@codions/portta 0.0.0-develop.171.sha-d749180 → 0.0.0-develop.172.sha-10ce987

package/dist/host.js

@@ -40819,7 +40819,6 @@ var RUNTIME_IDENTITY = {
   tmuxBufferPrefix: `${APP_SLUG}-prompt`,
   dockerContainerPrefix: APP_SLUG,
   tempUploadDir: `${APP_SLUG}-uploads`,
-  dockerImage: "portta-sandbox",
   gitBaseConfigKey: `${APP_SLUG}.base`
 };
 var LINEAR_IDENTITY = {
@@ -40929,41 +40928,11 @@ import { readFileSync as readFileSync2 } from "node:fs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { dirname as dirname2, resolve } from "node:path";
 var import_yaml = __toESM(require_dist(), 1);
-
-// ../host/src/modules/taskflow/lib/log.ts
-var DEBUG = process.env[ENV_NAMES.debug] === "1";
-function ts() {
-  return (/* @__PURE__ */ new Date()).toISOString().slice(11, 23);
-}
-function redactSecrets(text) {
-  return text.replace(/Bearer\s+\S+/gi, "Bearer [REDACTED]").replace(new RegExp(`(${ENV_NAMES.controlToken}=)\\S+`, "gi"), "$1[REDACTED]");
-}
-function safe(msg) {
-  return redactSecrets(msg);
-}
-var log = {
-  info(msg) {
-    console.log(`[${ts()}] ${safe(msg)}`);
-  },
-  debug(msg) {
-    if (DEBUG) console.log(`[${ts()}] ${safe(msg)}`);
-  },
-  warn(msg) {
-    console.warn(`[${ts()}] ${safe(msg)}`);
-  },
-  error(msg, err2) {
-    const redacted = safe(msg);
-    err2 !== void 0 ? console.error(`[${ts()}] ${redacted}`, err2) : console.error(`[${ts()}] ${redacted}`);
-  }
-};
-
-// ../host/src/modules/taskflow/adapters/config.ts
 function parseWorktreeRoot(raw2, fallback) {
   if (!isRecord(raw2)) return fallback;
   if (isRecord(raw2.worktrees) && typeof raw2.worktrees.root === "string" && raw2.worktrees.root.trim()) {
     return raw2.worktrees.root.trim();
   }
-  if (typeof raw2.worktreeRoot === "string" && raw2.worktreeRoot.trim()) return raw2.worktreeRoot.trim();
   return fallback;
 }
 function parseExposure(raw2) {
@@ -41108,18 +41077,15 @@ function parseProfile(raw2, fallbackRuntime) {
     ...typeof raw2.environment.cwd === "string" && raw2.environment.cwd.trim() ? { cwd: raw2.environment.cwd.trim() } : {},
     ...typeof raw2.environment.stopCommand === "string" && raw2.environment.stopCommand.trim() ? { stopCommand: raw2.environment.stopCommand.trim() } : {}
   } : void 0;
-  const legacyRuntimePane = environment && (environment.provider === "host" || environment.provider === "auto") && !environment.command ? panes.find((pane) => pane.id === "app" && pane.kind === "command" && Boolean(pane.command)) : void 0;
-  const effectiveEnvironment = legacyRuntimePane ? { ...environment, command: legacyRuntimePane.command } : environment;
-  const effectivePanes = legacyRuntimePane ? panes.filter((pane) => pane !== legacyRuntimePane) : panes;
   return {
     runtime,
     envPassthrough,
     ...raw2.yolo === true ? { yolo: true } : {},
-    panes: effectivePanes,
+    panes,
     ...typeof raw2.systemPrompt === "string" && raw2.systemPrompt.length > 0 ? { systemPrompt: raw2.systemPrompt } : {},
     ...image ? { image } : {},
     ...mounts ? { mounts } : {},
-    ...effectiveEnvironment && Object.keys(effectiveEnvironment).length > 0 ? { environment: effectiveEnvironment } : {}
+    ...environment && Object.keys(environment).length > 0 ? { environment } : {}
   };
 }
 function parseProfiles(raw2, includeDefaultProfile) {
@@ -41278,17 +41244,10 @@ function parseTeamKeyList(raw2) {
   const keys = raw2.filter((entry) => typeof entry === "string").map((entry) => entry.trim().toUpperCase()).filter((entry) => entry.length > 0);
   return keys.length > 0 ? Array.from(new Set(keys)) : void 0;
 }
-var warnedLegacyLinearTeamId = false;
 function parseLinearIntegration(parsed) {
   const defaults = DEFAULT_CONFIG.integrations.linear;
   const linear = isRecord(parsed.integrations) && isRecord(parsed.integrations.linear) ? parsed.integrations.linear : null;
   if (!linear) return { ...defaults };
-  if (typeof linear.teamId === "string" && !warnedLegacyLinearTeamId) {
-    warnedLegacyLinearTeamId = true;
-    log.warn(
