@fitlab-ai/agent-infra 0.8.2 → 0.8.4

package/lib/sandbox/clipboard/linux.ts

@@ -0,0 +1,124 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import type { ExecFileSyncOptions } from 'node:child_process';
+
+const PROBE_TIMEOUT_MS = 2_000;
+const READ_IMAGE_TIMEOUT_MS = 5_000;
+const PNG_MAGIC = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+
+type ExecFn = (cmd: string, args: string[], options?: ExecFileSyncOptions) => Buffer | string;
+type ExecToFileFn = (cmd: string, args: string[], outputPath: string, timeout: number) => void;
+
+type LinuxBackend =
+  | { kind: 'wayland'; command: 'wl-paste' }
+  | { kind: 'x11'; command: 'xclip' };
+
+export type LinuxClipboardAdapter = {
+  available(): { ok: true } | { ok: false; reason: string };
+  readImagePng(): Buffer | null;
+};
+
+export function createLinuxClipboardAdapter({
+  env = process.env,
+  execFn = execFileSync,
+  execToFileFn = execToFile,
+  mkdtempFn = fs.mkdtempSync,
+  readFileFn = fs.readFileSync,
+  rmFn = fs.rmSync
+}: {
+  env?: NodeJS.ProcessEnv;
+  execFn?: ExecFn;
+  execToFileFn?: ExecToFileFn;
+  mkdtempFn?: typeof fs.mkdtempSync;
+  readFileFn?: typeof fs.readFileSync;
+  rmFn?: typeof fs.rmSync;
+} = {}): LinuxClipboardAdapter {
+  return {
+    available() {
+      const backend = selectBackend(env);
+      try {
+        execFn(backend.command, versionArgs(backend), {
+          encoding: 'utf8',
+          timeout: PROBE_TIMEOUT_MS
+        });
+        return { ok: true };
+      } catch {
+        return { ok: false, reason: unavailableReason(backend) };
+      }
+    },
+    readImagePng() {
+      const backend = selectBackend(env);
+      try {
+        const mimeTypes = String(execFn(backend.command, mimeArgs(backend), {
+          encoding: 'utf8',
+          timeout: PROBE_TIMEOUT_MS
+        }));
+        if (!hasPngMime(mimeTypes)) {
+          return null;
+        }
+
+        const tmpDir = mkdtempFn(path.join(os.tmpdir(), 'agent-infra-clipboard-'));
+        const outputPath = path.join(tmpDir, 'clipboard.png');
+        try {
+          execToFileFn(backend.command, imageArgs(backend), outputPath, READ_IMAGE_TIMEOUT_MS);
+          const png = Buffer.from(readFileFn(outputPath));
+          return isPng(png) ? png : null;
+        } finally {
+          rmFn(tmpDir, { recursive: true, force: true });
+        }
+      } catch {
+        return null;
+      }
+    }
+  };
+}
+
+function selectBackend(env: NodeJS.ProcessEnv): LinuxBackend {
+  return env.WAYLAND_DISPLAY?.trim()
+    ? { kind: 'wayland', command: 'wl-paste' }
+    : { kind: 'x11', command: 'xclip' };
+}
+
+function versionArgs(backend: LinuxBackend): string[] {
+  return backend.kind === 'wayland' ? ['--version'] : ['-version'];
+}
+
+function mimeArgs(backend: LinuxBackend): string[] {
+  return backend.kind === 'wayland'
+    ? ['--list-types']
+    : ['-selection', 'clipboard', '-t', 'TARGETS', '-o'];
+}
+
+function imageArgs(backend: LinuxBackend): string[] {
+  return backend.kind === 'wayland'
+    ? ['-t', 'image/png']
+    : ['-selection', 'clipboard', '-t', 'image/png', '-o'];
+}
+
+function unavailableReason(backend: LinuxBackend): string {
+  return backend.kind === 'wayland'
+    ? 'Wayland clipboard tool wl-paste is unavailable; install wl-clipboard to enable image paste'
+    : 'X11 clipboard tool xclip is unavailable; install xclip to enable image paste';
+}
+
+function hasPngMime(output: string): boolean {
+  return output.split(/\s+/u).some((type) => type === 'image/png');
+}
+
+function execToFile(cmd: string, args: string[], outputPath: string, timeout: number): void {
+  const fd = fs.openSync(outputPath, 'w', 0o600);
+  try {
+    execFileSync(cmd, args, {
+      timeout,
+      stdio: ['ignore', fd, 'pipe']
+    });
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+function isPng(buffer: Buffer): boolean {
+  return buffer.length >= PNG_MAGIC.length && PNG_MAGIC.every((byte, index) => buffer[index] === byte);
+}

