@fitlab-ai/agent-infra 0.8.2 → 0.8.4

package/dist/lib/sandbox/commands/rebuild.js

@@ -1,58 +1,37 @@
 import { parseArgs } from 'node:util';
-import { createHash } from 'node:crypto';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
-import { loadConfig } from "../config.js";
-import { prepareDockerfile } from "../dockerfile.js";
-import { sandboxImageConfigLabel, sandboxLabel } from "../constants.js";
-import { detectEngine, ensureDocker } from "../engine.js";
-import { runEngine, runSafeEngine, runVerboseEngine } from "../shell.js";
-import { pruneSandboxDanglingImages } from "../image-prune.js";
-import { imageSignatureFields, resolveTools, toolNpmPackagesArg, toolShellInstallScriptBase64 } from "../tools.js";
-import { toEnginePath } from "../engines/wsl2-paths.js";
-import { resolveBuildUid } from "../engines/native.js";
+import { loadConfig } from '../config.js';
+import { prepareDockerfile } from '../dockerfile.js';
+import { sandboxImageRefreshLabel } from '../constants.js';
+import { detectEngine, ensureDocker } from '../engine.js';
+import { runEngine, runOkEngine, runSafeEngine, runVerboseEngine } from '../shell.js';
+import { pruneSandboxDanglingImages } from '../image-prune.js';
+import { resolveTools } from '../tools.js';
+import { buildImageSignature, buildSandboxImageArgs, parseImageLabels, parseRefreshTimestamp } from '../image-build.js';
 const USAGE = `Usage: ai sandbox rebuild [--quiet] [--refresh]`;
-function buildSignature(preparedDockerfile, tools) {
-    return createHash('sha256')
-        .update(JSON.stringify({
-        dockerfile: preparedDockerfile.signature,
-        tools: imageSignatureFields(tools)
-    }))
-        .digest('hex')
-        .slice(0, 12);
-}
-export function buildArgs(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, env = process.env, refresh = false } = {}) {
-    const selectedEngine = engine ?? detectEngine(config);
-    const { uid: hostUid, gid: hostGid } = resolveBuildUid({
-        engine: selectedEngine,
+export function buildArgs(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, env = process.env, refresh = false, lastRefresh } = {}) {
+    return buildSandboxImageArgs(config, tools, dockerfilePath, imageSignature, {
+        engine: engine ?? detectEngine(config),
         runFn,
         runSafeFn,
-        env
+        env,
+        refresh,
+        lastRefresh
     });
-    const args = [
-        'build',
-        '-t',
-        config.imageName,
-        '--build-arg',
-        `HOST_UID=${hostUid}`,
-        '--build-arg',
-        `HOST_GID=${hostGid}`,
-        '--build-arg',
-        `AI_TOOL_PACKAGES=${toolNpmPackagesArg(tools)}`,
-        '--build-arg',
-        `AI_TOOLS_SHELL_INSTALL_B64=${toolShellInstallScriptBase64(tools)}`,
-        '--label',
-        sandboxLabel(config),
-        '--label',
-        `${sandboxImageConfigLabel(config)}=${imageSignature}`,
-        '-f',
-        toEnginePath(selectedEngine, dockerfilePath),
-        toEnginePath(selectedEngine, config.repoRoot)
-    ];
-    if (refresh) {
-        args.splice(1, 0, '--no-cache', '--pull');
+}
+function readExistingLastRefresh(config, engine) {
+    if (!runOkEngine(engine, 'docker', ['image', 'inspect', config.imageName])) {
+        return 0;
     }
-    return args;
+    const labels = parseImageLabels(runSafeEngine(engine, 'docker', [
+        'image',
+        'inspect',
+        '--format',
+        '{{ json .Config.Labels }}',
+        config.imageName
+    ]));
+    return parseRefreshTimestamp(labels[sandboxImageRefreshLabel(config)] ?? '');
 }
 export async function rebuild(args) {
     const { values } = parseArgs({
@@ -72,24 +51,33 @@ export async function rebuild(args) {
     const config = loadConfig();
     const tools = resolveTools(config);
     const preparedDockerfile = prepareDockerfile(config);
-    const imageSignature = buildSignature(preparedDockerfile, tools);
+    const imageSignature = buildImageSignature(preparedDockerfile, tools);
     const quiet = values.quiet ?? false;
     const refresh = values.refresh ?? false;
     const engine = detectEngine(config);
     await ensureDocker(config, undefined);
+    const lastRefresh = refresh ? Date.now() : readExistingLastRefresh(config, engine);
     p.intro(pc.cyan('Rebuilding sandbox image'));
     try {
         if (quiet) {
             const spinner = p.spinner();
             spinner.start('Building image...');
-            runEngine(engine, 'docker', buildArgs(config, tools, preparedDockerfile.path, imageSignature, { engine, refresh }), {
+            runEngine(engine, 'docker', buildArgs(config, tools, preparedDockerfile.path, imageSignature, {
+                engine,
+                refresh,
+                lastRefresh
+            }), {
                 cwd: config.repoRoot
             });
             spinner.stop(pc.green('Sandbox image rebuilt'));
         }
         else {
             p.log.step('Building image');
-            runVerboseEngine(engine, 'docker', buildArgs(config, tools, preparedDockerfile.path, imageSignature, { engine, refresh }), { cwd: config.repoRoot });
+            runVerboseEngine(engine, 'docker', buildArgs(config, tools, preparedDockerfile.path, imageSignature, {
+                engine,
+                refresh,
+                lastRefresh
+            }), { cwd: config.repoRoot });
             p.log.success(pc.green('Sandbox image rebuilt'));
         }
         pruneSandboxDanglingImages(config, engine);