-      "[config] integrations.linear.teamId is no longer used \u2014 the ticket team is now picked at creation time in the dashboard"
-    );
-  }
   const watchTeams = parseTeamKeyList(linear.watchTeams);
   return {
     enabled: typeof linear.enabled === "boolean" ? linear.enabled : defaults.enabled,
@@ -48005,6 +47964,35 @@ exec ${JSON.stringify(executable)} "$@"
 // ../host/src/modules/taskflow/adapters/projects-registry.ts
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, renameSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname6 } from "node:path";
+
+// ../host/src/modules/taskflow/lib/log.ts
+var DEBUG = process.env[ENV_NAMES.debug] === "1";
+function ts() {
+  return (/* @__PURE__ */ new Date()).toISOString().slice(11, 23);
+}
+function redactSecrets(text) {
+  return text.replace(/Bearer\s+\S+/gi, "Bearer [REDACTED]").replace(new RegExp(`(${ENV_NAMES.controlToken}=)\\S+`, "gi"), "$1[REDACTED]");
+}
+function safe(msg) {
+  return redactSecrets(msg);
+}
+var log = {
+  info(msg) {
+    console.log(`[${ts()}] ${safe(msg)}`);
+  },
+  debug(msg) {
+    if (DEBUG) console.log(`[${ts()}] ${safe(msg)}`);
+  },
+  warn(msg) {
+    console.warn(`[${ts()}] ${safe(msg)}`);
+  },
+  error(msg, err2) {
+    const redacted = safe(msg);
+    err2 !== void 0 ? console.error(`[${ts()}] ${redacted}`, err2) : console.error(`[${ts()}] ${redacted}`);
+  }
+};
+
+// ../host/src/modules/taskflow/adapters/projects-registry.ts
 function defaultRegistryFile() {
   return globalPaths().projectsRegistry;
 }
@@ -50900,25 +50888,21 @@ function isRecord5(raw2) {
 function normalizeConversationMeta(raw2) {
   if (!raw2) return raw2;
   if (raw2.provider === "codexAppServer") {
-    const conversationId2 = raw2.conversationId || raw2.threadId;
-    const threadId = raw2.threadId || raw2.conversationId;
-    if (!conversationId2 || !threadId) return void 0;
+    if (!raw2.conversationId || !raw2.threadId) return void 0;
     const normalized2 = {
       provider: "codexAppServer",
-      conversationId: conversationId2,
-      threadId,
+      conversationId: raw2.conversationId,
+      threadId: raw2.threadId,
       cwd: raw2.cwd,
       lastSeenAt: raw2.lastSeenAt
     };
     return normalized2;
   }
-  const conversationId = raw2.conversationId || raw2.sessionId;
-  const sessionId = raw2.sessionId || raw2.conversationId;
-  if (!conversationId || !sessionId) return void 0;
+  if (!raw2.conversationId || !raw2.sessionId) return void 0;
   const normalized = {
     provider: "claudeCode",
-    conversationId,
-    sessionId,
+    conversationId: raw2.conversationId,
+    sessionId: raw2.sessionId,
     cwd: raw2.cwd,
     lastSeenAt: raw2.lastSeenAt
   };
@@ -53336,10 +53320,7 @@ ${oneshotPrompt}` : oneshotPrompt ?? baseSystemPrompt;
       return panes.length > 0 ? panes : [{ id: "runtime", kind: "runtime", cwd: "worktree" }];
     }
     if (panes.some((pane) => pane.kind === "runtime")) return panes;
-    const legacyShell = panes.findIndex((pane) => pane.id === "shell" && pane.kind === "shell");
-    const runtimePane = { id: "runtime", kind: "runtime", split: "right", sizePct: 30, cwd: "worktree" };
-    if (legacyShell >= 0) panes.splice(legacyShell, 1, runtimePane);
-    else panes.push(runtimePane);
+    panes.push({ id: "runtime", kind: "runtime", split: "right", sizePct: 30, cwd: "worktree" });
     return panes;
   }
   requireDockerProfile(profile) {
@@ -60041,10 +60022,15 @@ var migrations = [
       input_json TEXT NOT NULL,
       status TEXT NOT NULL CHECK(status IN ('queued', 'provisioning', 'running', 'waiting_input', 'completed', 'failed', 'cancelled', 'interrupted')),
       workspace_policy TEXT NOT NULL CHECK(workspace_policy IN ('none', 'run')),
+      workspace_strategy TEXT CHECK(workspace_strategy IN ('isolated_worktree', 'new_branch', 'current_branch')),
+      workspace_access TEXT CHECK(workspace_access IN ('shared_read', 'exclusive_write')),
       workflow_snapshot_id TEXT,
       workspace_id TEXT,
       worktree_path TEXT,
       canonical_workspace_path TEXT,
+      checkout_canonical_path TEXT,
+      checkout_branch TEXT,