package/lib/sandbox/clipboard/win32.ts

@@ -0,0 +1,173 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import type { ExecFileSyncOptions } from 'node:child_process';
+
+const PROBE_TIMEOUT_MS = 2_000;
+const READ_IMAGE_TIMEOUT_MS = 5_000;
+const PNG_MAGIC = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+const POWERSHELL_ARGS = ['-NoProfile', '-NonInteractive', '-STA', '-Command'];
+
+type ExecFn = (cmd: string, args: string[], options?: ExecFileSyncOptions) => Buffer | string;
+type MkdtempFn = (prefix: string) => string;
+type ReadFileFn = (filePath: fs.PathOrFileDescriptor) => Buffer | string;
+type RmFn = (filePath: fs.PathLike, options: { recursive?: boolean; force?: boolean }) => void;
+type ExistsFn = (filePath: fs.PathLike) => boolean;
+
+export type Win32ClipboardAdapter = {
+  available(): { ok: true } | { ok: false; reason: string };
+  readImagePng(): Buffer | null;
+  readImageFromPath(imagePath: string): Buffer | null;
+  readImageFromText(text: string): Buffer | null;
+};
+
+export function createWin32ClipboardAdapter({
+  execFn = execFileSync,
+  mkdtempFn = fs.mkdtempSync,
+  readFileFn = fs.readFileSync,
+  rmFn = fs.rmSync,
+  existsFn = fs.existsSync
+}: {
+  execFn?: ExecFn;
+  mkdtempFn?: MkdtempFn;
+  readFileFn?: ReadFileFn;
+  rmFn?: RmFn;
+  existsFn?: ExistsFn;
+} = {}): Win32ClipboardAdapter {
+  return {
+    available() {
+      try {
+        execFn('powershell.exe', [...POWERSHELL_ARGS, clipboardProbeScript()], {
+          encoding: 'utf8',
+          timeout: PROBE_TIMEOUT_MS
+        });
+        return { ok: true };
+      } catch {
+        return {
+          ok: false,
+          reason: 'Windows PowerShell Get-Clipboard is unavailable; install or enable powershell.exe to use image paste'
+        };
+      }
+    },
+    readImagePng() {
+      const tmpDir = mkdtempFn(path.join(os.tmpdir(), 'agent-infra-clipboard-'));
+      const outputPath = path.join(tmpDir, 'clipboard.png');
+      try {
+        execFn('powershell.exe', [...POWERSHELL_ARGS, pngWriteScript(outputPath)], {
+          encoding: 'utf8',
+          timeout: READ_IMAGE_TIMEOUT_MS
+        });
+        const png = Buffer.from(readFileFn(outputPath));
+        return isPng(png) ? png : null;
+      } catch {
+        return null;
+      } finally {
+        rmFn(tmpDir, { recursive: true, force: true });
+      }
+    },
+    readImageFromPath(imagePath) {
+      const tmpDir = mkdtempFn(path.join(os.tmpdir(), 'agent-infra-clipboard-'));
+      const outputPath = path.join(tmpDir, 'clipboard.png');
+      try {
+        execFn('powershell.exe', [...POWERSHELL_ARGS, pngFromPathScript(imagePath, outputPath)], {
+          encoding: 'utf8',
+          timeout: READ_IMAGE_TIMEOUT_MS
+        });
+        const png = Buffer.from(readFileFn(outputPath));
+        return isPng(png) ? png : null;
+      } catch {
+        return null;
+      } finally {
+        rmFn(tmpDir, { recursive: true, force: true });
+      }
+    },
+    readImageFromText(text) {
+      const trimmed = text.trim();
+      if (!isWindowsImagePath(trimmed)) {
+        return null;
+      }
+      if (!existsFn(trimmed)) {
+        return null;
+      }
