@fitlab-ai/agent-infra 0.9.0 → 0.9.1

package/lib/platform/release-notes.ts

@@ -0,0 +1,167 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+
+import { resolvePlatformContext } from './context.ts';
+import {
+  fetchGitHubReleaseNoteData,
+  publishGitHubReleaseNotes
+} from './github-release-notes.ts';
+import type { ReleaseNoteActor } from './github-release-notes.ts';
+import type { GitHubClient } from './github-client.ts';
+
+type ReleaseNoteOptions = {
+  cwd?: string;
+  platformType?: string;
+  client?: GitHubClient;
+};
+
+type ReleaseNoteCommit = { oid: string; title: string; authors: ReleaseNoteActor[] };
+
+const unsupportedError = {
+  code: 'PLATFORM_RELEASE_NOTES_UNSUPPORTED',
+  message: 'Release notes are not supported for the configured platform',
+  retryable: false
+};
+
+function baseResult(status: 'no-op' | 'failed' | 'blocked') {
+  return {
+    status,
+    changed: false,
+    range: null,
+    history: [],
+    pullRequests: [],
+    commits: [] as ReleaseNoteCommit[],
+    error: status === 'no-op' ? unsupportedError : null
+  };
+}
+
+function git(cwd: string, args: string[]): string {
+  return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+}
+
+function configuredPlatform(cwd: string): string | null {
+  try {
+    const value = JSON.parse(fs.readFileSync(path.join(cwd, '.agents', '.airc.json'), 'utf8'));
+    return typeof value?.platform?.type === 'string' ? value.platform.type : null;
+  } catch {
+    return null;
+  }
+}
+
+function releaseNoteContext(
+  input: { fromTag: string; toTag: string; branch: string; historyLimit?: number },
+  options: ReleaseNoteOptions = {}
+) {
+  const historyLimit = input.historyLimit ?? 3;
+  if (!input.fromTag || !input.toTag || !input.branch || !Number.isInteger(historyLimit) || historyLimit < 1 || historyLimit > 20) {
+    return { ...baseResult('failed'), error: { code: 'RELEASE_NOTES_INPUT_INVALID', message: 'from-tag, to-tag, branch, and a history limit from 1 to 20 are required', retryable: false } };
+  }
+  const cwd = path.resolve(options.cwd || process.cwd());
+  const platformType = options.platformType ?? configuredPlatform(cwd);
+  if (platformType !== 'github') return baseResult('no-op');
+  let fromOid: string;
+  let toOid: string;
+  let fromTime: string;
+  let toTime: string;
+  let commitFacts: Array<{ oid: string; title: string }>;
+  try {
+    fromOid = git(cwd, ['rev-parse', '--verify', `${input.fromTag}^{commit}`]);
+    toOid = git(cwd, ['rev-parse', '--verify', `${input.toTag}^{commit}`]);
+    git(cwd, ['merge-base', '--is-ancestor', fromOid, toOid]);
+    fromTime = git(cwd, ['show', '-s', '--format=%cI', fromOid]);
+    toTime = git(cwd, ['show', '-s', '--format=%cI', toOid]);
+    const raw = git(cwd, ['log', '--reverse', '--no-merges', '--format=%H%x00%s', `${fromOid}..${toOid}`]);
+    commitFacts = raw ? raw.split('\n').map((line) => {
+      const [oid = '', title = ''] = line.split('\0');
+      return { oid, title };
+    }) : [];
+  } catch {
+    return { ...baseResult('failed'), error: { code: 'RELEASE_NOTES_RANGE_INVALID', message: 'The release tag range is missing or is not ancestral', retryable: false } };
+  }
+  const context = resolvePlatformContext({ cwd, platformType, client: options.client });
+  if (!context.platform.repository) {
+    return {
+      ...baseResult(context.status === 'blocked' ? 'blocked' : 'failed'),
+      error: context.error || { code: 'PLATFORM_CONTEXT_UNAVAILABLE', message: 'Platform repository is unavailable', retryable: context.status === 'blocked' }
+    };
+  }
+  const platform = fetchGitHubReleaseNoteData(
+    {
+      repository: context.platform.repository,