+      environment_id TEXT,
       branch TEXT,
       base_branch TEXT,
       base_commit TEXT,
@@ -60072,6 +60058,7 @@ var migrations = [
       path TEXT NOT NULL,
       content_hash TEXT NOT NULL,
       engine_version TEXT NOT NULL,
+      key_version TEXT NOT NULL DEFAULT 'v1',
       source TEXT NOT NULL,
       metadata_json TEXT NOT NULL,
       created_at TEXT NOT NULL
@@ -60096,6 +60083,7 @@ var migrations = [
       error TEXT,
       session_id TEXT,
       capabilities_json TEXT,
+      checkpoint_json TEXT,
       started_at TEXT,
       completed_at TEXT,
       UNIQUE(run_id, node_key, attempt)
@@ -60107,10 +60095,7 @@ var migrations = [
       source TEXT NOT NULL,
       updated_at TEXT NOT NULL
     );
-  `,
-  "ALTER TABLE executions ADD COLUMN checkpoint_json TEXT;",
-  "ALTER TABLE workflow_snapshots ADD COLUMN key_version TEXT NOT NULL DEFAULT 'v1';",
-  `
+
     CREATE TABLE IF NOT EXISTS run_events (
       id TEXT PRIMARY KEY,
       run_id TEXT NOT NULL REFERENCES runs(id),
@@ -60123,8 +60108,7 @@ var migrations = [
       payload_json TEXT NOT NULL,
       UNIQUE(run_id, sequence)
     );
-  `,
-  `
+
     CREATE TABLE IF NOT EXISTS workspace_leases (
       id TEXT PRIMARY KEY,
       run_id TEXT NOT NULL REFERENCES runs(id),
@@ -60142,12 +60126,7 @@ var migrations = [
       updated_at TEXT NOT NULL,
       released_at TEXT
     );
-  `,
-  "ALTER TABLE runs ADD COLUMN workspace_strategy TEXT CHECK(workspace_strategy IN ('isolated_worktree', 'new_branch', 'current_branch'));",
-  "ALTER TABLE runs ADD COLUMN workspace_access TEXT CHECK(workspace_access IN ('shared_read', 'exclusive_write'));",
-  "ALTER TABLE runs ADD COLUMN checkout_canonical_path TEXT;",
-  "ALTER TABLE runs ADD COLUMN checkout_branch TEXT;",
-  `
+
     CREATE TABLE IF NOT EXISTS checkout_claims (
       run_id TEXT PRIMARY KEY REFERENCES runs(id),
       project_id TEXT NOT NULL,
@@ -60156,8 +60135,7 @@ var migrations = [
       created_at TEXT NOT NULL
     );
     CREATE INDEX IF NOT EXISTS checkout_claims_path_idx ON checkout_claims(project_id, canonical_path);
-  `,
-  "ALTER TABLE runs ADD COLUMN environment_id TEXT;"
+  `
 ];
 function defaultRunStorePath() {
   return globalPaths().database;
@@ -70927,7 +70905,7 @@ function createProjectApp(runtime, instancePrefix, host) {
   const reconciliationService = runtime.reconciliationService;
   const codexAppServerClient = new CodexAppServerClient({
     clientName: RUNTIME_IDENTITY.codexClientName,
-    clientVersion: "0.0.0"
+    clientVersion: PORTTA_FLOW_VERSION
   });
   const claudeCliClient = new ClaudeCliClient();
   const worktreeConversationService = new WorktreeConversationService({
@@ -72364,8 +72342,8 @@ function createTaskflowHost(options) {
     manager,
     apps,
     allowlist: options.projectAllowlist,
-    // Tracks leftover on-add setup records for API compatibility. Registration
-    // no longer scaffolds or launches an agent; `taskflow init` remains the authoring path.
+    // Backs the project-setup status listing. Registration itself does not
+    // scaffold or launch an agent; `taskflow init` is the authoring path.
     initTracker: new ProjectInitTracker(),
     closeSockets: (prefix) => sockets.closeProject(prefix)
   });
@@ -72428,7 +72406,7 @@ function createDaemonTaskflowHost(context) {
       port: hostListen(env2).port,
       workflowBuiltinsDir: taskflowAssets(env2).workflowBuiltinsDir,
       version: env2.PORTTA_VERSION || "0.0.0-local",
-      buildDate: true ? "2026-09-18T00:56:55Z" : (/* @__PURE__ */ new Date()).toISOString(),
+      buildDate: true ? "2026-09-18T02:24:34Z" : (/* @__PURE__ */ new Date()).toISOString(),
       environmentStore: createEnvironmentStore(paths.database),
       hostEnvironmentProvider: new HostEnvironmentProvider(),
       devContainerProvider: new DevContainerProvider(),
@@ -73666,24 +73644,6 @@ var upgradeWebSocket = defineWebSocketHelper(async (c, events, options) => {
 // ../core/src/diagnostics.ts
 var ENVIRONMENT_COLLECT_INTERVAL_MS = 5 * 60 * 1e3;
 
