@fitlab-ai/agent-infra 0.8.3 → 0.8.5

package/lib/sandbox/clipboard/bridge.ts

@@ -9,6 +9,7 @@ import {
   pruneClipboardDir,
   writeClipboardPngAtomic
 } from './paths.ts';
+import { isClipboardInboxReadable, readPendingClipboardPath } from './inbox.ts';
 import { commandForEngine, restoreTerminal, runInteractiveEngine, runOkEngine } from '../shell.ts';
 import { loadNodePty, type NodePty, type PtyProcess } from './node-pty.ts';
 
@@ -85,13 +86,9 @@ export async function runInteractiveWithClipboardBridge(options: BridgeOptions):
   if (!stdin.isTTY || !stdout.isTTY) {
     return fallback('host stdin/stdout is not a TTY');
   }
-  if (!adapter) {
-    return fallback('no clipboard adapter available on this platform');
-  }
-  const available = adapter.available();
-  if (!available.ok) {
-    return fallback(available.reason);
-  }
+  const available = adapter?.available() ?? { ok: false as const, reason: 'no clipboard adapter available on this platform' };
+  const inboxReady = isClipboardInboxReadable(home);
+  if (!available.ok && !inboxReady) return fallback(available.reason);
   if (!runOk(engine, 'docker', ['exec', container, 'sh', '-c', '[ -d /clipboard ] && [ -r /clipboard ]'])) {
     return fallback('container /clipboard mount is missing; rebuild the sandbox to enable image paste');
   }
@@ -119,7 +116,7 @@ export async function runInteractiveWithClipboardBridge(options: BridgeOptions):
   return runBridge({
     child,
     home,
-    adapter,
+    adapter: available.ok ? adapter : null,
     writeStderr,
     stdin,
     stdout,
@@ -138,7 +135,7 @@ async function runBridge({
 }: {
   child: PtyProcess;
   home: string;
-  adapter: ClipboardAdapter;
+  adapter: ClipboardAdapter | null;
   writeStderr: (chunk: string) => unknown;
   stdin: NodeJS.ReadStream;
   stdout: NodeJS.WriteStream;
@@ -182,9 +179,9 @@ async function runBridge({
   }
 
   function handleText(raw: string, target: PtyProcess): void {
-    const textAdapter = adapter as TextImageClipboardAdapter;
+    const textAdapter = adapter as TextImageClipboardAdapter | null;
     const pastedText = extractSinglePathPaste(raw);
-    if (!textAdapter.readImageFromText || pastedText === null) {
+    if (!textAdapter || !textAdapter.readImageFromText || pastedText === null) {
       target.write(raw);
       return;
     }
@@ -207,12 +204,17 @@ async function runBridge({
 
   function handleCtrlV(match: CtrlVMatch, target: PtyProcess): void {
     try {
+      const pendingPath = readPendingClipboardPath(home);
+      if (pendingPath) {
+        target.write(buildBracketedPaste(pendingPath));
+        return;
+      }
       // readImagePng returns null both for "no image on clipboard" and for
       // unexpected read failures; both cases forward the original Ctrl+V so
       // the container app handles it as a regular keystroke. The throw branch
       // below only fires on truly unexpected exceptions (e.g. fs write
       // errors writing to the host clipboard dir).
-      const png = adapter.readImagePng();
+      const png = adapter?.readImagePng() ?? null;
       if (!png) {
         target.write(match.raw);
         return;

