@fitlab-ai/agent-infra 0.8.2 → 0.8.3

package/dist/lib/sandbox/commands/create.js

@@ -7,21 +7,21 @@ import { parseArgs } from 'node:util';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
 import * as toml from 'smol-toml';
-import { loadConfig } from "../config.js";
-import { assertValidBranchName, containerName, containerNameCandidates, parsePositiveIntegerOption, sandboxBranchLabel, sandboxImageConfigLabel, sandboxLabel, shareBranchDir, shareCommonDir, shellConfigDir, worktreeDirCandidates } from "../constants.js";
-import { prepareDockerfile } from "../dockerfile.js";
-import { detectEngine, ensureDocker } from "../engine.js";
-import { commandForEngine, execEngine, run, runEngine, runOk, runOkEngine, runSafe, runSafeEngine, runVerboseEngine } from "../shell.js";
-import { resolveTaskBranch } from "../task-resolver.js";
-import { imageSignatureFields, resolveTools, toolConfigDirCandidates, toolNpmPackagesArg, toolShellInstallScriptBase64 } from "../tools.js";
-import { hostJoin, toEnginePath, volumeArg } from "../engines/wsl2-paths.js";
-import { clipboardHostDir, CONTAINER_CLIPBOARD_MOUNT } from "../clipboard/paths.js";
-import { validateSelinuxDisableEnv } from "../engines/selinux.js";
-import { resolveBuildUid } from "../engines/native.js";
-import { dotfilesCacheDir, materializeDotfiles } from "../dotfiles.js";
-import { ensureSandboxDiscoveryReadmes } from "../readme-scaffold.js";
-import { prepareClaudeCredentials, redactCommandError, validateClaudeCredentialsEnvOverride } from "../credentials.js";
-import { detectHostTimezone } from "../host-timezone.js";
+import { loadConfig } from '../config.js';
+import { assertValidBranchName, containerName, containerNameCandidates, parsePositiveIntegerOption, sandboxBranchLabel, sandboxImageConfigLabel, sandboxImageRefreshLabel, sandboxLabel, shareBranchDir, shareCommonDir, shellConfigDir, worktreeDirCandidates } from '../constants.js';
+import { prepareDockerfile } from '../dockerfile.js';
+import { detectEngine, ensureDocker } from '../engine.js';
+import { commandForEngine, execEngine, run, runEngine, runOk, runOkEngine, runSafe, runSafeEngine, runVerboseEngine } from '../shell.js';
+import { resolveTaskBranch } from '../task-resolver.js';
+import { resolveTools, toolConfigDirCandidates } from '../tools.js';
+import { hostJoin, toEnginePath, volumeArg } from '../engines/wsl2-paths.js';
+import { clipboardHostDir, CONTAINER_CLIPBOARD_MOUNT } from '../clipboard/paths.js';
+import { validateSelinuxDisableEnv } from '../engines/selinux.js';
+import { dotfilesCacheDir, materializeDotfiles } from '../dotfiles.js';
+import { ensureSandboxDiscoveryReadmes } from '../readme-scaffold.js';
+import { prepareClaudeCredentials, redactCommandError, validateClaudeCredentialsEnvOverride } from '../credentials.js';
+import { detectHostTimezone } from '../host-timezone.js';
+import { buildImageSignature, buildSandboxImageArgs, isRefreshDisabled, isRefreshDue, parseImageLabels, parseRefreshTimestamp } from '../image-build.js';
 const OPENCODE_YOLO_PERMISSION = '{"*":"allow","read":"allow","bash":"allow","edit":"allow","webfetch":"allow","external_directory":"allow","doom_loop":"allow"}';
 const SANDBOX_ALIAS_BLOCK_BEGIN = '# >>> agent-infra managed aliases >>>';
 const SANDBOX_ALIAS_BLOCK_END = '# <<< agent-infra managed aliases <<<';
@@ -47,22 +47,13 @@ alias gy='gemini --yolo; tput ed'
 `;
 const CONTAINER_HOME = '/home/devuser';
 const CONTAINER_SHELL_CONFIG_MOUNT = `${CONTAINER_HOME}/.host-shell-config`;
-const USAGE = `Usage: ai sandbox create <branch> [base] [--cpu <n>] [--memory <n>]
+const USAGE = `Usage: ai sandbox create <branch> [base] [--cpu <n>] [--memory <n>] [--no-refresh]
 
