@boxes-dev/dvb 1.0.59 → 1.0.61

package/dist/bin/dvb.cjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 "use strict";
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2abd239d-3084-5a69-b772-ab46c3dbd477")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b4643c26-df5e-5ece-b58a-108a9965ffde")}catch(e){}}();
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -88683,8 +88683,8 @@ var init_otel = __esm({
       return trimmed && trimmed.length > 0 ? trimmed : void 0;
     };
     readBuildMetadata = () => {
-      const rawPackageVersion = "1.0.59";
-      const rawGitSha = "9310fc020995a5ac4c4f9ee04ca291a3799a24c1";
+      const rawPackageVersion = "1.0.61";
+      const rawGitSha = "ef3417e1e95b9ccc6114ef7c44fa645a1704b688";
       const packageVersion = typeof rawPackageVersion === "string" ? rawPackageVersion : void 0;
       const gitSha = typeof rawGitSha === "string" ? rawGitSha : void 0;
       return { packageVersion, gitSha };
@@ -120672,9 +120672,9 @@ var init_sentry = __esm({
     sentryEnabled = false;
     uncaughtExceptionMonitorInstalled = false;
     readBuildMetadata2 = () => {
-      const rawPackageVersion = "1.0.59";
-      const rawGitSha = "9310fc020995a5ac4c4f9ee04ca291a3799a24c1";
-      const rawSentryRelease = "boxes-dev-dvb@1.0.59+9310fc020995a5ac4c4f9ee04ca291a3799a24c1";
+      const rawPackageVersion = "1.0.61";
+      const rawGitSha = "ef3417e1e95b9ccc6114ef7c44fa645a1704b688";
+      const rawSentryRelease = "boxes-dev-dvb@1.0.61+ef3417e1e95b9ccc6114ef7c44fa645a1704b688";
       const packageVersion = typeof rawPackageVersion === "string" ? rawPackageVersion : void 0;
       const gitSha = typeof rawGitSha === "string" ? rawGitSha : void 0;
       const sentryRelease = typeof rawSentryRelease === "string" ? rawSentryRelease : void 0;
@@ -129291,8 +129291,148 @@ var init_parse = __esm({
 });
 
 // ../../node_modules/smol-toml/dist/stringify.js
+function extendedTypeOf(obj) {
+  let type = typeof obj;
+  if (type === "object") {
+    if (Array.isArray(obj))
+      return "array";
+    if (obj instanceof Date)
+      return "date";
+  }
+  return type;
+}
+function isArrayOfTables(obj) {
+  for (let i2 = 0; i2 < obj.length; i2++) {
+    if (extendedTypeOf(obj[i2]) !== "object")
+      return false;
+  }
+  return obj.length != 0;
+}
+function formatString(s2) {
+  return JSON.stringify(s2).replace(/\x7f/g, "\\u007f");
+}
+function stringifyValue2(val, type, depth, numberAsFloat) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  if (type === "number") {
+    if (isNaN(val))
+      return "nan";
+    if (val === Infinity)
+      return "inf";
+    if (val === -Infinity)
+      return "-inf";
+    if (numberAsFloat && Number.isInteger(val))
+      return val.toFixed(1);
+    return val.toString();
+  }
+  if (type === "bigint" || type === "boolean") {
+    return val.toString();
+  }
+  if (type === "string") {
+    return formatString(val);
+  }
+  if (type === "date") {
+    if (isNaN(val.getTime())) {
+      throw new TypeError("cannot serialize invalid date");
+    }
+    return val.toISOString();
+  }
+  if (type === "object") {
+    return stringifyInlineTable(val, depth, numberAsFloat);
+  }
+  if (type === "array") {
+    return stringifyArray(val, depth, numberAsFloat);
+  }
+}
+function stringifyInlineTable(obj, depth, numberAsFloat) {
+  let keys = Object.keys(obj);
+  if (keys.length === 0)
+    return "{}";
+  let res = "{ ";
+  for (let i2 = 0; i2 < keys.length; i2++) {
+    let k3 = keys[i2];
+    if (i2)
+      res += ", ";
+    res += BARE_KEY.test(k3) ? k3 : formatString(k3);
+    res += " = ";
+    res += stringifyValue2(obj[k3], extendedTypeOf(obj[k3]), depth - 1, numberAsFloat);
+  }
+  return res + " }";
+}
+function stringifyArray(array, depth, numberAsFloat) {
+  if (array.length === 0)
+    return "[]";
+  let res = "[ ";
+  for (let i2 = 0; i2 < array.length; i2++) {
+    if (i2)
+      res += ", ";
+    if (array[i2] === null || array[i2] === void 0) {
+      throw new TypeError("arrays cannot contain null or undefined values");
+    }
+    res += stringifyValue2(array[i2], extendedTypeOf(array[i2]), depth - 1, numberAsFloat);
+  }
+  return res + " ]";
+}
+function stringifyArrayTable(array, key, depth, numberAsFloat) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  let res = "";
+  for (let i2 = 0; i2 < array.length; i2++) {
+    res += `${res && "\n"}[[${key}]]
+`;
+    res += stringifyTable(0, array[i2], key, depth, numberAsFloat);
+  }
+  return res;
+}
+function stringifyTable(tableKey, obj, prefix, depth, numberAsFloat) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  let preamble = "";
+  let tables = "";
+  let keys = Object.keys(obj);
+  for (let i2 = 0; i2 < keys.length; i2++) {
+    let k3 = keys[i2];
+    if (obj[k3] !== null && obj[k3] !== void 0) {
+      let type = extendedTypeOf(obj[k3]);
+      if (type === "symbol" || type === "function") {
+        throw new TypeError(`cannot serialize values of type '${type}'`);
+      }
+      let key = BARE_KEY.test(k3) ? k3 : formatString(k3);
+      if (type === "array" && isArrayOfTables(obj[k3])) {
+        tables += (tables && "\n") + stringifyArrayTable(obj[k3], prefix ? `${prefix}.${key}` : key, depth - 1, numberAsFloat);
+      } else if (type === "object") {
+        let tblKey = prefix ? `${prefix}.${key}` : key;
+        tables += (tables && "\n") + stringifyTable(tblKey, obj[k3], tblKey, depth - 1, numberAsFloat);
+      } else {
+        preamble += key;
+        preamble += " = ";
+        preamble += stringifyValue2(obj[k3], type, depth, numberAsFloat);
+        preamble += "\n";
+      }
+    }
+  }
+  if (tableKey && (preamble || !tables))
+    preamble = preamble ? `[${tableKey}]
+${preamble}` : `[${tableKey}]`;
+  return preamble && tables ? `${preamble}
+${tables}` : preamble || tables;
+}
+function stringify(obj, { maxDepth = 1e3, numbersAsFloat = false } = {}) {
+  if (extendedTypeOf(obj) !== "object") {
+    throw new TypeError("stringify can only be called with an object");
+  }
+  let str = stringifyTable(0, obj, "", maxDepth, numbersAsFloat);
+  if (str[str.length - 1] !== "\n")
+    return str + "\n";
+  return str;
+}
+var BARE_KEY;
 var init_stringify2 = __esm({
   "../../node_modules/smol-toml/dist/stringify.js"() {
