@fitlab-ai/agent-infra 0.7.4 → 0.7.6

package/bin/cli.ts

@@ -12,17 +12,19 @@ if (major < 22) {
 
 const USAGE = `agent-infra ${VERSION} - bootstrap AI collaboration infrastructure
 
-Usage:
-  agent-infra cp <ssh-alias>  Copy local clipboard image to a remote macOS NSPasteboard
-  agent-infra help            Show this help message
-  agent-infra init            Initialize a new project with update-agent-infra seed command
-  agent-infra merge           Merge tasks from another workspace directory (active/blocked/completed/archive)
-  agent-infra sandbox         Manage Docker-based AI sandboxes
-  agent-infra task            Read-only views over .agents/workspace tasks (ls / show / files / cat / status / log / grep)
-  agent-infra update          Update seed files and sync file registry for an existing project
-  agent-infra version         Show version
+Usage: ai <command> [options]
 
-Shorthand: ai (e.g. ai init)
+Commands:
+  cp <ssh-alias>  Copy local clipboard image to a remote macOS NSPasteboard
+  help            Show this help message
+  init            Initialize a new project with update-agent-infra seed command
+  merge           Merge tasks from another workspace directory (active/blocked/completed/archive)
+  sandbox         Manage Docker-based AI sandboxes
+  task            Read-only views over .agents/workspace tasks (cat / files / grep / log / ls / show / status)
+  update          Update seed files and sync file registry for an existing project
+  version         Show version
+
+'ai' and 'agent-infra' are interchangeable; 'ai' is the shorter form.
 
 Install methods:
   npm:   npm install -g @fitlab-ai/agent-infra
@@ -31,7 +33,7 @@ Install methods:
   curl:  curl -fsSL https://raw.githubusercontent.com/fitlab-ai/agent-infra/main/install.sh | sh  (runs npm install -g internally)
 
 Examples:
-  cd my-project && agent-infra init
+  cd my-project && ai init
   npx @fitlab-ai/agent-infra init
 `;
 

package/dist/bin/cli.js

@@ -16,17 +16,19 @@ if (major < 22) {
 }
 const USAGE = `agent-infra ${VERSION} - bootstrap AI collaboration infrastructure
 
-Usage:
-  agent-infra cp <ssh-alias>  Copy local clipboard image to a remote macOS NSPasteboard
-  agent-infra help            Show this help message
-  agent-infra init            Initialize a new project with update-agent-infra seed command
-  agent-infra merge           Merge tasks from another workspace directory (active/blocked/completed/archive)
-  agent-infra sandbox         Manage Docker-based AI sandboxes
-  agent-infra task            Read-only views over .agents/workspace tasks (ls / show / files / cat / status / log / grep)
-  agent-infra update          Update seed files and sync file registry for an existing project
-  agent-infra version         Show version
+Usage: ai <command> [options]
 
-Shorthand: ai (e.g. ai init)
+Commands:
+  cp <ssh-alias>  Copy local clipboard image to a remote macOS NSPasteboard
+  help            Show this help message
+  init            Initialize a new project with update-agent-infra seed command
+  merge           Merge tasks from another workspace directory (active/blocked/completed/archive)
+  sandbox         Manage Docker-based AI sandboxes
+  task            Read-only views over .agents/workspace tasks (cat / files / grep / log / ls / show / status)
+  update          Update seed files and sync file registry for an existing project
+  version         Show version
+
+'ai' and 'agent-infra' are interchangeable; 'ai' is the shorter form.
 
 Install methods:
   npm:   npm install -g @fitlab-ai/agent-infra
@@ -35,7 +37,7 @@ Install methods:
   curl:  curl -fsSL https://raw.githubusercontent.com/fitlab-ai/agent-infra/main/install.sh | sh  (runs npm install -g internally)
 
