@fitlab-ai/agent-infra 0.9.0 → 0.9.2

package/dist/lib/sandbox/commands/rm.js

@@ -10,7 +10,8 @@ import { pruneSandboxDanglingImages } from '../image-prune.js';
 import { removeManagedDir, removeWorktreeDir } from '../managed-fs.js';
 import { runOk, runSafe, runSafeEngine } from '../shell.js';
 import { resolveTaskBranch } from '../task-resolver.js';
-import { resolveTools, toolConfigDirCandidates, toolProjectDirCandidates } from '../tools.js';
+import { toolConfigDirCandidates, toolProjectDirCandidates } from '../tools.js';
+import { createSandboxCapabilityPlan } from '../agent-client-reconciler.js';
 import { fetchSandboxRows } from './list-running.js';
 import { lookupShortIdByBranch } from '../../task/short-id.js';
 const USAGE = `Usage:
@@ -284,7 +285,7 @@ export async function rm(args) {
         throw new Error(USAGE);
     }
     const config = loadConfig();
-    const tools = resolveTools(config);
+    const tools = [...createSandboxCapabilityPlan(config).cleanupInventory];
     if (values.purge) {
         await rmPurge(config, tools);
         return;

package/dist/lib/sandbox/config.js

@@ -3,6 +3,8 @@ import path from 'node:path';
 import { homedir, platform } from 'node:os';
 import { execFileSync } from 'node:child_process';
 import pc from 'picocolors';
+import { normalizeAgentClients } from '../agent-clients/config.js';
+import { isAgentClientId } from '../agent-clients/types.js';
 import { validateSandboxEngine } from './engine.js';
 import { hostJoin } from './engines/wsl2-paths.js';
 import { findRuntimeEngineMismatches } from './runtime-engines.js';
@@ -10,7 +12,7 @@ import { parseCustomTools } from './tools.js';
 const DEFAULTS = Object.freeze({
     engine: null,
     runtimes: ['node22'],
-    tools: ['agent-infra', 'claude-code', 'codex', 'gemini-cli', 'opencode'],
+    tools: ['agent-infra'],
     refreshIntervalDays: 7,
     dockerfile: null,
     vm: {
@@ -46,6 +48,18 @@ function cloneDefaults() {
         vm: { ...DEFAULTS.vm }
     };
 }
+function resolveSandboxToolIds(sandbox, agentClients, defaults) {
+    if (Array.isArray(sandbox.tools)) {
+        const tools = sandbox.tools.filter((tool) => typeof tool === 'string');
+        return agentClients.source === 'canonical'
+            ? tools.filter((tool) => !isAgentClientId(tool))
+            : tools;
+    }
+    if (agentClients.remainingSandboxTools !== undefined) {
+        return [...agentClients.remainingSandboxTools];
+    }
+    return [...defaults];
+}
 export function loadConfig({ platformFn = platform, writeStderr = (chunk) => process.stderr.write(chunk) } = {}) {
     const repoRoot = detectRepoRoot();
     const home = homedir();
@@ -57,6 +71,8 @@ export function loadConfig({ platformFn = platform, writeStderr = (chunk) => pro
         throw new Error('No .agents/.airc.json found. Run "ai init" first.');
     }
     const airc = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    const sandboxInput = airc.sandbox;
+    const agentClients = normalizeAgentClients(airc);
     const defaults = cloneDefaults();
     const sandbox = airc.sandbox ?? {};
     const engine = validateSandboxEngine(sandbox.engine ?? defaults.engine, { platformFn });
@@ -83,6 +99,7 @@ export function loadConfig({ platformFn = platform, writeStderr = (chunk) => pro
         }
     }
     const customTools = parseCustomTools(sandbox.customTools, { home });
+    const tools = resolveSandboxToolIds(sandbox, agentClients, defaults.tools);
     return {
         repoRoot,
         configPath,
@@ -97,10 +114,10 @@ export function loadConfig({ platformFn = platform, writeStderr = (chunk) => pro
         dotfilesDir: hostJoin(home, '.agent-infra', 'dotfiles'),
         engine,
         runtimes,
-        tools: Array.isArray(sandbox.tools) && sandbox.tools.length > 0
-            ? [...sandbox.tools]
-            : defaults.tools,
+        tools,
         customTools,
+        agentClientState: agentClients.state,
+        agentClientSource: agentClients.source,
         refreshIntervalDays: asNonNegativeIntegerOrDefault(sandbox.refreshIntervalDays, defaults.refreshIntervalDays),
         dockerfile,
         vm: {

