@boxes-dev/dvb 1.0.77 → 1.0.79

package/dist/bin/dvb.cjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 "use strict";
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="080b5259-7ff1-5cae-8b1d-315abb34a68e")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b785e941-0159-5a32-9ac9-c3686e30d3af")}catch(e){}}();
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -88688,8 +88688,8 @@ var init_otel = __esm({
       return trimmed && trimmed.length > 0 ? trimmed : void 0;
     };
     readBuildMetadata = () => {
-      const rawPackageVersion = "1.0.77";
-      const rawGitSha = "17fefd5b7fdac0e2ca0097ce453c614262d9e6d3";
+      const rawPackageVersion = "1.0.79";
+      const rawGitSha = "ceaceb54444acf1719c1f5fc72074b5048324e4a";
       const packageVersion = typeof rawPackageVersion === "string" ? rawPackageVersion : void 0;
       const gitSha = typeof rawGitSha === "string" ? rawGitSha : void 0;
       return { packageVersion, gitSha };
@@ -120679,9 +120679,9 @@ var init_sentry = __esm({
     sentryEnabled = false;
     uncaughtExceptionMonitorInstalled = false;
     readBuildMetadata2 = () => {
-      const rawPackageVersion = "1.0.77";
-      const rawGitSha = "17fefd5b7fdac0e2ca0097ce453c614262d9e6d3";
-      const rawSentryRelease = "boxes-dev-dvb@1.0.77+17fefd5b7fdac0e2ca0097ce453c614262d9e6d3";
+      const rawPackageVersion = "1.0.79";
+      const rawGitSha = "ceaceb54444acf1719c1f5fc72074b5048324e4a";
+      const rawSentryRelease = "boxes-dev-dvb@1.0.79+ceaceb54444acf1719c1f5fc72074b5048324e4a";
       const packageVersion = typeof rawPackageVersion === "string" ? rawPackageVersion : void 0;
       const gitSha = typeof rawGitSha === "string" ? rawGitSha : void 0;
       const sentryRelease = typeof rawSentryRelease === "string" ? rawSentryRelease : void 0;
@@ -141302,7 +141302,9 @@ var init_statusLine = __esm({
       enabled,
       stream = process.stderr
     }) => {
-      if (!enabled) {
+      const usableColumns = typeof stream.columns !== "number" || stream.columns > 0;
+      const spinnerEnabled = enabled && (!stream.isTTY || usableColumns);
+      if (!spinnerEnabled) {
         return {
           stage: () => {
           },
@@ -198479,6 +198481,592 @@ ${result.exception}`
   }
 });
 
+// src/devbox/commands/provider/modalLifecycle.ts
+var import_node_crypto9, DEFAULT_APP_NAME, DEFAULT_MODAL_ENVIRONMENT, DEFAULT_MODAL_DEVBOX_IMAGE, DEFAULT_TIMEOUT_MS, IMAGE_TAG_RESOLUTION_CACHE_TTL_MS, SANDBOX_LIST_PAGE_LIMIT, MODAL_DAEMON_WRAPPER_PATH, MODAL_DAEMON_SUPERVISOR_ENTRYPOINT, FINISHED_STATUS_LABELS, REGISTRY_MANIFEST_ACCEPT_HEADER, resolvedImageTagCache, trimEnv2, EMBEDDED_BUILD_PROFILE, resolveModalEnvironmentName, resolveConvexInstanceSeed, resolveDevModalSandboxPrefix, resolveModalSandboxName, parseRegistryImageTag, parseWwwAuthenticateBearer, fetchRegistryToken, resolveLatestImageTagToDigest, resolveImageTagForBuild, decodeJwtExpMs, createSafeModalAuthTokenManager, installSafeModalAuthTokenManager, parsePositiveInt, resolveRegions, resolveAppName, resolveModalSandboxTimeoutMs, isNotFoundError, isModalAlreadyExistsError, trimToNull, resolveControlPlaneToken, hasContextModalCredentialPair, shouldUseControlPlaneFallback, withModalClient, resolveModalApp, listSandboxesRaw, formatSandboxStatus, isRunningSandbox, resolveImageFromTag, provisionModalSandbox, findModalSandbox, terminateModalSandboxesByAlias;
+var init_modalLifecycle = __esm({
+  "src/devbox/commands/provider/modalLifecycle.ts"() {
+    "use strict";
+    init_src();
+    import_node_crypto9 = require("node:crypto");
+    init_dist5();
+    init_controlPlane();
+    DEFAULT_APP_NAME = "sandbox-modal-smoke";
+    DEFAULT_MODAL_ENVIRONMENT = "main";
+    DEFAULT_MODAL_DEVBOX_IMAGE = "public.ecr.aws/d8m4p4w9/modal-devbox:latest";
+    DEFAULT_TIMEOUT_MS = 24 * 60 * 60 * 1e3;
+    IMAGE_TAG_RESOLUTION_CACHE_TTL_MS = 5 * 60 * 1e3;
+    SANDBOX_LIST_PAGE_LIMIT = 100;
+    MODAL_DAEMON_WRAPPER_PATH = "/root/.devbox/daemon/run-daemon.sh";
+    MODAL_DAEMON_SUPERVISOR_ENTRYPOINT = [
+      "/bin/sh",
+      "-lc",
+      [
+        "set -u",
+        `wrapper=${JSON.stringify(MODAL_DAEMON_WRAPPER_PATH)}`,
+        'until [ -x "$wrapper" ]; do sleep 0.25; done',
+        "while true; do",
+        '  "$wrapper"',
+        "  status=$?",
+        '  echo "sprite-daemon exited with status $status; restarting" >&2',
+        "  sleep 1",
+        "done"
+      ].join("\n")
+    ];
+    FINISHED_STATUS_LABELS = {
+      1: "success",
+      2: "failure",
+      3: "terminated",
+      4: "timeout",
+      5: "init_failure",
+      6: "internal_failure",
+      7: "idle_timeout"
+    };
+    REGISTRY_MANIFEST_ACCEPT_HEADER = [
+      "application/vnd.oci.image.index.v1+json",
+      "application/vnd.oci.image.manifest.v1+json",
+      "application/vnd.docker.distribution.manifest.list.v2+json",
+      "application/vnd.docker.distribution.manifest.v2+json"
+    ].join(", ");
+    resolvedImageTagCache = /* @__PURE__ */ new Map();
+    trimEnv2 = (value) => value?.trim() ?? "";
+    EMBEDDED_BUILD_PROFILE = resolveDevboxProfile();
+    resolveModalEnvironmentName = () => {
+      if (!EMBEDDED_BUILD_PROFILE) {
+        return DEFAULT_MODAL_ENVIRONMENT;
+      }
+      return trimEnv2(process.env.MODAL_ENVIRONMENT) || "dev";
+    };
+    resolveConvexInstanceSeed = () => {
+      const candidates = [
+        trimEnv2(process.env.DEVBOX_CONVEX_URL),
+        trimEnv2(process.env.CONVEX_CLOUD_URL),
+        trimEnv2(process.env.CONVEX_SITE_URL)
+      ].filter((value) => value.length > 0);
+      const raw = candidates[0];
+      if (!raw) {
+        return null;
+      }
+      let normalized = raw;
+      if (normalized.startsWith("dev:")) {
+        normalized = normalized.slice(4);
+      }
+      if (normalized.includes(".convex.site")) {
+        normalized = normalized.replace(".convex.site", ".convex.cloud");
+      }
+      if (!normalized.startsWith("http://") && !normalized.startsWith("https://")) {
+        normalized = `https://${normalized}`;
+      }
+      try {
+        return new URL(normalized).host.toLowerCase();
+      } catch {
+        return normalized.toLowerCase();
+      }
+    };
+    resolveDevModalSandboxPrefix = () => {
+      const seed = resolveConvexInstanceSeed();
+      if (!seed) {
+        throw new Error(
+          "Missing Convex deployment URL context for MODAL_ENVIRONMENT=dev. Set DEVBOX_CONVEX_URL or CONVEX_CLOUD_URL."