+    BARE_KEY = /^[a-z0-9-_]+$/i;
   }
 });
 
@@ -189911,21 +190051,8 @@ var init_logger3 = __esm({
   }
 });
 
-// src/devbox/ui/copyableUrl.ts
-var showCopyableUrl;
-var init_copyableUrl = __esm({
-  "src/devbox/ui/copyableUrl.ts"() {
-    "use strict";
-    init_dist5();
-    showCopyableUrl = (url, label) => {
-      R2.info(`${label}:`);
-      R2.message(url, { withGuide: false, spacing: 0 });
-    };
-  }
-});
-
 // src/devbox/controlPlane.ts
-var import_node_http2, import_node_crypto6, import_node_child_process2, resolveControlPlaneUrl2, resolveConvexUrl2, openBrowser, escapeHtml, CALLBACK_LOGO_MARK, CALLBACK_FULL_LOGO, renderCallbackPage, requestJson2, startCallbackServer, getControlPlaneUrl, getConvexUrl, signInWithBrowser, spriteTokenGet, spriteTokenSet, spriteTokenClear, modalTokenGet, modalTokenSet, modalTokenClear, modalTokenResolvedGet2, modalDevboxUpsert, modalDevboxRemove, modalDevboxEnsureActive2, modalDevboxShellConnectionOpened, modalDevboxShellConnectionClosed, modalDevboxProxyConnectionOpened2, modalDevboxProxyConnectionClosed2, modalDevboxStatusesList, spriteDaemonReleaseGet, spriteDaemonTokenIssue, spriteDaemonSessionSummariesList, spriteDaemonSessionsList, helloViewerGet, withConvexClient, fetchSpriteTokenStatus, fetchResolvedModalCredentials2, fetchViewerIdentity, storeSpriteToken, clearSpriteToken, storeModalCredentials, clearModalCredentials, upsertModalDevboxLifecycle, ensureModalDevboxActive2, fetchSpriteDaemonRelease, issueSpriteDaemonToken, listSpriteDaemonSessionSummaries, listSpriteDaemonSessions, signOutControlPlane, refreshControlPlaneSession;
+var import_node_http2, import_node_crypto6, import_node_child_process2, resolveControlPlaneUrl2, resolveConvexUrl2, openBrowser, waitForAnyKeypress, escapeHtml, CALLBACK_LOGO_MARK, CALLBACK_FULL_LOGO, renderCallbackPage, requestJson2, startCallbackServer, getControlPlaneUrl, getConvexUrl, signInWithBrowser, spriteTokenGet, spriteTokenSet, spriteTokenClear, modalTokenGet, modalTokenSet, modalTokenClear, modalTokenResolvedGet2, modalDevboxUpsert, modalDevboxRemove, modalDevboxEnsureActive2, modalDevboxShellConnectionOpened, modalDevboxShellConnectionClosed, modalDevboxProxyConnectionOpened2, modalDevboxProxyConnectionClosed2, modalDevboxStatusesList, spriteDaemonReleaseGet, spriteDaemonTokenIssue, spriteDaemonSessionSummariesList, spriteDaemonSessionsList, helloViewerGet, withConvexClient, fetchSpriteTokenStatus, fetchResolvedModalCredentials2, fetchViewerIdentity, storeSpriteToken, clearSpriteToken, storeModalCredentials, clearModalCredentials, upsertModalDevboxLifecycle, ensureModalDevboxActive2, fetchSpriteDaemonRelease, issueSpriteDaemonToken, listSpriteDaemonSessionSummaries, listSpriteDaemonSessions, signOutControlPlane, refreshControlPlaneSession;
 var init_controlPlane = __esm({
   "src/devbox/controlPlane.ts"() {
     "use strict";
@@ -189936,7 +190063,6 @@ var init_controlPlane = __esm({
     init_index_node();
     init_server();
     init_logger3();
-    init_copyableUrl();
     resolveControlPlaneUrl2 = () => {
       const envOverride = process.env.DEVBOX_CONTROL_PLANE_URL ?? process.env.CONVEX_SITE_URL;
       if (envOverride && envOverride.trim().length > 0) {
@@ -189980,6 +190106,70 @@ var init_controlPlane = __esm({
         return false;
       }
     };
+    waitForAnyKeypress = () => {
+      const stdin = process.stdin;
+      const wasPaused = stdin.isPaused();
+      let stopRawMode = null;
+      let stopped = false;
+      let resolvePromise = null;
+      let rejectPromise = null;
+      const stop = () => {
+        if (stopped) return;
+        stopped = true;
+        stdin.off("data", onData);
+        stdin.off("error", onError);
+        stopRawMode?.();
+        if (wasPaused) {
+          stdin.pause();
+        }
+      };
+      const settle = (value) => {
+        if (stopped) return;
+        const resolve2 = resolvePromise;
+        stop();
+        resolve2?.(value);
+      };
+      const reject = (error2) => {
+        if (stopped) return;
+        const rejectFn = rejectPromise;
+        stop();
+        rejectFn?.(error2);
+      };
+      const onData = (chunk) => {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        if (buffer.includes(3)) {
+          settle("cancel");
+          return;
+        }
+        settle("open_browser");
+      };
+      const onError = (error2) => {
+        reject(error2);
+      };
+      const promise = new Promise((resolve2, reject2) => {
+        resolvePromise = resolve2;
+        rejectPromise = reject2;
+      });
+      if (stdin.isTTY) {
+        const wasRaw = stdin.isRaw;
+        if (wasRaw !== true) {
+          try {
+            stdin.setRawMode(true);
+            stopRawMode = () => {
+              try {
+                stdin.setRawMode(false);
+              } catch {
+              }
+            };
+          } catch {
+          }
+        }
+      }
+      stdin.resume();
+      stdin.on("data", onData);
+      stdin.on("error", onError);
+      return { promise, stop };
+    };
     escapeHtml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
     CALLBACK_LOGO_MARK = `<svg viewBox="0 0 48 48" aria-hidden="true" focusable="false">
   <rect x="1.5" y="1.5" width="45" height="45" rx="8" fill="#111" />
@@ -190246,34 +190436,50 @@ var init_controlPlane = __esm({
         if (!start.redirect || !start.verifier) {
           throw new Error("Control plane sign-in failed to start.");
         }
-        showCopyableUrl(start.redirect, "Login URL");
-        const action = await qt({
-          message: "Open the login URL in your browser?",
-          options: [
-            { value: "open", label: "Open in browser" },
-            { value: "skip", label: "Skip" }
-          ],
-          initialValue: "open"
-        });
-        if (Ct(action)) {
-          Pt("Sign-in canceled.");
-          throw new Error("Control plane sign-in cancelled.");
-        }
-        if (action === "open") {
-          const opened = openBrowser(start.redirect);
-          if (!opened) {
-            R2.warn("Unable to open the browser automatically.");
-            R2.info("Open the URL above to continue login.");
-          }
-        } else {
-          R2.warn(
-            "Skipping browser open. Open the URL above to continue login."