 Examples:
-  cd my-project && agent-infra init
+  cd my-project && ai init
   npx @fitlab-ai/agent-infra init
 `;
 const command = process.argv[2] || '';

package/dist/lib/init.js

@@ -70,7 +70,7 @@ function parseLocalSources(input) {
 }
 async function cmdInit() {
     console.log('');
-    console.log('  agent-infra init');
+    console.log('  ai init');
     console.log('  ================================');
     console.log('  Optional template and skill sources can be added now or later in .agents/.airc.json.');
     console.log('');

package/dist/lib/merge.js

@@ -702,7 +702,7 @@ function printReport(report) {
 async function cmdMerge(args) {
     const sourcePath = args[0];
     if (!sourcePath) {
-        throw new Error('Usage: agent-infra merge <source-path>');
+        throw new Error('Usage: ai merge <source-path>');
     }
     const resolvedSource = path.resolve(sourcePath);
     if (!fs.existsSync(resolvedSource)) {

package/dist/lib/sandbox/commands/create.js

@@ -820,6 +820,12 @@ function runEngineTaskCommand(engine, cmd, args, opts = {}) {
     const command = commandForEngine(engine, cmd, args);
     return runTaskCommand(command.cmd, command.args, opts);
 }
+// `docker run` args for mounting a tool's containerMount as an in-container
+// tmpfs. containerMount is an in-container path, so it is NOT engine-converted.
+export function buildTmpfsRunArgs(containerMount, tmpfs) {
+    const size = tmpfs.size ?? '512m';
+    return ['--tmpfs', `${containerMount}:rw,size=${size}`];
+}
 export function buildImage(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, runVerboseFn = runVerboseEngine, env = process.env } = {}) {
     const selectedEngine = engine ?? detectEngine({ engine: config.engine });
     const { uid: hostUid, gid: hostGid } = resolveBuildUid({
@@ -1076,10 +1082,8 @@ export async function create(args) {
                             // The TUI reads <toolDir>/opencode.json via OPENCODE_CONFIG pinned in tools.js.
                             ensureOpenCodeModelInheritance(opencodeEntry.dir, effectiveConfig.home);
                         }
-                        const toolVolumes = effectiveResolvedTools.flatMap(({ tool, dir }) => [
-                            '-v',
-                            volumeArg(engine, dir, tool.containerMount)
-                        ]);
+                        const toolVolumes = effectiveResolvedTools.flatMap(({ tool, dir }) => tool.tmpfs ? [] : ['-v', volumeArg(engine, dir, tool.containerMount)]);
+                        const tmpfsArgs = effectiveResolvedTools.flatMap(({ tool }) => tool.tmpfs ? buildTmpfsRunArgs(tool.containerMount, tool.tmpfs) : []);
                         const workspaceDir = path.join(effectiveConfig.repoRoot, '.agents', 'workspace');
                         hostShellConfig = prepareHostShellConfig({
                             home: effectiveConfig.home,
@@ -1091,6 +1095,22 @@ export async function create(args) {
                             '-v',
                             volumeArg(engine, hostPath, containerPath, ':ro')
                         ]);
+                        // A tmpfs containerMount starts empty, so the config seeded into the
+                        // host dir before launch would be invisible in-container. Bind only
+                        // the explicitly declared seed entries (config.toml, model-catalogs)
+                        // back over the tmpfs as nested mounts — the same proven mechanism as
+                        // hostLiveMounts/auth.json, established at `docker run` time (no
+                        // post-start `docker cp`, which can land under a freshly-mounted
+                        // tmpfs instead of inside it). The allowlist is deliberate: any
+                        // runtime files left in the host dir (e.g. a stale logs_2.sqlite or
+                        // sessions/ from a previous bind-mount era) must NOT be re-mounted,
+                        // or the high-churn writes would land on the host SSD again.
+                        const tmpfsSeedVolumes = effectiveResolvedTools.flatMap(({ tool, dir }) => (tool.tmpfs?.seed ?? []).flatMap((entry) => {
+                            const hostPath = path.join(dir, entry);
+                            return fs.existsSync(hostPath)
+                                ? ['-v', volumeArg(engine, hostPath, path.posix.join(tool.containerMount, entry))]
+                                : [];
+                        }));
                         const liveMountVolumes = effectiveResolvedTools.flatMap(({ tool }) => (tool.hostLiveMounts ?? [])
                             .filter(({ hostPath }) => fs.existsSync(hostPath))
                             .flatMap(({ hostPath, containerSubpath }) => [
@@ -1133,6 +1153,8 @@ export async function create(args) {
                             volumeArg(engine, hostJoin(effectiveConfig.home, '.ssh'), '/home/devuser/.ssh', ':ro'),
                             ...dotfilesMount,
                             ...toolVolumes,
+                            ...tmpfsArgs,
+                            ...tmpfsSeedVolumes,
                             ...liveMountVolumes,
                             ...shellConfigVolumes,
                             ...envFile.dockerArgs,