package/dist/lib/sandbox/constants.js

@@ -75,6 +75,9 @@ export function sandboxImageConfigLabel(config) {
 export function sandboxImageRefreshLabel(config) {
     return `${sandboxLabel(config)}.last-refresh`;
 }
+export function sandboxRuntimeCapabilityLabel(config) {
+    return `agent-infra.sandbox.runtime-capability.${config.project}`;
+}
 export function parsePositiveIntegerOption(value, optionName) {
     if (value === undefined || value === null) {
         return undefined;

package/dist/lib/sandbox/dockerfile.js

@@ -3,6 +3,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
+import { removeDirRecursive } from '../remove-dir.js';
 const RUNTIMES_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), 'runtimes');
 function listRuntimeFragments() {
     return fs.readdirSync(RUNTIMES_DIR)
@@ -63,7 +64,7 @@ export function prepareDockerfile(config) {
         path: tempPath,
         signature: dockerfileSignature(config),
         cleanup() {
-            fs.rmSync(tempDir, { recursive: true, force: true });
+            removeDirRecursive(tempDir);
         }
     };
 }

package/dist/lib/sandbox/image-build.js

@@ -14,7 +14,7 @@ export function buildImageSignature(preparedDockerfile, tools) {
         .digest('hex')
         .slice(0, 12);
 }
-export function buildSandboxImageArgs(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, env = process.env, refresh = false, lastRefresh } = {}) {
+export function buildSandboxImageArgs(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, env = process.env, refresh = false, lastRefresh, buildProxyArgs = [] } = {}) {
     const selectedEngine = engine ?? detectEngine({ engine: config.engine });
     const { uid: hostUid, gid: hostGid } = resolveBuildUid({
         engine: selectedEngine,
@@ -39,6 +39,7 @@ export function buildSandboxImageArgs(config, tools, dockerfilePath, imageSignat
         '--label',
         `${sandboxImageConfigLabel(config)}=${imageSignature}`
     ];
+    args.push(...buildProxyArgs);
     if (lastRefresh !== undefined) {
         args.push('--label', `${sandboxImageRefreshLabel(config)}=${lastRefresh}`);
     }

package/dist/lib/sandbox/managed-fs.js

@@ -1,6 +1,6 @@
-import fs from 'node:fs';
 import path from 'node:path';
-import { run } from './shell.js';
+import { run, runSafe } from './shell.js';
+import { removeDirRecursive } from '../remove-dir.js';
 export function assertManagedPath(root, target) {
     const resolvedRoot = path.resolve(root);
     const resolvedTarget = path.resolve(target);
@@ -12,14 +12,19 @@ export function assertManagedPath(root, target) {
 }
 export function removeManagedDir(root, dir) {
     assertManagedPath(root, dir);
-    fs.rmSync(dir, { recursive: true, force: true });
+    removeDirRecursive(dir);
 }
-export function removeWorktreeDir(repoRoot, worktreeBase, dir) {
+export function removeWorktreeDir(repoRoot, worktreeBase, dir, { runFn = run, runSafeFn = runSafe } = {}) {
     try {
-        run('git', ['-C', repoRoot, 'worktree', 'remove', dir, '--force']);
+        runFn('git', ['-C', repoRoot, 'worktree', 'remove', dir, '--force']);
     }
     catch {
+        // On WSL2 the worktree is registered under its `/mnt/<drive>/...` path, so
+        // `git worktree remove <windows-path>` cannot match it. Delete the managed
+        // directory directly, then prune the now-dangling worktree metadata so the
+        // branch is no longer reported as checked out.
         removeManagedDir(worktreeBase, dir);
+        runSafeFn('git', ['-C', repoRoot, 'worktree', 'prune']);
     }
 }
 //# sourceMappingURL=managed-fs.js.map