+        );
+      }
+      return (0, import_node_crypto9.createHash)("sha256").update(seed).digest("hex").slice(0, 8);
+    };
+    resolveModalSandboxName = (alias, environmentName) => {
+      const normalizedAlias = alias.trim();
+      if (!normalizedAlias) {
+        throw new Error("Modal alias is required.");
+      }
+      if (environmentName !== "dev") {
+        return normalizedAlias;
+      }
+      return `${resolveDevModalSandboxPrefix()}-${normalizedAlias}`;
+    };
+    parseRegistryImageTag = (imageTag) => {
+      const trimmed = imageTag.trim();
+      if (!trimmed || trimmed.includes("@")) {
+        return null;
+      }
+      const lastSlashIndex = trimmed.lastIndexOf("/");
+      const lastColonIndex = trimmed.lastIndexOf(":");
+      if (lastColonIndex <= lastSlashIndex) {
+        return null;
+      }
+      const repositoryWithHost = trimmed.slice(0, lastColonIndex);
+      const tag = trimmed.slice(lastColonIndex + 1).trim();
+      if (!repositoryWithHost || !tag) {
+        return null;
+      }
+      const firstSlashIndex = repositoryWithHost.indexOf("/");
+      if (firstSlashIndex <= 0) {
+        return null;
+      }
+      const registryHost = repositoryWithHost.slice(0, firstSlashIndex);
+      const repository = repositoryWithHost.slice(firstSlashIndex + 1);
+      if (!repository) {
+        return null;
+      }
+      const hasExplicitRegistryHost = registryHost.includes(".") || registryHost.includes(":") || registryHost === "localhost";
+      if (!hasExplicitRegistryHost) {
+        return null;
+      }
+      return {
+        registryHost,
+        repository,
+        tag,
+        repositoryWithHost
+      };
+    };
+    parseWwwAuthenticateBearer = (headerValue) => {
+      const trimmed = headerValue.trim();
+      if (!trimmed.toLowerCase().startsWith("bearer ")) {
+        return null;
+      }
+      const attributes = /* @__PURE__ */ new Map();
+      for (const match2 of trimmed.slice("bearer ".length).matchAll(/([A-Za-z0-9_-]+)="([^"]*)"/g)) {
+        const [, key, value] = match2;
+        if (!key) {
+          continue;
+        }
+        attributes.set(key.toLowerCase(), value ?? "");
+      }
+      const realm = attributes.get("realm");
+      const service = attributes.get("service");
+      const scope = attributes.get("scope");
+      if (!realm || !service) {
+        return null;
+      }
+      return {
+        realm,
+        service,
+        scope: scope || null
+      };
+    };
+    fetchRegistryToken = async ({
+      realm,
+      service,
+      scope
+    }) => {
+      const tokenUrl = new URL(realm);
+      tokenUrl.searchParams.set("service", service);
+      if (scope) {
+        tokenUrl.searchParams.set("scope", scope);
+      }
+      const response = await fetch(tokenUrl.toString());
+      if (!response.ok) {
+        throw new Error(
+          `Container registry auth token request failed (${response.status}).`
+        );
+      }
+      const payload = await response.json();
+      const token = typeof payload.token === "string" ? payload.token.trim() : typeof payload.access_token === "string" ? payload.access_token.trim() : "";
+      if (!token) {
+        throw new Error("Container registry auth token response was empty.");
+      }
+      return token;
+    };
+    resolveLatestImageTagToDigest = async (parsed) => {
+      const manifestUrl = `https://${parsed.registryHost}/v2/${parsed.repository}/manifests/${encodeURIComponent(parsed.tag)}`;
+      const fetchManifest = async ({
+        method,
+        token: token2
+      }) => {
+        const headers = {
+          Accept: REGISTRY_MANIFEST_ACCEPT_HEADER
+        };
+        if (token2) {
+          headers.Authorization = `Bearer ${token2}`;
+        }
+        return await fetch(manifestUrl, {
+          headers,
+          method
+        });
+      };
+      let token = null;
+      let headResponse = await fetchManifest({ method: "HEAD" });
+      if (headResponse.status === 401) {
+        const authHeader = headResponse.headers.get("www-authenticate") ?? "";
+        const challenge = parseWwwAuthenticateBearer(authHeader);
+        if (!challenge) {
+          throw new Error(
+            `Container registry auth challenge missing or invalid for ${parsed.repositoryWithHost}:${parsed.tag}.`
+          );
+        }
+        token = await fetchRegistryToken(challenge);
+        headResponse = await fetchManifest({
+          method: "HEAD",
+          token
+        });
+      }
+      if (!headResponse.ok) {
+        throw new Error(
+          `Container registry manifest lookup failed for ${parsed.repositoryWithHost}:${parsed.tag} (${headResponse.status}).`
+        );
+      }
+      const headDigest = headResponse.headers.get("docker-content-digest")?.trim();
+      if (headDigest) {
+        return `${parsed.repositoryWithHost}@${headDigest}`;
+      }
+      const getResponse = await fetchManifest(
+        token ? {
+          method: "GET",
+          token
+        } : {
+          method: "GET"
+        }
+      );
+      if (!getResponse.ok) {
+        throw new Error(
+          `Container registry manifest body lookup failed for ${parsed.repositoryWithHost}:${parsed.tag} (${getResponse.status}).`
+        );
+      }
+      const headerDigest = getResponse.headers.get("docker-content-digest")?.trim();
+      if (headerDigest) {
+        return `${parsed.repositoryWithHost}@${headerDigest}`;
+      }
+      const manifestBytes = Buffer.from(await getResponse.arrayBuffer());
+      const bodyDigest = `sha256:${(0, import_node_crypto9.createHash)("sha256").update(manifestBytes).digest("hex")}`;
+      return `${parsed.repositoryWithHost}@${bodyDigest}`;
+    };
+    resolveImageTagForBuild = async (imageTag) => {
+      const parsed = parseRegistryImageTag(imageTag);
+      if (!parsed || parsed.tag !== "latest") {
+        return imageTag;
+      }
+      const cacheKey = `${parsed.repositoryWithHost}:${parsed.tag}`;
+      const now = Date.now();
+      const cached = resolvedImageTagCache.get(cacheKey);
+      if (cached && cached.expiresAt > now) {
+        return cached.value;
+      }
+      const resolved = await resolveLatestImageTagToDigest(parsed);
+      resolvedImageTagCache.set(cacheKey, {
+        value: resolved,
+        expiresAt: now + IMAGE_TAG_RESOLUTION_CACHE_TTL_MS
+      });
+      return resolved;
+    };
+    decodeJwtExpMs = (token) => {
+      const segments = token.split(".");
+      if (segments.length < 2) return null;
+      const payload = segments[1];
+      if (!payload) return null;
+      const normalized = payload.replace(/-/g, "+").replace(/_/g, "/");
+      const padLength = (4 - normalized.length % 4) % 4;
+      const padded = `${normalized}${"=".repeat(padLength)}`;
+      try {
+        const parsed = JSON.parse(
+          Buffer.from(padded, "base64").toString("utf8")
+        );
+        const exp = parsed.exp;
+        if (typeof exp !== "number" || !Number.isFinite(exp) || exp <= 0) {
+          return null;
+        }
+        return Math.floor(exp * 1e3);
+      } catch {
+        return null;
+      }
+    };
+    createSafeModalAuthTokenManager = (modal) => {
+      let token = "";
+      let tokenExpMs = 0;
+      let inFlight = null;
+      const TOKEN_REFRESH_SKEW_MS = 3e4;
+      const FALLBACK_TOKEN_TTL_MS = 15 * 60 * 1e3;
+      const hasFreshToken = () => token.length > 0 && Date.now() + TOKEN_REFRESH_SKEW_MS < tokenExpMs;
+      const fetchToken = async () => {
+        const authTokenGet = modal.cpClient.authTokenGet;
+        if (typeof authTokenGet !== "function") {
+          throw new Error("Modal auth token endpoint unavailable.");
+        }
+        const response = await authTokenGet({});
+        const nextToken = typeof response?.token === "string" ? response.token.trim() : "";
+        if (!nextToken) {
+          throw new Error("Modal auth token unavailable.");