package/dist/lib/sandbox/index.js

@@ -6,9 +6,6 @@ Commands:
                                Enter sandbox or run a command. N (bare) is the
                                recommended form for task short ids (e.g.
                                'ai sandbox exec 11'); '#N' is also accepted.
-  start <branch | TASK-id | N | '#N'>
-                               Start an existing stopped sandbox container
-                               (e.g. after the Docker daemon restarted)
   ls                           List sandboxes for the current project (the '#'
                                column is a display-only row number; the 'SHORT'
                                column shows the active task short id, '-' if none)
@@ -19,6 +16,9 @@ Commands:
   rm <branch> | --all | --purge
                                Remove one sandbox, all sandboxes not bound to an
                                active task (--all), or tear down everything (--purge)
+  start <branch | TASK-id | N | '#N'>
+                               Start an existing stopped sandbox container
+                               (e.g. after the Docker daemon restarted)
   vm status|start|stop         Manage the sandbox VM (macOS) or check the backend (Windows)
 
 Run 'ai sandbox <command> --help' for details.`;
@@ -47,6 +47,21 @@ export async function runSandbox(args) {
             }
             break;
         }
+        case 'ls': {
+            const { ls } = await import("./commands/ls.js");
+            ls(rest);
+            break;
+        }
+        case 'prune': {
+            const { prune } = await import("./commands/prune.js");
+            await prune(rest);
+            break;
+        }
+        case 'rebuild': {
+            const { rebuild } = await import("./commands/rebuild.js");
+            await rebuild(rest);
+            break;
+        }
         case 'refresh': {
             const { refresh } = await import("./commands/refresh.js");
             const exitCode = await refresh(rest);
@@ -55,24 +70,14 @@ export async function runSandbox(args) {
             }
             break;
         }
-        case 'start': {
-            const { start } = await import("./commands/start.js");
-            await start(rest);
-            break;
-        }
-        case 'ls': {
-            const { ls } = await import("./commands/ls.js");
-            ls(rest);
-            break;
-        }
         case 'rm': {
             const { rm } = await import("./commands/rm.js");
             await rm(rest);
             break;
         }
-        case 'prune': {
-            const { prune } = await import("./commands/prune.js");
-            await prune(rest);
+        case 'start': {
+            const { start } = await import("./commands/start.js");
+            await start(rest);
             break;
         }
         case 'vm': {
@@ -80,11 +85,6 @@ export async function runSandbox(args) {
             await vm(rest);
             break;
         }
-        case 'rebuild': {
-            const { rebuild } = await import("./commands/rebuild.js");
-            await rebuild(rest);
-            break;
-        }
         default:
             throw new Error(`Unknown sandbox command: ${subcommand}`);
     }

package/dist/lib/sandbox/tools.js

@@ -41,6 +41,12 @@ function createBuiltinTools(home, project) {
             containerMount: '/home/devuser/.codex',
             versionCmd: 'codex --version',
             setupHint: 'Run codex once inside the container and choose Device Code login if needed.',
+            // codex churns ~/.codex/logs_2.sqlite heavily (upstream openai/codex#24275);
+            // a bind-mount would write-amplify onto the host SSD via virtiofs. Mount the
+            // codex home as tmpfs so those logs stay in RAM and die with the container.
+            // Only the seeded config (config.toml, model-catalogs) is bound back over
+            // the tmpfs; runtime files like logs_2.sqlite must stay in RAM.
+            tmpfs: { size: '512m', seed: ['config.toml', 'model-catalogs'] },
             hostLiveMounts: [
                 { hostPath: hostJoin(home, '.codex', 'auth.json'), containerSubpath: 'auth.json' }
             ],
@@ -218,6 +224,18 @@ function parseHostLiveMounts(value, context) {
         };
     });
 }
+function parseTmpfs(value, context) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!isPlainObject(value)) {
+        throw new Error(`${context}: field "tmpfs" must be an object when provided`);
+    }
+    return {
+        size: asOptionalNonEmptyString(value.size, 'tmpfs.size', context),
+        seed: asStringArray(value.seed, 'tmpfs.seed', context)
+    };
+}
 export function parseCustomTool(entry, index, options) {
     const context = `customTools[${index}]`;
     if (!isPlainObject(entry)) {
@@ -246,7 +264,8 @@ export function parseCustomTool(entry, index, options) {
         hostPreSeedDirs: parseHostPreSeedDirs(entry.hostPreSeedDirs, context),
         pathRewriteFiles: asStringArray(entry.pathRewriteFiles, 'pathRewriteFiles', context),
         hostLiveMounts: parseHostLiveMounts(entry.hostLiveMounts, context),
-        postSetupCmds: asStringArray(entry.postSetupCmds, 'postSetupCmds', context)
+        postSetupCmds: asStringArray(entry.postSetupCmds, 'postSetupCmds', context),
+        tmpfs: parseTmpfs(entry.tmpfs, context)
     };
     validateTool(tool);
     return tool;

