@boxes-dev/dvb 1.0.60 → 1.0.61

package/dist/bin/dvb.cjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 "use strict";
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="785204a7-1bc2-5318-801f-4ad682a364a7")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b4643c26-df5e-5ece-b58a-108a9965ffde")}catch(e){}}();
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -88683,8 +88683,8 @@ var init_otel = __esm({
       return trimmed && trimmed.length > 0 ? trimmed : void 0;
     };
     readBuildMetadata = () => {
-      const rawPackageVersion = "1.0.60";
-      const rawGitSha = "5d6099c6753665655e7ad622e1aa388d91ea0bf7";
+      const rawPackageVersion = "1.0.61";
+      const rawGitSha = "ef3417e1e95b9ccc6114ef7c44fa645a1704b688";
       const packageVersion = typeof rawPackageVersion === "string" ? rawPackageVersion : void 0;
       const gitSha = typeof rawGitSha === "string" ? rawGitSha : void 0;
       return { packageVersion, gitSha };
@@ -120672,9 +120672,9 @@ var init_sentry = __esm({
     sentryEnabled = false;
     uncaughtExceptionMonitorInstalled = false;
     readBuildMetadata2 = () => {
-      const rawPackageVersion = "1.0.60";
-      const rawGitSha = "5d6099c6753665655e7ad622e1aa388d91ea0bf7";
-      const rawSentryRelease = "boxes-dev-dvb@1.0.60+5d6099c6753665655e7ad622e1aa388d91ea0bf7";
+      const rawPackageVersion = "1.0.61";
+      const rawGitSha = "ef3417e1e95b9ccc6114ef7c44fa645a1704b688";
+      const rawSentryRelease = "boxes-dev-dvb@1.0.61+ef3417e1e95b9ccc6114ef7c44fa645a1704b688";
       const packageVersion = typeof rawPackageVersion === "string" ? rawPackageVersion : void 0;
       const gitSha = typeof rawGitSha === "string" ? rawGitSha : void 0;
       const sentryRelease = typeof rawSentryRelease === "string" ? rawSentryRelease : void 0;
@@ -129291,8 +129291,148 @@ var init_parse = __esm({
 });
 
 // ../../node_modules/smol-toml/dist/stringify.js
+function extendedTypeOf(obj) {
+  let type = typeof obj;
+  if (type === "object") {
+    if (Array.isArray(obj))
+      return "array";
+    if (obj instanceof Date)
+      return "date";
+  }
+  return type;
+}
+function isArrayOfTables(obj) {
+  for (let i2 = 0; i2 < obj.length; i2++) {
+    if (extendedTypeOf(obj[i2]) !== "object")
+      return false;
+  }
+  return obj.length != 0;
+}
+function formatString(s2) {
+  return JSON.stringify(s2).replace(/\x7f/g, "\\u007f");
+}
+function stringifyValue2(val, type, depth, numberAsFloat) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  if (type === "number") {
+    if (isNaN(val))
+      return "nan";
+    if (val === Infinity)
+      return "inf";
+    if (val === -Infinity)
+      return "-inf";
+    if (numberAsFloat && Number.isInteger(val))
+      return val.toFixed(1);
+    return val.toString();
+  }
+  if (type === "bigint" || type === "boolean") {
+    return val.toString();
+  }
+  if (type === "string") {
+    return formatString(val);
+  }
+  if (type === "date") {
+    if (isNaN(val.getTime())) {
+      throw new TypeError("cannot serialize invalid date");
+    }
+    return val.toISOString();
+  }
+  if (type === "object") {
+    return stringifyInlineTable(val, depth, numberAsFloat);
+  }
+  if (type === "array") {
+    return stringifyArray(val, depth, numberAsFloat);
+  }
+}
+function stringifyInlineTable(obj, depth, numberAsFloat) {
+  let keys = Object.keys(obj);
+  if (keys.length === 0)
+    return "{}";
+  let res = "{ ";
+  for (let i2 = 0; i2 < keys.length; i2++) {
+    let k3 = keys[i2];
+    if (i2)
+      res += ", ";
+    res += BARE_KEY.test(k3) ? k3 : formatString(k3);
+    res += " = ";
+    res += stringifyValue2(obj[k3], extendedTypeOf(obj[k3]), depth - 1, numberAsFloat);
+  }
+  return res + " }";
+}
+function stringifyArray(array, depth, numberAsFloat) {
+  if (array.length === 0)
+    return "[]";
+  let res = "[ ";
+  for (let i2 = 0; i2 < array.length; i2++) {
+    if (i2)
+      res += ", ";
+    if (array[i2] === null || array[i2] === void 0) {
+      throw new TypeError("arrays cannot contain null or undefined values");
+    }
+    res += stringifyValue2(array[i2], extendedTypeOf(array[i2]), depth - 1, numberAsFloat);
+  }
+  return res + " ]";
+}
+function stringifyArrayTable(array, key, depth, numberAsFloat) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  let res = "";
+  for (let i2 = 0; i2 < array.length; i2++) {
+    res += `${res && "\n"}[[${key}]]
+`;
+    res += stringifyTable(0, array[i2], key, depth, numberAsFloat);
+  }
+  return res;
+}
+function stringifyTable(tableKey, obj, prefix, depth, numberAsFloat) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  let preamble = "";
+  let tables = "";
+  let keys = Object.keys(obj);
+  for (let i2 = 0; i2 < keys.length; i2++) {
+    let k3 = keys[i2];
+    if (obj[k3] !== null && obj[k3] !== void 0) {
+      let type = extendedTypeOf(obj[k3]);
+      if (type === "symbol" || type === "function") {
+        throw new TypeError(`cannot serialize values of type '${type}'`);
+      }
+      let key = BARE_KEY.test(k3) ? k3 : formatString(k3);
+      if (type === "array" && isArrayOfTables(obj[k3])) {