-// ../core/src/endpoints.ts
-var PROVIDERS = [
-  { id: "internal", scope: "internal", requires: null, optional: false },
-  { id: "local", scope: "local", requires: "localhost", optional: false },
-  { id: "lan", scope: "lan", requires: "lan", optional: true },
-  { id: "tailscale", scope: "private", requires: "tailscale", optional: true },
-  { id: "tailscale-serve", scope: "private", requires: "tailscale-https", optional: true },
-  { id: "public-ip", scope: "public", requires: "public-ipv4", optional: true },
-  { id: "auto-domain", scope: "public", requires: "auto-domain", optional: true },
-  { id: "custom-domain", scope: "public", requires: "custom-domain", optional: true },
-  { id: "cloudflare-tunnel", scope: "public", requires: "cloudflare-tunnel", optional: true },
-  { id: "bridge", scope: "local", requires: null, optional: true }
-];
-var PROVIDERS_BY_ID = new Map(PROVIDERS.map((spec) => [spec.id, spec]));
-
-// ../core/src/host.ts
-var MIB = 1024 * 1024;
-
 // ../core/src/metrics.ts
 var HISTORY_RETENTION_SECONDS = 60 * 60;
 var DOCKER_SIZE_UNITS = {

package/dist/runtime/.env.example

@@ -1,4 +1,3 @@
-# Portta environment structure: 1
 # ============================================================================
 # Portta: configuration
 # ============================================================================
@@ -28,7 +27,7 @@ PORTTA_PROJECT_NAME=portta
 # Changing it changes the reference; files are not moved.
 # Default: ~/projects (user) or /srv/projects (root). Not PORTTA_HOME.
 PORTTA_PROJECTS_HOME=
-# PORTTA_PROJECTS_HOME=
+# PORTTA_PROJECTS_HOME=/srv/projects
 
 # Shared external Docker network that consumer projects attach published
 # HTTP services to. Created by `bootstrap`, never removed automatically.
@@ -57,10 +56,6 @@ PORTTA_ACCESS_LOG=false
 # The remote-public profile raises this to `delete` on its own.
 PORTTA_ALIAS_HEADERS_STRATEGY=keep
 