package/dist/lib/sandbox/commands/refresh.js

@@ -1,7 +1,7 @@
 import { homedir } from 'node:os';
 import { parseArgs } from 'node:util';
-import { buildLockedGuidance, discoverProjects, formatCredentialWarnings, formatRemaining, reconcileClaudeCredentials, redactCommandError, validateClaudeCredentialsEnvOverride } from "../credentials.js";
-import { runProbe } from "../shell.js";
+import { buildLockedGuidance, discoverProjects, formatCredentialWarnings, formatRemaining, reconcileClaudeCredentials, redactCommandError, validateClaudeCredentialsEnvOverride } from '../credentials.js';
+import { runProbe } from '../shell.js';
 const USAGE = 'Usage: ai sandbox refresh';
 export function probeClaudeStatus(spawnFn = runProbe) {
     const result = spawnFn('claude', ['/status'], {

package/dist/lib/sandbox/commands/rm.js

@@ -3,21 +3,21 @@ import path from 'node:path';
 import { parseArgs } from 'node:util';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
-import { loadConfig } from "../config.js";
-import { assertValidBranchName, containerNameCandidates, sandboxBranchLabel, sandboxLabel, shareBranchDir, shellConfigDirCandidates, worktreeDirCandidates } from "../constants.js";
-import { ENGINES, detectEngine, engineDisplayName, isManagedEngine, stopManagedVm } from "../engine.js";
-import { pruneSandboxDanglingImages } from "../image-prune.js";
-import { removeManagedDir, removeWorktreeDir } from "../managed-fs.js";
-import { runOk, runSafe, runSafeEngine } from "../shell.js";
-import { resolveTaskBranch } from "../task-resolver.js";
-import { resolveTools, toolConfigDirCandidates, toolProjectDirCandidates } from "../tools.js";
-import { fetchSandboxRows } from "./list-running.js";
-import { lookupShortIdByBranch } from "../../task/short-id.js";
+import { loadConfig } from '../config.js';
+import { assertValidBranchName, containerNameCandidates, sandboxBranchLabel, sandboxLabel, shareBranchDir, shellConfigDirCandidates, worktreeDirCandidates } from '../constants.js';
+import { ENGINES, detectEngine, engineDisplayName, isManagedEngine, stopManagedVm } from '../engine.js';
+import { pruneSandboxDanglingImages } from '../image-prune.js';
+import { removeManagedDir, removeWorktreeDir } from '../managed-fs.js';
+import { runOk, runSafe, runSafeEngine } from '../shell.js';
+import { resolveTaskBranch } from '../task-resolver.js';
+import { resolveTools, toolConfigDirCandidates, toolProjectDirCandidates } from '../tools.js';
+import { fetchSandboxRows } from './list-running.js';
+import { lookupShortIdByBranch } from '../../task/short-id.js';
 const USAGE = `Usage:
   ai sandbox rm <branch>                    Remove one sandbox (branch | TASK-id | short id)
   ai sandbox rm --all [--dry-run] [--yes]   Remove every sandbox not bound to an active task
   ai sandbox rm --purge                     Tear down ALL sandboxes for the project (containers, worktrees, image, VM)`;
-export { assertManagedPath } from "../managed-fs.js";
+export { assertManagedPath } from '../managed-fs.js';
 function projectToolDirs(config, tools) {
     return tools.flatMap((tool) => toolProjectDirCandidates(tool, config.project));
 }