+        tables += (tables && "\n") + stringifyArrayTable(obj[k3], prefix ? `${prefix}.${key}` : key, depth - 1, numberAsFloat);
+      } else if (type === "object") {
+        let tblKey = prefix ? `${prefix}.${key}` : key;
+        tables += (tables && "\n") + stringifyTable(tblKey, obj[k3], tblKey, depth - 1, numberAsFloat);
+      } else {
+        preamble += key;
+        preamble += " = ";
+        preamble += stringifyValue2(obj[k3], type, depth, numberAsFloat);
+        preamble += "\n";
+      }
+    }
+  }
+  if (tableKey && (preamble || !tables))
+    preamble = preamble ? `[${tableKey}]
+${preamble}` : `[${tableKey}]`;
+  return preamble && tables ? `${preamble}
+${tables}` : preamble || tables;
+}
+function stringify(obj, { maxDepth = 1e3, numbersAsFloat = false } = {}) {
+  if (extendedTypeOf(obj) !== "object") {
+    throw new TypeError("stringify can only be called with an object");
+  }
+  let str = stringifyTable(0, obj, "", maxDepth, numbersAsFloat);
+  if (str[str.length - 1] !== "\n")
+    return str + "\n";
+  return str;
+}
+var BARE_KEY;
 var init_stringify2 = __esm({
   "../../node_modules/smol-toml/dist/stringify.js"() {
+    BARE_KEY = /^[a-z0-9-_]+$/i;
   }
 });
 
@@ -199291,7 +199431,7 @@ var init_sessionUtils = __esm({
 });
 
 // src/devbox/commands/connect.ts
-var import_node_child_process4, import_node_crypto9, import_node_os10, import_node_path17, import_node_readline3, import_promises13, resolveInitialSessionId, shouldAttachToExistingSession, resolveSessionSpecifierFromExplicitTarget, isAttachReplacedCloseCode, DEFAULT_TTY_COLS, DEFAULT_TTY_ROWS, DEFAULT_MODAL_APP_NAME, TERMINAL_INPUT_MODE_RESET, resetTerminalInputModes, openBrowser2, warnSetupStatus, resolveTtyEnv, formatEnvExports, parseEnvSize, readStreamSize, resolveTtySize, resolveSessionEnv, parseReachabilityState, runCommand, checkReachability, watchReachabilityWithScutil, watchReachabilityWithNotifyutil, waitForNetworkOnline, parseConnectArgs, parseConnectTarget, isSessionNotFoundError, SESSION_NAME_TOKEN_KEY, encodeSessionNameToken, decodeSessionNameToken, extractSessionNameFromCommand, SESSION_LOG_FLUSH_BYTES, SESSION_LOG_EOF_MARKER, createRemoteSessionLogSink, CONNECT_SHELL_CANDIDATES, resolveConnectShell, confirmNewSession, promptRenameSession, HEARTBEAT_INTERVAL_MS, HEARTBEAT_TIMEOUT_MS, INPUT_PROBE_TIMEOUT_MS, WS_OPEN_STATE, streamExecSession, runConnect;
+var import_node_child_process4, import_node_crypto9, import_node_os10, import_node_path17, import_node_readline3, import_promises13, resolveInitialSessionId, shouldAttachToExistingSession, resolveSessionSpecifierFromExplicitTarget, isAttachReplacedCloseCode, shouldCancelConnectOnSigint, DEFAULT_TTY_COLS, DEFAULT_TTY_ROWS, DEFAULT_MODAL_APP_NAME, TERMINAL_INPUT_MODE_RESET, resetTerminalInputModes, openBrowser2, warnSetupStatus, resolveTtyEnv, formatEnvExports, parseEnvSize, readStreamSize, resolveTtySize, resolveSessionEnv, parseReachabilityState, runCommand, checkReachability, watchReachabilityWithScutil, watchReachabilityWithNotifyutil, waitForNetworkOnline, parseConnectArgs, parseConnectTarget, isSessionNotFoundError, SESSION_NAME_TOKEN_KEY, encodeSessionNameToken, decodeSessionNameToken, extractSessionNameFromCommand, SESSION_LOG_FLUSH_BYTES, SESSION_LOG_EOF_MARKER, createRemoteSessionLogSink, CONNECT_SHELL_CANDIDATES, resolveConnectShell, confirmNewSession, promptRenameSession, HEARTBEAT_INTERVAL_MS, HEARTBEAT_TIMEOUT_MS, INPUT_PROBE_TIMEOUT_MS, CONNECT_OPEN_TIMEOUT_MS, WS_OPEN_STATE, streamExecSession, runConnect;
 var init_connect2 = __esm({
   "src/devbox/commands/connect.ts"() {
     "use strict";
@@ -199349,6 +199489,7 @@ var init_connect2 = __esm({
       return { sessionName: void 0, sessionIdOverride: match2.id };
     };
     isAttachReplacedCloseCode = (closeCode) => closeCode === 1012;
+    shouldCancelConnectOnSigint = (phase) => phase !== "attached";
     DEFAULT_TTY_COLS = 80;
     DEFAULT_TTY_ROWS = 24;
     DEFAULT_MODAL_APP_NAME = "sandbox-modal-smoke";
@@ -199834,6 +199975,7 @@ var init_connect2 = __esm({
     HEARTBEAT_INTERVAL_MS = 4e3;
     HEARTBEAT_TIMEOUT_MS = 8e3;
     INPUT_PROBE_TIMEOUT_MS = 1e3;
+    CONNECT_OPEN_TIMEOUT_MS = 2e4;
     WS_OPEN_STATE = 1;
     streamExecSession = async (ws, options) => new Promise((resolve2, reject) => {
       let exitCode = null;
@@ -199846,6 +199988,7 @@ var init_connect2 = __esm({
       let lastSeenAt = Date.now();
       let heartbeatTimer = null;
       let inputProbeTimer = null;
+      let openTimer = null;
       let inputProbeStamp = 0;
       let disconnectNoted = false;
       let errorMessage;
@@ -200073,6 +200216,12 @@ var init_connect2 = __esm({
           inputProbeTimer = null;
         }
       };
+      const stopOpenTimer = () => {
+        if (openTimer) {
+          clearTimeout(openTimer);
+          openTimer = null;
+        }
+      };
       const onPong = () => {
         markAlive();
         latency?.notePong();
@@ -200167,6 +200316,7 @@ var init_connect2 = __esm({
         ws.removeEventListener("error", onError);
         ws.removeEventListener("open", onOpen);
         stopInputProbe();
+        stopOpenTimer();
         stopHeartbeat();
         stopInput();
       };
@@ -200210,6 +200360,7 @@ var init_connect2 = __esm({