-# ----------------------------------------------------------------------------
-# Local profile
-# ----------------------------------------------------------------------------
-
 # ----------------------------------------------------------------------------
 # Project domain: what every project hostname is built on
 # ----------------------------------------------------------------------------
@@ -185,7 +180,7 @@ PORTTA_PANEL_ADVERTISED_HOST=
 # access mode turns it on by itself.
 PORTTA_WEB_READ_ONLY=false
 
-# The panel's own front door, which is now the panel's own business.
+# The panel's own front door.
 #
 #   disabled  every request is the local operator. Legal wherever the set of
 #             people who can reach the panel is already an authenticated set:
@@ -264,19 +259,15 @@ PORTTA_WEB_DEV=false
 
 # Private, internal network carrying panel -> its own Docker socket proxy.
 PORTTA_WEB_NETWORK=portta-web
-# Host uid:gid, filled once by preparation so the containers can read/write state.
+# The host uid:gid the panel and the authentication service run as. .env is
+# owner-only, so the panel has to run as whoever owns it or the Settings page
+# cannot save; the authentication service reads .env once and the owner-only
+# protection store on every request. `setup`, `bootstrap` and `web up` record
+# "$(id -u):$(id -g)" here when it is missing; the image's own `node` is only
+# right when the host uid happens to be 1000.
 PORTTA_WEB_USER=
 PORTTA_AUTH_USER=
-
-# User the panel container runs as. .env is owner-only, so the panel has to run
-# as whoever owns it or the Settings page cannot save. `bootstrap`, `web up` and
-# the installer record "$(id -u):$(id -g)" here when it is missing; the image's
-# own `node` is only right when the host uid happens to be 1000.
 # PORTTA_WEB_USER=1000:1000
-
-# The user the authentication service runs as. Same reason as above: it reads
-# .env once and the owner-only protection store on every request, and both
-# belong to whoever installed Portta. The installer records the right value.
 # PORTTA_AUTH_USER=1000:1000
 
 # ----------------------------------------------------------------------------

package/dist/runtime/VERSION

@@ -1 +1 @@
-0.0.0-develop.171.sha-d749180
+0.0.0-develop.172.sha-10ce987

package/dist/runtime/docker/compose/features/panel-host.yaml

@@ -9,11 +9,10 @@
 # WebSocket through its authorised proxy
 # (docs/development/adr/0047-host-daemon-and-panel-proxy.md).
 #
-# This used to ride with Task Flow, because Task Flow was the only thing that
-# needed the host. Issues need it too, and Issues are the panel's work surface
-# now (docs/development/adr/0018-github-issues-through-the-gh-cli.md) — so the
-# connection is part of having a panel, and Task Flow is left as the switch for
-# its own routes.
+# Issues are the panel's work surface and are read through the daemon
+# (docs/development/adr/0018-github-issues-through-the-gh-cli.md), so the
+# connection is part of having a panel. PORTTA_TASKFLOW only switches Task
+# Flow's own routes on; it does not decide whether this overlay applies.
 #
 # What this adds to the panel, and nothing else
 # ----------------------------------------------

package/dist/runtime/templates/README.md

@@ -1,11 +1,14 @@
 # Templates
 
-Reference overlays for the shapes a project usually has. They are **references
-to copy from**, not runtime that projects depend on: nothing here is included,
-mounted or extended by a consumer project. Copy the closest one, adjust the
-service names and ports, and it is yours.
-
-`portta env init <path>` generates the same thing from a project's actual
+Reference overlays for the shapes a project usually has, for **manual mode**:
+a project that owns its own `compose.portta.yaml` instead of the overlay
+`portta adopt` generates (see
+[Add an existing project](../docs/product/guides/adopting-projects.md#manual-mode)).
+They are **references to copy from**, not runtime that projects depend on:
+nothing here is included, mounted or extended by a consumer project. Copy the
+closest one, adjust the service names and ports, and it is yours.
+
+`portta envs init <path>` generates the same thing from a project's actual
 Compose file, which is usually faster.
 