 Host aliases:
   ${'~'}/.agent-infra/aliases/sandbox.sh is auto-created on first run and exposed
   as ${CONTAINER_HOME}/.bash_aliases inside the sandbox container (the host
   shell-config directory is bind-mounted at ${CONTAINER_SHELL_CONFIG_MOUNT} and
   symlinked into $HOME).`;
-function buildSignature(preparedDockerfile, tools) {
-    return createHash('sha256')
-        .update(JSON.stringify({
-        dockerfile: preparedDockerfile.signature,
-        tools: imageSignatureFields(tools)
-    }))
-        .digest('hex')
-        .slice(0, 12);
-}
 function resolveToolDirs(config, tools, branch) {
     return tools.map((tool) => {
         const candidates = toolConfigDirCandidates(tool, config.project, branch);
@@ -908,34 +899,25 @@ export function buildTmpfsRunArgs(containerMount, tmpfs) {
     const size = tmpfs.size ?? '512m';
     return ['--tmpfs', `${containerMount}:rw,size=${size}`];
 }
-export function buildImage(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, runVerboseFn = runVerboseEngine, env = process.env } = {}) {
+export function buildImage(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, runVerboseFn = runVerboseEngine, env = process.env, refresh = false, lastRefresh } = {}) {
     const selectedEngine = engine ?? detectEngine({ engine: config.engine });
-    const { uid: hostUid, gid: hostGid } = resolveBuildUid({
+    runVerboseFn(selectedEngine, 'docker', buildSandboxImageArgs(config, tools, dockerfilePath, imageSignature, {
         engine: selectedEngine,
         runFn,
         runSafeFn,
-        env
-    });
-    runVerboseFn(selectedEngine, 'docker', [
-        'build',
-        '-t',
-        config.imageName,
-        '--build-arg',
-        `HOST_UID=${hostUid}`,
-        '--build-arg',
-        `HOST_GID=${hostGid}`,
-        '--build-arg',
-        `AI_TOOL_PACKAGES=${toolNpmPackagesArg(tools)}`,
-        '--build-arg',
-        `AI_TOOLS_SHELL_INSTALL_B64=${toolShellInstallScriptBase64(tools)}`,
-        '--label',
-        sandboxLabel(config),
-        '--label',
-        `${sandboxImageConfigLabel(config)}=${imageSignature}`,
-        '-f',
-        toEnginePath(selectedEngine, dockerfilePath),
-        toEnginePath(selectedEngine, config.repoRoot)
-    ], { cwd: config.repoRoot });
+        env,
+        refresh,
+        lastRefresh
+    }), { cwd: config.repoRoot });
+}
+function readImageLabels(config, engine) {
+    return parseImageLabels(runSafeEngine(engine, 'docker', [
+        'image',
+        'inspect',
+        '--format',
+        '{{ json .Config.Labels }}',
+        config.imageName
+    ]));
 }
 export async function create(args) {
     const { values, positionals } = parseArgs({
@@ -945,6 +927,7 @@ export async function create(args) {
         options: {
             cpu: { type: 'string' },
             memory: { type: 'string' },
+            'no-refresh': { type: 'boolean' },
             help: { type: 'boolean', short: 'h' }
         }
     });
@@ -986,7 +969,7 @@ export async function create(args) {
     const shareBranch = shareBranchDir(effectiveConfig, branch);
     const preparedDockerfile = prepareDockerfile(effectiveConfig);
     const baseBranch = base ?? runSafe('git', ['-C', effectiveConfig.repoRoot, 'branch', '--show-current']);
-    const expectedImageSignature = buildSignature(preparedDockerfile, tools);
+    const expectedImageSignature = buildImageSignature(preparedDockerfile, tools);
     const engine = detectEngine(effectiveConfig);
     p.intro(pc.cyan('AI Sandbox'));
     p.log.info(`Project: ${pc.bold(effectiveConfig.project)} | Branch: ${pc.bold(branch)} | Base: ${pc.bold(baseBranch || 'HEAD')}`);