package/lib/sandbox/clipboard/inbox.ts

@@ -0,0 +1,83 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import {
+  clipboardHostDir,
+  containerClipboardPath,
+  pngClipboardFilename,
+  pruneClipboardDir,
+  writeClipboardPngAtomic
+} from './paths.ts';
+
+export const RECEIVER_CAPABILITY = 'AGENT_INFRA_CLIPBOARD_RECEIVER:v1';
+const MARKER = '.pending.json';
+const PNG_SIGNATURE = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+const HASHED_PNG = /^[a-f0-9]{16}\.png$/u;
+const REMOTE_TEMP = /^agent-infra-cp-[0-9a-f-]{36}\.png$/u;
+
+export function isClipboardInboxReadable(home: string): boolean {
+  const dir = clipboardHostDir(home);
+  try {
+    fs.accessSync(dir, fs.constants.R_OK);
+    return fs.statSync(dir).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+export function receiveRemoteClipboardPng(home: string, tempPath: string, platformName: NodeJS.Platform = process.platform): string {
+  if (platformName !== 'linux') throw new Error('remote clipboard receiver requires Linux');
+  if (path.dirname(tempPath) !== '/tmp' || !REMOTE_TEMP.test(path.basename(tempPath))) {
+    throw new Error('invalid clipboard upload path');
+  }
+  const signature = Buffer.alloc(PNG_SIGNATURE.length);
+  const fd = fs.openSync(tempPath, 'r');
+  let signatureBytes: number;
+  try {
+    signatureBytes = fs.readSync(fd, signature, 0, signature.length, 0);
+  } finally {
+    fs.closeSync(fd);
+  }
+  if (signatureBytes !== PNG_SIGNATURE.length || !signature.equals(PNG_SIGNATURE)) {
+    throw new Error('uploaded clipboard file is not a PNG');
+  }
+  const png = fs.readFileSync(tempPath);
+  const dir = clipboardHostDir(home);
+  if (!fs.existsSync(path.dirname(dir))) throw new Error('agent-infra is not installed on this host');
+  const filename = pngClipboardFilename(png);
+  writeClipboardPngAtomic(dir, filename, png);
+  pruneClipboardDir(dir);
+  const markerTmp = path.join(dir, `.${MARKER}.${process.pid}.tmp`);
+  fs.writeFileSync(markerTmp, JSON.stringify({ version: 1, filename, createdAt: new Date().toISOString() }) + '\n', { mode: 0o600 });
+  fs.renameSync(markerTmp, path.join(dir, MARKER));
+  return containerClipboardPath(filename);
+}
+
+export function readPendingClipboardPath(home: string): string | null {
+  const dir = clipboardHostDir(home);
+  const markerPath = path.join(dir, MARKER);
+  let markerText: string;
+  try {
+    markerText = fs.readFileSync(markerPath, 'utf8');
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null;
+    throw new Error('invalid clipboard pending marker', { cause: error });
+  }
+
+  let marker: { version?: unknown; filename?: unknown };
+  try {
+    marker = JSON.parse(markerText) as { version?: unknown; filename?: unknown };
+  } catch (error) {
+    throw new Error('invalid clipboard pending marker', { cause: error });
+  }
+  if (marker.version !== 1 || typeof marker.filename !== 'string' || !HASHED_PNG.test(marker.filename)) {
+    throw new Error('invalid clipboard pending marker');
+  }
+  const filePath = path.join(dir, marker.filename);
+  try {
+    const stat = fs.lstatSync(filePath);
+    if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('pending clipboard image is not a regular file');
+  } catch (error) {
+    throw new Error('invalid clipboard pending marker', { cause: error });
+  }
+  return containerClipboardPath(marker.filename);
+}

package/lib/sandbox/commands/create.ts

@@ -87,17 +87,36 @@ alias gy='gemini --yolo; tput ed'
 `;
 const CONTAINER_HOME = '/home/devuser';
 const CONTAINER_SHELL_CONFIG_MOUNT = `${CONTAINER_HOME}/.host-shell-config`;
-const USAGE = `Usage: ai sandbox create <branch> [base] [--cpu <n>] [--memory <n>] [--no-refresh]
+const USAGE = `Usage: ai sandbox create <branch> [base] [--cpu <n>] [--memory <n>] [--no-refresh] [--inherit-proxy|-P]
 