+        R2.info("Sign in to boxes.dev to continue. Log in here:");
+        R2.message(start.redirect, { withGuide: false, spacing: 0 });
+        const codePromise = callback.waitForCode();
+        const keypress = waitForAnyKeypress();
+        const listeningSpinner = Ie();
+        let code2 = "";
+        try {
+          listeningSpinner.start(
+            "Listening for login. Press any key to open in your browser..."
           );
+          const firstResult = await Promise.race([
+            codePromise.then((value) => ({ type: "code", value })),
+            keypress.promise.then((value) => ({
+              type: "keypress",
+              value
+            }))
+          ]);
+          listeningSpinner.clear();
+          if (firstResult.type === "code") {
+            code2 = firstResult.value;
+          } else {
+            if (firstResult.value === "cancel") {
+              Pt("Sign-in canceled.");
+              throw new Error("Control plane sign-in cancelled.");
+            }
+            const opened = openBrowser(start.redirect);
+            if (!opened) {
+              R2.warn("Unable to open the browser automatically.");
+              R2.info("Open the URL above to continue login.");
+            }
+            const waitSpinner = Ie();
+            waitSpinner.start(
+              "Listening for login. Complete sign-in in your browser..."
+            );
+            try {
+              code2 = await codePromise;
+            } finally {
+              waitSpinner.clear();
+            }
+          }
+        } finally {
+          listeningSpinner.clear();
+          keypress.stop();
         }
-        R2.step(
-          "Waiting for browser login. Complete sign-in in your browser."
-        );
-        const code2 = await callback.waitForCode();
         const finish = await requestJson2(
           baseUrl,
           "POST",
@@ -190286,6 +190492,18 @@ var init_controlPlane = __esm({
         if (!finish.token) {
           throw new Error("Control plane sign-in failed to complete.");
         }
+        const viewer = await fetchViewerIdentity(finish.token).catch((error2) => {
+          logger7.warn("control_plane_viewer_identity_failed", {
+            error: error2 instanceof Error ? error2.message : String(error2)
+          });
+          return null;
+        });
+        const email = typeof viewer?.email === "string" ? viewer.email.trim() : "";
+        if (email.length > 0) {
+          R2.success(`Signed in as ${email}.`);
+        } else {
+          R2.success("Signed in.");
+        }
         return finish.refresh_token ? { token: finish.token, refreshToken: finish.refresh_token } : { token: finish.token };
       } finally {
         await callback.close();
@@ -190966,13 +191184,14 @@ var init_daemonClient = __esm({
 });
 
 // src/devbox/auth.ts
-var TOKEN_REFRESH_BUFFER_MS2, decodeJwtPayload4, parseTokenExpiresAt2, shouldRefreshToken2, isUnauthorizedError2, clearControlPlaneSession2, updateControlPlaneSession, refreshControlPlaneToken, ensureControlPlaneToken, ensureSpritesToken;
+var CONTROL_PLANE_INTERACTIVE_SIGNIN_STAGE, TOKEN_REFRESH_BUFFER_MS2, decodeJwtPayload4, parseTokenExpiresAt2, shouldRefreshToken2, isUnauthorizedError2, clearControlPlaneSession2, updateControlPlaneSession, refreshControlPlaneToken, ensureControlPlaneToken, ensureSpritesToken;
 var init_auth = __esm({
   "src/devbox/auth.ts"() {
     "use strict";
     init_src();
     init_logger3();
     init_controlPlane();
+    CONTROL_PLANE_INTERACTIVE_SIGNIN_STAGE = "Opening browser to sign in";
     TOKEN_REFRESH_BUFFER_MS2 = 5 * 60 * 1e3;
     decodeJwtPayload4 = (token) => {
       const parts = token.split(".");
@@ -191070,7 +191289,7 @@ var init_auth = __esm({
       if (!process.stdin.isTTY) {
         return null;
       }
-      stage?.("Opening browser to sign in");
+      stage?.(CONTROL_PLANE_INTERACTIVE_SIGNIN_STAGE);
       const tokens = await signInWithBrowser();
       await updateControlPlaneSession(store, tokens.token, tokens.refreshToken);
       logger7.info("control_plane_signed_in");
@@ -199212,7 +199431,7 @@ var init_sessionUtils = __esm({
 });
 
 // src/devbox/commands/connect.ts
-var import_node_child_process4, import_node_crypto9, import_node_os10, import_node_path17, import_node_readline3, import_promises13, resolveInitialSessionId, shouldAttachToExistingSession, resolveSessionSpecifierFromExplicitTarget, isAttachReplacedCloseCode, DEFAULT_TTY_COLS, DEFAULT_TTY_ROWS, DEFAULT_MODAL_APP_NAME, TERMINAL_INPUT_MODE_RESET, resetTerminalInputModes, openBrowser2, warnSetupStatus, resolveTtyEnv, formatEnvExports, parseEnvSize, readStreamSize, resolveTtySize, resolveSessionEnv, parseReachabilityState, runCommand, checkReachability, watchReachabilityWithScutil, watchReachabilityWithNotifyutil, waitForNetworkOnline, parseConnectArgs, parseConnectTarget, isSessionNotFoundError, SESSION_NAME_TOKEN_KEY, encodeSessionNameToken, decodeSessionNameToken, extractSessionNameFromCommand, SESSION_LOG_FLUSH_BYTES, SESSION_LOG_EOF_MARKER, createRemoteSessionLogSink, CONNECT_SHELL_CANDIDATES, resolveConnectShell, confirmNewSession, promptRenameSession, HEARTBEAT_INTERVAL_MS, HEARTBEAT_TIMEOUT_MS, INPUT_PROBE_TIMEOUT_MS, WS_OPEN_STATE, streamExecSession, runConnect;
+var import_node_child_process4, import_node_crypto9, import_node_os10, import_node_path17, import_node_readline3, import_promises13, resolveInitialSessionId, shouldAttachToExistingSession, resolveSessionSpecifierFromExplicitTarget, isAttachReplacedCloseCode, shouldCancelConnectOnSigint, DEFAULT_TTY_COLS, DEFAULT_TTY_ROWS, DEFAULT_MODAL_APP_NAME, TERMINAL_INPUT_MODE_RESET, resetTerminalInputModes, openBrowser2, warnSetupStatus, resolveTtyEnv, formatEnvExports, parseEnvSize, readStreamSize, resolveTtySize, resolveSessionEnv, parseReachabilityState, runCommand, checkReachability, watchReachabilityWithScutil, watchReachabilityWithNotifyutil, waitForNetworkOnline, parseConnectArgs, parseConnectTarget, isSessionNotFoundError, SESSION_NAME_TOKEN_KEY, encodeSessionNameToken, decodeSessionNameToken, extractSessionNameFromCommand, SESSION_LOG_FLUSH_BYTES, SESSION_LOG_EOF_MARKER, createRemoteSessionLogSink, CONNECT_SHELL_CANDIDATES, resolveConnectShell, confirmNewSession, promptRenameSession, HEARTBEAT_INTERVAL_MS, HEARTBEAT_TIMEOUT_MS, INPUT_PROBE_TIMEOUT_MS, CONNECT_OPEN_TIMEOUT_MS, WS_OPEN_STATE, streamExecSession, runConnect;
 var init_connect2 = __esm({
   "src/devbox/commands/connect.ts"() {
     "use strict";
@@ -199270,6 +199489,7 @@ var init_connect2 = __esm({
       return { sessionName: void 0, sessionIdOverride: match2.id };
     };
     isAttachReplacedCloseCode = (closeCode) => closeCode === 1012;
+    shouldCancelConnectOnSigint = (phase) => phase !== "attached";
     DEFAULT_TTY_COLS = 80;
     DEFAULT_TTY_ROWS = 24;
     DEFAULT_MODAL_APP_NAME = "sandbox-modal-smoke";
@@ -199755,6 +199975,7 @@ var init_connect2 = __esm({
     HEARTBEAT_INTERVAL_MS = 4e3;
     HEARTBEAT_TIMEOUT_MS = 8e3;
     INPUT_PROBE_TIMEOUT_MS = 1e3;
+    CONNECT_OPEN_TIMEOUT_MS = 2e4;
     WS_OPEN_STATE = 1;
     streamExecSession = async (ws, options) => new Promise((resolve2, reject) => {
       let exitCode = null;
@@ -199767,6 +199988,7 @@ var init_connect2 = __esm({
       let lastSeenAt = Date.now();
       let heartbeatTimer = null;
       let inputProbeTimer = null;
+      let openTimer = null;
       let inputProbeStamp = 0;
       let disconnectNoted = false;
       let errorMessage;
@@ -199994,6 +200216,12 @@ var init_connect2 = __esm({
           inputProbeTimer = null;
         }
       };
+      const stopOpenTimer = () => {