@@ -1002,20 +985,41 @@ export async function create(args) {
         });
         p.log.success('Docker is ready');
         const imageExists = runOkEngine(engine, 'docker', ['image', 'inspect', effectiveConfig.imageName]);
-        const currentImageSignature = imageExists
-            ? runSafeEngine(engine, 'docker', [
-                'image',
-                'inspect',
-                '--format',
-                `{{ index .Config.Labels "${sandboxImageConfigLabel(effectiveConfig)}" }}`,
-                effectiveConfig.imageName
-            ])
-            : '';
-        const needsImageBuild = !imageExists || currentImageSignature !== expectedImageSignature;
+        const imageLabels = imageExists ? readImageLabels(effectiveConfig, engine) : {};
+        const currentImageSignature = imageLabels[sandboxImageConfigLabel(effectiveConfig)] ?? '';
+        const currentLastRefresh = parseRefreshTimestamp(imageLabels[sandboxImageRefreshLabel(effectiveConfig)] ?? '');
+        const signatureStale = !imageExists || currentImageSignature !== expectedImageSignature;
+        const now = Date.now();
+        const refreshDue = imageExists
+            && !signatureStale
+            && !isRefreshDisabled(process.env, values['no-refresh'] ?? false)
+            && isRefreshDue(currentLastRefresh, now, effectiveConfig.refreshIntervalDays);
+        const needsImageBuild = signatureStale || refreshDue;
         if (needsImageBuild) {
-            p.log.step(imageExists ? 'Rebuilding stale image...' : 'Building image for first use...');
-            buildImage(effectiveConfig, tools, preparedDockerfile.path, expectedImageSignature, { engine });
-            p.log.success(imageExists ? 'Image rebuilt' : 'Image built');
+            const buildRefresh = !imageExists || refreshDue;
+            const buildLastRefresh = buildRefresh ? now : currentLastRefresh || 0;
+            p.log.step(refreshDue
+                ? 'Refreshing stale image...'
+                : imageExists
+                    ? 'Rebuilding stale image...'
+                    : 'Building image for first use...');
+            try {
+                buildImage(effectiveConfig, tools, preparedDockerfile.path, expectedImageSignature, { engine, refresh: buildRefresh, lastRefresh: buildLastRefresh });
+                p.log.success(refreshDue
+                    ? 'Image refreshed'
+                    : imageExists
+                        ? 'Image rebuilt'
+                        : 'Image built');
+            }
+            catch (error) {
+                if (refreshDue && !signatureStale && imageExists) {
+                    p.log.warn('Scheduled sandbox image refresh failed; continuing with the existing image. ' +
+                        commandErrorMessage(error));
+                }
+                else {
+                    throw error;
+                }
+            }
         }
         else {
             p.log.step(`Using existing image ${effectiveConfig.imageName}`);
@@ -1231,8 +1235,6 @@ export async function create(args) {
                             ...buildClipboardVolumeArgs(engine, effectiveConfig.home),
                             '-v',
                             volumeArg(engine, path.join(effectiveConfig.repoRoot, '.git'), `${toEnginePath(engine, effectiveConfig.repoRoot)}/.git`),
-                            '-v',
-                            volumeArg(engine, hostJoin(effectiveConfig.home, '.ssh'), '/home/devuser/.ssh', ':ro'),
                             ...dotfilesMount,
                             ...toolVolumes,
                             ...tmpfsArgs,