+        }
+        token = nextToken;
+        tokenExpMs = decodeJwtExpMs(nextToken) ?? Date.now() + FALLBACK_TOKEN_TTL_MS;
+        return nextToken;
+      };
+      return {
+        start: () => {
+        },
+        stop: () => {
+          token = "";
+          tokenExpMs = 0;
+          inFlight = null;
+        },
+        getToken: async () => {
+          if (hasFreshToken()) return token;
+          if (!inFlight) {
+            inFlight = fetchToken().finally(() => {
+              inFlight = null;
+            });
+          }
+          return await inFlight;
+        }
+      };
+    };
+    installSafeModalAuthTokenManager = (modal) => {
+      const candidate = modal;
+      if (candidate.authTokenManager) return;
+      candidate.authTokenManager = createSafeModalAuthTokenManager(candidate);
+    };
+    parsePositiveInt = (value, fallback2) => {
+      const parsed = Number.parseInt(value, 10);
+      if (!Number.isFinite(parsed) || parsed <= 0) return fallback2;
+      return parsed;
+    };
+    resolveRegions = () => {
+      const raw = trimEnv2(process.env.MODAL_SANDBOX_REGION);
+      if (!raw) return [];
+      return raw.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
+    };
+    resolveAppName = () => trimEnv2(process.env.MODAL_SANDBOX_APP) || DEFAULT_APP_NAME;
+    resolveModalSandboxTimeoutMs = () => parsePositiveInt(
+      trimEnv2(process.env.MODAL_SANDBOX_TIMEOUT_MS),
+      DEFAULT_TIMEOUT_MS
+    );
+    isNotFoundError = (error2) => error2 instanceof NotFoundError;
+    isModalAlreadyExistsError = (error2) => {
+      if (error2 instanceof AlreadyExistsError) {
+        return true;
+      }
+      const message = error2 instanceof Error ? `${error2.name} ${error2.message}` : String(error2 ?? "");
+      if (/\bALREADY_EXISTS\b/i.test(message)) {
+        return true;
+      }
+      return /already exists/i.test(message);
+    };
+    trimToNull = (value) => {
+      if (typeof value !== "string") return null;
+      const trimmed = value.trim();
+      return trimmed.length > 0 ? trimmed : null;
+    };
+    resolveControlPlaneToken = (options) => trimToNull(options?.credentials?.controlPlaneToken);
+    hasContextModalCredentialPair = (options) => Boolean(
+      trimToNull(options?.credentials?.modalTokenId) && trimToNull(options?.credentials?.modalTokenSecret)
+    );
+    shouldUseControlPlaneFallback = (options) => !options?.client && Boolean(resolveControlPlaneToken(options)) && !hasContextModalCredentialPair(options);
+    withModalClient = async (options, fn) => {
+      if (options?.client) {
+        return await fn(options.client);
+      }
+      const modalCredentials = resolveModalClientCredentials({
+        ...options?.credentialMode ? { credentialMode: options.credentialMode } : {},
+        ...options?.credentials !== void 0 ? { credentials: options.credentials } : {},
+        ...options?.cwd ? { cwd: options.cwd } : {}
+      });
+      const modal = new ModalClient2({
+        tokenId: modalCredentials.tokenId,
+        tokenSecret: modalCredentials.tokenSecret,
+        environment: resolveModalEnvironmentName()
+      });
+      installSafeModalAuthTokenManager(modal);
+      try {
+        return await fn(modal);
+      } finally {
+        modal.close();
+      }
+    };
+    resolveModalApp = async (modal, appName, createIfMissing) => {
+      try {
+        const app = await modal.apps.fromName(appName, { createIfMissing });
+        return { appId: app.appId, appName };
+      } catch (error2) {
+        if (!createIfMissing && isNotFoundError(error2)) {
+          return null;
+        }
+        throw error2;
+      }
+    };
+    listSandboxesRaw = async (modal, appId, includeFinished) => {
+      const sandboxes = [];
+      let beforeTimestamp = 0;
+      let guard = 0;
+      while (true) {
+        guard += 1;
+        if (guard > SANDBOX_LIST_PAGE_LIMIT) {
+          throw new Error("Modal sandbox list pagination exceeded safety limit.");
+        }
+        const response = await modal.cpClient.sandboxList({
+          appId,
+          beforeTimestamp,
+          environmentName: modal.environmentName(),
+          includeFinished,
+          tags: []
+        });
+        if (!response.sandboxes.length) break;
+        sandboxes.push(...response.sandboxes);
+        const nextCursor = response.sandboxes[response.sandboxes.length - 1];
+        if (!nextCursor || nextCursor.createdAt === beforeTimestamp) break;
+        beforeTimestamp = nextCursor.createdAt;
+      }
+      return sandboxes;
+    };
+    formatSandboxStatus = (sandbox) => {
+      const result = sandbox.taskInfo?.result;
+      const status = result?.status ?? 0;
+      if (status === 0) return "running";
+      const label = FINISHED_STATUS_LABELS[status] ?? String(status);
+      const exitCode = result?.exitcode ?? "unknown";
+      return `finished:${label}:exit=${String(exitCode)}`;
+    };
+    isRunningSandbox = (sandbox) => (sandbox.taskInfo?.result?.status ?? 0) === 0;
+    resolveImageFromTag = async (modal, imageTag) => {
+      const secretName = trimEnv2(process.env.MODAL_SANDBOX_IMAGE_SECRET);
+      if (!secretName) {
+        return modal.images.fromRegistry(imageTag);
+      }
+      const secret = await modal.secrets.fromName(secretName);
+      if (imageTag.includes(".dkr.ecr.")) {
+        return modal.images.fromAwsEcr(imageTag, secret);
+      }
+      return modal.images.fromRegistry(imageTag, secret);
+    };
+    provisionModalSandbox = async (alias, options) => {
+      if (shouldUseControlPlaneFallback(options)) {
+        const controlPlaneToken = resolveControlPlaneToken(options);
+        if (!controlPlaneToken) {
+          throw new Error(
+            "Control plane token is required for modal provisioning."
+          );
+        }
+        return await provisionModalSandboxViaControlPlane(controlPlaneToken, alias);
+      }
+      const appName = resolveAppName();
+      const envImageTag = trimEnv2(process.env.MODAL_SANDBOX_IMAGE);
+      const imageTag = envImageTag || DEFAULT_MODAL_DEVBOX_IMAGE;
+      const resolvedImageTag = await resolveImageTagForBuild(imageTag);
+      const timeoutMs = resolveModalSandboxTimeoutMs();
+      const timeoutSecs = Math.max(1, Math.floor(timeoutMs / 1e3));
+      const regions = resolveRegions();
+      return await withModalClient(options, async (modal) => {
+        const sandboxName = resolveModalSandboxName(alias, modal.environmentName());
+        const app = await resolveModalApp(modal, appName, true);
+        if (!app) {
+          throw new Error(`Could not resolve Modal app "${appName}".`);
+        }
+        const buildImage = async (tag) => {
+          const image = await resolveImageFromTag(modal, tag);
+          return await image.build({ appId: app.appId });
+        };
+        const builtImage = await buildImage(resolvedImageTag);
+        const createResponse = await modal.cpClient.sandboxCreate({
+          appId: app.appId,
+          definition: {
+            imageId: builtImage.imageId,
+            timeoutSecs,
+            name: sandboxName,
+            ...regions.length > 0 ? { schedulerPlacement: { regions } } : {},
+            entrypointArgs: MODAL_DAEMON_SUPERVISOR_ENTRYPOINT,
+            enableSnapshot: true
+          }
+        });
+        return {
+          sandboxId: createResponse.sandboxId,
+          appId: app.appId,
+          appName,
+          imageTag: resolvedImageTag,
+          timeoutMs,
+          memorySnapshotEnabled: false,
+          regions
+        };
+      });
+    };
+    findModalSandbox = async (options, operationOptions) => {
+      if (shouldUseControlPlaneFallback(operationOptions)) {
+        const controlPlaneToken = resolveControlPlaneToken(operationOptions);
+        if (!controlPlaneToken) {
+          throw new Error(
+            "Control plane token is required for modal sandbox lookup."