 Host aliases:
   ${'~'}/.agent-infra/aliases/sandbox.sh is auto-created on first run and exposed
   as ${CONTAINER_HOME}/.bash_aliases inside the sandbox container (the host
   shell-config directory is bind-mounted at ${CONTAINER_SHELL_CONFIG_MOUNT} and
-  symlinked into $HOME).`;
+  symlinked into $HOME).
+
+Proxy:
+  --inherit-proxy, -P  Copy non-empty standard host proxy variables into the
+                       container environment through the private env file.`;
+const HOST_PROXY_ENV_KEYS = [
+  'http_proxy',
+  'HTTP_PROXY',
+  'https_proxy',
+  'HTTPS_PROXY',
+  'all_proxy',
+  'ALL_PROXY',
+  'no_proxy',
+  'NO_PROXY'
+] as const;
 
 type SandboxCreateConfig = ReturnType<typeof loadConfig>;
 type PreparedDockerfile = ReturnType<typeof prepareDockerfile>;
 type ResolvedTool = { tool: SandboxTool; dir: string };
+type TmpfsSeedPlanEntry = {
+  stagingPath: string;
+  targetPath: string;
+  volumeArgs: string[];
+};
 type RuntimeCheck = { name: string; cmd: string[] };
 type JsonObject = Record<string, unknown>;
 type GpgCache = { pub: Buffer; sec: Buffer } | null;
@@ -322,12 +341,14 @@ export function writeSanitizedGitconfig({
 const SHELL_CONFIG_SYMLINKS = ['.gitconfig', '.gitignore_global', '.stCommitMsg', '.bash_aliases'];
 
 export function ensureShellConfigSymlinks(engine: string, container: string, execFn: EngineExecFn = execEngine): void {
-  // Idempotent symlink setup. Runs against a started container so it also
-  // covers custom Dockerfiles that don't bake the symlinks into the image.
-  const script = SHELL_CONFIG_SYMLINKS
-    .map((file) => `ln -sf .host-shell-config/${file} ${CONTAINER_HOME}/${file}`)
-    .join(' && ');
-  execFn(engine, 'docker', ['exec', container, 'bash', '-lc', script], { stdio: 'ignore' });
+  // Idempotent symlink setup. Avoid a shell command here because Windows .cmd
+  // engine shims would interpret metacharacters in a `bash -lc` script before
+  // forwarding it to Docker.
+  for (const file of SHELL_CONFIG_SYMLINKS) {
+    execFn(engine, 'docker', [
+      'exec', container, 'ln', '-sf', `.host-shell-config/${file}`, `${CONTAINER_HOME}/${file}`
+    ], { stdio: 'ignore' });
+  }
 }
 
 export function prepareHostShellConfig({
@@ -619,28 +640,44 @@ function formatEnvFileEntry(key: string, value: string): string {
   return `${key}=${value}`;
 }
 
+export function collectHostProxyEntries(env: NodeJS.ProcessEnv): Array<[string, string]> {
+  const entriesByExactKey = new Map(Object.entries(env));
+  return HOST_PROXY_ENV_KEYS.flatMap((key) => {
+    const value = entriesByExactKey.get(key);
+    return typeof value === 'string' && value !== '' ? [[key, value]] : [];
+  });
+}
+
 export function buildContainerEnvFile(
   resolvedTools: ResolvedTool[],
   engine: string,
   runSafeEngineFn: EngineRunSafeFn = runSafeEngine,
   options: {
+    additionalEntries?: Array<[string, string]>;
     mkdtempFn?: typeof fs.mkdtempSync;
     writeFileFn?: typeof fs.writeFileSync;
     chmodFn?: typeof fs.chmodSync;
     rmFn?: typeof fs.rmSync;
     tmpDir?: string;
+    runSafeFn?: DirectRunSafeFn;
   } = {}
 ): { dockerArgs: string[]; cleanup: () => void } {
   const {
+    additionalEntries = [],
     mkdtempFn = fs.mkdtempSync,
     writeFileFn = fs.writeFileSync,
     chmodFn = fs.chmodSync,
     rmFn = fs.rmSync,
-    tmpDir = os.tmpdir()
+    tmpDir = os.tmpdir(),
+    runSafeFn = runSafe
   } = options;
 