+      commitOids: commitFacts.map((item) => item.oid),
+      branch: input.branch,
+      historyLimit,
+      fromTime,
+      toTime
+    },
+    { cwd, client: options.client }
+  );
+  if (platform.status === 'blocked' || platform.status === 'failed' || !('authors' in platform)) {
+    return { ...baseResult(platform.status), error: platform.error };
+  }
+  const commits = commitFacts.map((commit) => {
+    const seen = new Set<string>();
+    const authors = (platform.authors.get(commit.oid) || []).filter((actor) => {
+      const key = actor.login || actor.email?.toLowerCase() || actor.name.toLowerCase();
+      if (seen.has(key)) return false;
+      seen.add(key);
+      return true;
+    });
+    return { ...commit, authors };
+  });
+  const pullRequests = platform.pullRequests
+    .map((item) => ({
+      number: Number(item.number),
+      title: String(item.title || ''),
+      body: String(item.body || ''),
+      url: String(item.url || ''),
+      mergedAt: String(item.mergedAt || ''),
+      labels: Array.isArray(item.labels) ? item.labels.map((label) => String((label as { name?: string }).name || label)) : [],
+      author: item.author && typeof item.author === 'object'
+        ? { login: String((item.author as { login?: string }).login || '').toLowerCase(), bot: String((item.author as { login?: string }).login || '').endsWith('[bot]') }
+        : null,
+      closingIssues: Array.isArray(item.closingIssuesReferences)
+        ? item.closingIssuesReferences.map((issue) => {
+          const value = issue as Record<string, unknown>;
+          return {
+            number: Number(value.number),
+            title: String(value.title || ''),
+            url: String(value.url || ''),
+            labels: Array.isArray(value.labels) ? value.labels.map((label) => String((label as { name?: string }).name || label)) : [],
+            author: value.author && typeof value.author === 'object'
+              ? { login: String((value.author as { login?: string }).login || '').toLowerCase(), bot: String((value.author as { login?: string }).login || '').endsWith('[bot]') }
+              : null
+          };
+        }) : []
+    }))
+    .sort((left, right) => left.number - right.number);
+  return {
+    status: 'no-op' as const,
+    changed: false,
+    range: { fromTag: input.fromTag, toTag: input.toTag, fromOid, toOid },
+    history: platform.history,
+    pullRequests,
+    commits,
+    error: null
+  };
+}
+
+function publishReleaseNotes(
+  input: { tag: string; title: string; notesFile: string; dryRun?: boolean },
+  options: ReleaseNoteOptions = {}
+) {
+  if (!input.tag || !input.title || !input.notesFile) {
+    return { status: 'failed' as const, changed: false, operation: null, url: null, error: { code: 'RELEASE_NOTES_INPUT_INVALID', message: 'tag, title, and notes-file are required', retryable: false } };
+  }
+  const cwd = path.resolve(options.cwd || process.cwd());
+  const platformType = options.platformType ?? configuredPlatform(cwd);
+  if (platformType !== 'github') return { status: 'no-op' as const, changed: false, operation: null, url: null, error: unsupportedError };
+  const context = resolvePlatformContext({ cwd, platformType, client: options.client });
+  if (!context.platform.repository) {
+    return { status: context.status === 'blocked' ? 'blocked' as const : 'failed' as const, changed: false, operation: null, url: null, error: context.error };
+  }
+  return publishGitHubReleaseNotes({ ...input, repository: context.platform.repository }, { cwd, client: options.client });
+}
+
+export { publishReleaseNotes, releaseNoteContext };