+          );
+        }
+        return await findModalSandboxViaControlPlane(controlPlaneToken, options);
+      }
+      const appName = resolveAppName();
+      const includeFinished = options.includeFinished ?? true;
+      return await withModalClient(operationOptions, async (modal) => {
+        const sandboxName = resolveModalSandboxName(
+          options.alias,
+          modal.environmentName()
+        );
+        const app = await resolveModalApp(modal, appName, false);
+        if (!app) return null;
+        const sandboxes = await listSandboxesRaw(modal, app.appId, includeFinished);
+        const matching = sandboxes.filter((sandbox) => {
+          if (options.sandboxId && sandbox.id === options.sandboxId) return true;
+          return sandbox.name === sandboxName;
+        });
+        if (matching.length === 0) return null;
+        matching.sort((left, right) => {
+          const runningOrder = Number(isRunningSandbox(right)) - Number(isRunningSandbox(left));
+          if (runningOrder !== 0) return runningOrder;
+          return right.createdAt - left.createdAt;
+        });
+        const selected = matching[0];
+        if (!selected) {
+          throw new Error("Modal sandbox selection failed.");
+        }
+        return {
+          sandboxId: selected.id,
+          appId: app.appId,
+          appName: app.appName,
+          name: options.alias,
+          createdAt: selected.createdAt,
+          status: formatSandboxStatus(selected),
+          regions: selected.regions
+        };
+      });
+    };
+    terminateModalSandboxesByAlias = async (alias, options) => {
+      if (shouldUseControlPlaneFallback(options)) {
+        const controlPlaneToken = resolveControlPlaneToken(options);
+        if (!controlPlaneToken) {
+          throw new Error(
+            "Control plane token is required for modal sandbox termination."
+          );
+        }
+        return await terminateModalSandboxesByAliasViaControlPlane(
+          controlPlaneToken,
+          {
+            alias,
+            ...typeof options?.includeFinished === "boolean" ? { includeFinished: options.includeFinished } : {}
+          }
+        );
+      }
+      const appName = resolveAppName();
+      const includeFinished = options?.includeFinished ?? false;
+      return await withModalClient(options, async (modal) => {
+        const sandboxName = resolveModalSandboxName(alias, modal.environmentName());
+        const app = await resolveModalApp(modal, appName, false);
+        if (!app) {
+          return {
+            appName,
+            appId: null,
+            matchedSandboxIds: [],
+            terminatedSandboxIds: []
+          };
+        }
+        const sandboxes = await listSandboxesRaw(modal, app.appId, includeFinished);
+        const matching = sandboxes.filter(
+          (sandbox) => sandbox.name === sandboxName
+        );
+        const terminatedSandboxIds = [];
+        for (const sandbox of matching) {
+          await modal.cpClient.sandboxTerminate({ sandboxId: sandbox.id });
+          terminatedSandboxIds.push(sandbox.id);
+        }
+        return {
+          appName: app.appName,
+          appId: app.appId,
+          matchedSandboxIds: matching.map((sandbox) => sandbox.id),
+          terminatedSandboxIds
+        };
+      });
+    };
+  }
+});
+
 // src/devbox/commands/provider/modalRuntime.ts
 var import_node_path15, import_node_net3, import_ws4, SERVICE_NAME_PATTERN, CORE_SERVICE_NAMES2, MODAL_DAEMON_REQUEST_TIMEOUT_MS, MODAL_DAEMON_TTY_HANDSHAKE_TIMEOUT_MS, MODAL_SANDBOX_RESOLVE_TIMEOUT_MS, MODAL_DAEMON_CONTROL_HTTP_TIMEOUT_MS, MODAL_DAEMON_TTY_WS_PATH, validateServiceName, isSandboxNotFoundError, resolveReadPath, decodeBase642, parseJsonRecord2, withTimeout3, parseControlError, mapControlSessionRecord, normalizeServiceScope, normalizeServiceRestartPolicy, normalizeServiceStatus2, ModalDaemonExecSocket, createModalRuntimeClient;
 var init_modalRuntime = __esm({
@@ -198490,6 +199078,7 @@ var init_modalRuntime = __esm({
     import_ws4 = __toESM(require("ws"), 1);
     init_src();
     init_daemonClient();
+    init_modalLifecycle();
     SERVICE_NAME_PATTERN = /^[a-zA-Z0-9._-]+$/;
     CORE_SERVICE_NAMES2 = /* @__PURE__ */ new Set(["devbox-sprite-daemon", "devbox-sshd"]);
     MODAL_DAEMON_REQUEST_TIMEOUT_MS = 15e3;
@@ -198927,15 +199516,19 @@ var init_modalRuntime = __esm({
       serviceRole: requestedServiceRole
     }) => {
       let modal = null;
+      let modalSandboxName = alias;
       try {
         const modalCredentials = resolveModalClientCredentials({
           ...credentialMode ? { credentialMode } : {},
           ...credentials !== void 0 ? { credentials } : {},
           ...cwd ? { cwd } : {}
         });
+        const modalEnvironmentName = resolveModalEnvironmentName();
+        modalSandboxName = resolveModalSandboxName(alias, modalEnvironmentName);
         modal = new ModalClient2({
           tokenId: modalCredentials.tokenId,
-          tokenSecret: modalCredentials.tokenSecret
+          tokenSecret: modalCredentials.tokenSecret,
+          environment: modalEnvironmentName
         });
       } catch (error2) {
         if (!(error2 instanceof ProviderClientError && error2.code === "authentication_required")) {
@@ -198964,7 +199557,7 @@ var init_modalRuntime = __esm({
         sandboxPromise = (async () => {
           try {
             const runningSandbox = await withTimeout3(
-              directModal.sandboxes.fromName(appName, alias),
+              directModal.sandboxes.fromName(appName, modalSandboxName),
               MODAL_SANDBOX_RESOLVE_TIMEOUT_MS,
               "Timed out resolving running modal sandbox by name."