package/dist/lib/task/commands/log.js

@@ -3,12 +3,14 @@ import { formatTable } from "../../table.js";
 import { resolveTaskRef } from "../resolve-ref.js";
 const USAGE = `Usage: ai task log <N | #N | TASK-id>
 
-Renders a task's activity log as a chronological timeline table.
+Renders a task's activity log as a per-step status table. A step's start and
+completion are paired onto one row: STARTED holds the start time, DONE the
+completion time (or '(in progress)' while still running).
   <ref>   Bare numeric / '#N' short id, or a full TASK-YYYYMMDD-HHMMSS id.
 
-Columns: # (timeline position) / TIME / STEP / AGENT / NOTE
+Columns: # (row) / STEP / AGENT / STARTED / DONE / NOTE
 `;
-const TABLE_HEADERS = ['#', 'TIME', 'STEP', 'AGENT', 'NOTE'];
+const TABLE_HEADERS = ['#', 'STEP', 'AGENT', 'STARTED', 'DONE', 'NOTE'];
 // The activity-log H2 heading is language-dependent (zh template / en template).
 const HEADING_RE = /^##\s+(活动日志|Activity Log)\s*$/;
 const NEXT_H2_RE = /^##\s/;
@@ -16,6 +18,11 @@ const NEXT_H2_RE = /^##\s/;
 // (U+2014). STEP/AGENT are non-greedy so a note that itself contains ' — ' or
 // '→' is not mis-split; NOTE greedily takes the rest of the line.
 const ENTRY_RE = /^- (\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}[+-]\d{2}:\d{2}) — \*\*(.+?)\*\* by (.+?) — (.*)$/;
+// A start marker reuses the normal entry grammar and only suffixes its action
+// with ` [started]`; the matching done entry carries the identical base action
+// without the suffix. Pairing therefore keys on the base action (including any
+// `(Round N)`), so every round and every repeated execution pairs on its own.
+const STARTED_SUFFIX_RE = /\s*\[started\]\s*$/;
 function parseActivityLog(content) {
     const lines = content.split('\n');
     let i = 0;
@@ -40,6 +47,41 @@ function parseActivityLog(content) {
     parsed.sort((a, b) => a.epoch - b.epoch || a.order - b.order);
     return { sectionFound: true, entries: parsed.map((p) => p.entry) };
 }
+// Collapse a chronological entry list into per-step rows: a `[started]` marker
+// opens a row, the next matching done entry fills it in place (FIFO per base
+// action). Started-only rows stay in flight; done-only entries (legacy logs with
+// no start marker) render as standalone rows. Result order = first-seen order,
+// which is already ascending because `entries` is sorted ascending.
+function pairEntries(entries) {
+    const rows = [];
+    const open = new Map();
+    for (const e of entries) {
+        const isStarted = STARTED_SUFFIX_RE.test(e.step);
+        const base = e.step.replace(STARTED_SUFFIX_RE, '');
+        if (isStarted) {
+            const row = { step: base, agent: e.agent, started: e.time, done: '', note: e.note };
+            rows.push(row);
+            const queue = open.get(base);
+            if (queue)
+                queue.push(row);
+            else
+                open.set(base, [row]);
+        }
+        else {
+            const pending = open.get(base)?.shift();
+            if (pending) {
+                // Done fills the open row; the done entry carries the meaningful note.
+                pending.done = e.time;
+                pending.agent = e.agent;
+                pending.note = e.note;
+            }
+            else {
+                rows.push({ step: base, agent: e.agent, started: '', done: e.time, note: e.note });
+            }
+        }
+    }
+    return rows;
+}
 function log(args = []) {
     if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
@@ -65,11 +107,19 @@ function log(args = []) {
         process.exitCode = 1;
         return;
     }
-    const rows = entries.map((e, idx) => [String(idx + 1), e.time, e.step, e.agent, e.note]);
+    const steps = pairEntries(entries);
+    const rows = steps.map((s, idx) => [
+        String(idx + 1),
+        s.step,
+        s.agent,
+        s.started,
+        s.done || (s.started ? '(in progress)' : ''),
+        s.note
+    ]);
     for (const line of formatTable(TABLE_HEADERS, rows, { zebra: Boolean(process.stdout.isTTY) })) {
         process.stdout.write(`${line}\n`);
     }
-    process.stdout.write(`Total: ${entries.length} entries\n`);
+    process.stdout.write(`Total: ${steps.length} steps\n`);
 }
-export { log, parseActivityLog };
+export { log, parseActivityLog, pairEntries };
 //# sourceMappingURL=log.js.map