package/dist/lib/sandbox/recovery.js

@@ -1,6 +1,8 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { containerNameCandidates, sandboxBranchLabel, sandboxLabel } from './constants.js';
+import { containerNameCandidates, sandboxBranchLabel, sandboxLabel, sandboxRuntimeCapabilityLabel } from './constants.js';
+import { isAgentClientId } from '../agent-clients/types.js';
+import { createSandboxCapabilityPlan } from './agent-client-reconciler.js';
 import { toEnginePath } from './engines/wsl2-paths.js';
 import { sandboxCoreBindMounts } from './mounts.js';
 import { runEngine, runOkEngine, runVerboseEngine } from './shell.js';
@@ -17,6 +19,19 @@ export function classifySandboxRecovery(snapshot) {
             message: 'Container identity does not match the requested sandbox branch.'
         });
     }
+    if (snapshot.runtimeCapabilityOk === false) {
+        findings.push({
+            repairKind: 'hard-failure',
+            message: 'Container runtime capability signature does not match the current sandbox plan.'
+        });
+    }
+    for (const mountPath of snapshot.unexpectedCapabilityMounts ?? []) {
+        findings.push({
+            repairKind: 'hard-failure',
+            message: `Disabled Agent Client capability remains mounted at ${mountPath}.`,
+            path: mountPath
+        });
+    }
     for (const mount of snapshot.mounts) {
         if (mount.actualType !== mount.expectedType
             || !mount.sourceMatches
@@ -74,25 +89,11 @@ export function classifySandboxRecovery(snapshot) {
             path: '/home/devuser/.bash_aliases'
         });
     }
-    if (snapshot.codex) {
-        if (!snapshot.codex.commandAvailable) {
-            findings.push({
-                repairKind: 'hard-failure',
-                message: 'Codex is not available on PATH inside the sandbox.'
-            });
-        }
-        if (!snapshot.codex.stateWritable) {
+    for (const check of snapshot.agentClientChecks) {
+        if (check.applicable && !check.healthy) {
             findings.push({
-                repairKind: 'permissions',
-                message: 'Codex state directory is not writable by devuser.',
-                path: '/home/devuser/.codex'
-            });
-        }
-        if (snapshot.codex.promptsSourceExists && !snapshot.codex.promptsValid) {
-            findings.push({
-                repairKind: 'builtin-link',
-                message: 'Codex prompts link does not point to the workspace commands directory.',
-                path: '/home/devuser/.codex/prompts'
+                ...check.finding,
+                ...(check.repair === undefined ? {} : { repair: check.repair })
             });
         }
     }
@@ -154,8 +155,7 @@ function hostSourceAccessible(hostPath, writable) {
     }
 }
 function expectedMounts(params) {
-    const { config, branch, actualMounts } = params;
-    const tools = resolveTools(config);
+    const { config, branch, tools, actualMounts } = params;
     const core = sandboxCoreBindMounts(config, branch).map((mount) => ({
         path: mount.containerPath,
         expectedType: 'bind',
@@ -174,7 +174,9 @@ function expectedMounts(params) {
             }];
     }));
     const persistentTools = tools
-        .filter((tool) => !tool.tmpfs && actualMounts.has(tool.containerMount))
+        .filter((tool) => !tool.tmpfs
+        && (config.agentClientSource === 'canonical'
+            || actualMounts.has(tool.containerMount)))
         .map((tool) => ({
         path: tool.containerMount,
         expectedType: 'bind',
@@ -245,7 +247,8 @@ export function collectSandboxRecoverySnapshot(params) {
             });
         }
     }
-    const tools = resolveTools(params.config);
+    const capabilityPlan = createSandboxCapabilityPlan(params.config);
+    const tools = [...capabilityPlan.tools];
     const seeds = declaredTmpfsSeedEntries(tools).map((seed) => {
         const mounted = mountsByDestination.get(seed.stagingPath)?.Type === 'bind';