package/dist/lib/sandbox/commands/enter.js

@@ -1,12 +1,12 @@
-import { loadConfig } from "../config.js";
-import { assertValidBranchName, containerNameCandidates, sandboxBranchLabel, sandboxLabel } from "../constants.js";
-import { detectEngine } from "../engine.js";
-import { formatCredentialWarnings, formatRemaining, hasClaudeProviderAuth, reconcileClaudeCredentials, redactCommandError, validateClaudeCredentialsEnvOverride } from "../credentials.js";
-import { runInteractiveEngine } from "../shell.js";
-import { dotfilesCacheDir, materializeDotfiles } from "../dotfiles.js";
-import { runInteractiveWithClipboardBridge } from "../clipboard/bridge.js";
-import { detectHostTimezone } from "../host-timezone.js";
-import { fetchSandboxRows, resolveBranchArg, selectSandboxContainer, startSandboxContainer } from "./list-running.js";
+import { loadConfig } from '../config.js';
+import { assertValidBranchName, containerNameCandidates, sandboxBranchLabel, sandboxLabel } from '../constants.js';
+import { detectEngine } from '../engine.js';
+import { formatCredentialWarnings, formatRemaining, hasClaudeProviderAuth, reconcileClaudeCredentials, redactCommandError, validateClaudeCredentialsEnvOverride } from '../credentials.js';
+import { runInteractiveEngine } from '../shell.js';
+import { dotfilesCacheDir, materializeDotfiles } from '../dotfiles.js';
+import { runInteractiveWithClipboardBridge } from '../clipboard/bridge.js';
+import { detectHostTimezone } from '../host-timezone.js';
+import { fetchSandboxRows, resolveBranchArg, selectSandboxContainer, startSandboxContainer } from './list-running.js';
 const USAGE = `Usage: ai sandbox exec <branch | TASK-id | N | '#N'> [cmd...]
 
 N (bare) and '#N' both reference the same active task short id from

package/dist/lib/sandbox/commands/list-running.js

@@ -1,8 +1,8 @@
 import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
-import { runSafeEngine, runVerboseEngine } from "../shell.js";
-import { resolveTaskBranch } from "../task-resolver.js";
+import { runSafeEngine, runVerboseEngine } from '../shell.js';
+import { resolveTaskBranch } from '../task-resolver.js';
 export function containerListFormat() {
     return '{{.Names}}\t{{.Status}}\t{{.Labels}}';
 }

package/dist/lib/sandbox/commands/ls.js

@@ -1,12 +1,12 @@
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
-import { loadConfig } from "../config.js";
-import { sandboxBranchLabel, sandboxLabel } from "../constants.js";
-import { detectEngine } from "../engine.js";
-import { formatTable } from "../../table.js";
-import { lookupShortIdByBranch } from "../../task/short-id.js";
-import { fetchSandboxRows } from "./list-running.js";
-export { containerListFormat, parseLabels } from "./list-running.js";
+import { loadConfig } from '../config.js';
+import { sandboxBranchLabel, sandboxLabel } from '../constants.js';
+import { detectEngine } from '../engine.js';
+import { formatTable } from '../../table.js';
+import { lookupShortIdByBranch } from '../../task/short-id.js';
+import { fetchSandboxRows } from './list-running.js';
+export { containerListFormat, parseLabels } from './list-running.js';
 const USAGE = `Usage: ai sandbox ls
 
 Lists all containers for the current project. The '#' column is a

package/dist/lib/sandbox/commands/prune.js

@@ -3,14 +3,14 @@ import path from 'node:path';
 import { parseArgs } from 'node:util';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
-import { loadConfig } from "../config.js";
-import { safeNameCandidates, sandboxBranchLabel, sandboxLabel } from "../constants.js";
-import { detectEngine } from "../engine.js";
-import { hostJoin } from "../engines/wsl2-paths.js";
-import { removeManagedDir, removeWorktreeDir } from "../managed-fs.js";
-import { parseLabels } from "./ls.js";
-import { runEngine, runSafe } from "../shell.js";
-import { resolveTools } from "../tools.js";
+import { loadConfig } from '../config.js';
+import { safeNameCandidates, sandboxBranchLabel, sandboxLabel } from '../constants.js';
+import { detectEngine } from '../engine.js';
+import { hostJoin } from '../engines/wsl2-paths.js';
+import { removeManagedDir, removeWorktreeDir } from '../managed-fs.js';
+import { parseLabels } from './ls.js';
+import { runEngine, runSafe } from '../shell.js';
+import { resolveTools } from '../tools.js';
 const USAGE = `Usage: ai sandbox prune [--dry-run]`;
 function listChildDirs(base) {
     if (!fs.existsSync(base)) {