   const entries: Array<[string, string]> = resolvedTools.flatMap(({ tool }) => Object.entries(tool.envVars ?? {}));
-  const ghToken = runSafeEngineFn(engine, 'gh', ['auth', 'token']);
+  entries.push(...additionalEntries);
+  let ghToken = runSafeEngineFn(engine, 'gh', ['auth', 'token']);
+  if (!ghToken && engine === 'wsl2') {
+    ghToken = runSafeFn('gh', ['auth', 'token']);
+  }
   if (ghToken) {
     entries.push(['GH_TOKEN', ghToken]);
   }
@@ -1234,6 +1271,7 @@ export async function create(args: string[]): Promise<void> {
       cpu: { type: 'string' },
       memory: { type: 'string' },
       'no-refresh': { type: 'boolean' },
+      'inherit-proxy': { type: 'boolean', short: 'P' },
       help: { type: 'boolean', short: 'h' }
     }
   });
@@ -1491,8 +1529,12 @@ export async function create(args: string[]): Promise<void> {
               signingKey
             )
             : null;
-          const envFile = buildContainerEnvFile(effectiveResolvedTools, engine);
+          const proxyEntries = values['inherit-proxy'] ? collectHostProxyEntries(process.env) : [];
+          const envFile = buildContainerEnvFile(effectiveResolvedTools, engine, undefined, {
+            additionalEntries: proxyEntries
+          });
           let hostShellConfig: HostShellConfig;
+          let tmpfsSeedPlan: TmpfsSeedPlanEntry[] = [];
           try {
             const claudeCodeEntry = effectiveResolvedTools.find(({ tool }) => tool.id === 'claude-code');
             if (claudeCodeEntry) {
@@ -1533,22 +1575,24 @@ export async function create(args: string[]): Promise<void> {
               '-v',
               volumeArg(engine, hostPath, containerPath, ':ro')
             ]);
-            // A tmpfs containerMount starts empty, so the config seeded into the
-            // host dir before launch would be invisible in-container. Bind only
-            // the explicitly declared seed entries (config.toml, model-catalogs)
-            // back over the tmpfs as nested mounts — the same proven mechanism as
-            // hostLiveMounts/auth.json, established at `docker run` time (no
-            // post-start `docker cp`, which can land under a freshly-mounted
-            // tmpfs instead of inside it). The allowlist is deliberate: any
-            // runtime files left in the host dir (e.g. a stale logs_2.sqlite or
-            // sessions/ from a previous bind-mount era) must NOT be re-mounted,
-            // or the high-churn writes would land on the host SSD again.
-            const tmpfsSeedVolumes = effectiveResolvedTools.flatMap(({ tool, dir }) =>
-              (tool.tmpfs?.seed ?? []).flatMap((entry) => {
+            // Mount each declared seed read-only at an isolated staging path.
+            // After docker run mounts the empty tmpfs, the container's default
+            // user copies these entries into it so the runtime targets are normal,
+            // writable files rather than nested mount points. The allowlist keeps
+            // stale runtime files (logs_2.sqlite, sessions, etc.) on the host from
+            // being exposed or written through.
+            tmpfsSeedPlan = effectiveResolvedTools.flatMap(({ tool, dir }) =>
+              (tool.tmpfs?.seed ?? []).flatMap((entry, index) => {
                 const hostPath = path.join(dir, entry);
-                return fs.existsSync(hostPath)
-                  ? ['-v', volumeArg(engine, hostPath, path.posix.join(tool.containerMount, entry))]
-                  : [];
+                if (!fs.existsSync(hostPath)) {
+                  return [];
+                }
+                const stagingPath = path.posix.join('/run/agent-infra/tmpfs-seeds', tool.id, String(index));
+                return [{
+                  stagingPath,
+                  targetPath: path.posix.join(tool.containerMount, entry),
+                  volumeArgs: ['-v', volumeArg(engine, hostPath, stagingPath, ':ro')]
+                }];
               })
             );
             const liveMountVolumes = effectiveResolvedTools.flatMap(({ tool }) =>
@@ -1604,7 +1648,7 @@ export async function create(args: string[]): Promise<void> {
               ...dotfilesMount,
               ...toolVolumes,
               ...tmpfsArgs,
-              ...tmpfsSeedVolumes,
+              ...tmpfsSeedPlan.flatMap(({ volumeArgs }) => volumeArgs),
               ...liveMountVolumes,
               ...shellConfigVolumes,
               ...envFile.dockerArgs,
@@ -1617,6 +1661,15 @@ export async function create(args: string[]): Promise<void> {
             envFile.cleanup();
           }
 