         resolve2(result);
       };
       const onOpen = () => {
+        stopOpenTimer();
         opened = true;
         markAlive();
         latency?.noteConnectOpen();
@@ -200224,6 +200375,20 @@ var init_connect2 = __esm({
       ws.addEventListener("error", onError);
       ws.addEventListener("open", onOpen);
       sendResize();
+      const openTimeoutMs = options.openTimeoutMs ?? CONNECT_OPEN_TIMEOUT_MS;
+      if (openTimeoutMs > 0) {
+        openTimer = setTimeout(() => {
+          if (resolved || opened) return;
+          noteDisconnect();
+          forceClose();
+          onError({
+            data: new Error(
+              `Timed out waiting for session connection after ${openTimeoutMs}ms.`
+            )
+          });
+        }, openTimeoutMs);
+        openTimer.unref();
+      }
     });
     runConnect = async (args, overrides) => {
       const parsed = parseConnectArgs(args);
@@ -200769,6 +200934,11 @@ var init_connect2 = __esm({
           let retryDelayMs = 250;
           let printedSessionInfo = false;
           let sawOutput = false;
+          let connectPhase = "connecting";
+          let activeSocket = null;
+          let localCancelRequested = false;
+          let attemptedAttach = false;
+          let sigintListenerInstalled = false;
           const printSessionInfo = (message) => {
             if (process.stderr.isTTY && process.stdout.isTTY) {
               process.stderr.write(`\x1B7\r
@@ -200796,208 +200966,262 @@ ${message}\r
               status.stop();
             }
           };
-          while (true) {
+          const onSigint = () => {
+            localCancelRequested = true;
+            if (!activeSocket) return;
             try {
-              await refreshSessionMapping();
-            } catch (error2) {
-              logger7.warn("session_refresh_failed", { error: String(error2) });
-            }
-            if (explicitName && sessionName && !sessionId && !confirmedCreateExplicit) {
-              pauseStatus();
-              const confirmed = await confirmNewSession(sessionName);
-              if (!confirmed) {
-                throw new Error(`Session "${sessionName}" not created.`);
-              }
-              confirmedCreateExplicit = true;
-            }
-            let createdNew = false;
-            let mappingWrite = null;
-            latency?.noteConnectStart();
-            const canAttach = shouldAttachToExistingSession({
-              supportsAttachExecSession,
-              sessionId,
-              requireFreshSessionOpen
-            });
-            stage(canAttach ? "Attaching to session" : "Opening session");
-            let ws;
-            if (canAttach) {
-              if (!sessionId) {
-                throw new Error("Missing session id for attach.");
-              }
-              ws = client2.attachExecSession(spriteAlias, sessionId);
-            } else {
-              createdNew = true;
-              ws = client2.openExecSession(spriteAlias, {
-                cmd: execCommand2,
-                tty: isTty,
-                stdin: openStdin,
-                ...ttySize ? { cols: ttySize.cols, rows: ttySize.rows } : {},
-                ...modalSessionLogPath ? { logPath: modalSessionLogPath } : {}
-              });
+              activeSocket.terminate?.();
+            } catch {
             }
-            const shouldSendInitialInput = createdNew && Boolean(pendingInitialInput);
-            const initialInputToSend = shouldSendInitialInput ? pendingInitialInput : void 0;
-            const result = await streamExecSession(ws, {
-              tty: isTty,
-              stdin: localStdin,
-              supportsResizeControlMessages,
-              ...latency ? { latency } : {},
-              onOutput: noteOutput,
-              onOutputChunk: (chunk) => {
-                sessionLogSink?.write(chunk);
-              },
-              onInputChunk: (chunk) => {
-                sessionLogSink?.write(chunk);
-              },
-              onOpen: () => {
-                if (shouldSendInitialInput) {
-                  pendingInitialInput = void 0;
-                }
-                if (sessionId) {
-                  reportSessionInfo(sessionId);
+            try {
+              activeSocket.close();
+            } catch {
+            }
+          };
+          const setConnectPhase = (phase) => {
+            connectPhase = phase;
+            const shouldInstallListener = shouldReconnect && shouldCancelConnectOnSigint(connectPhase);
+            if (shouldInstallListener && !sigintListenerInstalled) {
+              process.on("SIGINT", onSigint);
+              sigintListenerInstalled = true;
+              return;
+            }
+            if (!shouldInstallListener && sigintListenerInstalled) {
+              process.removeListener("SIGINT", onSigint);
+              sigintListenerInstalled = false;
+            }
+          };
+          setConnectPhase("connecting");
+          try {
+            while (true) {
+              if (localCancelRequested) {
+                process.exitCode = 130;
+                break;
+              }