package/dist/lib/sandbox/commands/rebuild.js

@@ -1,58 +1,37 @@
 import { parseArgs } from 'node:util';
-import { createHash } from 'node:crypto';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
-import { loadConfig } from "../config.js";
-import { prepareDockerfile } from "../dockerfile.js";
-import { sandboxImageConfigLabel, sandboxLabel } from "../constants.js";
-import { detectEngine, ensureDocker } from "../engine.js";
-import { runEngine, runSafeEngine, runVerboseEngine } from "../shell.js";
-import { pruneSandboxDanglingImages } from "../image-prune.js";
-import { imageSignatureFields, resolveTools, toolNpmPackagesArg, toolShellInstallScriptBase64 } from "../tools.js";
-import { toEnginePath } from "../engines/wsl2-paths.js";
-import { resolveBuildUid } from "../engines/native.js";
+import { loadConfig } from '../config.js';
+import { prepareDockerfile } from '../dockerfile.js';
+import { sandboxImageRefreshLabel } from '../constants.js';
+import { detectEngine, ensureDocker } from '../engine.js';
+import { runEngine, runOkEngine, runSafeEngine, runVerboseEngine } from '../shell.js';
+import { pruneSandboxDanglingImages } from '../image-prune.js';
+import { resolveTools } from '../tools.js';
+import { buildImageSignature, buildSandboxImageArgs, parseImageLabels, parseRefreshTimestamp } from '../image-build.js';
 const USAGE = `Usage: ai sandbox rebuild [--quiet] [--refresh]`;
-function buildSignature(preparedDockerfile, tools) {
-    return createHash('sha256')
-        .update(JSON.stringify({
-        dockerfile: preparedDockerfile.signature,
-        tools: imageSignatureFields(tools)
-    }))
-        .digest('hex')
-        .slice(0, 12);
-}
-export function buildArgs(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, env = process.env, refresh = false } = {}) {
-    const selectedEngine = engine ?? detectEngine(config);
-    const { uid: hostUid, gid: hostGid } = resolveBuildUid({
-        engine: selectedEngine,
+export function buildArgs(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, env = process.env, refresh = false, lastRefresh } = {}) {
+    return buildSandboxImageArgs(config, tools, dockerfilePath, imageSignature, {
+        engine: engine ?? detectEngine(config),
         runFn,
         runSafeFn,
-        env
+        env,
+        refresh,
+        lastRefresh
     });
-    const args = [
-        'build',
-        '-t',
-        config.imageName,
-        '--build-arg',
-        `HOST_UID=${hostUid}`,
-        '--build-arg',
-        `HOST_GID=${hostGid}`,
-        '--build-arg',
-        `AI_TOOL_PACKAGES=${toolNpmPackagesArg(tools)}`,
-        '--build-arg',
-        `AI_TOOLS_SHELL_INSTALL_B64=${toolShellInstallScriptBase64(tools)}`,
-        '--label',
-        sandboxLabel(config),
-        '--label',
-        `${sandboxImageConfigLabel(config)}=${imageSignature}`,
-        '-f',
-        toEnginePath(selectedEngine, dockerfilePath),
-        toEnginePath(selectedEngine, config.repoRoot)
-    ];
-    if (refresh) {
-        args.splice(1, 0, '--no-cache', '--pull');
+}
+function readExistingLastRefresh(config, engine) {
+    if (!runOkEngine(engine, 'docker', ['image', 'inspect', config.imageName])) {
+        return 0;
     }
-    return args;
+    const labels = parseImageLabels(runSafeEngine(engine, 'docker', [
+        'image',
+        'inspect',
+        '--format',
+        '{{ json .Config.Labels }}',
+        config.imageName
+    ]));
+    return parseRefreshTimestamp(labels[sandboxImageRefreshLabel(config)] ?? '');
 }
 export async function rebuild(args) {
     const { values } = parseArgs({
@@ -72,24 +51,33 @@ export async function rebuild(args) {
     const config = loadConfig();
     const tools = resolveTools(config);
     const preparedDockerfile = prepareDockerfile(config);
-    const imageSignature = buildSignature(preparedDockerfile, tools);
+    const imageSignature = buildImageSignature(preparedDockerfile, tools);
     const quiet = values.quiet ?? false;
     const refresh = values.refresh ?? false;
     const engine = detectEngine(config);
     await ensureDocker(config, undefined);
+    const lastRefresh = refresh ? Date.now() : readExistingLastRefresh(config, engine);
     p.intro(pc.cyan('Rebuilding sandbox image'));
     try {
         if (quiet) {
             const spinner = p.spinner();
             spinner.start('Building image...');
-            runEngine(engine, 'docker', buildArgs(config, tools, preparedDockerfile.path, imageSignature, { engine, refresh }), {
+            runEngine(engine, 'docker', buildArgs(config, tools, preparedDockerfile.path, imageSignature, {
+                engine,
+                refresh,
+                lastRefresh
+            }), {
                 cwd: config.repoRoot
             });
             spinner.stop(pc.green('Sandbox image rebuilt'));
         }
         else {
             p.log.step('Building image');
-            runVerboseEngine(engine, 'docker', buildArgs(config, tools, preparedDockerfile.path, imageSignature, { engine, refresh }), { cwd: config.repoRoot });
+            runVerboseEngine(engine, 'docker', buildArgs(config, tools, preparedDockerfile.path, imageSignature, {
+                engine,
+                refresh,
+                lastRefresh
+            }), { cwd: config.repoRoot });
             p.log.success(pc.green('Sandbox image rebuilt'));
         }
         pruneSandboxDanglingImages(config, engine);