 | Template | Shape |

package/dist/runtime/templates/overlays/07-worktree.env

@@ -15,7 +15,7 @@
 # The original environment keeps running. Nothing inside the project changed.
 # Derive the name instead of inventing one:
 #
-#   portta env namespace
+#   portta envs namespace
 # ============================================================================
 
 COMPOSE_PROJECT_NAME=base-empresarial-issue59

package/dist/runtime/templates/project/PORTTA.md

@@ -1,8 +1,8 @@
 # Running this project on Portta
 
 > Copy this file into the project and adjust the names. It covers only what
-> someone working on *this* project needs. The rules themselves live in the Dev
-> Gateway repository, which stays the single source of truth.
+> someone working on *this* project needs. The rules themselves live in the
+> Portta repository, which stays the single source of truth.
 
 ## Prerequisites
 
@@ -71,7 +71,7 @@ Credentials are this project's, from its own `.env`.
 ## Working on two branches at once
 
 ```bash
-git worktree add ../<project>-issue59 issue59
+git worktree add --relative-paths ../<project>-issue59 issue59
 cd ../<project>-issue59
 echo "COMPOSE_PROJECT_NAME=<project>-issue59" >> .env
 docker compose -f compose.yaml -f compose.portta.yaml up -d

package/dist/supervisor.js

@@ -79,7 +79,6 @@ var RUNTIME_IDENTITY = {
   tmuxBufferPrefix: `${APP_SLUG}-prompt`,
   dockerContainerPrefix: APP_SLUG,
   tempUploadDir: `${APP_SLUG}-uploads`,
-  dockerImage: "portta-sandbox",
   gitBaseConfigKey: `${APP_SLUG}.base`
 };
 var LINEAR_IDENTITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codions/portta",
-  "version": "0.0.0-develop.171.sha-d749180",
+  "version": "0.0.0-develop.172.sha-10ce987",
   "description": "Machine-first CLI for a shared Docker development gateway",
   "license": "MIT",
   "type": "module",
@@ -19,10 +19,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run",
     "prepack": "npm run build",
-    "prepublishOnly": "npm run typecheck && npm test",
-    "preversion": "node scripts/git-version.mjs check",
-    "version": "node scripts/git-version.mjs sync",
-    "postversion": "node scripts/git-version.mjs verify"
+    "prepublishOnly": "npm run typecheck && npm test"
   },
   "engines": {
     "node": ">=24"

package/dist/runtime/config/traefik/dynamic/auth.example.yaml.disabled

@@ -1,24 +0,0 @@
-# ============================================================================
-# Portta project protection: the working middleware is generated for you
-# ============================================================================
-# Do not copy this file into the dynamic directory. `portta-auth.yaml` already
-# defines `portta-forward-auth`; this disabled example documents the project
-# label that opts one existing router into it.
-#
-# 1. Create or rotate the host credential:
-#
-#      portta auth protect demo-web.example.com --project demo --service web
-#
-# 2. Add the middleware to that project's own router:
-#
-#      labels:
-#        - "traefik.http.routers.demo-web.middlewares=portta-forward-auth@file"
-#
-# Portta deliberately does not edit a consumer project's labels. The project
-# owns that router; Portta owns only the credential, login route and ForwardAuth
-# middleware. `/__portta/auth` is reserved on every protected hostname.
-#
-# To remove the credential (the project label remains yours to remove):
-#
-#      portta auth unprotect demo-web.example.com
-# ============================================================================

package/dist/runtime/docker/images/README.md

@@ -1,12 +0,0 @@
-# Operational images
-
-These directories are self-contained build contexts for images used by the
-Portta runtime rather than by a Compose service directly:
-
-- `apply/` builds the opt-in applier that recreates the gateway after settings
-  change.
-- `toolbox/` builds the pinned diagnostic and database-client toolbox.
-
-Application images stay with their applications. In particular,
-`apps/web/Dockerfile` remains under `apps/web` because it builds the web and
-authentication workspaces from the repository-root context.

package/dist/runtime/docker/images/sandbox/Dockerfile

@@ -1,79 +0,0 @@
-# syntax=docker/dockerfile:1.7
-
-FROM node:24-bookworm-slim
-
-ENV AWS_DEFAULT_REGION=auto \
-    DEBIAN_FRONTEND=noninteractive \
-    DISABLE_UPDATES=1 \
-    NPM_CONFIG_PREFIX=/usr/local \
-    PATH="/root/.local/bin:/usr/local/bin:/root/.bun/bin:/root/.cargo/bin:${PATH}" \
-    PLAYWRIGHT_BROWSERS_PATH=/ms-playwright \
-    PORTTA_FLOW_SANDBOX_MANIFEST=/etc/taskflow-sandbox/manifest.json
-
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends \
-        build-essential \
-        ca-certificates \
-        curl \
-        git \
-        gnupg \
-        groff \
-        jq \
-        less \
-        openssh-client \
-        ripgrep \
-        sudo \
-        unzip \
-    && rm -rf /var/lib/apt/lists/*
-
-ARG TARGETARCH
-ARG ASCIINEMA_VERSION=3.2.1
-ARG ASCIINEMA_SHA256_AMD64=1b405bbda565b33c3c4718de67fedc3535580603c0694b1ff3fb04f363430a20
-ARG ASCIINEMA_SHA256_ARM64=b516a6d896844c0ffbc96e0a55afe4cbcc79216abde0fc64fdda4e39bee421ea
-
-RUN case "${TARGETARCH}" in \
-        amd64) target=x86_64; sha256="${ASCIINEMA_SHA256_AMD64}" ;; \
-        arm64) target=aarch64; sha256="${ASCIINEMA_SHA256_ARM64}" ;; \
-        *) echo "Unsupported asciinema architecture: ${TARGETARCH}" >&2; exit 1 ;; \
-    esac \
-    && curl -fsSL -o /usr/local/bin/asciinema \
-        "https://github.com/asciinema/asciinema/releases/download/v${ASCIINEMA_VERSION}/asciinema-${target}-unknown-linux-gnu" \
-    && echo "${sha256}  /usr/local/bin/asciinema" | sha256sum -c - \
-    && chmod 0755 /usr/local/bin/asciinema
-
-COPY --chmod=0755 agents/ /usr/local/lib/taskflow-sandbox/agents/
-COPY --chmod=0755 scripts/ /usr/local/lib/taskflow-sandbox/scripts/
-
-ARG BUILD_DATE=unknown
-ARG BUILD_ID=local
-ARG SANDBOX_VERSION=dev
-ARG TOOLS_REFRESH=local
-ARG VCS_REF=unknown
-
-# TOOLS_REFRESH deliberately invalidates only the high-cadence tool layer.
-RUN echo "Refreshing volatile tools: ${TOOLS_REFRESH}" \
-    && TARGETARCH="${TARGETARCH}" /usr/local/lib/taskflow-sandbox/scripts/install-tools.sh \
-    && install -d -m 0755 /etc/taskflow-sandbox \
-    && SANDBOX_VERSION="${SANDBOX_VERSION}" \
-       BUILD_DATE="${BUILD_DATE}" \
-       BUILD_ID="${BUILD_ID}" \
-       VCS_REF="${VCS_REF}" \
-       node /usr/local/lib/taskflow-sandbox/scripts/generate-manifest.mjs "${PORTTA_FLOW_SANDBOX_MANIFEST}" \
-    && /usr/local/lib/taskflow-sandbox/scripts/verify-image.sh
-
-# Task Flow runs containers with the host UID/GID. Keep HOME traversable and
-# writable while tools remain installed read-only under /usr/local.
-RUN usermod -l agent -d /root -s /bin/bash node \
-    && echo "agent ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/agent \
-    && chmod 0440 /etc/sudoers.d/agent \
-    && chmod -R 0777 /root /ms-playwright \
-    && ln -sf /usr/local/lib/taskflow-sandbox/scripts/entrypoint.sh /usr/local/bin/entrypoint.sh
-
-LABEL org.opencontainers.image.created="${BUILD_DATE}" \
-      org.opencontainers.image.description="Universal Task Flow agent sandbox" \
-      org.opencontainers.image.revision="${VCS_REF}" \
-      org.opencontainers.image.source="https://github.com/codions-labs/task-flow" \
-      org.opencontainers.image.title="Task Flow Sandbox" \
-      org.opencontainers.image.version="${SANDBOX_VERSION}"
-
-CMD ["sleep", "infinity"]