+        if (openTimer) {
+          clearTimeout(openTimer);
+          openTimer = null;
+        }
+      };
       const onPong = () => {
         markAlive();
         latency?.notePong();
@@ -200088,6 +200316,7 @@ var init_connect2 = __esm({
         ws.removeEventListener("error", onError);
         ws.removeEventListener("open", onOpen);
         stopInputProbe();
+        stopOpenTimer();
         stopHeartbeat();
         stopInput();
       };
@@ -200131,6 +200360,7 @@ var init_connect2 = __esm({
         resolve2(result);
       };
       const onOpen = () => {
+        stopOpenTimer();
         opened = true;
         markAlive();
         latency?.noteConnectOpen();
@@ -200145,6 +200375,20 @@ var init_connect2 = __esm({
       ws.addEventListener("error", onError);
       ws.addEventListener("open", onOpen);
       sendResize();
+      const openTimeoutMs = options.openTimeoutMs ?? CONNECT_OPEN_TIMEOUT_MS;
+      if (openTimeoutMs > 0) {
+        openTimer = setTimeout(() => {
+          if (resolved || opened) return;
+          noteDisconnect();
+          forceClose();
+          onError({
+            data: new Error(
+              `Timed out waiting for session connection after ${openTimeoutMs}ms.`
+            )
+          });
+        }, openTimeoutMs);
+        openTimer.unref();
+      }
     });
     runConnect = async (args, overrides) => {
       const parsed = parseConnectArgs(args);
@@ -200690,6 +200934,11 @@ var init_connect2 = __esm({
           let retryDelayMs = 250;
           let printedSessionInfo = false;
           let sawOutput = false;
+          let connectPhase = "connecting";
+          let activeSocket = null;
+          let localCancelRequested = false;
+          let attemptedAttach = false;
+          let sigintListenerInstalled = false;
           const printSessionInfo = (message) => {
             if (process.stderr.isTTY && process.stdout.isTTY) {
               process.stderr.write(`\x1B7\r
@@ -200717,208 +200966,262 @@ ${message}\r
               status.stop();
             }
           };
-          while (true) {
+          const onSigint = () => {
+            localCancelRequested = true;
+            if (!activeSocket) return;
             try {
-              await refreshSessionMapping();
-            } catch (error2) {
-              logger7.warn("session_refresh_failed", { error: String(error2) });
-            }
-            if (explicitName && sessionName && !sessionId && !confirmedCreateExplicit) {
-              pauseStatus();
-              const confirmed = await confirmNewSession(sessionName);
-              if (!confirmed) {
-                throw new Error(`Session "${sessionName}" not created.`);
-              }
-              confirmedCreateExplicit = true;
-            }
-            let createdNew = false;
-            let mappingWrite = null;
-            latency?.noteConnectStart();
-            const canAttach = shouldAttachToExistingSession({
-              supportsAttachExecSession,
-              sessionId,
-              requireFreshSessionOpen
-            });
-            stage(canAttach ? "Attaching to session" : "Opening session");
-            let ws;
-            if (canAttach) {
-              if (!sessionId) {
-                throw new Error("Missing session id for attach.");
-              }
-              ws = client2.attachExecSession(spriteAlias, sessionId);
-            } else {
-              createdNew = true;
-              ws = client2.openExecSession(spriteAlias, {
-                cmd: execCommand2,
-                tty: isTty,
-                stdin: openStdin,
-                ...ttySize ? { cols: ttySize.cols, rows: ttySize.rows } : {},
-                ...modalSessionLogPath ? { logPath: modalSessionLogPath } : {}
-              });
+              activeSocket.terminate?.();
+            } catch {
             }
-            const shouldSendInitialInput = createdNew && Boolean(pendingInitialInput);
-            const initialInputToSend = shouldSendInitialInput ? pendingInitialInput : void 0;
-            const result = await streamExecSession(ws, {
-              tty: isTty,
-              stdin: localStdin,
-              supportsResizeControlMessages,
-              ...latency ? { latency } : {},
-              onOutput: noteOutput,
-              onOutputChunk: (chunk) => {
-                sessionLogSink?.write(chunk);
-              },
-              onInputChunk: (chunk) => {
-                sessionLogSink?.write(chunk);
-              },
-              onOpen: () => {
-                if (shouldSendInitialInput) {
-                  pendingInitialInput = void 0;
-                }
-                if (sessionId) {
-                  reportSessionInfo(sessionId);
+            try {
+              activeSocket.close();
+            } catch {
+            }
+          };
+          const setConnectPhase = (phase) => {
+            connectPhase = phase;
+            const shouldInstallListener = shouldReconnect && shouldCancelConnectOnSigint(connectPhase);
+            if (shouldInstallListener && !sigintListenerInstalled) {
+              process.on("SIGINT", onSigint);
+              sigintListenerInstalled = true;
+              return;
+            }
+            if (!shouldInstallListener && sigintListenerInstalled) {
+              process.removeListener("SIGINT", onSigint);
+              sigintListenerInstalled = false;
+            }
+          };
+          setConnectPhase("connecting");
+          try {
+            while (true) {
+              if (localCancelRequested) {
+                process.exitCode = 130;
+                break;
+              }
+              setConnectPhase(attemptedAttach ? "reconnecting" : "connecting");
+              attemptedAttach = true;
+              try {
+                await refreshSessionMapping();
+              } catch (error2) {
+                logger7.warn("session_refresh_failed", { error: String(error2) });
+              }
+              if (explicitName && sessionName && !sessionId && !confirmedCreateExplicit) {
+                pauseStatus();
+                const confirmed = await confirmNewSession(sessionName);
+                if (!confirmed) {
+                  throw new Error(`Session "${sessionName}" not created.`);
                 }
-              },
-              ...initialInputToSend ? { initialInput: initialInputToSend } : {},
-              onSessionInfo: (id) => {
-                if (supportsAttachExecSession) {
-                  if (createdNew) {
-                    requireFreshSessionOpen = false;
-                  }
-                  sessionId = sessionId ?? id;
+                confirmedCreateExplicit = true;
+              }
+              let createdNew = false;
+              let mappingWrite = null;
+              latency?.noteConnectStart();
+              const canAttach = shouldAttachToExistingSession({
+                supportsAttachExecSession,
+                sessionId,
+                requireFreshSessionOpen
+              });
+              stage(canAttach ? "Attaching to session" : "Opening session");
+              let ws;
+              if (canAttach) {
+                if (!sessionId) {
+                  throw new Error("Missing session id for attach.");
                 }
-                if (sessionName && createdNew) {
-                  if (autoNamed) {
-                    mappingWrite = finalizeAutoSession(id);
-                    if (mappingWrite) {
-                      mappingWrite.then(() => {
-                        reportSessionInfo(id);
-                      }).catch((error2) => {