             );
@@ -199483,530 +200076,6 @@ var init_modalRuntime = __esm({
   }
 });
 
-// src/devbox/commands/provider/modalLifecycle.ts
-var import_node_crypto9, DEFAULT_APP_NAME, DEFAULT_MODAL_DEVBOX_IMAGE, DEFAULT_TIMEOUT_MS, IMAGE_TAG_RESOLUTION_CACHE_TTL_MS, SANDBOX_LIST_PAGE_LIMIT, MODAL_DAEMON_WRAPPER_PATH, MODAL_DAEMON_SUPERVISOR_ENTRYPOINT, FINISHED_STATUS_LABELS, REGISTRY_MANIFEST_ACCEPT_HEADER, resolvedImageTagCache, trimEnv2, parseRegistryImageTag, parseWwwAuthenticateBearer, fetchRegistryToken, resolveLatestImageTagToDigest, resolveImageTagForBuild, decodeJwtExpMs, createSafeModalAuthTokenManager, installSafeModalAuthTokenManager, parsePositiveInt, resolveRegions, resolveAppName, resolveModalSandboxTimeoutMs, isNotFoundError, isModalAlreadyExistsError, trimToNull, resolveControlPlaneToken, hasContextModalCredentialPair, shouldUseControlPlaneFallback, withModalClient, resolveModalApp, listSandboxesRaw, formatSandboxStatus, isRunningSandbox, resolveImageFromTag, provisionModalSandbox, findModalSandbox, terminateModalSandboxesByAlias;
-var init_modalLifecycle = __esm({
-  "src/devbox/commands/provider/modalLifecycle.ts"() {
-    "use strict";
-    init_src();
-    import_node_crypto9 = require("node:crypto");
-    init_dist5();
-    init_controlPlane();
-    DEFAULT_APP_NAME = "sandbox-modal-smoke";
-    DEFAULT_MODAL_DEVBOX_IMAGE = "public.ecr.aws/d8m4p4w9/modal-devbox:latest";
-    DEFAULT_TIMEOUT_MS = 24 * 60 * 60 * 1e3;
-    IMAGE_TAG_RESOLUTION_CACHE_TTL_MS = 5 * 60 * 1e3;
-    SANDBOX_LIST_PAGE_LIMIT = 100;
-    MODAL_DAEMON_WRAPPER_PATH = "/root/.devbox/daemon/run-daemon.sh";
-    MODAL_DAEMON_SUPERVISOR_ENTRYPOINT = [
-      "/bin/sh",
-      "-lc",
-      [
-        "set -u",
-        `wrapper=${JSON.stringify(MODAL_DAEMON_WRAPPER_PATH)}`,
-        'until [ -x "$wrapper" ]; do sleep 0.25; done',
-        "while true; do",
-        '  "$wrapper"',
-        "  status=$?",
-        '  echo "sprite-daemon exited with status $status; restarting" >&2',
-        "  sleep 1",
-        "done"
-      ].join("\n")
-    ];
-    FINISHED_STATUS_LABELS = {
-      1: "success",
-      2: "failure",
-      3: "terminated",
-      4: "timeout",
-      5: "init_failure",
-      6: "internal_failure",
-      7: "idle_timeout"
-    };
-    REGISTRY_MANIFEST_ACCEPT_HEADER = [
-      "application/vnd.oci.image.index.v1+json",
-      "application/vnd.oci.image.manifest.v1+json",
-      "application/vnd.docker.distribution.manifest.list.v2+json",
-      "application/vnd.docker.distribution.manifest.v2+json"
-    ].join(", ");
-    resolvedImageTagCache = /* @__PURE__ */ new Map();
-    trimEnv2 = (value) => value?.trim() ?? "";
-    parseRegistryImageTag = (imageTag) => {
-      const trimmed = imageTag.trim();
-      if (!trimmed || trimmed.includes("@")) {
-        return null;
-      }
-      const lastSlashIndex = trimmed.lastIndexOf("/");
-      const lastColonIndex = trimmed.lastIndexOf(":");
-      if (lastColonIndex <= lastSlashIndex) {
-        return null;
-      }
-      const repositoryWithHost = trimmed.slice(0, lastColonIndex);
-      const tag = trimmed.slice(lastColonIndex + 1).trim();
-      if (!repositoryWithHost || !tag) {
-        return null;
-      }
-      const firstSlashIndex = repositoryWithHost.indexOf("/");
-      if (firstSlashIndex <= 0) {
-        return null;
-      }
-      const registryHost = repositoryWithHost.slice(0, firstSlashIndex);
-      const repository = repositoryWithHost.slice(firstSlashIndex + 1);
-      if (!repository) {
-        return null;
-      }
-      const hasExplicitRegistryHost = registryHost.includes(".") || registryHost.includes(":") || registryHost === "localhost";
-      if (!hasExplicitRegistryHost) {
-        return null;
-      }
-      return {
-        registryHost,
-        repository,
-        tag,
-        repositoryWithHost
-      };
-    };
-    parseWwwAuthenticateBearer = (headerValue) => {
-      const trimmed = headerValue.trim();
-      if (!trimmed.toLowerCase().startsWith("bearer ")) {
-        return null;
-      }
-      const attributes = /* @__PURE__ */ new Map();
-      for (const match2 of trimmed.slice("bearer ".length).matchAll(/([A-Za-z0-9_-]+)="([^"]*)"/g)) {
-        const [, key, value] = match2;
-        if (!key) {
-          continue;
-        }
-        attributes.set(key.toLowerCase(), value ?? "");
-      }
-      const realm = attributes.get("realm");
-      const service = attributes.get("service");
-      const scope = attributes.get("scope");
-      if (!realm || !service) {
-        return null;
-      }
-      return {
-        realm,
-        service,
-        scope: scope || null
-      };
-    };
-    fetchRegistryToken = async ({
-      realm,
-      service,
-      scope
-    }) => {
-      const tokenUrl = new URL(realm);
-      tokenUrl.searchParams.set("service", service);
-      if (scope) {
-        tokenUrl.searchParams.set("scope", scope);
-      }
-      const response = await fetch(tokenUrl.toString());
-      if (!response.ok) {
-        throw new Error(
-          `Container registry auth token request failed (${response.status}).`
-        );
-      }
-      const payload = await response.json();
-      const token = typeof payload.token === "string" ? payload.token.trim() : typeof payload.access_token === "string" ? payload.access_token.trim() : "";
-      if (!token) {
-        throw new Error("Container registry auth token response was empty.");
-      }
-      return token;
-    };
-    resolveLatestImageTagToDigest = async (parsed) => {
-      const manifestUrl = `https://${parsed.registryHost}/v2/${parsed.repository}/manifests/${encodeURIComponent(parsed.tag)}`;
-      const fetchManifest = async ({
-        method,
-        token: token2
-      }) => {
-        const headers = {
-          Accept: REGISTRY_MANIFEST_ACCEPT_HEADER
-        };
-        if (token2) {
-          headers.Authorization = `Bearer ${token2}`;
-        }
-        return await fetch(manifestUrl, {
-          headers,
-          method
-        });
-      };
-      let token = null;
-      let headResponse = await fetchManifest({ method: "HEAD" });
-      if (headResponse.status === 401) {
-        const authHeader = headResponse.headers.get("www-authenticate") ?? "";
-        const challenge = parseWwwAuthenticateBearer(authHeader);
-        if (!challenge) {
-          throw new Error(
-            `Container registry auth challenge missing or invalid for ${parsed.repositoryWithHost}:${parsed.tag}.`
-          );
-        }
-        token = await fetchRegistryToken(challenge);
-        headResponse = await fetchManifest({
-          method: "HEAD",
-          token
-        });
-      }
-      if (!headResponse.ok) {
-        throw new Error(
-          `Container registry manifest lookup failed for ${parsed.repositoryWithHost}:${parsed.tag} (${headResponse.status}).`
-        );
-      }
-      const headDigest = headResponse.headers.get("docker-content-digest")?.trim();
-      if (headDigest) {
-        return `${parsed.repositoryWithHost}@${headDigest}`;
-      }
-      const getResponse = await fetchManifest(
-        token ? {
-          method: "GET",
-          token
-        } : {
-          method: "GET"
-        }
-      );
-      if (!getResponse.ok) {
-        throw new Error(
-          `Container registry manifest body lookup failed for ${parsed.repositoryWithHost}:${parsed.tag} (${getResponse.status}).`
-        );
-      }
-      const headerDigest = getResponse.headers.get("docker-content-digest")?.trim();
-      if (headerDigest) {
-        return `${parsed.repositoryWithHost}@${headerDigest}`;
-      }
-      const manifestBytes = Buffer.from(await getResponse.arrayBuffer());
-      const bodyDigest = `sha256:${(0, import_node_crypto9.createHash)("sha256").update(manifestBytes).digest("hex")}`;
-      return `${parsed.repositoryWithHost}@${bodyDigest}`;
-    };