package/dist/lib/sandbox/commands/refresh.js

@@ -1,7 +1,7 @@
 import { homedir } from 'node:os';
 import { parseArgs } from 'node:util';
-import { buildLockedGuidance, discoverProjects, formatCredentialWarnings, formatRemaining, reconcileClaudeCredentials, redactCommandError, validateClaudeCredentialsEnvOverride } from "../credentials.js";
-import { runProbe } from "../shell.js";
+import { buildLockedGuidance, discoverProjects, formatCredentialWarnings, formatRemaining, reconcileClaudeCredentials, redactCommandError, validateClaudeCredentialsEnvOverride } from '../credentials.js';
+import { runProbe } from '../shell.js';
 const USAGE = 'Usage: ai sandbox refresh';
 export function probeClaudeStatus(spawnFn = runProbe) {
     const result = spawnFn('claude', ['/status'], {

package/dist/lib/sandbox/commands/rm.js

@@ -3,21 +3,21 @@ import path from 'node:path';
 import { parseArgs } from 'node:util';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
-import { loadConfig } from "../config.js";
-import { assertValidBranchName, containerNameCandidates, sandboxBranchLabel, sandboxLabel, shareBranchDir, shellConfigDirCandidates, worktreeDirCandidates } from "../constants.js";
-import { ENGINES, detectEngine, engineDisplayName, isManagedEngine, stopManagedVm } from "../engine.js";
-import { pruneSandboxDanglingImages } from "../image-prune.js";
-import { removeManagedDir, removeWorktreeDir } from "../managed-fs.js";
-import { runOk, runSafe, runSafeEngine } from "../shell.js";
-import { resolveTaskBranch } from "../task-resolver.js";
-import { resolveTools, toolConfigDirCandidates, toolProjectDirCandidates } from "../tools.js";
-import { fetchSandboxRows } from "./list-running.js";
-import { lookupShortIdByBranch } from "../../task/short-id.js";
+import { loadConfig } from '../config.js';
+import { assertValidBranchName, containerNameCandidates, sandboxBranchLabel, sandboxLabel, shareBranchDir, shellConfigDirCandidates, worktreeDirCandidates } from '../constants.js';
+import { ENGINES, detectEngine, engineDisplayName, isManagedEngine, stopManagedVm } from '../engine.js';
+import { pruneSandboxDanglingImages } from '../image-prune.js';
+import { removeManagedDir, removeWorktreeDir } from '../managed-fs.js';
+import { runOk, runSafe, runSafeEngine } from '../shell.js';
+import { resolveTaskBranch } from '../task-resolver.js';
+import { resolveTools, toolConfigDirCandidates, toolProjectDirCandidates } from '../tools.js';
+import { fetchSandboxRows } from './list-running.js';
+import { lookupShortIdByBranch } from '../../task/short-id.js';
 const USAGE = `Usage:
   ai sandbox rm <branch>                    Remove one sandbox (branch | TASK-id | short id)
   ai sandbox rm --all [--dry-run] [--yes]   Remove every sandbox not bound to an active task
   ai sandbox rm --purge                     Tear down ALL sandboxes for the project (containers, worktrees, image, VM)`;
-export { assertManagedPath } from "../managed-fs.js";
+export { assertManagedPath } from '../managed-fs.js';
 function projectToolDirs(config, tools) {
     return tools.flatMap((tool) => toolProjectDirCandidates(tool, config.project));
 }