         return {
@@ -266,11 +269,18 @@ export function collectSandboxRecoverySnapshot(params) {
     }));
     const labels = inspection.Config?.Labels ?? {};
     const branchLabel = labels[sandboxBranchLabel(params.config)];
-    const hasCodex = tools.some((tool) => tool.id === 'codex');
+    const selectedToolIds = new Set(tools.map((tool) => tool.id));
+    const enforceCanonicalPlan = params.config.agentClientSource === 'canonical';
+    const unexpectedCapabilityMounts = enforceCanonicalPlan
+        ? capabilityPlan.cleanupInventory
+            .filter((tool) => isAgentClientId(tool.id) && !selectedToolIds.has(tool.id))
+            .map((tool) => tool.containerMount)
+            .filter((mountPath) => mountsByDestination.has(mountPath))
+        : [];
     const mountSnapshots = expectedMounts({
         config: params.config,
         branch: params.branch,
-        engine: params.engine,
+        tools,
         actualMounts: mountsByDestination
     }).map((expected) => {
         const actual = mountsByDestination.get(expected.path);
@@ -304,18 +314,25 @@ export function collectSandboxRecoverySnapshot(params) {
         identityOk: typeof inspection.Id === 'string'
             && inspection.Id.length > 0
             && branchLabel === params.branch,
+        runtimeCapabilityOk: enforceCanonicalPlan
+            ? labels[sandboxRuntimeCapabilityLabel(params.config)] === capabilityPlan.runtimeSignature
+            : undefined,
+        unexpectedCapabilityMounts,
         mounts: mountSnapshots,
         tmpfs,
         seeds,
         aliasesReadable: probe(params.engine, params.container, 'test -r "$1"', ['/home/devuser/.bash_aliases'], runOkFn),
-        codex: hasCodex
-            ? {
-                commandAvailable: probe(params.engine, params.container, 'command -v codex', [], runOkFn),
-                stateWritable: probe(params.engine, params.container, 'probe="$1/.agent-infra-codex-state-$$"; trap \'rm -f -- "$probe"\' EXIT; : > "$probe"', ['/home/devuser/.codex'], runOkFn),
-                promptsSourceExists: probe(params.engine, params.container, 'test -d "$1"', ['/workspace/.codex/commands'], runOkFn),
-                promptsValid: probe(params.engine, params.container, 'test "$(readlink -- "$1")" = "$2"', ['/home/devuser/.codex/prompts', '/workspace/.codex/commands'], runOkFn)
-            }
-            : undefined
+        agentClientChecks: capabilityPlan.recoveryChecks.map(({ adapterId, check }) => {
+            const applicable = check.when === undefined || probe(params.engine, params.container, check.when.script, [...check.when.args], runOkFn, check.when.user);
+            return {
+                adapterId,
+                checkId: check.id,
+                applicable,
+                healthy: !applicable || probe(params.engine, params.container, check.probe.script, [...check.probe.args], runOkFn, check.probe.user),
+                finding: check.finding,
+                ...(check.repair === undefined ? {} : { repair: check.repair })
+            };
+        })
     };
 }
 export function prepareTmpfsMounts(params) {
@@ -394,10 +411,9 @@ function repairFindings(params) {
         deps: params.deps
     });
     const runVerboseFn = params.deps?.runVerbose ?? runVerboseEngine;
-    if (params.findings.some((finding) => finding.repairKind === 'builtin-link')) {
+    for (const repair of params.findings.flatMap((finding) => finding.repair === undefined ? [] : [finding.repair])) {
         runVerboseFn(params.engine, 'docker', [
-            'exec', '--user', 'devuser', params.container, 'ln', '-sfn',
-            '/workspace/.codex/commands', '/home/devuser/.codex/prompts'
+            'exec', '--user', repair.user, params.container, repair.command, ...repair.args
         ]);
     }
 }

package/dist/lib/sandbox/runtimes/ai-tools.dockerfile

@@ -5,20 +5,41 @@ ENV NPM_CONFIG_PREFIX=/home/devuser/.npm-global
 ENV PATH="/home/devuser/.npm-global/bin:${PATH}"
 
