtifacts?.bundlePath ?? null,
                         localArtifactsManifestPath: setupArtifacts?.manifestPath ?? null,
+                        localArtifactsPartsDescriptorPath: setupArtifacts?.partsDescriptorPath ?? null,
                         remoteArtifactsBundlePath: setupArtifacts
                             ? path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.tgz")
                             : null,
                         remoteArtifactsManifestPath: setupArtifacts
                             ? path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.json")
                             : null,
+                        remoteArtifactsPartsDescriptorPath: setupArtifacts
+                            ? remoteArtifactsPartsDescriptorPath
+                            : null,
                         status,
                     });
                 },
@@ -2244,12 +2522,16 @@ export const runInit = async (args) => {
                                 remoteSetupPath,
                                 localArtifactsBundlePath: setupArtifacts?.bundlePath ?? null,
                                 localArtifactsManifestPath: setupArtifacts?.manifestPath ?? null,
+                                localArtifactsPartsDescriptorPath: setupArtifacts?.partsDescriptorPath ?? null,
                                 remoteArtifactsBundlePath: setupArtifacts
                                     ? path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.tgz")
                                     : null,
                                 remoteArtifactsManifestPath: setupArtifacts
                                     ? path.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.json")
                                     : null,
+                                remoteArtifactsPartsDescriptorPath: setupArtifacts
+                                    ? remoteArtifactsPartsDescriptorPath
+                                    : null,
                                 status,
                             });
                         },
@@ -2566,7 +2848,7 @@ export const runInit = async (args) => {
                         client,
                         canonical,
                         workdir: expandedWorkdir,
-                        services: approvedPlan.services.backgroundServices,
+                        services: finalApprovedPlan.services.backgroundServices,
                     });
                     await updateInitState({ steps: { servicesConfigWritten: true } });
                 },
@@ -2703,7 +2985,7 @@ export const runInit = async (args) => {
                         await enableRemoteServices({
                             client,
                             canonical,
-                            services: approvedPlan.services.backgroundServices,
+                            services: finalApprovedPlan.services.backgroundServices,
                             status,
                         });
                         await updateInitState({ steps: { servicesEnabled: true } });
@@ -2724,7 +3006,7 @@ export const runInit = async (args) => {
                         socketInfo,
                         status,
                         pathSetup,
-                        entrypoints: approvedPlan.services.appEntrypoints,
+                        entrypoints: finalApprovedPlan.services.appEntrypoints,
                         emitCodexOutput: !parsed.json,
                         ...(initCodexProxyOptions
                             ? { proxyOptions: initCodexProxyOptions }