+              setConnectPhase(attemptedAttach ? "reconnecting" : "connecting");
+              attemptedAttach = true;
+              try {
+                await refreshSessionMapping();
+              } catch (error2) {
+                logger7.warn("session_refresh_failed", { error: String(error2) });
+              }
+              if (explicitName && sessionName && !sessionId && !confirmedCreateExplicit) {
+                pauseStatus();
+                const confirmed = await confirmNewSession(sessionName);
+                if (!confirmed) {
+                  throw new Error(`Session "${sessionName}" not created.`);
                 }
-              },
-              ...initialInputToSend ? { initialInput: initialInputToSend } : {},
-              onSessionInfo: (id) => {
-                if (supportsAttachExecSession) {
-                  if (createdNew) {
-                    requireFreshSessionOpen = false;
-                  }
-                  sessionId = sessionId ?? id;
+                confirmedCreateExplicit = true;
+              }
+              let createdNew = false;
+              let mappingWrite = null;
+              latency?.noteConnectStart();
+              const canAttach = shouldAttachToExistingSession({
+                supportsAttachExecSession,
+                sessionId,
+                requireFreshSessionOpen
+              });
+              stage(canAttach ? "Attaching to session" : "Opening session");
+              let ws;
+              if (canAttach) {
+                if (!sessionId) {
+                  throw new Error("Missing session id for attach.");
                 }
-                if (sessionName && createdNew) {
-                  if (autoNamed) {
-                    mappingWrite = finalizeAutoSession(id);
-                    if (mappingWrite) {
-                      mappingWrite.then(() => {
-                        reportSessionInfo(id);
-                      }).catch((error2) => {
-                        logger7.warn("session_auto_rename_failed", {
-                          error: String(error2)
-                        });
+                ws = client2.attachExecSession(spriteAlias, sessionId);
+              } else {
+                createdNew = true;
+                ws = client2.openExecSession(spriteAlias, {
+                  cmd: execCommand2,
+                  tty: isTty,
+                  stdin: openStdin,
+                  ...ttySize ? { cols: ttySize.cols, rows: ttySize.rows } : {},
+                  ...modalSessionLogPath ? { logPath: modalSessionLogPath } : {}
+                });
+              }
+              activeSocket = ws;
+              const shouldSendInitialInput = createdNew && Boolean(pendingInitialInput);
+              const initialInputToSend = shouldSendInitialInput ? pendingInitialInput : void 0;
+              let result;
+              try {
+                result = await streamExecSession(ws, {
+                  tty: isTty,
+                  stdin: localStdin,
+                  supportsResizeControlMessages,
+                  ...latency ? { latency } : {},
+                  openTimeoutMs: CONNECT_OPEN_TIMEOUT_MS,
+                  onOutput: noteOutput,
+                  onOutputChunk: (chunk) => {
+                    sessionLogSink?.write(chunk);
+                  },
+                  onInputChunk: (chunk) => {
+                    sessionLogSink?.write(chunk);
+                  },
+                  onOpen: () => {
+                    setConnectPhase("attached");
+                    if (shouldSendInitialInput) {
+                      pendingInitialInput = void 0;
+                    }
+                    if (sessionId) {
+                      reportSessionInfo(sessionId);
+                    }
+                  },
+                  ...initialInputToSend ? { initialInput: initialInputToSend } : {},
+                  onSessionInfo: (id) => {
+                    if (supportsAttachExecSession) {
+                      if (createdNew) {
+                        requireFreshSessionOpen = false;
+                      }
+                      sessionId = sessionId ?? id;
+                    }
+                    if (sessionName && createdNew) {
+                      if (autoNamed) {
+                        mappingWrite = finalizeAutoSession(id);
+                        if (mappingWrite) {
+                          mappingWrite.then(() => {
+                            reportSessionInfo(id);
+                          }).catch((error2) => {
+                            logger7.warn("session_auto_rename_failed", {
+                              error: String(error2)
+                            });
+                            reportSessionInfo(id);
+                          });
+                        } else {
+                          reportSessionInfo(id);
+                        }
+                      } else {
+                        sessions[sessionName] = id;
+                        mappingWrite = writeSpriteSessions(
+                          client2,
+                          spriteAlias,
+                          sessions
+                        );
                         reportSessionInfo(id);