package/dist/lib/sandbox/commands/show.js

@@ -1,10 +1,10 @@
 import fs from 'node:fs';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
-import { loadConfig } from "../config.js";
-import { assertValidBranchName, worktreeDirCandidates } from "../constants.js";
-import { resolveBranchArg } from "./list-running.js";
-import { resolveTools, toolConfigDirCandidates } from "../tools.js";
+import { loadConfig } from '../config.js';
+import { assertValidBranchName, worktreeDirCandidates } from '../constants.js';
+import { resolveBranchArg } from './list-running.js';
+import { resolveTools, toolConfigDirCandidates } from '../tools.js';
 const USAGE = `Usage: ai sandbox show <branch | TASK-id | N | '#N'>
 
 Shows one sandbox's worktree path and per-tool state paths (Claude Code,

package/dist/lib/sandbox/commands/start.js

@@ -1,7 +1,7 @@
-import { loadConfig } from "../config.js";
-import { assertValidBranchName, containerNameCandidates, sandboxBranchLabel, sandboxLabel } from "../constants.js";
-import { detectEngine } from "../engine.js";
-import { fetchSandboxRows, resolveBranchArg, selectSandboxContainer, startSandboxContainer } from "./list-running.js";
+import { loadConfig } from '../config.js';
+import { assertValidBranchName, containerNameCandidates, sandboxBranchLabel, sandboxLabel } from '../constants.js';
+import { detectEngine } from '../engine.js';
+import { fetchSandboxRows, resolveBranchArg, selectSandboxContainer, startSandboxContainer } from './list-running.js';
 const USAGE = `Usage: ai sandbox start <branch | TASK-id | N | '#N'>
 
 Start an existing sandbox container that has stopped (for example after the

package/dist/lib/sandbox/commands/vm.js

@@ -1,10 +1,10 @@
 import { parseArgs } from 'node:util';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
-import { loadConfig } from "../config.js";
-import { parsePositiveIntegerOption } from "../constants.js";
-import { ENGINES, detectEngine, engineDisplayName, isManagedEngine, startManagedVm, stopManagedVm } from "../engine.js";
-import { runOk, runSafe } from "../shell.js";
+import { loadConfig } from '../config.js';
+import { parsePositiveIntegerOption } from '../constants.js';
+import { ENGINES, detectEngine, engineDisplayName, isManagedEngine, startManagedVm, stopManagedVm } from '../engine.js';
+import { runOk, runSafe } from '../shell.js';
 const USAGE = `Usage: ai sandbox vm <status|start|stop> [--cpu <n>] [--memory <n>]`;
 export function ensureManagedVm(engine) {
     if (engine === ENGINES.NATIVE) {