+      return this.readImageFromPath(trimmed);
+    }
+  };
+}
+
+function clipboardProbeScript(): string {
+  return 'if ($null -eq (Get-Command Get-Clipboard -ErrorAction SilentlyContinue)) { exit 1 }';
+}
+
+// Embed a filesystem path in a PowerShell single-quoted string literal.
+// Single-quoted strings in PowerShell are verbatim (no variable expansion,
+// no escape sequences). The only special character is a single quote itself,
+// which is escaped by doubling it.
+function psLiteral(value: string): string {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+
+function pngWriteScript(outputPath: string): string {
+  const psOutputPath = psLiteral(outputPath);
+  return [
+    '$ErrorActionPreference = "Stop"',
+    `$outputPath = ${psOutputPath}`,
+    '$image = $null',
+    'try {',
+    '  Add-Type -AssemblyName System.Drawing',
+    '  $image = Get-Clipboard -Format Image -ErrorAction SilentlyContinue',
+    '  if ($null -ne $image) {',
+    '    $image.Save($outputPath, [System.Drawing.Imaging.ImageFormat]::Png)',
+    '    return',
+    '  }',
+    '  $files = Get-Clipboard -Format FileDropList -ErrorAction SilentlyContinue',
+    '  if ($null -ne $files) {',
+    '    $allowed = @(".png", ".jpg", ".jpeg", ".gif", ".bmp", ".webp", ".tiff", ".tif", ".ico")',
+    '    foreach ($file in $files) {',
+    '      if (-not (Test-Path -LiteralPath $file -PathType Leaf)) { continue }',
+    '      $ext = [System.IO.Path]::GetExtension($file)',
+    '      if ($allowed -notcontains $ext) { continue }',
+    '      try {',
+    '        $image = [System.Drawing.Image]::FromFile($file)',
+    '        $image.Save($outputPath, [System.Drawing.Imaging.ImageFormat]::Png)',
+    '        return',
+    '      } catch {}',
+    '    }',
+    '  }',
+    '  throw "clipboard has no image"',
+    '} finally {',
+    '  if ($null -ne $image -and $image -is [System.IDisposable]) { $image.Dispose() }',
+    '}'
+  ].join('\n');
+}
+
+function pngFromPathScript(imagePath: string, outputPath: string): string {
+  const psImagePath = psLiteral(imagePath);
+  const psOutputPath = psLiteral(outputPath);
+  return [
+    '$ErrorActionPreference = "Stop"',
+    `$imagePath = ${psImagePath}`,
+    `$outputPath = ${psOutputPath}`,
+    '$image = $null',
+    'try {',
+    '  Add-Type -AssemblyName System.Drawing',
+    '  if (-not (Test-Path -LiteralPath $imagePath -PathType Leaf)) { throw "file not found: $imagePath" }',
+    '  $image = [System.Drawing.Image]::FromFile($imagePath)',
+    '  $image.Save($outputPath, [System.Drawing.Imaging.ImageFormat]::Png)',
+    '} finally {',
+    '  if ($null -ne $image -and $image -is [System.IDisposable]) { $image.Dispose() }',
+    '}'
+  ].join('\n');
+}
+
+const IMAGE_EXTENSIONS_RE = /\.(png|jpg|jpeg|gif|bmp|webp|tiff?|ico)$/i;
+
+function isWindowsImagePath(text: string): boolean {
+  // Must be a Windows absolute path: drive letter + colon + backslash/slash
+  // followed by a path ending with a known image extension.
+  return /^[A-Za-z]:[\\/].+$/.test(text) && IMAGE_EXTENSIONS_RE.test(text);
+}
+
+function isPng(buffer: Buffer): boolean {
+  return buffer.length >= PNG_MAGIC.length && PNG_MAGIC.every((byte, index) => buffer[index] === byte);
+}