package/dist/lib/task/index.js

@@ -34,14 +34,9 @@ export async function runTask(args) {
         return;
     }
     switch (subcommand) {
-        case 'ls': {
-            const { ls } = await import("./commands/ls.js");
-            ls(rest);
-            break;
-        }
-        case 'show': {
-            const { show } = await import("./commands/show.js");
-            show(rest);
+        case 'cat': {
+            const { cat } = await import("./commands/cat.js");
+            cat(rest);
             break;
         }
         case 'files': {
@@ -49,11 +44,6 @@ export async function runTask(args) {
             files(rest);
             break;
         }
-        case 'cat': {
-            const { cat } = await import("./commands/cat.js");
-            cat(rest);
-            break;
-        }
         case 'grep': {
             const { grep } = await import("./commands/grep.js");
             grep(rest);
@@ -64,6 +54,16 @@ export async function runTask(args) {
             log(rest);
             break;
         }
+        case 'ls': {
+            const { ls } = await import("./commands/ls.js");
+            ls(rest);
+            break;
+        }
+        case 'show': {
+            const { show } = await import("./commands/show.js");
+            show(rest);
+            break;
+        }
         case 'status': {
             const { status } = await import("./commands/status.js");
             status(rest);

package/dist/lib/update.js

@@ -83,7 +83,7 @@ function syncFileRegistry(config, platformType, enabledTUIs) {
 }
 async function cmdUpdate() {
     console.log('');
-    console.log('  agent-infra update');
+    console.log('  ai update');
     console.log('  ==================================');
     console.log('');
     // check config exists

package/lib/init.ts

@@ -119,7 +119,7 @@ function parseLocalSources(input: string): SourceEntry[] {
 
 async function cmdInit(): Promise<void> {
   console.log('');
-  console.log('  agent-infra init');
+  console.log('  ai init');
   console.log('  ================================');
   console.log('  Optional template and skill sources can be added now or later in .agents/.airc.json.');
   console.log('');

package/lib/merge.ts

@@ -901,7 +901,7 @@ function printReport(report: MergeReport): void {
 async function cmdMerge(args: string[]): Promise<void> {
   const sourcePath = args[0];
   if (!sourcePath) {
-    throw new Error('Usage: agent-infra merge <source-path>');
+    throw new Error('Usage: ai merge <source-path>');
   }
 
   const resolvedSource = path.resolve(sourcePath);

package/lib/sandbox/commands/create.ts

@@ -1084,6 +1084,13 @@ function runEngineTaskCommand(engine: string, cmd: string, args: string[], opts:
   return runTaskCommand(command.cmd, command.args, opts);
 }
 