-                      });
+                      }
                     } else {
                       reportSessionInfo(id);
                     }
-                  } else {
-                    sessions[sessionName] = id;
-                    mappingWrite = writeSpriteSessions(
-                      client2,
-                      spriteAlias,
-                      sessions
-                    );
-                    reportSessionInfo(id);
-                  }
-                } else {
-                  reportSessionInfo(id);
-                }
-                if (isDetached) {
-                  ws.close();
+                    if (isDetached) {
+                      ws.close();
+                    }
+                  },
+                  onPortEvent: notifyPortEvent,
+                  ...shouldReconnect ? {
+                    onDisconnectNotice: () => {
+                      setConnectPhase("reconnecting");
+                      resetTerminalInputModes();
+                      if (!reconnectNoticeShown) {
+                        console.error(
+                          "Connection lost. Reconnecting... (Ctrl+C to cancel)"
+                        );
+                        reconnectNoticeShown = true;
+                      }
+                    }
+                  } : {}
+                });
+              } finally {
+                activeSocket = null;
+              }
+              if (mappingWrite) {
+                try {
+                  await mappingWrite;
+                } catch (error2) {
+                  logger7.warn("session_write_failed", { error: String(error2) });
                 }
-              },
-              onPortEvent: notifyPortEvent,
-              ...shouldReconnect ? {
-                onDisconnectNotice: () => {
-                  resetTerminalInputModes();
-                  if (!reconnectNoticeShown) {
-                    console.error(
-                      "Connection lost. Reconnecting... (Ctrl+C to cancel)"
-                    );
-                    reconnectNoticeShown = true;
+              }
+              if (localCancelRequested) {
+                process.exitCode = 130;
+                break;
+              }
+              if (result.kind === "exit") {
+                process.exitCode = result.code;
+                break;
+              }
+              if (result.kind === "detach") {
+                if (autoNamed && sessionName && sessionId) {
+                  const nextName = await promptRenameSession(sessionName);
+                  if (nextName && nextName !== sessionName) {
+                    try {
+                      await renameSessionMapping(sessionName, nextName, sessionId);
+                    } catch (error2) {
+                      console.error(
+                        `Failed to rename session: ${error2 instanceof Error ? error2.message : String(error2)}`
+                      );
+                    }
                   }
                 }
-              } : {}
-            });
-            if (mappingWrite) {
-              try {
-                await mappingWrite;
-              } catch (error2) {
-                logger7.warn("session_write_failed", { error: String(error2) });
+                process.exitCode = 0;
+                break;
               }
-            }
-            if (result.kind === "exit") {
-              process.exitCode = result.code;
-              break;
-            }
-            if (result.kind === "detach") {
-              if (autoNamed && sessionName && sessionId) {
-                const nextName = await promptRenameSession(sessionName);
-                if (nextName && nextName !== sessionName) {
-                  try {
-                    await renameSessionMapping(sessionName, nextName, sessionId);
-                  } catch (error2) {
-                    console.error(
-                      `Failed to rename session: ${error2 instanceof Error ? error2.message : String(error2)}`
-                    );
-                  }
+              if (isDetached) {
+                process.exitCode = 0;
+                break;
+              }
+              if (isAttachReplacedCloseCode(result.closeCode)) {
+                resetTerminalInputModes();
+                console.error(
+                  "Session attached from another client. Closing this window."
+                );
+                process.exitCode = 0;
+                break;
+              }
+              if (!shouldReconnect) {
+                if (result.errorMessage) {
+                  throw new Error(`Connection lost: ${result.errorMessage}`);
                 }
+                throw new Error("Connection lost.");
               }
-              process.exitCode = 0;
-              break;
-            }
-            if (isDetached) {
-              process.exitCode = 0;
-              break;
-            }
-            if (isAttachReplacedCloseCode(result.closeCode)) {
+              setConnectPhase("reconnecting");
               resetTerminalInputModes();
-              console.error(
-                "Session attached from another client. Closing this window."