package/dist/lib/sandbox/config.js

@@ -3,14 +3,15 @@ import path from 'node:path';
 import { homedir, platform } from 'node:os';
 import { execFileSync } from 'node:child_process';
 import pc from 'picocolors';
-import { validateSandboxEngine } from "./engine.js";
-import { hostJoin } from "./engines/wsl2-paths.js";
-import { findRuntimeEngineMismatches } from "./runtime-engines.js";
-import { parseCustomTools } from "./tools.js";
+import { validateSandboxEngine } from './engine.js';
+import { hostJoin } from './engines/wsl2-paths.js';
+import { findRuntimeEngineMismatches } from './runtime-engines.js';
+import { parseCustomTools } from './tools.js';
 const DEFAULTS = Object.freeze({
     engine: null,
     runtimes: ['node22'],
     tools: ['agent-infra', 'claude-code', 'codex', 'gemini-cli', 'opencode'],
+    refreshIntervalDays: 7,
     dockerfile: null,
     vm: {
         cpu: null,
@@ -32,11 +33,15 @@ function detectRepoRoot() {
 function asPositiveNumberOrNull(value) {
     return typeof value === 'number' ? value : null;
 }
+function asNonNegativeIntegerOrDefault(value, fallback) {
+    return typeof value === 'number' && Number.isInteger(value) && value >= 0 ? value : fallback;
+}
 function cloneDefaults() {
     return {
         engine: DEFAULTS.engine,
         runtimes: [...DEFAULTS.runtimes],
         tools: [...DEFAULTS.tools],
+        refreshIntervalDays: DEFAULTS.refreshIntervalDays,
         dockerfile: DEFAULTS.dockerfile,
         vm: { ...DEFAULTS.vm }
     };
@@ -96,6 +101,7 @@ export function loadConfig({ platformFn = platform, writeStderr = (chunk) => pro
             ? [...sandbox.tools]
             : defaults.tools,
         customTools,
+        refreshIntervalDays: asNonNegativeIntegerOrDefault(sandbox.refreshIntervalDays, defaults.refreshIntervalDays),
         dockerfile,
         vm: {
             cpu: asPositiveNumberOrNull(sandbox.vm?.cpu) ?? defaults.vm.cpu,

package/dist/lib/sandbox/constants.js

@@ -1,6 +1,6 @@
 import os from 'node:os';
 import { execFileSync } from 'node:child_process';
-import { hostJoin } from "./engines/wsl2-paths.js";
+import { hostJoin } from './engines/wsl2-paths.js';
 const validatedBranches = new Set();
 function dedupe(items) {
     return [...new Set(items)];
@@ -72,6 +72,9 @@ export function sandboxBranchLabel(config) {
 export function sandboxImageConfigLabel(config) {
     return `${sandboxLabel(config)}.image-config`;
 }
+export function sandboxImageRefreshLabel(config) {
+    return `${sandboxLabel(config)}.last-refresh`;
+}
 export function parsePositiveIntegerOption(value, optionName) {
     if (value === undefined || value === null) {
         return undefined;

package/dist/lib/sandbox/credentials.js

@@ -2,7 +2,7 @@ import { execFileSync } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
-import { hostJoin } from "./engines/wsl2-paths.js";
+import { hostJoin } from './engines/wsl2-paths.js';
 const LOCKED_PATTERN = /errSecInteractionNotAllowed|User interaction is not allowed/i;
 const NOT_FOUND_PATTERN = /errSecItemNotFound|specified item could not be found/i;
 const REDACTION_PATTERNS = [

package/dist/lib/sandbox/dotfiles.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { hostJoin } from "./engines/wsl2-paths.js";
+import { hostJoin } from './engines/wsl2-paths.js';
 export function dotfilesCacheDir(home, project) {
     return hostJoin(home, '.agent-infra', '.cache', 'dotfiles-resolved', project);
 }

package/dist/lib/sandbox/engine.js

@@ -1,7 +1,7 @@
 import { platform } from 'node:os';
-import { detectHostResources } from "./constants.js";
-import { ADAPTERS, enginesForPlatform, getAdapter } from "./engines/index.js";
-import { run, runOk, runSafe, runVerbose } from "./shell.js";
+import { detectHostResources } from './constants.js';
+import { ADAPTERS, enginesForPlatform, getAdapter } from './engines/index.js';
+import { run, runOk, runSafe, runVerbose } from './shell.js';
 export const ENGINES = Object.freeze({
     COLIMA: 'colima',
     ORBSTACK: 'orbstack',