 ARG AI_TOOL_PACKAGES=
-RUN set -e && \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    set -e && \
     for pkg in ${AI_TOOL_PACKAGES}; do \
       npm install -g "$pkg"; \
     done
 
 ARG AI_TOOLS_SHELL_INSTALL_B64=
-RUN if [ -n "${AI_TOOLS_SHELL_INSTALL_B64}" ]; then \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    if [ -n "${AI_TOOLS_SHELL_INSTALL_B64}" ]; then \
       set -e && \
       echo "${AI_TOOLS_SHELL_INSTALL_B64}" | base64 -d > /tmp/ai-tools-install.sh && \
       bash /tmp/ai-tools-install.sh && \
       rm /tmp/ai-tools-install.sh; \
     fi
 
-RUN npm install -g pyright
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    npm install -g pyright
 
 RUN mkdir -p /home/devuser/.local/share /home/devuser/.local/state
 

package/dist/lib/sandbox/runtimes/base.dockerfile

@@ -19,7 +19,14 @@ RUN if [ "${HOST_UID}" = "0" ]; then \
         useradd -u ${HOST_UID} -g ${HOST_GID} -m -s /bin/bash devuser; \
     fi
 
-RUN apt-get update && apt-get install -y \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    apt-get update && apt-get install -y \
     curl wget git vim file jq \
     build-essential ca-certificates gnupg lsb-release \
     libevent-core-2.1-7 libncursesw6 libtinfo6 \

package/dist/lib/sandbox/runtimes/java17.dockerfile

@@ -1,3 +1,10 @@
-RUN apt-get update && apt-get install -y \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    apt-get update && apt-get install -y \
     openjdk-17-jdk maven \
     && rm -rf /var/lib/apt/lists/*

package/dist/lib/sandbox/runtimes/java21.dockerfile

@@ -1,3 +1,10 @@
-RUN apt-get update && apt-get install -y \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    apt-get update && apt-get install -y \
     openjdk-21-jdk maven \
     && rm -rf /var/lib/apt/lists/*

package/dist/lib/sandbox/runtimes/node20.dockerfile

@@ -1,3 +1,10 @@
-RUN bash -o pipefail -c 'curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_20.x | bash -' && \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    bash -o pipefail -c 'curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_20.x | bash -' && \
     apt-get install -y nodejs && \
     rm -rf /var/lib/apt/lists/*

package/dist/lib/sandbox/runtimes/node22.dockerfile

@@ -1,3 +1,10 @@
-RUN bash -o pipefail -c 'curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_22.x | bash -' && \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    bash -o pipefail -c 'curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_22.x | bash -' && \
     apt-get install -y nodejs && \
     rm -rf /var/lib/apt/lists/*

package/dist/lib/sandbox/runtimes/python3.dockerfile

@@ -1,3 +1,10 @@
-RUN apt-get update && apt-get install -y \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    apt-get update && apt-get install -y \
     python3 python3-pip python3-venv \
     && rm -rf /var/lib/apt/lists/*

package/dist/lib/sandbox/shell.js

@@ -8,7 +8,8 @@ function normalizeOptions(opts = {}, stdio) {
         cwd: opts.cwd,
         encoding: opts.encoding,
         stdio,
-        timeout: opts.timeout ?? DEFAULT_TIMEOUT_MS
+        timeout: opts.timeout ?? DEFAULT_TIMEOUT_MS,
+        env: opts.env
     };
 }
 function resolveCommand(cmd) {
@@ -113,7 +114,7 @@ export function runSafe(cmd, args, opts = {}) {
 export function commandForEngine(engine, cmd, args = []) {
     if (engine === 'wsl2') {
         const resolvedWrapper = resolveCommand('wsl.exe');
-        return { cmd: resolvedWrapper, args: ['--', cmd, ...args] };
+        return { cmd: resolvedWrapper, args: ['--exec', cmd, ...args] };
     }
     if (cmd === 'docker') {
         const context = getAdapter(engine).dockerContext;