-    resolveImageTagForBuild = async (imageTag) => {
-      const parsed = parseRegistryImageTag(imageTag);
-      if (!parsed || parsed.tag !== "latest") {
-        return imageTag;
-      }
-      const cacheKey = `${parsed.repositoryWithHost}:${parsed.tag}`;
-      const now = Date.now();
-      const cached = resolvedImageTagCache.get(cacheKey);
-      if (cached && cached.expiresAt > now) {
-        return cached.value;
-      }
-      const resolved = await resolveLatestImageTagToDigest(parsed);
-      resolvedImageTagCache.set(cacheKey, {
-        value: resolved,
-        expiresAt: now + IMAGE_TAG_RESOLUTION_CACHE_TTL_MS
-      });
-      return resolved;
-    };
-    decodeJwtExpMs = (token) => {
-      const segments = token.split(".");
-      if (segments.length < 2) return null;
-      const payload = segments[1];
-      if (!payload) return null;
-      const normalized = payload.replace(/-/g, "+").replace(/_/g, "/");
-      const padLength = (4 - normalized.length % 4) % 4;
-      const padded = `${normalized}${"=".repeat(padLength)}`;
-      try {
-        const parsed = JSON.parse(
-          Buffer.from(padded, "base64").toString("utf8")
-        );
-        const exp = parsed.exp;
-        if (typeof exp !== "number" || !Number.isFinite(exp) || exp <= 0) {
-          return null;
-        }
-        return Math.floor(exp * 1e3);
-      } catch {
-        return null;
-      }
-    };
-    createSafeModalAuthTokenManager = (modal) => {
-      let token = "";
-      let tokenExpMs = 0;
-      let inFlight = null;
-      const TOKEN_REFRESH_SKEW_MS = 3e4;
-      const FALLBACK_TOKEN_TTL_MS = 15 * 60 * 1e3;
-      const hasFreshToken = () => token.length > 0 && Date.now() + TOKEN_REFRESH_SKEW_MS < tokenExpMs;
-      const fetchToken = async () => {
-        const authTokenGet = modal.cpClient.authTokenGet;
-        if (typeof authTokenGet !== "function") {
-          throw new Error("Modal auth token endpoint unavailable.");
-        }
-        const response = await authTokenGet({});
-        const nextToken = typeof response?.token === "string" ? response.token.trim() : "";
-        if (!nextToken) {
-          throw new Error("Modal auth token unavailable.");
-        }
-        token = nextToken;
-        tokenExpMs = decodeJwtExpMs(nextToken) ?? Date.now() + FALLBACK_TOKEN_TTL_MS;
-        return nextToken;
-      };
-      return {
-        start: () => {
-        },
-        stop: () => {
-          token = "";
-          tokenExpMs = 0;
-          inFlight = null;
-        },
-        getToken: async () => {
-          if (hasFreshToken()) return token;
-          if (!inFlight) {
-            inFlight = fetchToken().finally(() => {
-              inFlight = null;
-            });
-          }
-          return await inFlight;
-        }
-      };
-    };
-    installSafeModalAuthTokenManager = (modal) => {
-      const candidate = modal;
-      if (candidate.authTokenManager) return;
-      candidate.authTokenManager = createSafeModalAuthTokenManager(candidate);
-    };
-    parsePositiveInt = (value, fallback2) => {
-      const parsed = Number.parseInt(value, 10);
-      if (!Number.isFinite(parsed) || parsed <= 0) return fallback2;
-      return parsed;
-    };
-    resolveRegions = () => {
-      const raw = trimEnv2(process.env.MODAL_SANDBOX_REGION);
-      if (!raw) return [];
-      return raw.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
-    };
-    resolveAppName = () => trimEnv2(process.env.MODAL_SANDBOX_APP) || DEFAULT_APP_NAME;
-    resolveModalSandboxTimeoutMs = () => parsePositiveInt(
-      trimEnv2(process.env.MODAL_SANDBOX_TIMEOUT_MS),
-      DEFAULT_TIMEOUT_MS
-    );
-    isNotFoundError = (error2) => error2 instanceof NotFoundError;
-    isModalAlreadyExistsError = (error2) => {
-      if (error2 instanceof AlreadyExistsError) {
-        return true;
-      }
-      const message = error2 instanceof Error ? `${error2.name} ${error2.message}` : String(error2 ?? "");
-      if (/\bALREADY_EXISTS\b/i.test(message)) {
-        return true;
-      }
-      return /already exists/i.test(message);
-    };
-    trimToNull = (value) => {
-      if (typeof value !== "string") return null;
-      const trimmed = value.trim();
-      return trimmed.length > 0 ? trimmed : null;
-    };
-    resolveControlPlaneToken = (options) => trimToNull(options?.credentials?.controlPlaneToken);
-    hasContextModalCredentialPair = (options) => Boolean(
-      trimToNull(options?.credentials?.modalTokenId) && trimToNull(options?.credentials?.modalTokenSecret)
-    );
-    shouldUseControlPlaneFallback = (options) => !options?.client && Boolean(resolveControlPlaneToken(options)) && !hasContextModalCredentialPair(options);
-    withModalClient = async (options, fn) => {
-      if (options?.client) {
-        return await fn(options.client);
-      }
-      const modalCredentials = resolveModalClientCredentials({
-        ...options?.credentialMode ? { credentialMode: options.credentialMode } : {},
-        ...options?.credentials !== void 0 ? { credentials: options.credentials } : {},
-        ...options?.cwd ? { cwd: options.cwd } : {}
-      });
-      const modal = new ModalClient2({
-        tokenId: modalCredentials.tokenId,
-        tokenSecret: modalCredentials.tokenSecret
-      });
-      installSafeModalAuthTokenManager(modal);
-      try {
-        return await fn(modal);
-      } finally {
-        modal.close();
-      }
-    };
-    resolveModalApp = async (modal, appName, createIfMissing) => {
-      try {
-        const app = await modal.apps.fromName(appName, { createIfMissing });
-        return { appId: app.appId, appName };
-      } catch (error2) {
-        if (!createIfMissing && isNotFoundError(error2)) {
-          return null;
-        }
-        throw error2;
-      }
-    };
-    listSandboxesRaw = async (modal, appId, includeFinished) => {
-      const sandboxes = [];
-      let beforeTimestamp = 0;
-      let guard = 0;
-      while (true) {
-        guard += 1;
-        if (guard > SANDBOX_LIST_PAGE_LIMIT) {
-          throw new Error("Modal sandbox list pagination exceeded safety limit.");
-        }
-        const response = await modal.cpClient.sandboxList({
-          appId,
-          beforeTimestamp,
-          environmentName: modal.environmentName(),
-          includeFinished,
-          tags: []
-        });
-        if (!response.sandboxes.length) break;
-        sandboxes.push(...response.sandboxes);
-        const nextCursor = response.sandboxes[response.sandboxes.length - 1];
-        if (!nextCursor || nextCursor.createdAt === beforeTimestamp) break;
-        beforeTimestamp = nextCursor.createdAt;
-      }
-      return sandboxes;
-    };
-    formatSandboxStatus = (sandbox) => {
-      const result = sandbox.taskInfo?.result;
-      const status = result?.status ?? 0;
-      if (status === 0) return "running";
-      const label = FINISHED_STATUS_LABELS[status] ?? String(status);
-      const exitCode = result?.exitcode ?? "unknown";
-      return `finished:${label}:exit=${String(exitCode)}`;
-    };
-    isRunningSandbox = (sandbox) => (sandbox.taskInfo?.result?.status ?? 0) === 0;
-    resolveImageFromTag = async (modal, imageTag) => {
-      const secretName = trimEnv2(process.env.MODAL_SANDBOX_IMAGE_SECRET);
-      if (!secretName) {
-        return modal.images.fromRegistry(imageTag);
-      }
-      const secret = await modal.secrets.fromName(secretName);
-      if (imageTag.includes(".dkr.ecr.")) {
-        return modal.images.fromAwsEcr(imageTag, secret);
-      }
-      return modal.images.fromRegistry(imageTag, secret);
-    };
-    provisionModalSandbox = async (alias, options) => {
-      if (shouldUseControlPlaneFallback(options)) {
-        const controlPlaneToken = resolveControlPlaneToken(options);
-        if (!controlPlaneToken) {
-          throw new Error(
-            "Control plane token is required for modal provisioning."