package/dist/lib/sandbox/engines/index.js

@@ -1,8 +1,8 @@
-import { colimaAdapter } from "./colima.js";
-import { dockerDesktopAdapter } from "./docker-desktop.js";
-import { nativeAdapter } from "./native.js";
-import { orbstackAdapter } from "./orbstack.js";
-import { wsl2Adapter } from "./wsl2.js";
+import { colimaAdapter } from './colima.js';
+import { dockerDesktopAdapter } from './docker-desktop.js';
+import { nativeAdapter } from './native.js';
+import { orbstackAdapter } from './orbstack.js';
+import { wsl2Adapter } from './wsl2.js';
 export const ADAPTERS = Object.freeze({
     colima: colimaAdapter,
     orbstack: orbstackAdapter,

package/dist/lib/sandbox/engines/wsl2-paths.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { selinuxLabelForMount } from "./selinux.js";
+import { selinuxLabelForMount } from './selinux.js';
 const WINDOWS_DRIVE_PATH_PATTERN = /^([A-Za-z]):[\\/](.*)$/;
 const UNC_PATH_PATTERN = /^(?:\\\\|\/\/)[^\\/]+[\\/][^\\/]+/;
 export function hostJoin(basePath, ...segments) {

package/dist/lib/sandbox/image-build.js

@@ -0,0 +1,80 @@
+import { createHash } from 'node:crypto';
+import { detectEngine } from './engine.js';
+import { resolveBuildUid } from './engines/native.js';
+import { toEnginePath } from './engines/wsl2-paths.js';
+import { sandboxImageConfigLabel, sandboxImageRefreshLabel, sandboxLabel } from './constants.js';
+import { runEngine, runSafeEngine } from './shell.js';
+import { imageSignatureFields, toolNpmPackagesArg, toolShellInstallScriptBase64 } from './tools.js';
+export function buildImageSignature(preparedDockerfile, tools) {
+    return createHash('sha256')
+        .update(JSON.stringify({
+        dockerfile: preparedDockerfile.signature,
+        tools: imageSignatureFields(tools)
+    }))
+        .digest('hex')
+        .slice(0, 12);
+}
+export function buildSandboxImageArgs(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, env = process.env, refresh = false, lastRefresh } = {}) {
+    const selectedEngine = engine ?? detectEngine({ engine: config.engine });
+    const { uid: hostUid, gid: hostGid } = resolveBuildUid({
+        engine: selectedEngine,
+        runFn,
+        runSafeFn,
+        env
+    });
+    const args = [
+        'build',
+        '-t',
+        config.imageName,
+        '--build-arg',
+        `HOST_UID=${hostUid}`,
+        '--build-arg',
+        `HOST_GID=${hostGid}`,
+        '--build-arg',
+        `AI_TOOL_PACKAGES=${toolNpmPackagesArg(tools)}`,
+        '--build-arg',
+        `AI_TOOLS_SHELL_INSTALL_B64=${toolShellInstallScriptBase64(tools)}`,
+        '--label',
+        sandboxLabel(config),
+        '--label',
+        `${sandboxImageConfigLabel(config)}=${imageSignature}`
+    ];
+    if (lastRefresh !== undefined) {
+        args.push('--label', `${sandboxImageRefreshLabel(config)}=${lastRefresh}`);
+    }
+    args.push('-f', toEnginePath(selectedEngine, dockerfilePath), toEnginePath(selectedEngine, config.repoRoot));
+    if (refresh) {
+        args.splice(1, 0, '--no-cache', '--pull');
+    }
+    return args;
+}
+export function parseRefreshTimestamp(value) {
+    const parsed = Number(value);
+    return Number.isInteger(parsed) && parsed >= 0 ? parsed : 0;
+}
+export function parseImageLabels(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== 'object') {
+            return {};
+        }
+        return Object.fromEntries(Object.entries(parsed).filter((entry) => typeof entry[1] === 'string'));
+    }
+    catch {
+        return {};
+    }
+}
+export function isRefreshDisabled(env, noRefreshFlag) {
+    if (noRefreshFlag) {
+        return true;
+    }
+    const value = env.AI_SANDBOX_NO_REFRESH?.trim().toLowerCase();
+    return value === '1' || value === 'true' || value === 'yes';
+}
+export function isRefreshDue(lastRefresh, now, intervalDays) {
+    if (intervalDays <= 0 || lastRefresh > now) {
+        return false;
+    }
+    return now - lastRefresh >= intervalDays * 24 * 60 * 60 * 1000;
+}
+//# sourceMappingURL=image-build.js.map