-                        logger7.warn("session_auto_rename_failed", {
-                          error: String(error2)
-                        });
+                ws = client2.attachExecSession(spriteAlias, sessionId);
+              } else {
+                createdNew = true;
+                ws = client2.openExecSession(spriteAlias, {
+                  cmd: execCommand2,
+                  tty: isTty,
+                  stdin: openStdin,
+                  ...ttySize ? { cols: ttySize.cols, rows: ttySize.rows } : {},
+                  ...modalSessionLogPath ? { logPath: modalSessionLogPath } : {}
+                });
+              }
+              activeSocket = ws;
+              const shouldSendInitialInput = createdNew && Boolean(pendingInitialInput);
+              const initialInputToSend = shouldSendInitialInput ? pendingInitialInput : void 0;
+              let result;
+              try {
+                result = await streamExecSession(ws, {
+                  tty: isTty,
+                  stdin: localStdin,
+                  supportsResizeControlMessages,
+                  ...latency ? { latency } : {},
+                  openTimeoutMs: CONNECT_OPEN_TIMEOUT_MS,
+                  onOutput: noteOutput,
+                  onOutputChunk: (chunk) => {
+                    sessionLogSink?.write(chunk);
+                  },
+                  onInputChunk: (chunk) => {
+                    sessionLogSink?.write(chunk);
+                  },
+                  onOpen: () => {
+                    setConnectPhase("attached");
+                    if (shouldSendInitialInput) {
+                      pendingInitialInput = void 0;
+                    }
+                    if (sessionId) {
+                      reportSessionInfo(sessionId);
+                    }
+                  },
+                  ...initialInputToSend ? { initialInput: initialInputToSend } : {},
+                  onSessionInfo: (id) => {
+                    if (supportsAttachExecSession) {
+                      if (createdNew) {
+                        requireFreshSessionOpen = false;
+                      }
+                      sessionId = sessionId ?? id;
+                    }
+                    if (sessionName && createdNew) {
+                      if (autoNamed) {
+                        mappingWrite = finalizeAutoSession(id);
+                        if (mappingWrite) {
+                          mappingWrite.then(() => {
+                            reportSessionInfo(id);
+                          }).catch((error2) => {
+                            logger7.warn("session_auto_rename_failed", {
+                              error: String(error2)
+                            });
+                            reportSessionInfo(id);
+                          });
+                        } else {
+                          reportSessionInfo(id);
+                        }
+                      } else {
+                        sessions[sessionName] = id;
+                        mappingWrite = writeSpriteSessions(
+                          client2,
+                          spriteAlias,
+                          sessions
+                        );
                         reportSessionInfo(id);
-                      });
+                      }
                     } else {
                       reportSessionInfo(id);
                     }
-                  } else {
-                    sessions[sessionName] = id;
-                    mappingWrite = writeSpriteSessions(
-                      client2,
-                      spriteAlias,
-                      sessions
-                    );
-                    reportSessionInfo(id);
-                  }
-                } else {
-                  reportSessionInfo(id);
-                }
-                if (isDetached) {
-                  ws.close();
+                    if (isDetached) {
+                      ws.close();
+                    }
+                  },
+                  onPortEvent: notifyPortEvent,
+                  ...shouldReconnect ? {
+                    onDisconnectNotice: () => {
+                      setConnectPhase("reconnecting");
+                      resetTerminalInputModes();
+                      if (!reconnectNoticeShown) {
+                        console.error(
+                          "Connection lost. Reconnecting... (Ctrl+C to cancel)"
+                        );
+                        reconnectNoticeShown = true;
+                      }
+                    }
+                  } : {}
+                });
+              } finally {
+                activeSocket = null;
+              }
+              if (mappingWrite) {
+                try {
+                  await mappingWrite;
+                } catch (error2) {
+                  logger7.warn("session_write_failed", { error: String(error2) });
                 }
-              },
-              onPortEvent: notifyPortEvent,
-              ...shouldReconnect ? {
-                onDisconnectNotice: () => {
-                  resetTerminalInputModes();
-                  if (!reconnectNoticeShown) {
-                    console.error(
-                      "Connection lost. Reconnecting... (Ctrl+C to cancel)"
-                    );
-                    reconnectNoticeShown = true;
+              }
+              if (localCancelRequested) {
+                process.exitCode = 130;
+                break;
+              }
+              if (result.kind === "exit") {
+                process.exitCode = result.code;
+                break;
+              }
+              if (result.kind === "detach") {
+                if (autoNamed && sessionName && sessionId) {
+                  const nextName = await promptRenameSession(sessionName);
+                  if (nextName && nextName !== sessionName) {
+                    try {
+                      await renameSessionMapping(sessionName, nextName, sessionId);
+                    } catch (error2) {
+                      console.error(
+                        `Failed to rename session: ${error2 instanceof Error ? error2.message : String(error2)}`
+                      );
+                    }
                   }
                 }
-              } : {}
-            });
-            if (mappingWrite) {
-              try {
-                await mappingWrite;
-              } catch (error2) {
-                logger7.warn("session_write_failed", { error: String(error2) });
+                process.exitCode = 0;
+                break;
               }
-            }
-            if (result.kind === "exit") {
-              process.exitCode = result.code;
-              break;
-            }
-            if (result.kind === "detach") {
-              if (autoNamed && sessionName && sessionId) {
-                const nextName = await promptRenameSession(sessionName);
-                if (nextName && nextName !== sessionName) {
-                  try {
-                    await renameSessionMapping(sessionName, nextName, sessionId);
-                  } catch (error2) {
-                    console.error(
-                      `Failed to rename session: ${error2 instanceof Error ? error2.message : String(error2)}`
-                    );
-                  }
+              if (isDetached) {
+                process.exitCode = 0;
+                break;
+              }
+              if (isAttachReplacedCloseCode(result.closeCode)) {
+                resetTerminalInputModes();
+                console.error(
+                  "Session attached from another client. Closing this window."