-              );
-              process.exitCode = 0;
-              break;
-            }
-            if (!shouldReconnect) {
-              if (result.errorMessage) {
-                throw new Error(`Connection lost: ${result.errorMessage}`);
+              if (!reconnectNoticeShown) {
+                console.error(
+                  "Connection lost. Reconnecting... (Ctrl+C to cancel)"
+                );
+                reconnectNoticeShown = true;
               }
-              throw new Error("Connection lost.");
-            }
-            resetTerminalInputModes();
-            if (!reconnectNoticeShown) {
-              console.error("Connection lost. Reconnecting... (Ctrl+C to cancel)");
-              reconnectNoticeShown = true;
-            }
-            if (sessionId && supportsAttachExecSession) {
-              if (computeProvider === "modal" && isSessionNotFoundError(result.errorMessage)) {
-                if (sessionName) {
-                  delete sessions[sessionName];
-                  await writeSpriteSessions(client2, spriteAlias, sessions);
-                }
-                sessionId = void 0;
-              } else if (computeProvider !== "modal" && result.opened === false && supportsListExecSessions) {
-                try {
-                  const available = await client2.listExecSessions(spriteAlias);
-                  const match2 = available.find(
-                    (session) => session.id === sessionId
-                  );
-                  if (!match2 || match2.tty === false) {
-                    if (sessionName) {
-                      delete sessions[sessionName];
-                      await writeSpriteSessions(client2, spriteAlias, sessions);
+              if (sessionId && supportsAttachExecSession) {
+                if (computeProvider === "modal" && isSessionNotFoundError(result.errorMessage)) {
+                  if (sessionName) {
+                    delete sessions[sessionName];
+                    await writeSpriteSessions(client2, spriteAlias, sessions);
+                  }
+                  sessionId = void 0;
+                } else if (computeProvider !== "modal" && result.opened === false && supportsListExecSessions) {
+                  try {
+                    const available = await client2.listExecSessions(spriteAlias);
+                    const match2 = available.find(
+                      (session) => session.id === sessionId
+                    );
+                    if (!match2 || match2.tty === false) {
+                      if (sessionName) {
+                        delete sessions[sessionName];
+                        await writeSpriteSessions(client2, spriteAlias, sessions);
+                      }
+                      sessionId = void 0;
                     }
-                    sessionId = void 0;
+                  } catch (error2) {
+                    logger7.warn("session_lookup_failed", { error: String(error2) });
                   }
-                } catch (error2) {
-                  logger7.warn("session_lookup_failed", { error: String(error2) });
                 }
               }
+              const networkWait = await waitForNetworkOnline({
+                targetHost: networkTargetHost,
+                onStatus: stage,
+                onNotice: (message) => console.error(message)
+              });
+              if (networkWait === "aborted" || localCancelRequested) {
+                process.exitCode = 130;
+                break;
+              }
+              if (networkWait === "waited") {
+                retryDelayMs = 250;
+              }
+              await new Promise((resolve2) => setTimeout(resolve2, retryDelayMs));
+              retryDelayMs = Math.min(5e3, Math.round(retryDelayMs * 1.6));
             }
-            const networkWait = await waitForNetworkOnline({
-              targetHost: networkTargetHost,
-              onStatus: stage,
-              onNotice: (message) => console.error(message)
-            });
-            if (networkWait === "aborted") {
-              process.exitCode = 130;
-              break;
-            }
-            if (networkWait === "waited") {
-              retryDelayMs = 250;
+          } finally {
+            if (sigintListenerInstalled) {
+              process.removeListener("SIGINT", onSigint);
             }
-            await new Promise((resolve2) => setTimeout(resolve2, retryDelayMs));
-            retryDelayMs = Math.min(5e3, Math.round(retryDelayMs * 1.6));
           }
         } finally {
           const exitCode = typeof process.exitCode === "number" ? process.exitCode : void 0;
@@ -201876,6 +202100,7 @@ var init_state = __esm({
       "workdirProvisioned",
       "gitSafeDirectoryConfigured",
       "setupUploaded",
+      "codexConfigUpdated",