package/dist/lib/sandbox/commands/show.js

@@ -1,10 +1,10 @@
 import fs from 'node:fs';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
-import { loadConfig } from "../config.js";
-import { assertValidBranchName, worktreeDirCandidates } from "../constants.js";
-import { resolveBranchArg } from "./list-running.js";
-import { resolveTools, toolConfigDirCandidates } from "../tools.js";
+import { loadConfig } from '../config.js';
+import { assertValidBranchName, worktreeDirCandidates } from '../constants.js';
+import { resolveBranchArg } from './list-running.js';
+import { resolveTools, toolConfigDirCandidates } from '../tools.js';
 const USAGE = `Usage: ai sandbox show <branch | TASK-id | N | '#N'>
 
 Shows one sandbox's worktree path and per-tool state paths (Claude Code,

package/dist/lib/sandbox/commands/start.js

@@ -1,7 +1,7 @@
-import { loadConfig } from "../config.js";
-import { assertValidBranchName, containerNameCandidates, sandboxBranchLabel, sandboxLabel } from "../constants.js";
-import { detectEngine } from "../engine.js";
-import { fetchSandboxRows, resolveBranchArg, selectSandboxContainer, startSandboxContainer } from "./list-running.js";
+import { loadConfig } from '../config.js';
+import { assertValidBranchName, containerNameCandidates, sandboxBranchLabel, sandboxLabel } from '../constants.js';
+import { detectEngine } from '../engine.js';
+import { fetchSandboxRows, resolveBranchArg, selectSandboxContainer, startSandboxContainer } from './list-running.js';
 const USAGE = `Usage: ai sandbox start <branch | TASK-id | N | '#N'>
 
 Start an existing sandbox container that has stopped (for example after the

package/dist/lib/sandbox/commands/vm.js

@@ -1,10 +1,10 @@
 import { parseArgs } from 'node:util';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
-import { loadConfig } from "../config.js";
-import { parsePositiveIntegerOption } from "../constants.js";
-import { ENGINES, detectEngine, engineDisplayName, isManagedEngine, startManagedVm, stopManagedVm } from "../engine.js";
-import { runOk, runSafe } from "../shell.js";
+import { loadConfig } from '../config.js';
+import { parsePositiveIntegerOption } from '../constants.js';
+import { ENGINES, detectEngine, engineDisplayName, isManagedEngine, startManagedVm, stopManagedVm } from '../engine.js';
+import { runOk, runSafe } from '../shell.js';
 const USAGE = `Usage: ai sandbox vm <status|start|stop> [--cpu <n>] [--memory <n>]`;
 export function ensureManagedVm(engine) {
     if (engine === ENGINES.NATIVE) {

package/dist/lib/sandbox/config.js

@@ -3,14 +3,15 @@ import path from 'node:path';
 import { homedir, platform } from 'node:os';
 import { execFileSync } from 'node:child_process';
 import pc from 'picocolors';
-import { validateSandboxEngine } from "./engine.js";
-import { hostJoin } from "./engines/wsl2-paths.js";
-import { findRuntimeEngineMismatches } from "./runtime-engines.js";
-import { parseCustomTools } from "./tools.js";
+import { validateSandboxEngine } from './engine.js';
+import { hostJoin } from './engines/wsl2-paths.js';
+import { findRuntimeEngineMismatches } from './runtime-engines.js';
+import { parseCustomTools } from './tools.js';
 const DEFAULTS = Object.freeze({
     engine: null,
     runtimes: ['node22'],
     tools: ['agent-infra', 'claude-code', 'codex', 'gemini-cli', 'opencode'],
+    refreshIntervalDays: 7,
     dockerfile: null,
     vm: {
         cpu: null,
@@ -32,11 +33,15 @@ function detectRepoRoot() {
 function asPositiveNumberOrNull(value) {
     return typeof value === 'number' ? value : null;
 }
+function asNonNegativeIntegerOrDefault(value, fallback) {
+    return typeof value === 'number' && Number.isInteger(value) && value >= 0 ? value : fallback;
+}
 function cloneDefaults() {
     return {
         engine: DEFAULTS.engine,
         runtimes: [...DEFAULTS.runtimes],
         tools: [...DEFAULTS.tools],
+        refreshIntervalDays: DEFAULTS.refreshIntervalDays,
         dockerfile: DEFAULTS.dockerfile,
         vm: { ...DEFAULTS.vm }
     };
@@ -96,6 +101,7 @@ export function loadConfig({ platformFn = platform, writeStderr = (chunk) => pro
             ? [...sandbox.tools]
             : defaults.tools,
         customTools,
+        refreshIntervalDays: asNonNegativeIntegerOrDefault(sandbox.refreshIntervalDays, defaults.refreshIntervalDays),
         dockerfile,
         vm: {
             cpu: asPositiveNumberOrNull(sandbox.vm?.cpu) ?? defaults.vm.cpu,