package/dist/lib/sandbox/tool-types.js

@@ -0,0 +1,8 @@
+const SANDBOX_HOOK_PHASES = [
+    'prepare',
+    'before-container-create',
+    'after-container-start',
+    'before-enter'
+];
+export { SANDBOX_HOOK_PHASES };
+//# sourceMappingURL=tool-types.js.map

package/dist/lib/sandbox/tools.js

@@ -1,4 +1,5 @@
 import path from 'node:path';
+import { createSandboxCapabilityPlan } from './agent-client-reconciler.js';
 import { safeNameCandidates, sanitizeBranchName } from './constants.js';
 import { hostJoin } from './engines/wsl2-paths.js';
 export function tmpfsSeedStagingPath(toolId, index) {
@@ -20,108 +21,6 @@ export function declaredTmpfsSeedEntries(tools) {
     })));
 }
 const TOOL_ID_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
-function createBuiltinTools(home, project) {
-    return {
-        'claude-code': {
-            id: 'claude-code',
-            name: 'Claude Code',
-            install: { type: 'npm', cmd: '@anthropic-ai/claude-code@latest' },
-            sandboxBase: hostJoin(home, '.agent-infra', 'sandboxes', 'claude-code'),
-            containerMount: '/home/devuser/.claude',
-            versionCmd: 'claude --version',
-            setupHint: 'Authenticates via host credentials live-mounted at ~/.claude/.credentials.json',
-            // Claude Code stores user data (.claude.json — onboarding state, theme,
-            // workspace trust) at $HOME/.claude.json by default, which sits OUTSIDE
-            // the bind-mounted /home/devuser/.claude tree, so our preseeded
-            // .claude.json never gets read and the theme picker re-runs on every
-            // container start. Pinning CLAUDE_CONFIG_DIR to the tool mount relocates
-            // .claude.json into the same directory as .credentials.json/settings.json,
-            // letting ensureClaudeOnboarding actually take effect.
-            envVars: { CLAUDE_CONFIG_DIR: '/home/devuser/.claude' },
-            hostPreSeedDirs: [
-                { hostDir: hostJoin(home, '.claude', 'plugins'), sandboxSubdir: 'plugins' }
-            ],
-            pathRewriteFiles: [
-                'plugins/installed_plugins.json',
-                'plugins/known_marketplaces.json'
-            ],
-            hostLiveMounts: [
-                {
-                    hostPath: hostJoin(home, '.agent-infra', 'credentials', project, 'claude-code', '.credentials.json'),
-                    containerSubpath: '.credentials.json'
-                }
-            ]
-        },
-        codex: {
-            id: 'codex',
-            name: 'Codex',
-            install: { type: 'npm', cmd: '@openai/codex' },
-            sandboxBase: hostJoin(home, '.agent-infra', 'sandboxes', 'codex'),
-            containerMount: '/home/devuser/.codex',
-            versionCmd: 'codex --version',
-            setupHint: 'Run codex once inside the container and choose Device Code login if needed.',
-            // codex churns ~/.codex/logs_2.sqlite heavily (upstream openai/codex#24275);
-            // a bind-mount would write-amplify onto the host SSD via virtiofs. Mount the
-            // codex home as tmpfs so those logs stay in RAM and die with the container.
-            // Seeded config (config.toml, model-catalogs) is copied into the tmpfs at
-            // startup; runtime files like logs_2.sqlite stay in RAM.
-            tmpfs: { size: '512m', seed: ['config.toml', 'model-catalogs'] },
-            hostLiveMounts: [
-                { hostPath: hostJoin(home, '.codex', 'auth.json'), containerSubpath: 'auth.json' }
-            ],
-            postSetupCmds: [
-                'test -d /workspace/.codex/commands && ln -sfn /workspace/.codex/commands /home/devuser/.codex/prompts || true'
-            ]
-        },
-        opencode: {
-            id: 'opencode',