package/dist/lib/sandbox/image-prune.js

@@ -1,6 +1,6 @@
 import * as p from '@clack/prompts';
-import { sandboxLabel } from "./constants.js";
-import { runEngine } from "./shell.js";
+import { sandboxLabel } from './constants.js';
+import { runEngine } from './shell.js';
 export function pruneSandboxDanglingImages(config, engine) {
     try {
         runEngine(engine, 'docker', [

package/dist/lib/sandbox/index.js

@@ -37,12 +37,12 @@ export async function runSandbox(args) {
     }
     switch (subcommand) {
         case 'create': {
-            const { create } = await import("./commands/create.js");
+            const { create } = await import('./commands/create.js');
             await create(rest);
             break;
         }
         case 'exec': {
-            const { enter } = await import("./commands/enter.js");
+            const { enter } = await import('./commands/enter.js');
             const exitCode = await enter(rest);
             if (typeof exitCode === 'number' && exitCode !== 0) {
                 process.exitCode = exitCode;
@@ -50,27 +50,27 @@ export async function runSandbox(args) {
             break;
         }
         case 'ls': {
-            const { ls } = await import("./commands/ls.js");
+            const { ls } = await import('./commands/ls.js');
             ls(rest);
             break;
         }
         case 'show': {
-            const { show } = await import("./commands/show.js");
+            const { show } = await import('./commands/show.js');
             show(rest);
             break;
         }
         case 'prune': {
-            const { prune } = await import("./commands/prune.js");
+            const { prune } = await import('./commands/prune.js');
             await prune(rest);
             break;
         }
         case 'rebuild': {
-            const { rebuild } = await import("./commands/rebuild.js");
+            const { rebuild } = await import('./commands/rebuild.js');
             await rebuild(rest);
             break;
         }
         case 'refresh': {
-            const { refresh } = await import("./commands/refresh.js");
+            const { refresh } = await import('./commands/refresh.js');
             const exitCode = await refresh(rest);
             if (typeof exitCode === 'number' && exitCode !== 0) {
                 process.exitCode = exitCode;
@@ -78,17 +78,17 @@ export async function runSandbox(args) {
             break;
         }
         case 'rm': {
-            const { rm } = await import("./commands/rm.js");
+            const { rm } = await import('./commands/rm.js');
             await rm(rest);
             break;
         }
         case 'start': {
-            const { start } = await import("./commands/start.js");
+            const { start } = await import('./commands/start.js');
             await start(rest);
             break;
         }
         case 'vm': {
-            const { vm } = await import("./commands/vm.js");
+            const { vm } = await import('./commands/vm.js');
             await vm(rest);
             break;
         }

package/dist/lib/sandbox/managed-fs.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { run } from "./shell.js";
+import { run } from './shell.js';
 export function assertManagedPath(root, target) {
     const resolvedRoot = path.resolve(root);
     const resolvedTarget = path.resolve(target);

package/dist/lib/sandbox/readme-scaffold.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { shareBranchDir, shareCommonDir } from "./constants.js";
+import { shareBranchDir, shareCommonDir } from './constants.js';
 const DOTFILES_README = `# User-level dotfiles channel
 
 This directory is mounted **read-only** into every sandbox container at

package/dist/lib/sandbox/runtimes/base.dockerfile

@@ -12,6 +12,9 @@ RUN if [ "${HOST_UID}" = "0" ]; then \
         (groupadd -o -g ${HOST_GID} devuser || true) && \
         useradd -o -u ${HOST_UID} -g ${HOST_GID} -m -s /bin/bash devuser; \
     else \
+        if ubuntu_uid="$(id -u ubuntu 2>/dev/null)" && [ "${ubuntu_uid}" = "${HOST_UID}" ]; then \
+            userdel -r ubuntu || exit 1; \
+        fi; \
         (groupadd -g ${HOST_GID} devuser || true) && \
         useradd -u ${HOST_UID} -g ${HOST_GID} -m -s /bin/bash devuser; \
     fi