+          for (const { stagingPath, targetPath } of tmpfsSeedPlan) {
+            runEngineTaskCommand(engine, 'docker', [
+              'exec', container, 'mkdir', '-p', path.posix.dirname(targetPath)
+            ]);
+            runEngineTaskCommand(engine, 'docker', [
+              'exec', container, 'cp', '-R', '--', stagingPath, targetPath
+            ]);
+          }
+
           // Belt-and-suspenders: re-create the four shell-config symlinks at
           // runtime so users with a custom `sandbox.dockerfile` (which won't
           // include the ai-tools.dockerfile symlink fragment) still get

package/lib/sandbox/engine.ts

@@ -2,7 +2,7 @@ import { platform } from 'node:os';
 import { detectHostResources } from './constants.ts';
 import { ADAPTERS, enginesForPlatform, getAdapter } from './engines/index.ts';
 import type { EffectiveSandboxConfig, OnMessage, RunFns, SandboxAdapter, SandboxVmConfig } from './engines/index.ts';
-import { run, runOk, runSafe, runVerbose } from './shell.ts';
+import { run, runOk, runOkEngine, runSafe, runVerbose } from './shell.ts';
 
 export const ENGINES = Object.freeze({
   COLIMA: 'colima',
@@ -26,6 +26,7 @@ type EngineDependencies = {
   platformFn?: typeof platform;
   runFn?: RunFns['run'];
   runOkFn?: RunFns['runOk'];
+  runOkEngineFn?: typeof runOkEngine;
   runSafeFn?: RunFns['runSafe'];
   runVerboseFn?: RunFns['runVerbose'];
 };
@@ -50,6 +51,37 @@ function applyDockerContext(adapter: SandboxAdapter): void {
   }
 }
 
+function buildKitError(engine: string): Error {
+  let repair: string;
+  switch (engine) {
+    case ENGINES.COLIMA:
+      repair = 'Install the Docker Buildx plugin with: brew install docker-buildx';
+      break;
+    case ENGINES.DOCKER_DESKTOP:
+    case ENGINES.WSL2:
+      repair = 'Upgrade or repair Docker Desktop so Docker Buildx and BuildKit are available.';
+      break;
+    case ENGINES.NATIVE:
+      repair = 'Install the Docker Buildx plugin for your Docker Engine installation.';
+      break;
+    default:
+      repair = `Upgrade or repair ${engineDisplayName(engine)} so Docker Buildx and BuildKit are available.`;
+  }
+
+  return new Error([
+    `Docker BuildKit is not available for ${engineDisplayName(engine)}.`,
+    repair,
+    'Verify the builder with: docker buildx inspect --bootstrap',
+    'Then retry the sandbox create or rebuild command.'
+  ].join('\n'));
+}
+
+function ensureBuildKit(engine: string, runOkEngineFn: typeof runOkEngine): void {
+  if (!runOkEngineFn(engine, 'docker', ['buildx', 'inspect', '--bootstrap'])) {
+    throw buildKitError(engine);
+  }
+}
+
 export function validateSandboxEngine(
   engine: string | null | undefined,
   { platformFn = platform }: Pick<EngineDependencies, 'platformFn'> = {}
@@ -144,10 +176,12 @@ export async function ensureDocker(
   const engine = detectEngine(config, dependencies);
   const adapter = getAdapter(engine);
   const effectiveConfig = effectiveConfigFor(adapter, config);
+  const fns = runFns(dependencies);
 