+                );
+                process.exitCode = 0;
+                break;
+              }
+              if (!shouldReconnect) {
+                if (result.errorMessage) {
+                  throw new Error(`Connection lost: ${result.errorMessage}`);
                 }
+                throw new Error("Connection lost.");
               }
-              process.exitCode = 0;
-              break;
-            }
-            if (isDetached) {
-              process.exitCode = 0;
-              break;
-            }
-            if (isAttachReplacedCloseCode(result.closeCode)) {
+              setConnectPhase("reconnecting");
               resetTerminalInputModes();
-              console.error(
-                "Session attached from another client. Closing this window."
-              );
-              process.exitCode = 0;
-              break;
-            }
-            if (!shouldReconnect) {
-              if (result.errorMessage) {
-                throw new Error(`Connection lost: ${result.errorMessage}`);
+              if (!reconnectNoticeShown) {
+                console.error(
+                  "Connection lost. Reconnecting... (Ctrl+C to cancel)"
+                );
+                reconnectNoticeShown = true;
               }
-              throw new Error("Connection lost.");
-            }
-            resetTerminalInputModes();
-            if (!reconnectNoticeShown) {
-              console.error("Connection lost. Reconnecting... (Ctrl+C to cancel)");
-              reconnectNoticeShown = true;
-            }
-            if (sessionId && supportsAttachExecSession) {
-              if (computeProvider === "modal" && isSessionNotFoundError(result.errorMessage)) {
-                if (sessionName) {
-                  delete sessions[sessionName];
-                  await writeSpriteSessions(client2, spriteAlias, sessions);
-                }
-                sessionId = void 0;
-              } else if (computeProvider !== "modal" && result.opened === false && supportsListExecSessions) {
-                try {
-                  const available = await client2.listExecSessions(spriteAlias);
-                  const match2 = available.find(
-                    (session) => session.id === sessionId
-                  );
-                  if (!match2 || match2.tty === false) {
-                    if (sessionName) {
-                      delete sessions[sessionName];
-                      await writeSpriteSessions(client2, spriteAlias, sessions);
+              if (sessionId && supportsAttachExecSession) {
+                if (computeProvider === "modal" && isSessionNotFoundError(result.errorMessage)) {
+                  if (sessionName) {
+                    delete sessions[sessionName];
+                    await writeSpriteSessions(client2, spriteAlias, sessions);
+                  }
+                  sessionId = void 0;
+                } else if (computeProvider !== "modal" && result.opened === false && supportsListExecSessions) {
+                  try {
+                    const available = await client2.listExecSessions(spriteAlias);
+                    const match2 = available.find(
+                      (session) => session.id === sessionId
+                    );
+                    if (!match2 || match2.tty === false) {
+                      if (sessionName) {
+                        delete sessions[sessionName];
+                        await writeSpriteSessions(client2, spriteAlias, sessions);
+                      }
+                      sessionId = void 0;
                     }
-                    sessionId = void 0;
+                  } catch (error2) {
+                    logger7.warn("session_lookup_failed", { error: String(error2) });
                   }
-                } catch (error2) {
-                  logger7.warn("session_lookup_failed", { error: String(error2) });
                 }
               }
+              const networkWait = await waitForNetworkOnline({
+                targetHost: networkTargetHost,
+                onStatus: stage,
+                onNotice: (message) => console.error(message)
+              });
+              if (networkWait === "aborted" || localCancelRequested) {
+                process.exitCode = 130;
+                break;
+              }
+              if (networkWait === "waited") {
+                retryDelayMs = 250;
+              }
+              await new Promise((resolve2) => setTimeout(resolve2, retryDelayMs));
+              retryDelayMs = Math.min(5e3, Math.round(retryDelayMs * 1.6));
             }
-            const networkWait = await waitForNetworkOnline({
-              targetHost: networkTargetHost,
-              onStatus: stage,
-              onNotice: (message) => console.error(message)
-            });
-            if (networkWait === "aborted") {
-              process.exitCode = 130;
-              break;
-            }
-            if (networkWait === "waited") {
-              retryDelayMs = 250;
+          } finally {
+            if (sigintListenerInstalled) {
+              process.removeListener("SIGINT", onSigint);
             }
-            await new Promise((resolve2) => setTimeout(resolve2, retryDelayMs));
-            retryDelayMs = Math.min(5e3, Math.round(retryDelayMs * 1.6));
           }
         } finally {
           const exitCode = typeof process.exitCode === "number" ? process.exitCode : void 0;
@@ -201797,6 +202100,7 @@ var init_state = __esm({
       "workdirProvisioned",
       "gitSafeDirectoryConfigured",
       "setupUploaded",
+      "codexConfigUpdated",
       "setupArtifactsStaged",
       "servicesEnabled",
       "codexCliEnsured",
@@ -202459,14 +202763,64 @@ var init_weztermMux = __esm({
   }
 });
 
+// src/devbox/commands/init/codex/config.ts
+var isRecord, parseExistingConfig, normalizeTrustedPaths, ensureNoticeConfig, ensureTrustedProjects, mergeCodexInitConfig;
+var init_config2 = __esm({
+  "src/devbox/commands/init/codex/config.ts"() {
+    "use strict";
+    init_dist2();
+    isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+    parseExistingConfig = (content) => {
+      if (!content) return {};
+      try {
+        const parsed = parse(content);
+        return isRecord(parsed) ? { ...parsed } : {};
+      } catch {
+        return {};
+      }