+// `docker run` args for mounting a tool's containerMount as an in-container
+// tmpfs. containerMount is an in-container path, so it is NOT engine-converted.
+export function buildTmpfsRunArgs(containerMount: string, tmpfs: { size?: string }): string[] {
+  const size = tmpfs.size ?? '512m';
+  return ['--tmpfs', `${containerMount}:rw,size=${size}`];
+}
+
 export function buildImage(
   config: Pick<SandboxCreateConfig, 'project' | 'imageName' | 'repoRoot'> & { engine?: string | null },
   tools: SandboxTool[],
@@ -1397,10 +1404,12 @@ export async function create(args: string[]): Promise<void> {
               // The TUI reads <toolDir>/opencode.json via OPENCODE_CONFIG pinned in tools.js.
               ensureOpenCodeModelInheritance(opencodeEntry.dir, effectiveConfig.home);
             }
-            const toolVolumes = effectiveResolvedTools.flatMap(({ tool, dir }) => [
-              '-v',
-              volumeArg(engine, dir, tool.containerMount)
-            ]);
+            const toolVolumes = effectiveResolvedTools.flatMap(({ tool, dir }) =>
+              tool.tmpfs ? [] : ['-v', volumeArg(engine, dir, tool.containerMount)]
+            );
+            const tmpfsArgs = effectiveResolvedTools.flatMap(({ tool }) =>
+              tool.tmpfs ? buildTmpfsRunArgs(tool.containerMount, tool.tmpfs) : []
+            );
             const workspaceDir = path.join(effectiveConfig.repoRoot, '.agents', 'workspace');
             hostShellConfig = prepareHostShellConfig({
               home: effectiveConfig.home,
@@ -1412,6 +1421,24 @@ export async function create(args: string[]): Promise<void> {
               '-v',
               volumeArg(engine, hostPath, containerPath, ':ro')
             ]);
+            // A tmpfs containerMount starts empty, so the config seeded into the
+            // host dir before launch would be invisible in-container. Bind only
+            // the explicitly declared seed entries (config.toml, model-catalogs)
+            // back over the tmpfs as nested mounts — the same proven mechanism as
+            // hostLiveMounts/auth.json, established at `docker run` time (no
+            // post-start `docker cp`, which can land under a freshly-mounted
+            // tmpfs instead of inside it). The allowlist is deliberate: any
+            // runtime files left in the host dir (e.g. a stale logs_2.sqlite or
+            // sessions/ from a previous bind-mount era) must NOT be re-mounted,
+            // or the high-churn writes would land on the host SSD again.
+            const tmpfsSeedVolumes = effectiveResolvedTools.flatMap(({ tool, dir }) =>
+              (tool.tmpfs?.seed ?? []).flatMap((entry) => {
+                const hostPath = path.join(dir, entry);
+                return fs.existsSync(hostPath)
+                  ? ['-v', volumeArg(engine, hostPath, path.posix.join(tool.containerMount, entry))]
+                  : [];
+              })
+            );
             const liveMountVolumes = effectiveResolvedTools.flatMap(({ tool }) =>
               (tool.hostLiveMounts ?? [])
                 .filter(({ hostPath }) => fs.existsSync(hostPath))
@@ -1466,6 +1493,8 @@ export async function create(args: string[]): Promise<void> {
               volumeArg(engine, hostJoin(effectiveConfig.home, '.ssh'), '/home/devuser/.ssh', ':ro'),
               ...dotfilesMount,
               ...toolVolumes,
+              ...tmpfsArgs,
+              ...tmpfsSeedVolumes,
               ...liveMountVolumes,
               ...shellConfigVolumes,
               ...envFile.dockerArgs,

package/lib/sandbox/index.ts

@@ -6,9 +6,6 @@ Commands:
                                Enter sandbox or run a command. N (bare) is the
                                recommended form for task short ids (e.g.
                                'ai sandbox exec 11'); '#N' is also accepted.
-  start <branch | TASK-id | N | '#N'>
-                               Start an existing stopped sandbox container
-                               (e.g. after the Docker daemon restarted)
   ls                           List sandboxes for the current project (the '#'
                                column is a display-only row number; the 'SHORT'
                                column shows the active task short id, '-' if none)
@@ -19,6 +16,9 @@ Commands:
   rm <branch> | --all | --purge
                                Remove one sandbox, all sandboxes not bound to an
                                active task (--all), or tear down everything (--purge)
+  start <branch | TASK-id | N | '#N'>
+                               Start an existing stopped sandbox container
+                               (e.g. after the Docker daemon restarted)
   vm status|start|stop         Manage the sandbox VM (macOS) or check the backend (Windows)
 