package/dist/lib/sandbox/shell.js

@@ -1,6 +1,7 @@
 import { execFileSync, spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
+import { getAdapter } from './engines/index.js';
 const DEFAULT_TIMEOUT_MS = 60 * 60 * 1000;
 function normalizeOptions(opts = {}, stdio) {
     return {
@@ -114,6 +115,12 @@ export function commandForEngine(engine, cmd, args = []) {
         const resolvedWrapper = resolveCommand('wsl.exe');
         return { cmd: resolvedWrapper, args: ['--', cmd, ...args] };
     }
+    if (cmd === 'docker') {
+        const context = getAdapter(engine).dockerContext;
+        if (context) {
+            return { cmd, args: ['--context', context, ...args] };
+        }
+    }
     return { cmd, args };
 }
 export function runEngine(engine, cmd, args, opts = {}) {
@@ -122,7 +129,8 @@ export function runEngine(engine, cmd, args, opts = {}) {
 }
 export function execEngine(engine, cmd, args, opts = {}) {
     const command = commandForEngine(engine, cmd, args);
-    return execFileSync(command.cmd, command.args, opts);
+    const resolved = resolveCommand(command.cmd);
+    return execFileSync(resolved, command.args, commandOptions(resolved, opts));
 }
 export function runOkEngine(engine, cmd, args, opts = {}) {
     const command = commandForEngine(engine, cmd, args);

package/dist/lib/sandbox/tools.js

@@ -1,5 +1,5 @@
-import { safeNameCandidates, sanitizeBranchName } from "./constants.js";
-import { hostJoin } from "./engines/wsl2-paths.js";
+import { safeNameCandidates, sanitizeBranchName } from './constants.js';
+import { hostJoin } from './engines/wsl2-paths.js';
 const TOOL_ID_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 function createBuiltinTools(home, project) {
     return {
@@ -44,8 +44,8 @@ function createBuiltinTools(home, project) {
             // codex churns ~/.codex/logs_2.sqlite heavily (upstream openai/codex#24275);
             // a bind-mount would write-amplify onto the host SSD via virtiofs. Mount the
             // codex home as tmpfs so those logs stay in RAM and die with the container.
-            // Only the seeded config (config.toml, model-catalogs) is bound back over
-            // the tmpfs; runtime files like logs_2.sqlite must stay in RAM.
+            // Seeded config (config.toml, model-catalogs) is copied into the tmpfs at
+            // startup; runtime files like logs_2.sqlite stay in RAM.
             tmpfs: { size: '512m', seed: ['config.toml', 'model-catalogs'] },
             hostLiveMounts: [
                 { hostPath: hostJoin(home, '.codex', 'auth.json'), containerSubpath: 'auth.json' }

package/dist/lib/server/adapters/feishu/index.js

@@ -1,4 +1,5 @@
-import { cardMessage, createFeishuTransport, normalizeMessage } from "./transport.js";
+import { renderFeishuMessage } from './renderer.js';
+import { createFeishuTransport, normalizeMessage } from './transport.js';
 // Assemble the feishu adapter. The transport is injectable so unit tests can
 // drive start/dispatch/reply/sendMessage against a fake transport without the
 // real SDK; production uses the default SDK-backed transport.
@@ -19,7 +20,10 @@ export function createFeishuAdapter(config, transport = createFeishuTransport(co
                         messageId: normalized.messageId,
                         raw: normalized.raw,
                         reply: async (text) => {
-                            await transport.send(normalized.chatId, cardMessage(text));
+                            await transport.send(normalized.chatId, renderFeishuMessage(text));
+                        },
+                        replyDisplay: async (message) => {
+                            await transport.send(normalized.chatId, renderFeishuMessage(message));
                         }
                     };
                     await adapterCtx.dispatch(message);
@@ -33,7 +37,10 @@ export function createFeishuAdapter(config, transport = createFeishuTransport(co
             await transport.stop();
         },
         async sendMessage(target, text) {
-            await transport.send(target.chatId, cardMessage(text));
+            await transport.send(target.chatId, renderFeishuMessage(text));
+        },
+        async sendDisplayMessage(target, message) {
+            await transport.send(target.chatId, renderFeishuMessage(message));
         }
     };
 }