package/lib/sandbox/commands/create.ts

@@ -16,6 +16,7 @@ import {
   parsePositiveIntegerOption,
   sandboxBranchLabel,
   sandboxImageConfigLabel,
+  sandboxImageRefreshLabel,
   sandboxLabel,
   shareBranchDir,
   shareCommonDir,
@@ -37,17 +38,13 @@ import {
 } from '../shell.ts';
 import { resolveTaskBranch } from '../task-resolver.ts';
 import {
-  imageSignatureFields,
   resolveTools,
-  toolConfigDirCandidates,
-  toolNpmPackagesArg,
-  toolShellInstallScriptBase64
+  toolConfigDirCandidates
 } from '../tools.ts';
 import type { SandboxTool } from '../tools.ts';
 import { hostJoin, toEnginePath, volumeArg } from '../engines/wsl2-paths.ts';
 import { clipboardHostDir, CONTAINER_CLIPBOARD_MOUNT } from '../clipboard/paths.ts';
 import { validateSelinuxDisableEnv } from '../engines/selinux.ts';
-import { resolveBuildUid } from '../engines/native.ts';
 import { dotfilesCacheDir, materializeDotfiles } from '../dotfiles.ts';
 import { ensureSandboxDiscoveryReadmes } from '../readme-scaffold.ts';
 import {
@@ -56,6 +53,14 @@ import {
   validateClaudeCredentialsEnvOverride
 } from '../credentials.ts';
 import { detectHostTimezone } from '../host-timezone.ts';
+import {
+  buildImageSignature,
+  buildSandboxImageArgs,
+  isRefreshDisabled,
+  isRefreshDue,
+  parseImageLabels,
+  parseRefreshTimestamp
+} from '../image-build.ts';
 
 const OPENCODE_YOLO_PERMISSION = '{"*":"allow","read":"allow","bash":"allow","edit":"allow","webfetch":"allow","external_directory":"allow","doom_loop":"allow"}';
 const SANDBOX_ALIAS_BLOCK_BEGIN = '# >>> agent-infra managed aliases >>>';
@@ -82,7 +87,7 @@ alias gy='gemini --yolo; tput ed'
 `;
 const CONTAINER_HOME = '/home/devuser';
 const CONTAINER_SHELL_CONFIG_MOUNT = `${CONTAINER_HOME}/.host-shell-config`;
-const USAGE = `Usage: ai sandbox create <branch> [base] [--cpu <n>] [--memory <n>]
+const USAGE = `Usage: ai sandbox create <branch> [base] [--cpu <n>] [--memory <n>] [--no-refresh]
 
 Host aliases:
   ${'~'}/.agent-infra/aliases/sandbox.sh is auto-created on first run and exposed
@@ -93,6 +98,11 @@ Host aliases:
 type SandboxCreateConfig = ReturnType<typeof loadConfig>;
 type PreparedDockerfile = ReturnType<typeof prepareDockerfile>;
 type ResolvedTool = { tool: SandboxTool; dir: string };
+type TmpfsSeedPlanEntry = {
+  stagingPath: string;
+  targetPath: string;
+  volumeArgs: string[];
+};
 type RuntimeCheck = { name: string; cmd: string[] };
 type JsonObject = Record<string, unknown>;
 type GpgCache = { pub: Buffer; sec: Buffer } | null;
@@ -115,16 +125,6 @@ type HostShellConfig = {
   mounts: Array<{ hostPath: string; containerPath: string }>;
 };
 
-function buildSignature(preparedDockerfile: PreparedDockerfile, tools: SandboxTool[]): string {
-  return createHash('sha256')
-    .update(JSON.stringify({
-      dockerfile: preparedDockerfile.signature,
-      tools: imageSignatureFields(tools)
-    }))
-    .digest('hex')
-    .slice(0, 12);
-}
-
 function resolveToolDirs(config: Pick<SandboxCreateConfig, 'project'>, tools: SandboxTool[], branch: string): ResolvedTool[] {
   return tools.map((tool) => {
     const candidates = toolConfigDirCandidates(tool, config.project, branch);
@@ -327,12 +327,14 @@ export function writeSanitizedGitconfig({
 const SHELL_CONFIG_SYMLINKS = ['.gitconfig', '.gitignore_global', '.stCommitMsg', '.bash_aliases'];
 