package/dist/lib/sandbox/constants.js

@@ -1,6 +1,6 @@
 import os from 'node:os';
 import { execFileSync } from 'node:child_process';
-import { hostJoin } from "./engines/wsl2-paths.js";
+import { hostJoin } from './engines/wsl2-paths.js';
 const validatedBranches = new Set();
 function dedupe(items) {
     return [...new Set(items)];
@@ -72,6 +72,9 @@ export function sandboxBranchLabel(config) {
 export function sandboxImageConfigLabel(config) {
     return `${sandboxLabel(config)}.image-config`;
 }
+export function sandboxImageRefreshLabel(config) {
+    return `${sandboxLabel(config)}.last-refresh`;
+}
 export function parsePositiveIntegerOption(value, optionName) {
     if (value === undefined || value === null) {
         return undefined;

package/dist/lib/sandbox/credentials.js

@@ -2,7 +2,7 @@ import { execFileSync } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
-import { hostJoin } from "./engines/wsl2-paths.js";
+import { hostJoin } from './engines/wsl2-paths.js';
 const LOCKED_PATTERN = /errSecInteractionNotAllowed|User interaction is not allowed/i;
 const NOT_FOUND_PATTERN = /errSecItemNotFound|specified item could not be found/i;
 const REDACTION_PATTERNS = [

package/dist/lib/sandbox/dotfiles.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { hostJoin } from "./engines/wsl2-paths.js";
+import { hostJoin } from './engines/wsl2-paths.js';
 export function dotfilesCacheDir(home, project) {
     return hostJoin(home, '.agent-infra', '.cache', 'dotfiles-resolved', project);
 }

package/dist/lib/sandbox/engine.js

@@ -1,7 +1,7 @@
 import { platform } from 'node:os';
-import { detectHostResources } from "./constants.js";
-import { ADAPTERS, enginesForPlatform, getAdapter } from "./engines/index.js";
-import { run, runOk, runSafe, runVerbose } from "./shell.js";
+import { detectHostResources } from './constants.js';
+import { ADAPTERS, enginesForPlatform, getAdapter } from './engines/index.js';
+import { run, runOk, runSafe, runVerbose } from './shell.js';
 export const ENGINES = Object.freeze({
     COLIMA: 'colima',
     ORBSTACK: 'orbstack',

package/dist/lib/sandbox/engines/index.js

@@ -1,8 +1,8 @@
-import { colimaAdapter } from "./colima.js";
-import { dockerDesktopAdapter } from "./docker-desktop.js";
-import { nativeAdapter } from "./native.js";
-import { orbstackAdapter } from "./orbstack.js";
-import { wsl2Adapter } from "./wsl2.js";
+import { colimaAdapter } from './colima.js';
+import { dockerDesktopAdapter } from './docker-desktop.js';
+import { nativeAdapter } from './native.js';
+import { orbstackAdapter } from './orbstack.js';
+import { wsl2Adapter } from './wsl2.js';
 export const ADAPTERS = Object.freeze({
     colima: colimaAdapter,
     orbstack: orbstackAdapter,

package/dist/lib/sandbox/engines/wsl2-paths.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { selinuxLabelForMount } from "./selinux.js";
+import { selinuxLabelForMount } from './selinux.js';
 const WINDOWS_DRIVE_PATH_PATTERN = /^([A-Za-z]):[\\/](.*)$/;
 const UNC_PATH_PATTERN = /^(?:\\\\|\/\/)[^\\/]+[\\/][^\\/]+/;
 export function hostJoin(basePath, ...segments) {