package/lib/platform/verification-required.ts

@@ -4,6 +4,8 @@ import { execFileSync } from "node:child_process";
 
 import { inspectRequiredChecks } from "./pr-checks.ts";
 import { resolvePlatformContext } from "./context.ts";
+import { resolveReviewedHeadRelation } from "./merged-pr-equivalence.ts";
+import { loadPostReviewConfig, resolvePostReviewGlobs } from "../task/review-fingerprint.ts";
 
 const CHECK_TYPE = "required-checks";
 const SHA_PATTERN = /^[0-9a-f]{7,40}$/i;
@@ -50,14 +52,31 @@ export function evaluateRequiredChecks(context: any, shared: any): any {
     return shared.failResult(CHECK_TYPE, inspection.error?.message || "Required checks are unavailable", "check_failed");
   }
 
-  const prHead = inspection.pullRequest?.headSha;
-  if (!prHead || localHead !== reviewedHead || localHead !== prHead) {
-    return shared.failResult(CHECK_TYPE, "Local HEAD, last reviewed commit, and PR head must match", "check_failed");
+  const prHead = inspection.pullRequest?.head?.sha || inspection.pullRequest?.headSha;
+  const relation = context.relation || (
+    context.gitRoot && inspection.pullRequest?.head
+      ? resolveReviewedHeadRelation({
+          gitRoot: context.gitRoot,
+          localHead,
+          lastReviewedCommit: reviewedHead,
+          pullRequest: inspection.pullRequest,
+          pathspecs: context.pathspecs || [":/"]
+        })
+      : localHead === reviewedHead && localHead === prHead
+        ? { status: "strict" }
+        : { status: "failed" }
+  );
+  if (relation.status !== "strict" && relation.status !== "merged-equivalent") {
+    const message = relation.message || "Local HEAD, last reviewed commit, and PR head must match";
+    return relation.status === "blocked"
+      ? shared.blockedResult(CHECK_TYPE, message, "dependency_error")
+      : shared.failResult(CHECK_TYPE, message, "check_failed");
   }
 
   const state = inspection.checks?.state;
   if (state === "passed" || state === "no-required") {
-    return shared.passResult(CHECK_TYPE, `Required checks are ${state} for PR head ${prHead}`);
+    const suffix = relation.status === "merged-equivalent" ? " via verified squash merge equivalence" : "";
+    return shared.passResult(CHECK_TYPE, `Required checks are ${state} for PR head ${prHead}${suffix}`);
   }
   if (state === "pending") {
     return shared.blockedResult(CHECK_TYPE, inspection.error?.message || "Required checks are pending", "check_pending");
@@ -79,5 +98,12 @@ export function check({ taskDir }: any, shared: any): any {
   const localHead = readHead(shared.repoRoot);
   if (!localHead) return evaluateRequiredChecks({ metadata: task.metadata, localHead, inspection: null, prFlow }, shared);
   const inspection = inspectRequiredChecks(task.metadata.id, { cwd: shared.repoRoot });
-  return evaluateRequiredChecks({ metadata: task.metadata, localHead, inspection, prFlow }, shared);
+  return evaluateRequiredChecks({
+    metadata: task.metadata,
+    localHead,
+    inspection,
+    prFlow,
+    gitRoot: shared.repoRoot,
+    pathspecs: resolvePostReviewGlobs({}, loadPostReviewConfig(shared.repoRoot))
+  }, shared);
 }