 export function ensureShellConfigSymlinks(engine: string, container: string, execFn: EngineExecFn = execEngine): void {
-  // Idempotent symlink setup. Runs against a started container so it also
-  // covers custom Dockerfiles that don't bake the symlinks into the image.
-  const script = SHELL_CONFIG_SYMLINKS
-    .map((file) => `ln -sf .host-shell-config/${file} ${CONTAINER_HOME}/${file}`)
-    .join(' && ');
-  execFn(engine, 'docker', ['exec', container, 'bash', '-lc', script], { stdio: 'ignore' });
+  // Idempotent symlink setup. Avoid a shell command here because Windows .cmd
+  // engine shims would interpret metacharacters in a `bash -lc` script before
+  // forwarding it to Docker.
+  for (const file of SHELL_CONFIG_SYMLINKS) {
+    execFn(engine, 'docker', [
+      'exec', container, 'ln', '-sf', `.host-shell-config/${file}`, `${CONTAINER_HOME}/${file}`
+    ], { stdio: 'ignore' });
+  }
 }
 
 export function prepareHostShellConfig({
@@ -634,6 +636,7 @@ export function buildContainerEnvFile(
     chmodFn?: typeof fs.chmodSync;
     rmFn?: typeof fs.rmSync;
     tmpDir?: string;
+    runSafeFn?: DirectRunSafeFn;
   } = {}
 ): { dockerArgs: string[]; cleanup: () => void } {
   const {
@@ -641,11 +644,15 @@ export function buildContainerEnvFile(
     writeFileFn = fs.writeFileSync,
     chmodFn = fs.chmodSync,
     rmFn = fs.rmSync,
-    tmpDir = os.tmpdir()
+    tmpDir = os.tmpdir(),
+    runSafeFn = runSafe
   } = options;
 
   const entries: Array<[string, string]> = resolvedTools.flatMap(({ tool }) => Object.entries(tool.envVars ?? {}));
-  const ghToken = runSafeEngineFn(engine, 'gh', ['auth', 'token']);
+  let ghToken = runSafeEngineFn(engine, 'gh', ['auth', 'token']);
+  if (!ghToken && engine === 'wsl2') {
+    ghToken = runSafeFn('gh', ['auth', 'token']);
+  }
   if (ghToken) {
     entries.push(['GH_TOKEN', ghToken]);
   }
@@ -1191,43 +1198,43 @@ export function buildImage(
     runFn = runEngine,
     runSafeFn = runSafeEngine,
     runVerboseFn = runVerboseEngine,
-    env = process.env
+    env = process.env,
+    refresh = false,
+    lastRefresh
   }: {
     engine?: string;
     runFn?: EngineRunFn;
     runSafeFn?: EngineRunSafeFn;
     runVerboseFn?: EngineRunVerboseFn;
     env?: NodeJS.ProcessEnv;
+    refresh?: boolean;
+    lastRefresh?: number;
   } = {}
 ): void {
   const selectedEngine = engine ?? detectEngine({ engine: config.engine });
-  const { uid: hostUid, gid: hostGid } = resolveBuildUid({
-    engine: selectedEngine,
-    runFn,
-    runSafeFn,
-    env
-  });
+  runVerboseFn(
+    selectedEngine,
+    'docker',
+    buildSandboxImageArgs(config, tools, dockerfilePath, imageSignature, {
+      engine: selectedEngine,
+      runFn,
+      runSafeFn,
+      env,
+      refresh,
+      lastRefresh
+    }),
+    { cwd: config.repoRoot }
+  );
+}
 
-  runVerboseFn(selectedEngine, 'docker', [
-    'build',
-    '-t',
-    config.imageName,
-    '--build-arg',
-    `HOST_UID=${hostUid}`,
-    '--build-arg',
-    `HOST_GID=${hostGid}`,
-    '--build-arg',
-    `AI_TOOL_PACKAGES=${toolNpmPackagesArg(tools)}`,
-    '--build-arg',
-    `AI_TOOLS_SHELL_INSTALL_B64=${toolShellInstallScriptBase64(tools)}`,
-    '--label',
-    sandboxLabel(config),
-    '--label',
-    `${sandboxImageConfigLabel(config)}=${imageSignature}`,
-    '-f',
-    toEnginePath(selectedEngine, dockerfilePath),
-    toEnginePath(selectedEngine, config.repoRoot)
-  ], { cwd: config.repoRoot });
+function readImageLabels(config: Pick<SandboxCreateConfig, 'imageName'> & Pick<SandboxCreateConfig, 'project'>, engine: string): Record<string, string> {
+  return parseImageLabels(runSafeEngine(engine, 'docker', [
+    'image',
+    'inspect',
+    '--format',
+    '{{ json .Config.Labels }}',
+    config.imageName
+  ]));
 }
 