   applyDockerContext(adapter);
-  const vmJustStarted = await adapter.ensure(effectiveConfig, onMessage, runFns(dependencies));
-  adapter.syncResources(effectiveConfig, onMessage, runFns(dependencies), { vmJustStarted });
+  const vmJustStarted = await adapter.ensure(effectiveConfig, onMessage, fns);
+  ensureBuildKit(engine, dependencies.runOkEngineFn ?? runOkEngine);
+  adapter.syncResources(effectiveConfig, onMessage, fns, { vmJustStarted });
 }
 
 export function isVmManaged(config: EngineConfig = {}, dependencies: EngineDependencies = {}): boolean {

package/lib/sandbox/engines/colima.ts

@@ -35,8 +35,8 @@ export const colimaAdapter: SandboxAdapter = {
     let started = false;
 
     if (!runOk('which', ['colima'])) {
-      onMessage?.('Installing colima + docker via Homebrew...');
-      runVerbose('brew', ['install', 'colima', 'docker']);
+      onMessage?.('Installing colima + docker + docker-buildx via Homebrew...');
+      runVerbose('brew', ['install', 'colima', 'docker', 'docker-buildx']);
     }
 
     if (!runOk('colima', ['status'])) {

package/lib/sandbox/runtimes/base.dockerfile

@@ -12,6 +12,9 @@ RUN if [ "${HOST_UID}" = "0" ]; then \
         (groupadd -o -g ${HOST_GID} devuser || true) && \
         useradd -o -u ${HOST_UID} -g ${HOST_GID} -m -s /bin/bash devuser; \
     else \
+        if ubuntu_uid="$(id -u ubuntu 2>/dev/null)" && [ "${ubuntu_uid}" = "${HOST_UID}" ]; then \
+            userdel -r ubuntu || exit 1; \
+        fi; \
         (groupadd -g ${HOST_GID} devuser || true) && \
         useradd -u ${HOST_UID} -g ${HOST_GID} -m -s /bin/bash devuser; \
     fi
@@ -188,6 +191,10 @@ fi
 exec tmux new-session -s "$SESSION"
 SCRIPT
 
+RUN test -s /usr/local/bin/cc-token-status && test -x /usr/local/bin/cc-token-status && \
+    test -s /usr/local/bin/sandbox-dotfiles-link && test -x /usr/local/bin/sandbox-dotfiles-link && \
+    test -s /usr/local/bin/sandbox-tmux-entry && test -x /usr/local/bin/sandbox-tmux-entry
+
 ENV LANG=en_US.UTF-8
 ENV LC_ALL=en_US.UTF-8
 ENV TERM=xterm-256color

package/lib/sandbox/shell.ts

@@ -2,6 +2,7 @@ import { execFileSync, spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import type { ExecFileSyncOptions, StdioOptions, SpawnSyncOptions, SpawnSyncReturns } from 'node:child_process';
+import { getAdapter } from './engines/index.ts';
 
 const DEFAULT_TIMEOUT_MS = 60 * 60 * 1000;
 
@@ -52,7 +53,7 @@ function resolveCommand(cmd: string): string {
   return cmd;
 }
 
-function commandOptions<T extends CommandOptions>(cmd: string, opts: T): T | (T & { shell: true }) {
+function commandOptions<T extends object>(cmd: string, opts: T): T | (T & { shell: true }) {
   if (process.platform === 'win32' && /\.(?:bat|cmd)$/i.test(cmd)) {
     return { ...opts, shell: true };
   }
@@ -143,6 +144,13 @@ export function commandForEngine(engine: string, cmd: string, args: string[] = [
     return { cmd: resolvedWrapper, args: ['--', cmd, ...args] };
   }
 