package/lib/sandbox/build-proxy.ts

@@ -0,0 +1,94 @@
+import semver from 'semver';
+import { engineDisplayName } from './engine.ts';
+import { runSafeEngine } from './shell.ts';
+
+export const BUILD_PROXY_ENV_KEYS = ['HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY'] as const;
+export const MIN_BUILD_PROXY_DOCKER_VERSION = '20.10.0';
+export const MIN_BUILD_PROXY_BUILDKIT_VERSION = '0.9.0';
+
+export type BuildProxyPlan = {
+  args: string[];
+  env: NodeJS.ProcessEnv;
+  redactionValues: string[];
+};
+
+type EngineRunSafeFn = (engine: string, cmd: string, args: string[]) => string;
+
+export function prepareBuildProxy(
+  enabled: boolean,
+  hostEnv: NodeJS.ProcessEnv,
+  engine: string
+): BuildProxyPlan {
+  const env = { ...hostEnv };
+  if (!enabled) {
+    return { args: [], env, redactionValues: [] };
+  }
+
+  const entries = BUILD_PROXY_ENV_KEYS.flatMap((key) => {
+    const value = hostEnv[key]?.trim();
+    return value ? [[key, value] as const] : [];
+  });
+  if (entries.length === 0) {
+    throw new Error(
+      `No non-empty build proxy variables are set. Configure one of: ${BUILD_PROXY_ENV_KEYS.join(', ')}.`
+    );
+  }
+
+  for (const [key, value] of entries) env[key] = value;
+  if (engine === 'wsl2') {
+    const existing = (env.WSLENV ?? '').split(':').filter(Boolean);
+    env.WSLENV = [...new Set([...existing, ...entries.map(([key]) => key)])].join(':');
+  }
+
+  return {
+    args: entries.flatMap(([key]) => ['--secret', `id=${key},env=${key}`]),
+    env,
+    redactionValues: entries.map(([, value]) => value)
+  };
+}
+
+function parsedVersion(raw: string): string | null {
+  return semver.coerce(raw.trim())?.version ?? null;
+}
+
+export function assertBuildProxyCompatibility(
+  engine: string,
+  runSafeEngineFn: EngineRunSafeFn = runSafeEngine
+): void {
+  const dockerRaw = runSafeEngineFn(engine, 'docker', ['version', '--format', '{{.Server.Version}}']);
+  const dockerVersion = parsedVersion(dockerRaw);
+  if (!dockerVersion || !semver.gte(dockerVersion, MIN_BUILD_PROXY_DOCKER_VERSION)) {
+    throw new Error(
+      `Build proxy requires Docker Engine ${MIN_BUILD_PROXY_DOCKER_VERSION} or newer; `
+      + `observed ${dockerVersion ?? 'an unparseable version'}.`
+    );
+  }
+
+  const buildxRaw = runSafeEngineFn(engine, 'docker', ['buildx', 'inspect', '--bootstrap']);
+  const versions = [...buildxRaw.matchAll(/BuildKit(?:\s+version)?:\s*v?(\d+\.\d+\.\d+(?:[-+][^\s]+)?)/gi)]
+    .map((match) => parsedVersion(match[1] ?? ''))
+    .filter((version): version is string => version !== null);
+  if (versions.length === 0) {
+    throw new Error(
+      `Build proxy requires BuildKit ${MIN_BUILD_PROXY_BUILDKIT_VERSION} or newer, `
+      + 'but the active builder version could not be determined.'
+    );
+  }
+  const oldVersion = versions.find((version) => !semver.gte(version, MIN_BUILD_PROXY_BUILDKIT_VERSION));
+  if (oldVersion) {
+    throw new Error(
+      `Build proxy observed BuildKit ${oldVersion}; version ${MIN_BUILD_PROXY_BUILDKIT_VERSION} or newer is required.`
+    );
+  }
+}
+
+export function redactBuildProxyValues(text: string, values: readonly string[]): string {
+  return [...new Set(values.filter(Boolean))]
+    .sort((left, right) => right.length - left.length)
+    .reduce((result, value) => result.replaceAll(value, '[REDACTED_BUILD_PROXY]'), text);
+}
+
+export function buildProxyFailureHint(engine: string): string {
+  return `Build-step proxy inheritance is enabled for ${engineDisplayName(engine)}. `
+    + 'Image pulls and Dockerfile FROM resolution use the Docker daemon or builder proxy configuration.';
+}

package/lib/sandbox/commands/create.ts

@@ -24,6 +24,12 @@ import {
   worktreeDirCandidates
 } from '../constants.ts';
 import { prepareDockerfile } from '../dockerfile.ts';
+import {
+  assertBuildProxyCompatibility,
+  buildProxyFailureHint,
+  prepareBuildProxy,
+  redactBuildProxyValues
+} from '../build-proxy.ts';
 import { detectEngine, ensureDocker } from '../engine.ts';
 import {
   commandForEngine,
@@ -95,7 +101,7 @@ alias gy='gemini --yolo; tput ed'
 `;
 const CONTAINER_HOME = '/home/devuser';
 const CONTAINER_SHELL_CONFIG_MOUNT = `${CONTAINER_HOME}/.host-shell-config`;
-const USAGE = `Usage: ai sandbox create <branch> [base] [--cpu <n>] [--memory <n>] [--no-refresh] [--inherit-proxy|-P]
+const USAGE = `Usage: ai sandbox create <branch> [base] [--cpu <n>] [--memory <n>] [--no-refresh] [--inherit-proxy|-P] [--inherit-build-proxy|-B]
 
 Host aliases:
   ${'~'}/.agent-infra/aliases/sandbox.sh is auto-created on first run and exposed
@@ -105,7 +111,9 @@ Host aliases:
 