 export async function create(args: string[]): Promise<void> {
@@ -1238,6 +1245,7 @@ export async function create(args: string[]): Promise<void> {
     options: {
       cpu: { type: 'string' },
       memory: { type: 'string' },
+      'no-refresh': { type: 'boolean' },
       help: { type: 'boolean', short: 'h' }
     }
   });
@@ -1287,7 +1295,7 @@ export async function create(args: string[]): Promise<void> {
   const shareBranch = shareBranchDir(effectiveConfig, branch);
   const preparedDockerfile = prepareDockerfile(effectiveConfig);
   const baseBranch = base ?? runSafe('git', ['-C', effectiveConfig.repoRoot, 'branch', '--show-current']);
-  const expectedImageSignature = buildSignature(preparedDockerfile, tools);
+  const expectedImageSignature = buildImageSignature(preparedDockerfile, tools);
   const engine = detectEngine(effectiveConfig);
 
   p.intro(pc.cyan('AI Sandbox'));
@@ -1310,27 +1318,53 @@ export async function create(args: string[]): Promise<void> {
     p.log.success('Docker is ready');
 
     const imageExists = runOkEngine(engine, 'docker', ['image', 'inspect', effectiveConfig.imageName]);
-    const currentImageSignature = imageExists
-      ? runSafeEngine(engine, 'docker', [
-        'image',
-        'inspect',
-        '--format',
-        `{{ index .Config.Labels "${sandboxImageConfigLabel(effectiveConfig)}" }}`,
-        effectiveConfig.imageName
-      ])
-      : '';
-    const needsImageBuild = !imageExists || currentImageSignature !== expectedImageSignature;
+    const imageLabels = imageExists ? readImageLabels(effectiveConfig, engine) : {};
+    const currentImageSignature = imageLabels[sandboxImageConfigLabel(effectiveConfig)] ?? '';
+    const currentLastRefresh = parseRefreshTimestamp(imageLabels[sandboxImageRefreshLabel(effectiveConfig)] ?? '');
+    const signatureStale = !imageExists || currentImageSignature !== expectedImageSignature;
+    const now = Date.now();
+    const refreshDue = imageExists
+      && !signatureStale
+      && !isRefreshDisabled(process.env, values['no-refresh'] ?? false)
+      && isRefreshDue(currentLastRefresh, now, effectiveConfig.refreshIntervalDays);
+    const needsImageBuild = signatureStale || refreshDue;
 