-            name: 'OpenCode',
-            install: { type: 'npm', cmd: 'opencode-ai' },
-            sandboxBase: hostJoin(home, '.agent-infra', 'sandboxes', 'opencode'),
-            containerMount: '/home/devuser/.local/share/opencode',
-            versionCmd: 'opencode version',
-            setupHint: 'Configure OpenCode credentials inside the container before first use.',
-            // OpenCode reads opencode.json from $XDG_CONFIG_HOME/opencode by default,
-            // outside this tool mount. Pin the config file path so the inherited
-            // sandbox opencode.json is the one the TUI actually reads.
-            envVars: { OPENCODE_CONFIG: '/home/devuser/.local/share/opencode/opencode.json' },
-            hostLiveMounts: [
-                {
-                    hostPath: hostJoin(home, '.local', 'share', 'opencode', 'auth.json'),
-                    containerSubpath: 'auth.json'
-                }
-            ]
-        },
-        'gemini-cli': {
-            id: 'gemini-cli',
-            name: 'Gemini CLI',
-            install: { type: 'npm', cmd: '@google/gemini-cli' },
-            sandboxBase: hostJoin(home, '.agent-infra', 'sandboxes', 'gemini-cli'),
-            containerMount: '/home/devuser/.gemini',
-            versionCmd: 'gemini --version',
-            setupHint: 'Run gemini inside the container to finish authentication.',
-            hostLiveMounts: [
-                { hostPath: hostJoin(home, '.gemini', 'oauth_creds.json'), containerSubpath: 'oauth_creds.json' }
-            ],
-            hostPreSeedFiles: [
-                { hostPath: hostJoin(home, '.gemini', 'settings.json'), sandboxName: 'settings.json' },
-                { hostPath: hostJoin(home, '.gemini', 'google_accounts.json'), sandboxName: 'google_accounts.json' }
-            ]
-        },
-        'agent-infra': {
-            id: 'agent-infra',
-            name: 'agent-infra CLI',
-            install: { type: 'npm', cmd: '@fitlab-ai/agent-infra@latest' },
-            sandboxBase: hostJoin(home, '.agent-infra', 'sandboxes', 'agent-infra'),
-            containerMount: '/home/devuser/.agent-infra-cli',
-            versionCmd: 'ai version --raw',
-            setupHint: 'Provides the ai and agent-infra CLI commands inside the sandbox.'
-        }
-    };
-}
-export function builtinToolIds() {
-    return Object.keys(createBuiltinTools('', ''));
-}
 function validateTool(tool) {
     if (!tool.id || !TOOL_ID_PATTERN.test(tool.id)) {
         throw new Error(`Invalid sandbox tool id: ${String(tool.id)}`);
@@ -308,30 +207,7 @@ export function parseCustomTools(value, options) {
     return value.map((entry, index) => parseCustomTool(entry, index, options));
 }
 export function resolveTools(config) {
-    const builtins = createBuiltinTools(config.home, config.project);
-    const customs = config.customTools ?? [];
-    const seen = new Set();
-    for (const tool of customs) {
-        if (builtins[tool.id]) {
-            throw new Error(`Custom sandbox tool id "${tool.id}" collides with a built-in tool`);
-        }
-        if (seen.has(tool.id)) {
-            throw new Error(`Duplicate sandbox tool id "${tool.id}" in customTools`);
-        }
-        seen.add(tool.id);
-    }
-    const merged = { ...builtins };
-    for (const tool of customs) {
-        merged[tool.id] = tool;
-    }
-    return config.tools.map((id) => {
-        const tool = merged[id];
-        if (!tool) {
-            throw new Error(`Unknown sandbox tool: ${id}`);
-        }
-        validateTool(tool);
-        return tool;
-    });
+    return [...createSandboxCapabilityPlan(config).tools];
 }
 export function toolConfigDir(tool, project, branch) {
     return hostJoin(tool.sandboxBase, project, sanitizeBranchName(branch));