+    };
+    normalizeTrustedPaths = (trustedPaths) => [
+      ...new Set(trustedPaths.map((path38) => path38.trim()).filter(Boolean))
+    ];
+    ensureNoticeConfig = (config4) => {
+      const notice = isRecord(config4.notice) ? { ...config4.notice } : {};
+      notice.hide_full_access_warning = true;
+      config4.notice = notice;
+    };
+    ensureTrustedProjects = (config4, trustedPaths) => {
+      const projects = isRecord(config4.projects) ? { ...config4.projects } : {};
+      for (const trustedPath of normalizeTrustedPaths(trustedPaths)) {
+        const existingProject = isRecord(projects[trustedPath]) ? { ...projects[trustedPath] } : {};
+        existingProject.trust_level = "trusted";
+        projects[trustedPath] = existingProject;
+      }
+      config4.projects = projects;
+    };
+    mergeCodexInitConfig = ({
+      existingContent,
+      trustedPaths
+    }) => {
+      const config4 = parseExistingConfig(existingContent);
+      config4.approval_policy = "never";
+      config4.sandbox_mode = "danger-full-access";
+      ensureNoticeConfig(config4);
+      ensureTrustedProjects(config4, trustedPaths);
+      const rendered = stringify(config4);
+      return rendered.endsWith("\n") ? rendered : `${rendered}
+`;
+    };
+  }
+});
+
 // src/devbox/commands/init/remote.ts
-var import_node_crypto11, DAEMON_DIR, DAEMON_TARBALL, DAEMON_BUNDLE_DIR, DAEMON_ENTRY, DAEMON_WRAPPER, DAEMON_SERVICE_NAME, DAEMON_CONFIG_FILE, MODAL_DAEMON_HEALTH_PORT, DEFAULT_DAEMON_BASE_URL, DEFAULT_HEARTBEAT_MS, BOOTSTRAP_EXEC_TIMEOUT_MS, BOOTSTRAP_EXEC_HANDSHAKE_TIMEOUT_MS, BASHRC_PATH, ZSHRC_PATH, BASIC_ALIASES_MARKER, LEGACY_BASH_TRAP, SAFE_BASH_TRAP, BASH_HISTORY_BLOCK, ZSH_HISTORY_BLOCK, HISTORY_BLOCK_PATTERN, BASH_HISTORY_LINE_PATTERN, ZSH_HISTORY_LINE_PATTERN, logger8, truncateTail, shellQuote4, expandHome2, execWithLog, writeRemoteFile, readRemoteFile, ensureTrailingNewline, upsertHistoryBlock, patchBashrcContent, patchZshrcContent, bootstrapDevbox, buildWeztermMuxConfig, buildWeztermMuxRunner, patchRemoteRcFile, patchBashrc, patchZshrc, stageRemoteSetupArtifacts, resolveDaemonUrl, fetchDaemonBinary, buildDaemonConfig, buildDaemonWrapperScript, isSameArgs, ensureSpriteDaemonService, installWeztermMux, ensureWeztermMuxService, hasWeztermMuxBinary, isWeztermMuxHealthy, installSpriteDaemon;
+var import_node_crypto11, DAEMON_DIR, DAEMON_TARBALL, DAEMON_BUNDLE_DIR, DAEMON_ENTRY, DAEMON_WRAPPER, DAEMON_SERVICE_NAME, DAEMON_CONFIG_FILE, MODAL_DAEMON_HEALTH_PORT, DEFAULT_DAEMON_BASE_URL, DEFAULT_HEARTBEAT_MS, BOOTSTRAP_EXEC_TIMEOUT_MS, BOOTSTRAP_EXEC_HANDSHAKE_TIMEOUT_MS, BASHRC_PATH, ZSHRC_PATH, CODEX_CONFIG_DIR, CODEX_CONFIG_PATH, BASIC_ALIASES_MARKER, LEGACY_BASH_TRAP, SAFE_BASH_TRAP, BASH_HISTORY_BLOCK, ZSH_HISTORY_BLOCK, HISTORY_BLOCK_PATTERN, BASH_HISTORY_LINE_PATTERN, ZSH_HISTORY_LINE_PATTERN, logger8, truncateTail, shellQuote4, expandHome2, execWithLog, writeRemoteFile, readRemoteFile, ensureTrailingNewline, upsertHistoryBlock, patchBashrcContent, patchZshrcContent, bootstrapDevbox, buildWeztermMuxConfig, buildWeztermMuxRunner, patchRemoteRcFile, patchBashrc, patchZshrc, ensureRemoteCodexConfig, stageRemoteSetupArtifacts, resolveDaemonUrl, fetchDaemonBinary, buildDaemonConfig, buildDaemonWrapperScript, isSameArgs, ensureSpriteDaemonService, installWeztermMux, ensureWeztermMuxService, hasWeztermMuxBinary, isWeztermMuxHealthy, installSpriteDaemon;
 var init_remote = __esm({
   "src/devbox/commands/init/remote.ts"() {
     "use strict";
     import_node_crypto11 = require("node:crypto");
     init_src();
     init_weztermMux();
+    init_config2();
     DAEMON_DIR = "/home/sprite/.devbox/daemon";
     DAEMON_TARBALL = `${DAEMON_DIR}/sprite-daemon.tar.gz`;
     DAEMON_BUNDLE_DIR = `${DAEMON_DIR}/bundle`;
@@ -202481,6 +202835,8 @@ var init_remote = __esm({
     BOOTSTRAP_EXEC_HANDSHAKE_TIMEOUT_MS = 2e4;
     BASHRC_PATH = "/home/sprite/.bashrc";
     ZSHRC_PATH = "/home/sprite/.zshrc";
+    CODEX_CONFIG_DIR = "/home/sprite/.codex";
+    CODEX_CONFIG_PATH = `${CODEX_CONFIG_DIR}/config.toml`;
     BASIC_ALIASES_MARKER = "\n# Basic aliases";
     LEGACY_BASH_TRAP = `trap 'echo -ne "\\033]0;\${BASH_COMMAND}\\007"' DEBUG`;
     SAFE_BASH_TRAP = `trap 'printf "\\033]0;%s\\007" "\${BASH_COMMAND//[^[:print:]]/}"' DEBUG`;
@@ -202896,6 +203252,59 @@ ${canonicalBlock}
       errorLabel: "zshrc",
       transform: patchZshrcContent
     });
+    ensureRemoteCodexConfig = async ({
+      client: client2,
+      spriteAlias,
+      trustedPaths
+    }) => {
+      const mkdirResult = await execWithLog(
+        client2,
+        spriteAlias,
+        [
+          "set -euo pipefail",
+          `mkdir -p ${shellQuote4(CODEX_CONFIG_DIR)}`,
+          `chmod 700 ${shellQuote4(CODEX_CONFIG_DIR)}`
+        ].join("\n"),
+        "codex-config-mkdir"
+      );
+      if (mkdirResult.exitCode !== 0) {
+        const details = mkdirResult.stderr || mkdirResult.stdout || "";
+        throw new Error(
+          details ? `codex config mkdir failed: ${details}` : `codex config mkdir failed (exit ${mkdirResult.exitCode})`
+        );
+      }
+      const existing = await readRemoteFile(
+        client2,
+        spriteAlias,
+        CODEX_CONFIG_PATH,
+        "codex-config-read"
+      );
+      const next = mergeCodexInitConfig({
+        existingContent: existing,
+        trustedPaths
+      });
+      await writeRemoteFile(
+        client2,
+        spriteAlias,
+        CODEX_CONFIG_PATH,
+        next,
+        "codex-config-write"
+      );
+      const chmodResult = await execWithLog(
+        client2,
+        spriteAlias,
+        ["set -euo pipefail", `chmod 600 ${shellQuote4(CODEX_CONFIG_PATH)}`].join(
+          "\n"
+        ),
+        "codex-config-chmod"
+      );
+      if (chmodResult.exitCode !== 0) {
+        const details = chmodResult.stderr || chmodResult.stdout || "";
+        throw new Error(
+          details ? `codex config chmod failed: ${details}` : `codex config chmod failed (exit ${chmodResult.exitCode})`
+        );
+      }
+    };
     stageRemoteSetupArtifacts = async ({
       client: client2,
       spriteAlias,
@@ -204003,6 +204412,19 @@ ${combined}` : "";
   }
 });
 
+// src/devbox/ui/copyableUrl.ts
+var showCopyableUrl;
+var init_copyableUrl = __esm({
+  "src/devbox/ui/copyableUrl.ts"() {
+    "use strict";