 Proxy:
   --inherit-proxy, -P  Copy non-empty standard host proxy variables into the
-                       container environment through the private env file.`;
+                       container environment through the private env file.
+  --inherit-build-proxy, -B  Pass uppercase HTTP_PROXY, HTTPS_PROXY, and NO_PROXY
+                             to managed image build steps for this invocation.`;
 const HOST_PROXY_ENV_KEYS = [
   'http_proxy',
   'HTTP_PROXY',
@@ -116,6 +124,15 @@ const HOST_PROXY_ENV_KEYS = [
   'no_proxy',
   'NO_PROXY'
 ] as const;
+const MANAGED_GITHUB_GIT_CONFIG = [
+  '[credential]',
+  '\thelper = !gh auth git-credential',
+  '[credential "https://github.com"]',
+  '\thelper =',
+  '\thelper = !gh auth git-credential',
+  '[url "https://github.com/"]',
+  '\tinsteadOf = git@github.com:'
+];
 
 type SandboxCreateConfig = ReturnType<typeof loadConfig>;
 type PreparedDockerfile = ReturnType<typeof prepareDockerfile>;
@@ -134,9 +151,9 @@ type ExecSyncOptions = ExecFileSyncOptions & {
 };
 type ExecSyncFn = (cmd: string, args: string[], options?: ExecSyncOptions) => Buffer | string;
 type EngineExecFn = (engine: string, cmd: string, args: string[], opts?: ExecFileSyncOptions) => Buffer | string;
-type EngineRunFn = (engine: string, cmd: string, args: string[], opts?: { cwd?: string }) => string;
+type EngineRunFn = (engine: string, cmd: string, args: string[], opts?: { cwd?: string; env?: NodeJS.ProcessEnv }) => string;
 type EngineRunSafeFn = EngineRunFn;
-type EngineRunVerboseFn = (engine: string, cmd: string, args: string[], opts?: { cwd?: string }) => void;
+type EngineRunVerboseFn = (engine: string, cmd: string, args: string[], opts?: { cwd?: string; env?: NodeJS.ProcessEnv }) => void;
 type DirectRunFn = (cmd: string, args: string[], opts?: { cwd?: string }) => string;
 type DirectRunSafeFn = DirectRunFn;
 type DirectRunVerboseFn = (cmd: string, args: string[], opts?: { cwd?: string }) => void;
@@ -255,6 +272,16 @@ function normalizeContainerHomeSeparators(content: string): string {
   return content.replace(containerHomePattern, (value) => value.replaceAll('\\', '/'));
 }
 
+function isGitHubCliCredentialHelper(line: string): boolean {
+  const helperMatch = line.match(/^\s*helper\s*=\s*(.+?)\s*$/i);
+  if (!helperMatch) {
+    return false;
+  }
+
+  const helper = (helperMatch[1] ?? '').trim().replace(/^"(.*)"$/, '$1');
+  return /^!\s*(?:"[^"]*[\\/]+gh"|(?:\S*[\\/]+)?gh)\s+auth\s+git-credential(?:\s|$)/i.test(helper);
+}
+
 export function sanitizeGitConfig(
   gitconfig: string,
   home: string,
@@ -272,11 +299,13 @@ export function sanitizeGitConfig(
   const sanitized = [];
   let inGpgSection = false;
   let currentSection = '';
+  let currentSectionName = '';
 
   for (const line of lines) {
     const sectionMatch = line.match(/^\s*\[([^\]]+)\]\s*$/);
     if (sectionMatch) {
       const sectionName = (sectionMatch[1] ?? '').trim();
+      currentSectionName = sectionName;
       currentSection = ((sectionName.match(/^([^\s"]+)/)?.[1]) ?? '').toLowerCase();
       inGpgSection = /^gpg(?:\s+"[^"]+")?$/i.test(sectionName);
       if (stripGpg && inGpgSection) {
@@ -304,11 +333,23 @@ export function sanitizeGitConfig(
     if (stripGpg && currentSection === 'user' && /^\s*signingKey\s*=.*$/i.test(line)) {
       continue;
     }
+    if (currentSection === 'credential' && isGitHubCliCredentialHelper(line)) {
+      continue;
+    }
+    if (
+      /^url\s+"https:\/\/github\.com\/"$/i.test(currentSectionName)
+      && /^\s*insteadOf\s*=\s*git@github\.com:\s*$/i.test(line)
+    ) {
+      continue;
+    }
 
     sanitized.push(line);
   }
 
-  return appendSafeDirectories(sanitized, repoRoot).join('\n');
+  return [
+    ...appendSafeDirectories(sanitized, repoRoot),
+    ...MANAGED_GITHUB_GIT_CONFIG
+  ].join('\n');
 }
 