-          );
-        }
-        return await provisionModalSandboxViaControlPlane(controlPlaneToken, alias);
-      }
-      const appName = resolveAppName();
-      const envImageTag = trimEnv2(process.env.MODAL_SANDBOX_IMAGE);
-      const imageTag = envImageTag || DEFAULT_MODAL_DEVBOX_IMAGE;
-      const resolvedImageTag = await resolveImageTagForBuild(imageTag);
-      const timeoutMs = resolveModalSandboxTimeoutMs();
-      const timeoutSecs = Math.max(1, Math.floor(timeoutMs / 1e3));
-      const regions = resolveRegions();
-      return await withModalClient(options, async (modal) => {
-        const app = await resolveModalApp(modal, appName, true);
-        if (!app) {
-          throw new Error(`Could not resolve Modal app "${appName}".`);
-        }
-        const buildImage = async (tag) => {
-          const image = await resolveImageFromTag(modal, tag);
-          return await image.build({ appId: app.appId });
-        };
-        const builtImage = await buildImage(resolvedImageTag);
-        const createResponse = await modal.cpClient.sandboxCreate({
-          appId: app.appId,
-          definition: {
-            imageId: builtImage.imageId,
-            timeoutSecs,
-            name: alias,
-            ...regions.length > 0 ? { schedulerPlacement: { regions } } : {},
-            entrypointArgs: MODAL_DAEMON_SUPERVISOR_ENTRYPOINT,
-            enableSnapshot: true
-          }
-        });
-        return {
-          sandboxId: createResponse.sandboxId,
-          appId: app.appId,
-          appName,
-          imageTag: resolvedImageTag,
-          timeoutMs,
-          memorySnapshotEnabled: false,
-          regions
-        };
-      });
-    };
-    findModalSandbox = async (options, operationOptions) => {
-      if (shouldUseControlPlaneFallback(operationOptions)) {
-        const controlPlaneToken = resolveControlPlaneToken(operationOptions);
-        if (!controlPlaneToken) {
-          throw new Error(
-            "Control plane token is required for modal sandbox lookup."
-          );
-        }
-        return await findModalSandboxViaControlPlane(controlPlaneToken, options);
-      }
-      const appName = resolveAppName();
-      const includeFinished = options.includeFinished ?? true;
-      return await withModalClient(operationOptions, async (modal) => {
-        const app = await resolveModalApp(modal, appName, false);
-        if (!app) return null;
-        const sandboxes = await listSandboxesRaw(modal, app.appId, includeFinished);
-        const matching = sandboxes.filter((sandbox) => {
-          if (options.sandboxId && sandbox.id === options.sandboxId) return true;
-          return sandbox.name === options.alias;
-        });
-        if (matching.length === 0) return null;
-        matching.sort((left, right) => {
-          const runningOrder = Number(isRunningSandbox(right)) - Number(isRunningSandbox(left));
-          if (runningOrder !== 0) return runningOrder;
-          return right.createdAt - left.createdAt;
-        });
-        const selected = matching[0];
-        if (!selected) {
-          throw new Error("Modal sandbox selection failed.");
-        }
-        return {
-          sandboxId: selected.id,
-          appId: app.appId,
-          appName: app.appName,
-          name: selected.name,
-          createdAt: selected.createdAt,
-          status: formatSandboxStatus(selected),
-          regions: selected.regions
-        };
-      });
-    };
-    terminateModalSandboxesByAlias = async (alias, options) => {
-      if (shouldUseControlPlaneFallback(options)) {
-        const controlPlaneToken = resolveControlPlaneToken(options);
-        if (!controlPlaneToken) {
-          throw new Error(
-            "Control plane token is required for modal sandbox termination."
-          );
-        }
-        return await terminateModalSandboxesByAliasViaControlPlane(
-          controlPlaneToken,
-          {
-            alias,
-            ...typeof options?.includeFinished === "boolean" ? { includeFinished: options.includeFinished } : {}
-          }
-        );
-      }
-      const appName = resolveAppName();
-      const includeFinished = options?.includeFinished ?? false;
-      return await withModalClient(options, async (modal) => {
-        const app = await resolveModalApp(modal, appName, false);
-        if (!app) {
-          return {
-            appName,
-            appId: null,
-            matchedSandboxIds: [],
-            terminatedSandboxIds: []
-          };
-        }
-        const sandboxes = await listSandboxesRaw(modal, app.appId, includeFinished);
-        const matching = sandboxes.filter((sandbox) => sandbox.name === alias);
-        const terminatedSandboxIds = [];
-        for (const sandbox of matching) {
-          await modal.cpClient.sandboxTerminate({ sandboxId: sandbox.id });
-          terminatedSandboxIds.push(sandbox.id);
-        }
-        return {
-          appName: app.appName,
-          appId: app.appId,
-          matchedSandboxIds: matching.map((sandbox) => sandbox.id),
-          terminatedSandboxIds
-        };
-      });
-    };
-  }
-});
-
 // src/devbox/commands/providerClient.ts
 var CORE_SERVICE_NAMES3, DEFAULT_MODAL_APP_NAME, normalizeServiceStatus3, mapSpriteServiceToProviderRecord2, mapProviderUpsertToSpriteInput2, trimToNull2, normalizeEpochToIso, resolveModalRuntimeSeedAppName, createProviderCredentialContext, resolveModalCommandOperationOptions, throwModalNotImplemented2, MODAL_AUTH_ERROR_CODES, normalizeModalErrorCode, extractModalErrorCode, isModalAuthError, rethrowModalOperationError, mapModalRecordToProviderInstance, createModalCommandProviderClient, createCommandProviderClient;
 var init_providerClient = __esm({
@@ -205365,7 +205434,7 @@ var init_session3 = __esm({
         nonInteractive || shouldResume && initState?.steps.codexApplied
       );
       const skipCodexCliEnsure = Boolean(
-        skipCodexApply || shouldResume && initState?.steps.codexCliEnsured
+        shouldResume && initState?.steps.codexCliEnsured
       );
       return {
         initState,
@@ -206416,7 +206485,16 @@ var init_remote2 = __esm({
       });
     };
     ensureRemoteCodexInstalled = async (client2, spriteAlias) => {
-      const pathSetup = 'export PATH="$(npm bin -g 2>/dev/null):$PATH"';
+      const installScript = [
+        "set -euo pipefail",
+        'prefix="${HOME}/.local"',
+        'npm install -g --prefix "$prefix" @openai/codex --loglevel=error',
+        'if [ ! -x "$prefix/bin/codex" ]; then',