+    init_dist5();
+    showCopyableUrl = (url, label) => {
+      R2.info(`${label}:`);
+      R2.message(url, { withGuide: false, spacing: 0 });
+    };
+  }
+});
+
 // src/devbox/commands/init/codex/template.ts
 var renderTemplate;
 var init_template = __esm({
@@ -208618,7 +209040,7 @@ ${sshResult.stderr}`.trim();
 });
 
 // src/devbox/commands/servicesToml.ts
-var splitShellCommand, normalizeSectionName, isRecord, asString2, asStringArray, asNumber, parseServicesToml, formatSectionName, renderServiceBlock, mergeServicesToml;
+var splitShellCommand, normalizeSectionName, isRecord2, asString2, asStringArray, asNumber, parseServicesToml, formatSectionName, renderServiceBlock, mergeServicesToml;
 var init_servicesToml = __esm({
   "src/devbox/commands/servicesToml.ts"() {
     "use strict";
@@ -208674,7 +209096,7 @@ var init_servicesToml = __esm({
       }
       return trimmed;
     };
-    isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+    isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
     asString2 = (value) => typeof value === "string" ? value : null;
     asStringArray = (value) => {
       if (!Array.isArray(value)) return null;
@@ -208698,14 +209120,14 @@ var init_servicesToml = __esm({
     };
     parseServicesToml = (content) => {
       const parsed = parse(content);
-      if (!isRecord(parsed)) return {};
+      if (!isRecord2(parsed)) return {};
       const servicesRoot = parsed.services;
-      if (!isRecord(servicesRoot)) return {};
+      if (!isRecord2(servicesRoot)) return {};
       const services = {};
       for (const [rawName, value] of Object.entries(servicesRoot)) {
         const name = String(rawName);
         if (!name) continue;
-        if (!isRecord(value)) continue;
+        if (!isRecord2(value)) continue;
         const entry = { name };
         const cmd = asString2(value.cmd);
         if (cmd) entry.cmd = cmd;
@@ -209383,6 +209805,27 @@ var init_finalizeFlow = __esm({
           });
         }
       });
+      const skipCodexConfigUpdate = Boolean(
+        shouldResume && getInitState()?.steps.codexConfigUpdated
+      );
+      if (!skipCodexConfigUpdate) {
+        await runInitStep({
+          enabled: progressEnabled,
+          title: "Updating Codex config",
+          fn: async ({ status }) => {
+            await retryInitStep2({
+              status,
+              title: "Updating Codex config",
+              fn: async () => await ensureRemoteCodexConfig({
+                client: client2,
+                spriteAlias,
+                trustedPaths: ["/home/sprite", expandedWorkdir]
+              })
+            });
+          }
+        });
+        await updateInitState({ steps: { codexConfigUpdated: true } });
+      }
       const skipSetupArtifactsStage = Boolean(
         skipCodexApply || shouldResume && getInitState()?.steps.setupArtifactsStaged
       );
@@ -211246,7 +211689,7 @@ Tip: re-run with DEVBOX_LOG_LEVEL=info to see Sprite exec logs on stderr.`
 });
 
 // src/devbox/commands/list.ts
-var buildListColumns, parseListArgs, resolveBoxStateStyle, resolveBoxStatus, resolveSetupCell, fetchSpritesRemoteStates, resolveRemoteStates, runList;
+var buildListColumns, parseListArgs, resolveBoxStateStyle, resolveBoxStatus, resolveSetupCell, resolveSpritesLookupAlias, fetchSpritesRemoteStates, resolveRemoteStates, runList;
 var init_list = __esm({
   "src/devbox/commands/list.ts"() {
     "use strict";
@@ -211323,17 +211766,32 @@ var init_list = __esm({
       }
       return makeCell("-", colors.dim);
     };
+    resolveSpritesLookupAlias = (box) => {
+      const alias = box.alias?.trim();
+      return alias ? alias : null;
+    };
     fetchSpritesRemoteStates = async (client2, boxes) => {
       const states = /* @__PURE__ */ new Map();
-      const canonicals = Array.from(
-        new Set(
-          boxes.filter((box) => box.computeProvider !== "modal").map((box) => box.canonical).filter((canonical) => canonical.trim().length > 0)
-        )
-      );
+      const canonicalLookups = /* @__PURE__ */ new Map();
+      for (const box of boxes) {
+        if (box.computeProvider === "modal") continue;
+        const canonical = box.canonical.trim();
+        if (!canonical || canonicalLookups.has(canonical)) continue;
+        const lookupAlias = resolveSpritesLookupAlias(box);
+        if (!lookupAlias) {
+          logger7.warn("sprites_status_lookup_missing_alias", { canonical });
+          states.set(canonical, {
+            remote: "error",
+            note: "alias metadata missing"
+          });
+          continue;
+        }
+        canonicalLookups.set(canonical, lookupAlias);
+      }
       await Promise.all(
-        canonicals.map(async (canonical) => {
+        [...canonicalLookups.entries()].map(async ([canonical, lookupName]) => {
           try {
-            const sprite = await client2.getSprite(canonical);
+            const sprite = await client2.getSprite(lookupName);
             if (!sprite) {
               states.set(canonical, { remote: "missing" });
               return;
@@ -211345,6 +211803,7 @@ var init_list = __esm({
           } catch (error2) {
             logger7.warn("sprites_status_lookup_failed", {
               canonical,
+              lookupName,
               error: String(error2)
             });
             states.set(canonical, { remote: "error" });
@@ -215124,9 +215583,16 @@ var init_setup = __esm({
         const store = await createSecretStore(void 0, storeOptions);
         const apiBaseUrl = resolveSpritesApiUrl(existingConfig);
         const requireControlPlaneToken2 = parsed.spriteAuthMode ? true : parsed.verify;
+        const authStage = (message) => {
+          if (message === CONTROL_PLANE_INTERACTIVE_SIGNIN_STAGE) {
+            status.stop();
+            return;
+          }
+          status.stage(message);
+        };
         const tokenResult = await ensureSpritesToken(
           store,
-          (message) => status.stage(message),
+          authStage,
           parsed.token ? {
             tokenOverride: parsed.token,
             requireControlPlaneToken: requireControlPlaneToken2,
@@ -216968,4 +217434,4 @@ smol-toml/dist/index.js:
 */
 //# sourceMappingURL=dvb.cjs.map
 
-//# debugId=2abd239d-3084-5a69-b772-ab46c3dbd477
+//# debugId=b4643c26-df5e-5ece-b58a-108a9965ffde