 export function hostHasGpgKeys(home: string, execFn: ExecSyncFn = execFileSync): boolean {
@@ -1231,7 +1272,9 @@ export function buildImage(
     runVerboseFn = runVerboseEngine,
     env = process.env,
     refresh = false,
-    lastRefresh
+    lastRefresh,
+    buildProxyArgs = [],
+    buildEnv
   }: {
     engine?: string;
     runFn?: EngineRunFn;
@@ -1240,6 +1283,8 @@ export function buildImage(
     env?: NodeJS.ProcessEnv;
     refresh?: boolean;
     lastRefresh?: number;
+    buildProxyArgs?: string[];
+    buildEnv?: NodeJS.ProcessEnv;
   } = {}
 ): void {
   const selectedEngine = engine ?? detectEngine({ engine: config.engine });
@@ -1252,9 +1297,10 @@ export function buildImage(
       runSafeFn,
       env,
       refresh,
-      lastRefresh
+      lastRefresh,
+      buildProxyArgs
     }),
-    { cwd: config.repoRoot }
+    { cwd: config.repoRoot, env: buildEnv }
   );
 }
 
@@ -1278,6 +1324,7 @@ export async function create(args: string[]): Promise<void> {
       memory: { type: 'string' },
       'no-refresh': { type: 'boolean' },
       'inherit-proxy': { type: 'boolean', short: 'P' },
+      'inherit-build-proxy': { type: 'boolean', short: 'B' },
       help: { type: 'boolean', short: 'h' }
     }
   });
@@ -1363,6 +1410,15 @@ export async function create(args: string[]): Promise<void> {
     const needsImageBuild = signatureStale || refreshDue;
 
     if (needsImageBuild) {
+      if (values['inherit-build-proxy'] && effectiveConfig.dockerfile) {
+        throw new Error('Build proxy inheritance is unavailable with a custom sandbox Dockerfile.');
+      }
+      const buildProxy = prepareBuildProxy(
+        values['inherit-build-proxy'] ?? false,
+        process.env,
+        engine
+      );
+      if (values['inherit-build-proxy']) assertBuildProxyCompatibility(engine);
       const buildRefresh = !imageExists || refreshDue;
       const buildLastRefresh = buildRefresh ? now : currentLastRefresh || 0;
 
@@ -1379,7 +1435,13 @@ export async function create(args: string[]): Promise<void> {
           tools,
           preparedDockerfile.path,
           expectedImageSignature,
-          { engine, refresh: buildRefresh, lastRefresh: buildLastRefresh }
+          {
+            engine,
+            refresh: buildRefresh,
+            lastRefresh: buildLastRefresh,
+            buildProxyArgs: buildProxy.args,
+            buildEnv: buildProxy.env
+          }
         );
         p.log.success(
           refreshDue
@@ -1392,10 +1454,14 @@ export async function create(args: string[]): Promise<void> {
         if (refreshDue && !signatureStale && imageExists) {
           p.log.warn(
             'Scheduled sandbox image refresh failed; continuing with the existing image. ' +
-            commandErrorMessage(error)
+            redactBuildProxyValues(commandErrorMessage(error), buildProxy.redactionValues)
+            + (values['inherit-build-proxy'] ? ` ${buildProxyFailureHint(engine)}` : '')
           );
         } else {
-          throw error;
+          const hint = values['inherit-build-proxy'] ? `\n${buildProxyFailureHint(engine)}` : '';
+          throw new Error(
+            `${redactBuildProxyValues(commandErrorMessage(error), buildProxy.redactionValues)}${hint}`
+          );
         }
       }
     } else {

package/lib/sandbox/commands/rebuild.ts

@@ -16,8 +16,14 @@ import {
   parseImageLabels,
   parseRefreshTimestamp
 } from '../image-build.ts';
+import {
+  assertBuildProxyCompatibility,
+  buildProxyFailureHint,
+  prepareBuildProxy,
+  redactBuildProxyValues
+} from '../build-proxy.ts';
 