+        '  echo "codex binary missing at $prefix/bin/codex" >&2',
+        "  exit 1",
+        "fi",
+        '"$prefix/bin/codex" --version >/dev/null'
+      ].join("\n");
       const install = await client2.exec(spriteAlias, [
         "/bin/bash",
         "--noprofile",
@@ -206426,8 +206504,7 @@ var init_remote2 = __esm({
         "-o",
         "pipefail",
         "-c",
-        `${pathSetup}
-npm install -g @openai/codex`
+        installScript
       ]);
       if (install.exitCode !== 0) {
         throw new Error(install.stderr || "Failed to install/upgrade Codex.");
@@ -211015,7 +211092,7 @@ ${sshResult.stderr}`.trim();
 });
 
 // src/devbox/commands/init/claudeBootstrap.ts
-var import_promises29, import_node_path32, import_node_crypto16, import_node_child_process11, import_node_os17, import_node_util5, REMOTE_CLAUDE_DIR, REMOTE_CLAUDE_JSON_PATH, REMOTE_CLAUDE_CONFIG_OVERRIDE_PATH, REMOTE_CLAUDE_SETTINGS_PATH, REMOTE_CLAUDE_CREDENTIALS_PATH, REMOTE_CLAUDE_MD_PATH, REMOTE_CLAUDE_PLUGINS_DIR, REMOTE_CLAUDE_PLUGINS_CONFIG_PATH, CLAUDE_STATE_VARIANT_PATTERN, SECURITY_TIMEOUT_MS, OAUTH_SERVICE_SUFFIX_CANDIDATES, CLAUDE_ROOT_ALLOWLIST, CLAUDE_PROJECT_ALLOWLIST, isRecord2, hasOwn, execFileAsync, stripLeadingBom, getExecErrorStatus, getExecErrorCode, parseJsonRecord3, uniquePaths, resolveLocalClaudeDirCandidates, resolveLocalClaudeStateBaseDir, resolveLocalClaudeStorageDir, getCredentialStorageHashSuffix, getOauthServiceSuffixCandidates, resolveClaudeCredentialKeychainServices, resolveClaudeCredentialKeychainAccounts, listClaudeStateVariantPaths, readFileIfExists, findFirstExistingFile, readLocalClaudeStateSource, resolveLocalClaudeFilePath, readLocalClaudeFile, readLocalClaudeSettings, extractClaudeOauthRecord, readClaudeOauthFromKeychain, readLocalClaudeOauthCredentials, normalizeLocalRepoRootCandidates, copyAllowlistedKeys, buildBootstrapClaudeState, mergeClaudeSettingsForDevbox, isNotFoundError2, readRemoteFileIfExists, ensureRemoteClaudeDirectories, applyRemoteClaudePermissions, bootstrapRemoteClaudeConfig;
+var import_promises29, import_node_path32, import_node_crypto16, import_node_child_process11, import_node_os17, import_node_util5, REMOTE_CLAUDE_DIR, REMOTE_CLAUDE_JSON_PATH, REMOTE_CLAUDE_CONFIG_OVERRIDE_PATH, REMOTE_CLAUDE_SETTINGS_PATH, REMOTE_CLAUDE_CREDENTIALS_PATH, REMOTE_CLAUDE_MD_PATH, REMOTE_CLAUDE_PLUGINS_DIR, REMOTE_CLAUDE_PLUGINS_CONFIG_PATH, CLAUDE_STATE_VARIANT_PATTERN, SECURITY_TIMEOUT_MS, OAUTH_SERVICE_SUFFIX_CANDIDATES, CLAUDE_ROOT_ALLOWLIST, CLAUDE_PROJECT_ALLOWLIST, isRecord2, hasOwn, execFileAsync, stripLeadingBom, getExecErrorStatus, getExecErrorExitCode, parseJsonRecord3, uniquePaths, resolveLocalClaudeDirCandidates, resolveLocalClaudeStateBaseDir, resolveLocalClaudeStorageDir, getCredentialStorageHashSuffix, getOauthServiceSuffixCandidates, resolveClaudeCredentialKeychainServices, resolveClaudeCredentialKeychainAccounts, listClaudeStateVariantPaths, readFileIfExists, findFirstExistingFile, readLocalClaudeStateSource, resolveLocalClaudeFilePath, readLocalClaudeFile, readLocalClaudeSettings, extractClaudeOauthRecord, readClaudeOauthFromKeychain, readLocalClaudeOauthCredentials, normalizeLocalRepoRootCandidates, copyAllowlistedKeys, buildBootstrapClaudeState, mergeClaudeSettingsForDevbox, isNotFoundError2, readRemoteFileIfExists, ensureRemoteClaudeDirectories, applyRemoteClaudePermissions, bootstrapRemoteClaudeConfig;
 var init_claudeBootstrap = __esm({
   "src/devbox/commands/init/claudeBootstrap.ts"() {
     "use strict";
@@ -211094,10 +211171,15 @@ var init_claudeBootstrap = __esm({
       const status = error2.status;
       return typeof status === "number" ? status : null;
     };
-    getExecErrorCode = (error2) => {
+    getExecErrorExitCode = (error2) => {
       if (!error2 || typeof error2 !== "object") return null;
       const code2 = error2.code;
-      return typeof code2 === "string" ? code2 : null;
+      if (typeof code2 === "number") return code2;
+      if (typeof code2 === "string") {
+        const parsed = Number.parseInt(code2, 10);
+        return Number.isNaN(parsed) ? null : parsed;
+      }
+      return null;
     };
     parseJsonRecord3 = (value, sourcePath) => {
       const parsed = JSON.parse(stripLeadingBom(value.toString("utf8")));
@@ -211141,7 +211223,15 @@ var init_claudeBootstrap = __esm({
     };
     getOauthServiceSuffixCandidates = () => {
       const preferred = process.env.CLAUDE_CODE_CUSTOM_OAUTH_URL ? "-custom-oauth" : "";
-      return uniquePaths([preferred, ...OAUTH_SERVICE_SUFFIX_CANDIDATES]);
+      const ordered = [preferred, ...OAUTH_SERVICE_SUFFIX_CANDIDATES];
+      const seen = /* @__PURE__ */ new Set();
+      const candidates = [];
+      for (const suffix of ordered) {
+        if (seen.has(suffix)) continue;
+        seen.add(suffix);
+        candidates.push(suffix);
+      }
+      return candidates;
     };
     resolveClaudeCredentialKeychainServices = () => {
       const storageHashSuffix = getCredentialStorageHashSuffix();
@@ -211323,13 +211413,13 @@ var init_claudeBootstrap = __esm({
             };
           } catch (error2) {
             const status = getExecErrorStatus(error2);
-            if (status === 44) {
+            const exitCode = getExecErrorExitCode(error2);
+            if (status === 44 || exitCode === 44) {
               continue;
             }
             if (!warning) {
-              const code2 = getExecErrorCode(error2);
               const rawMessage = error2 instanceof Error ? error2.message : String(error2);
-              const detail = status ? `status ${status}` : code2 ? `code ${code2}` : rawMessage;
+              const detail = status ? `status ${status}` : exitCode !== null ? `code ${exitCode}` : rawMessage;
               warning = `Failed to copy Claude OAuth credentials from macOS Keychain (${detail}).`;
             }
             continue;
@@ -213663,7 +213753,7 @@ var init_init = __esm({
           ".devbox",
           "setup-artifacts.parts.json"
         );
-        const pathSetup = 'export PATH="$(npm bin -g 2>/dev/null):$PATH"';
+        const pathSetup = 'export PATH="$HOME/.local/bin:$(npm bin -g 2>/dev/null || true):$PATH"';
         let canonical = alias;
         let projectCreatedAt = existingEntry?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
         let projectLocalPaths = mergeLocalPaths(
@@ -220157,4 +220247,4 @@ smol-toml/dist/index.js:
 */
 //# sourceMappingURL=dvb.cjs.map
 
-//# debugId=080b5259-7ff1-5cae-8b1d-315abb34a68e
+//# debugId=b785e941-0159-5a32-9ac9-c3686e30d3af