       "setupArtifactsStaged",
       "servicesEnabled",
       "codexCliEnsured",
@@ -202538,14 +202763,64 @@ var init_weztermMux = __esm({
   }
 });
 
+// src/devbox/commands/init/codex/config.ts
+var isRecord, parseExistingConfig, normalizeTrustedPaths, ensureNoticeConfig, ensureTrustedProjects, mergeCodexInitConfig;
+var init_config2 = __esm({
+  "src/devbox/commands/init/codex/config.ts"() {
+    "use strict";
+    init_dist2();
+    isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+    parseExistingConfig = (content) => {
+      if (!content) return {};
+      try {
+        const parsed = parse(content);
+        return isRecord(parsed) ? { ...parsed } : {};
+      } catch {
+        return {};
+      }
+    };
+    normalizeTrustedPaths = (trustedPaths) => [
+      ...new Set(trustedPaths.map((path38) => path38.trim()).filter(Boolean))
+    ];
+    ensureNoticeConfig = (config4) => {
+      const notice = isRecord(config4.notice) ? { ...config4.notice } : {};
+      notice.hide_full_access_warning = true;
+      config4.notice = notice;
+    };
+    ensureTrustedProjects = (config4, trustedPaths) => {
+      const projects = isRecord(config4.projects) ? { ...config4.projects } : {};
+      for (const trustedPath of normalizeTrustedPaths(trustedPaths)) {
+        const existingProject = isRecord(projects[trustedPath]) ? { ...projects[trustedPath] } : {};
+        existingProject.trust_level = "trusted";
+        projects[trustedPath] = existingProject;
+      }
+      config4.projects = projects;
+    };
+    mergeCodexInitConfig = ({
+      existingContent,
+      trustedPaths
+    }) => {
+      const config4 = parseExistingConfig(existingContent);
+      config4.approval_policy = "never";
+      config4.sandbox_mode = "danger-full-access";
+      ensureNoticeConfig(config4);
+      ensureTrustedProjects(config4, trustedPaths);
+      const rendered = stringify(config4);
+      return rendered.endsWith("\n") ? rendered : `${rendered}
+`;
+    };
+  }
+});
+
 // src/devbox/commands/init/remote.ts
-var import_node_crypto11, DAEMON_DIR, DAEMON_TARBALL, DAEMON_BUNDLE_DIR, DAEMON_ENTRY, DAEMON_WRAPPER, DAEMON_SERVICE_NAME, DAEMON_CONFIG_FILE, MODAL_DAEMON_HEALTH_PORT, DEFAULT_DAEMON_BASE_URL, DEFAULT_HEARTBEAT_MS, BOOTSTRAP_EXEC_TIMEOUT_MS, BOOTSTRAP_EXEC_HANDSHAKE_TIMEOUT_MS, BASHRC_PATH, ZSHRC_PATH, BASIC_ALIASES_MARKER, LEGACY_BASH_TRAP, SAFE_BASH_TRAP, BASH_HISTORY_BLOCK, ZSH_HISTORY_BLOCK, HISTORY_BLOCK_PATTERN, BASH_HISTORY_LINE_PATTERN, ZSH_HISTORY_LINE_PATTERN, logger8, truncateTail, shellQuote4, expandHome2, execWithLog, writeRemoteFile, readRemoteFile, ensureTrailingNewline, upsertHistoryBlock, patchBashrcContent, patchZshrcContent, bootstrapDevbox, buildWeztermMuxConfig, buildWeztermMuxRunner, patchRemoteRcFile, patchBashrc, patchZshrc, stageRemoteSetupArtifacts, resolveDaemonUrl, fetchDaemonBinary, buildDaemonConfig, buildDaemonWrapperScript, isSameArgs, ensureSpriteDaemonService, installWeztermMux, ensureWeztermMuxService, hasWeztermMuxBinary, isWeztermMuxHealthy, installSpriteDaemon;
+var import_node_crypto11, DAEMON_DIR, DAEMON_TARBALL, DAEMON_BUNDLE_DIR, DAEMON_ENTRY, DAEMON_WRAPPER, DAEMON_SERVICE_NAME, DAEMON_CONFIG_FILE, MODAL_DAEMON_HEALTH_PORT, DEFAULT_DAEMON_BASE_URL, DEFAULT_HEARTBEAT_MS, BOOTSTRAP_EXEC_TIMEOUT_MS, BOOTSTRAP_EXEC_HANDSHAKE_TIMEOUT_MS, BASHRC_PATH, ZSHRC_PATH, CODEX_CONFIG_DIR, CODEX_CONFIG_PATH, BASIC_ALIASES_MARKER, LEGACY_BASH_TRAP, SAFE_BASH_TRAP, BASH_HISTORY_BLOCK, ZSH_HISTORY_BLOCK, HISTORY_BLOCK_PATTERN, BASH_HISTORY_LINE_PATTERN, ZSH_HISTORY_LINE_PATTERN, logger8, truncateTail, shellQuote4, expandHome2, execWithLog, writeRemoteFile, readRemoteFile, ensureTrailingNewline, upsertHistoryBlock, patchBashrcContent, patchZshrcContent, bootstrapDevbox, buildWeztermMuxConfig, buildWeztermMuxRunner, patchRemoteRcFile, patchBashrc, patchZshrc, ensureRemoteCodexConfig, stageRemoteSetupArtifacts, resolveDaemonUrl, fetchDaemonBinary, buildDaemonConfig, buildDaemonWrapperScript, isSameArgs, ensureSpriteDaemonService, installWeztermMux, ensureWeztermMuxService, hasWeztermMuxBinary, isWeztermMuxHealthy, installSpriteDaemon;
 var init_remote = __esm({
   "src/devbox/commands/init/remote.ts"() {
     "use strict";
     import_node_crypto11 = require("node:crypto");
     init_src();
     init_weztermMux();
+    init_config2();
     DAEMON_DIR = "/home/sprite/.devbox/daemon";
     DAEMON_TARBALL = `${DAEMON_DIR}/sprite-daemon.tar.gz`;
     DAEMON_BUNDLE_DIR = `${DAEMON_DIR}/bundle`;
@@ -202560,6 +202835,8 @@ var init_remote = __esm({
     BOOTSTRAP_EXEC_HANDSHAKE_TIMEOUT_MS = 2e4;
     BASHRC_PATH = "/home/sprite/.bashrc";
     ZSHRC_PATH = "/home/sprite/.zshrc";
+    CODEX_CONFIG_DIR = "/home/sprite/.codex";
+    CODEX_CONFIG_PATH = `${CODEX_CONFIG_DIR}/config.toml`;
     BASIC_ALIASES_MARKER = "\n# Basic aliases";