     if (needsImageBuild) {
-      p.log.step(imageExists ? 'Rebuilding stale image...' : 'Building image for first use...');
-      buildImage(
-        effectiveConfig,
-        tools,
-        preparedDockerfile.path,
-        expectedImageSignature,
-        { engine }
+      const buildRefresh = !imageExists || refreshDue;
+      const buildLastRefresh = buildRefresh ? now : currentLastRefresh || 0;
+
+      p.log.step(
+        refreshDue
+          ? 'Refreshing stale image...'
+          : imageExists
+            ? 'Rebuilding stale image...'
+            : 'Building image for first use...'
       );
-      p.log.success(imageExists ? 'Image rebuilt' : 'Image built');
+      try {
+        buildImage(
+          effectiveConfig,
+          tools,
+          preparedDockerfile.path,
+          expectedImageSignature,
+          { engine, refresh: buildRefresh, lastRefresh: buildLastRefresh }
+        );
+        p.log.success(
+          refreshDue
+            ? 'Image refreshed'
+            : imageExists
+              ? 'Image rebuilt'
+              : 'Image built'
+        );
+      } catch (error) {
+        if (refreshDue && !signatureStale && imageExists) {
+          p.log.warn(
+            'Scheduled sandbox image refresh failed; continuing with the existing image. ' +
+            commandErrorMessage(error)
+          );
+        } else {
+          throw error;
+        }
+      }
     } else {
       p.log.step(`Using existing image ${effectiveConfig.imageName}`);
     }
@@ -1471,6 +1505,7 @@ export async function create(args: string[]): Promise<void> {
             : null;
           const envFile = buildContainerEnvFile(effectiveResolvedTools, engine);
           let hostShellConfig: HostShellConfig;
+          let tmpfsSeedPlan: TmpfsSeedPlanEntry[] = [];
           try {
             const claudeCodeEntry = effectiveResolvedTools.find(({ tool }) => tool.id === 'claude-code');
             if (claudeCodeEntry) {
@@ -1511,22 +1546,24 @@ export async function create(args: string[]): Promise<void> {
               '-v',
               volumeArg(engine, hostPath, containerPath, ':ro')
             ]);
-            // A tmpfs containerMount starts empty, so the config seeded into the
-            // host dir before launch would be invisible in-container. Bind only
-            // the explicitly declared seed entries (config.toml, model-catalogs)
-            // back over the tmpfs as nested mounts — the same proven mechanism as
-            // hostLiveMounts/auth.json, established at `docker run` time (no
-            // post-start `docker cp`, which can land under a freshly-mounted
-            // tmpfs instead of inside it). The allowlist is deliberate: any
-            // runtime files left in the host dir (e.g. a stale logs_2.sqlite or
-            // sessions/ from a previous bind-mount era) must NOT be re-mounted,
-            // or the high-churn writes would land on the host SSD again.
-            const tmpfsSeedVolumes = effectiveResolvedTools.flatMap(({ tool, dir }) =>
-              (tool.tmpfs?.seed ?? []).flatMap((entry) => {
+            // Mount each declared seed read-only at an isolated staging path.
+            // After docker run mounts the empty tmpfs, the container's default
+            // user copies these entries into it so the runtime targets are normal,
+            // writable files rather than nested mount points. The allowlist keeps
+            // stale runtime files (logs_2.sqlite, sessions, etc.) on the host from
+            // being exposed or written through.
+            tmpfsSeedPlan = effectiveResolvedTools.flatMap(({ tool, dir }) =>
+              (tool.tmpfs?.seed ?? []).flatMap((entry, index) => {
                 const hostPath = path.join(dir, entry);
-                return fs.existsSync(hostPath)
-                  ? ['-v', volumeArg(engine, hostPath, path.posix.join(tool.containerMount, entry))]
-                  : [];
+                if (!fs.existsSync(hostPath)) {
+                  return [];
+                }
+                const stagingPath = path.posix.join('/run/agent-infra/tmpfs-seeds', tool.id, String(index));
+                return [{
+                  stagingPath,
+                  targetPath: path.posix.join(tool.containerMount, entry),
+                  volumeArgs: ['-v', volumeArg(engine, hostPath, stagingPath, ':ro')]
+                }];
               })
             );
             const liveMountVolumes = effectiveResolvedTools.flatMap(({ tool }) =>
@@ -1579,12 +1616,10 @@ export async function create(args: string[]): Promise<void> {
                 path.join(effectiveConfig.repoRoot, '.git'),
                 `${toEnginePath(engine, effectiveConfig.repoRoot)}/.git`
               ),
-              '-v',
-              volumeArg(engine, hostJoin(effectiveConfig.home, '.ssh'), '/home/devuser/.ssh', ':ro'),
               ...dotfilesMount,
               ...toolVolumes,
               ...tmpfsArgs,
-              ...tmpfsSeedVolumes,
+              ...tmpfsSeedPlan.flatMap(({ volumeArgs }) => volumeArgs),
               ...liveMountVolumes,
               ...shellConfigVolumes,
               ...envFile.dockerArgs,
@@ -1597,6 +1632,15 @@ export async function create(args: string[]): Promise<void> {
             envFile.cleanup();
           }
 
+          for (const { stagingPath, targetPath } of tmpfsSeedPlan) {
+            runEngineTaskCommand(engine, 'docker', [
+              'exec', container, 'mkdir', '-p', path.posix.dirname(targetPath)
+            ]);
+            runEngineTaskCommand(engine, 'docker', [
+              'exec', container, 'cp', '-R', '--', stagingPath, targetPath
+            ]);
+          }
+
           // Belt-and-suspenders: re-create the four shell-config symlinks at
           // runtime so users with a custom `sandbox.dockerfile` (which won't
           // include the ai-tools.dockerfile symlink fragment) still get