-const USAGE = `Usage: ai sandbox rebuild [--quiet] [--refresh]`;
+const USAGE = `Usage: ai sandbox rebuild [--quiet] [--refresh] [--inherit-build-proxy|-B]`;
 
 type EngineRunFn = (engine: string, cmd: string, args: string[], opts?: { cwd?: string }) => string;
 type EngineRunSafeFn = EngineRunFn;
@@ -33,7 +39,8 @@ export function buildArgs(
     runSafeFn = runSafeEngine,
     env = process.env,
     refresh = false,
-    lastRefresh
+    lastRefresh,
+    buildProxyArgs = []
   }: {
     engine?: string;
     runFn?: EngineRunFn;
@@ -41,6 +48,7 @@ export function buildArgs(
     env?: NodeJS.ProcessEnv;
     refresh?: boolean;
     lastRefresh?: number;
+    buildProxyArgs?: string[];
   } = {}
 ): string[] {
   return buildSandboxImageArgs(config, tools, dockerfilePath, imageSignature, {
@@ -49,7 +57,8 @@ export function buildArgs(
     runSafeFn,
     env,
     refresh,
-    lastRefresh
+    lastRefresh,
+    buildProxyArgs
   });
 }
 
@@ -77,6 +86,7 @@ export async function rebuild(args: string[]): Promise<void> {
     options: {
       refresh: { type: 'boolean' },
       quiet: { type: 'boolean', short: 'q' },
+      'inherit-build-proxy': { type: 'boolean', short: 'B' },
       help: { type: 'boolean', short: 'h' }
     }
   });
@@ -95,6 +105,11 @@ export async function rebuild(args: string[]): Promise<void> {
   const engine = detectEngine(config);
 
   await ensureDocker(config, undefined);
+  if (values['inherit-build-proxy'] && config.dockerfile) {
+    throw new Error('Build proxy inheritance is unavailable with a custom sandbox Dockerfile.');
+  }
+  const buildProxy = prepareBuildProxy(values['inherit-build-proxy'] ?? false, process.env, engine);
+  if (values['inherit-build-proxy']) assertBuildProxyCompatibility(engine);
   const lastRefresh = refresh ? Date.now() : readExistingLastRefresh(config, engine);
   p.intro(pc.cyan('Rebuilding sandbox image'));
 
@@ -105,9 +120,11 @@ export async function rebuild(args: string[]): Promise<void> {
       runEngine(engine, 'docker', buildArgs(config, tools, preparedDockerfile.path, imageSignature, {
         engine,
         refresh,
-        lastRefresh
+        lastRefresh,
+        buildProxyArgs: buildProxy.args
       }), {
-        cwd: config.repoRoot
+        cwd: config.repoRoot,
+        env: buildProxy.env
       });
       spinner.stop(pc.green('Sandbox image rebuilt'));
     } else {
@@ -118,13 +135,18 @@ export async function rebuild(args: string[]): Promise<void> {
         buildArgs(config, tools, preparedDockerfile.path, imageSignature, {
           engine,
           refresh,
-          lastRefresh
+          lastRefresh,
+          buildProxyArgs: buildProxy.args
         }),
-        { cwd: config.repoRoot }
+        { cwd: config.repoRoot, env: buildProxy.env }
       );
       p.log.success(pc.green('Sandbox image rebuilt'));
     }
     pruneSandboxDanglingImages(config, engine);
+  } catch (error) {
+    const message = redactBuildProxyValues(error instanceof Error ? error.message : String(error), buildProxy.redactionValues);
+    const hint = values['inherit-build-proxy'] ? `\n${buildProxyFailureHint(engine)}` : '';
+    throw new Error(`${message}${hint}`);
   } finally {
     preparedDockerfile.cleanup();
   }

package/lib/sandbox/image-build.ts

@@ -44,7 +44,8 @@ export function buildSandboxImageArgs(
     runSafeFn = runSafeEngine,
     env = process.env,
     refresh = false,
-    lastRefresh
+    lastRefresh,
+    buildProxyArgs = []
   }: {
     engine?: string;
     runFn?: EngineRunFn;
@@ -52,6 +53,7 @@ export function buildSandboxImageArgs(
     env?: NodeJS.ProcessEnv;
     refresh?: boolean;
     lastRefresh?: number;
+    buildProxyArgs?: string[];
   } = {}
 ): string[] {
   const selectedEngine = engine ?? detectEngine({ engine: config.engine });
@@ -79,6 +81,7 @@ export function buildSandboxImageArgs(
     '--label',
     `${sandboxImageConfigLabel(config)}=${imageSignature}`
   ];
+  args.push(...buildProxyArgs);
 
   if (lastRefresh !== undefined) {
     args.push('--label', `${sandboxImageRefreshLabel(config)}=${lastRefresh}`);