+  if (cmd === 'docker') {
+    const context = getAdapter(engine).dockerContext;
+    if (context) {
+      return { cmd, args: ['--context', context, ...args] };
+    }
+  }
+
   return { cmd, args };
 }
 
@@ -153,7 +161,8 @@ export function runEngine(engine: string, cmd: string, args: string[], opts: Com
 
 export function execEngine(engine: string, cmd: string, args: string[], opts: ExecFileSyncOptions = {}) {
   const command = commandForEngine(engine, cmd, args);
-  return execFileSync(command.cmd, command.args, opts);
+  const resolved = resolveCommand(command.cmd);
+  return execFileSync(resolved, command.args, commandOptions(resolved, opts));
 }
 
 export function runOkEngine(engine: string, cmd: string, args: string[], opts: CommandOptions = {}): boolean {

package/lib/sandbox/tools.ts

@@ -22,9 +22,9 @@ export type SandboxTool = {
   // When set, containerMount is mounted as an in-container tmpfs (RAM) instead
   // of bind-mounting the host config dir, keeping high-churn tool logs off the
   // host disk. `seed` lists the host-dir entries (relative to the tool's config
-  // dir) to bind back over the tmpfs so seeded config stays visible — it is an
-  // explicit allowlist so runtime files (e.g. logs_2.sqlite, sessions) left in
-  // the host dir are NOT re-mounted, which would defeat the tmpfs.
+  // dir) to copy into the tmpfs when the container starts. It is an explicit
+  // allowlist so runtime files (e.g. logs_2.sqlite, sessions) left in the host
+  // dir stay out of the container and seeded config cannot write back.
   tmpfs?: { size?: string; seed?: string[] };
 };
 
@@ -80,8 +80,8 @@ function createBuiltinTools(home: string, project: string): Record<string, Sandb
       // codex churns ~/.codex/logs_2.sqlite heavily (upstream openai/codex#24275);
       // a bind-mount would write-amplify onto the host SSD via virtiofs. Mount the
       // codex home as tmpfs so those logs stay in RAM and die with the container.
-      // Only the seeded config (config.toml, model-catalogs) is bound back over
-      // the tmpfs; runtime files like logs_2.sqlite must stay in RAM.
+      // Seeded config (config.toml, model-catalogs) is copied into the tmpfs at
+      // startup; runtime files like logs_2.sqlite stay in RAM.
       tmpfs: { size: '512m', seed: ['config.toml', 'model-catalogs'] },
       hostLiveMounts: [
         { hostPath: hostJoin(home, '.codex', 'auth.json'), containerSubpath: 'auth.json' }

package/lib/server/daemon.ts

@@ -12,6 +12,7 @@ import type { RunnerOptions, RunnerResult } from './runner.ts';
 import { streamCommand } from './streamer.ts';
 import { markdownMessage, replyOutbound, textMessage } from './display.ts';
 import { buildStatusModel, statusModelToDisplay, type StatusModel } from '../task/commands/status.ts';
+import { getProcessStartTime, removePidRecordIfMatches } from './process-state.ts';
 
 function errorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
@@ -110,6 +111,7 @@ export async function runDaemon(): Promise<void> {
 
   const logger = createLogger(config.log);
   logger.info(`daemon starting agent-infra ${VERSION} pid=${process.pid}`);
+  const ownStartTime = getProcessStartTime(process.pid);
 
   const abortController = new AbortController();
   let resolveShutdown: () => void = () => {};
@@ -135,6 +137,13 @@ export async function runDaemon(): Promise<void> {
       await unloadAdapters(adapters);
       clearInterval(heartbeat);
       logger.close();
+      if (ownStartTime !== null) {
+        removePidRecordIfMatches(config.pidFile, {
+          version: 1,
+          pid: process.pid,
+          startTime: ownStartTime
+        });
+      }
       resolveShutdown();
     })();
   };