 Run 'ai sandbox <command> --help' for details.`;
@@ -51,6 +51,21 @@ export async function runSandbox(args: string[]): Promise<void> {
       }
       break;
     }
+    case 'ls': {
+      const { ls } = await import('./commands/ls.ts');
+      ls(rest);
+      break;
+    }
+    case 'prune': {
+      const { prune } = await import('./commands/prune.ts');
+      await prune(rest);
+      break;
+    }
+    case 'rebuild': {
+      const { rebuild } = await import('./commands/rebuild.ts');
+      await rebuild(rest);
+      break;
+    }
     case 'refresh': {
       const { refresh } = await import('./commands/refresh.ts');
       const exitCode = await refresh(rest);
@@ -59,24 +74,14 @@ export async function runSandbox(args: string[]): Promise<void> {
       }
       break;
     }
-    case 'start': {
-      const { start } = await import('./commands/start.ts');
-      await start(rest);
-      break;
-    }
-    case 'ls': {
-      const { ls } = await import('./commands/ls.ts');
-      ls(rest);
-      break;
-    }
     case 'rm': {
       const { rm } = await import('./commands/rm.ts');
       await rm(rest);
       break;
     }
-    case 'prune': {
-      const { prune } = await import('./commands/prune.ts');
-      await prune(rest);
+    case 'start': {
+      const { start } = await import('./commands/start.ts');
+      await start(rest);
       break;
     }
     case 'vm': {
@@ -84,11 +89,6 @@ export async function runSandbox(args: string[]): Promise<void> {
       await vm(rest);
       break;
     }
-    case 'rebuild': {
-      const { rebuild } = await import('./commands/rebuild.ts');
-      await rebuild(rest);
-      break;
-    }
     default:
       throw new Error(`Unknown sandbox command: ${subcommand}`);
   }

package/lib/sandbox/tools.ts

@@ -19,6 +19,13 @@ export type SandboxTool = {
   pathRewriteFiles?: string[];
   hostLiveMounts?: Array<{ hostPath: string; containerSubpath: string }>;
   postSetupCmds?: string[];
+  // When set, containerMount is mounted as an in-container tmpfs (RAM) instead
+  // of bind-mounting the host config dir, keeping high-churn tool logs off the
+  // host disk. `seed` lists the host-dir entries (relative to the tool's config
+  // dir) to bind back over the tmpfs so seeded config stays visible — it is an
+  // explicit allowlist so runtime files (e.g. logs_2.sqlite, sessions) left in
+  // the host dir are NOT re-mounted, which would defeat the tmpfs.
+  tmpfs?: { size?: string; seed?: string[] };
 };
 
 type ToolsConfig = {
@@ -70,6 +77,12 @@ function createBuiltinTools(home: string, project: string): Record<string, Sandb
       containerMount: '/home/devuser/.codex',
       versionCmd: 'codex --version',
       setupHint: 'Run codex once inside the container and choose Device Code login if needed.',
+      // codex churns ~/.codex/logs_2.sqlite heavily (upstream openai/codex#24275);
+      // a bind-mount would write-amplify onto the host SSD via virtiofs. Mount the
+      // codex home as tmpfs so those logs stay in RAM and die with the container.
+      // Only the seeded config (config.toml, model-catalogs) is bound back over
+      // the tmpfs; runtime files like logs_2.sqlite must stay in RAM.
+      tmpfs: { size: '512m', seed: ['config.toml', 'model-catalogs'] },
       hostLiveMounts: [
         { hostPath: hostJoin(home, '.codex', 'auth.json'), containerSubpath: 'auth.json' }
       ],
@@ -259,6 +272,19 @@ function parseHostLiveMounts(value: unknown, context: string): SandboxTool['host
   });
 }
 
+function parseTmpfs(value: unknown, context: string): SandboxTool['tmpfs'] {
+  if (value === undefined) {
+    return undefined;
+  }
+  if (!isPlainObject(value)) {
+    throw new Error(`${context}: field "tmpfs" must be an object when provided`);
+  }
+  return {
+    size: asOptionalNonEmptyString(value.size, 'tmpfs.size', context),
+    seed: asStringArray(value.seed, 'tmpfs.seed', context)
+  };
+}
+
 export function parseCustomTool(
   entry: unknown,
   index: number,
@@ -294,7 +320,8 @@ export function parseCustomTool(
     hostPreSeedDirs: parseHostPreSeedDirs(entry.hostPreSeedDirs, context),
     pathRewriteFiles: asStringArray(entry.pathRewriteFiles, 'pathRewriteFiles', context),
     hostLiveMounts: parseHostLiveMounts(entry.hostLiveMounts, context),
-    postSetupCmds: asStringArray(entry.postSetupCmds, 'postSetupCmds', context)
+    postSetupCmds: asStringArray(entry.postSetupCmds, 'postSetupCmds', context),
+    tmpfs: parseTmpfs(entry.tmpfs, context)
   };
 
   validateTool(tool);