     LEGACY_BASH_TRAP = `trap 'echo -ne "\\033]0;\${BASH_COMMAND}\\007"' DEBUG`;
     SAFE_BASH_TRAP = `trap 'printf "\\033]0;%s\\007" "\${BASH_COMMAND//[^[:print:]]/}"' DEBUG`;
@@ -202975,6 +203252,59 @@ ${canonicalBlock}
       errorLabel: "zshrc",
       transform: patchZshrcContent
     });
+    ensureRemoteCodexConfig = async ({
+      client: client2,
+      spriteAlias,
+      trustedPaths
+    }) => {
+      const mkdirResult = await execWithLog(
+        client2,
+        spriteAlias,
+        [
+          "set -euo pipefail",
+          `mkdir -p ${shellQuote4(CODEX_CONFIG_DIR)}`,
+          `chmod 700 ${shellQuote4(CODEX_CONFIG_DIR)}`
+        ].join("\n"),
+        "codex-config-mkdir"
+      );
+      if (mkdirResult.exitCode !== 0) {
+        const details = mkdirResult.stderr || mkdirResult.stdout || "";
+        throw new Error(
+          details ? `codex config mkdir failed: ${details}` : `codex config mkdir failed (exit ${mkdirResult.exitCode})`
+        );
+      }
+      const existing = await readRemoteFile(
+        client2,
+        spriteAlias,
+        CODEX_CONFIG_PATH,
+        "codex-config-read"
+      );
+      const next = mergeCodexInitConfig({
+        existingContent: existing,
+        trustedPaths
+      });
+      await writeRemoteFile(
+        client2,
+        spriteAlias,
+        CODEX_CONFIG_PATH,
+        next,
+        "codex-config-write"
+      );
+      const chmodResult = await execWithLog(
+        client2,
+        spriteAlias,
+        ["set -euo pipefail", `chmod 600 ${shellQuote4(CODEX_CONFIG_PATH)}`].join(
+          "\n"
+        ),
+        "codex-config-chmod"
+      );
+      if (chmodResult.exitCode !== 0) {
+        const details = chmodResult.stderr || chmodResult.stdout || "";
+        throw new Error(
+          details ? `codex config chmod failed: ${details}` : `codex config chmod failed (exit ${chmodResult.exitCode})`
+        );
+      }
+    };
     stageRemoteSetupArtifacts = async ({
       client: client2,
       spriteAlias,
@@ -208710,7 +209040,7 @@ ${sshResult.stderr}`.trim();
 });
 
 // src/devbox/commands/servicesToml.ts
-var splitShellCommand, normalizeSectionName, isRecord, asString2, asStringArray, asNumber, parseServicesToml, formatSectionName, renderServiceBlock, mergeServicesToml;
+var splitShellCommand, normalizeSectionName, isRecord2, asString2, asStringArray, asNumber, parseServicesToml, formatSectionName, renderServiceBlock, mergeServicesToml;
 var init_servicesToml = __esm({
   "src/devbox/commands/servicesToml.ts"() {
     "use strict";
@@ -208766,7 +209096,7 @@ var init_servicesToml = __esm({
       }
       return trimmed;
     };
-    isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+    isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
     asString2 = (value) => typeof value === "string" ? value : null;
     asStringArray = (value) => {
       if (!Array.isArray(value)) return null;
@@ -208790,14 +209120,14 @@ var init_servicesToml = __esm({
     };
     parseServicesToml = (content) => {
       const parsed = parse(content);
-      if (!isRecord(parsed)) return {};
+      if (!isRecord2(parsed)) return {};
       const servicesRoot = parsed.services;
-      if (!isRecord(servicesRoot)) return {};
+      if (!isRecord2(servicesRoot)) return {};
       const services = {};
       for (const [rawName, value] of Object.entries(servicesRoot)) {
         const name = String(rawName);
         if (!name) continue;
-        if (!isRecord(value)) continue;
+        if (!isRecord2(value)) continue;
         const entry = { name };
         const cmd = asString2(value.cmd);
         if (cmd) entry.cmd = cmd;
@@ -209475,6 +209805,27 @@ var init_finalizeFlow = __esm({
           });
         }
       });
+      const skipCodexConfigUpdate = Boolean(
+        shouldResume && getInitState()?.steps.codexConfigUpdated
+      );
+      if (!skipCodexConfigUpdate) {
+        await runInitStep({
+          enabled: progressEnabled,
+          title: "Updating Codex config",
+          fn: async ({ status }) => {
+            await retryInitStep2({
+              status,
+              title: "Updating Codex config",
+              fn: async () => await ensureRemoteCodexConfig({
+                client: client2,
+                spriteAlias,
+                trustedPaths: ["/home/sprite", expandedWorkdir]
+              })
+            });
+          }
+        });
+        await updateInitState({ steps: { codexConfigUpdated: true } });
+      }
       const skipSetupArtifactsStage = Boolean(
         skipCodexApply || shouldResume && getInitState()?.steps.setupArtifactsStaged
       );
@@ -217083,4 +217434,4 @@ smol-toml/dist/index.js:
 */
 //# sourceMappingURL=dvb.cjs.map
 
-//# debugId=785204a7-1bc2-5318-801f-4ad682a364a7
+//# debugId=b4643c26-df5e-5ece-b58a-108a9965ffde