@locusai/cli 0.18.0 → 0.18.1

package/bin/locus.js

@@ -807,6 +807,14 @@ var init_rate_limiter = __esm(() => {
 });
 
 // src/display/progress.ts
+var exports_progress = {};
+__export(exports_progress, {
+  renderTaskStatus: () => renderTaskStatus,
+  progressBar: () => progressBar,
+  formatDuration: () => formatDuration,
+  createTimer: () => createTimer,
+  Spinner: () => Spinner
+});
 function progressBar(current, total, options = {}) {
   const { width = 30, showPercent = true, showCount = true, label } = options;
   const percent = total > 0 ? current / total : 0;
@@ -903,6 +911,149 @@ var init_progress = __esm(() => {
   SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
 });
 
+// src/core/sandbox.ts
+var exports_sandbox = {};
+__export(exports_sandbox, {
+  resolveSandboxMode: () => resolveSandboxMode,
+  displaySandboxWarning: () => displaySandboxWarning,
+  detectSandboxSupport: () => detectSandboxSupport
+});
+import { execFile } from "node:child_process";
+import { createInterface } from "node:readline";
+async function detectSandboxSupport() {
+  if (cachedStatus)
+    return cachedStatus;
+  const log = getLogger();
+  log.debug("Detecting Docker sandbox support...");
+  const status = await runDetection();
+  cachedStatus = status;
+  if (status.available) {
+    log.verbose("Docker sandbox support detected");
+  } else {
+    log.verbose(`Docker sandbox not available: ${status.reason}`);
+  }
+  return status;
+}
+function runDetection() {
+  return new Promise((resolve) => {
+    let settled = false;
+    const child = execFile("docker", ["sandbox", "ls"], { timeout: TIMEOUT_MS }, (error, _stdout, stderr) => {
+      if (settled)
+        return;
+      settled = true;
+      if (!error) {
+        resolve({ available: true });
+        return;
+      }
+      const code = error.code;
+      if (code === "ENOENT") {
+        resolve({ available: false, reason: "Docker is not installed" });
+        return;
+      }
+      if (error.killed) {
+        resolve({ available: false, reason: "Docker is not responding" });
+        return;
+      }
+      const stderrStr = (stderr ?? "").toLowerCase();
+      if (stderrStr.includes("unknown") || stderrStr.includes("not a docker command") || stderrStr.includes("is not a docker command")) {
+        resolve({
+          available: false,
+          reason: "Docker Desktop 4.58+ with sandbox support required"
+        });
+        return;
+      }
+      resolve({
+        available: false,
+        reason: "Docker Desktop 4.58+ with sandbox support required"
+      });
+    });
+    child.on?.("error", (err) => {
+      if (settled)
+        return;
+      settled = true;
+      if (err.code === "ENOENT") {
+        resolve({ available: false, reason: "Docker is not installed" });
+      } else {
+        resolve({
+          available: false,
+          reason: "Docker Desktop 4.58+ with sandbox support required"
+        });
+      }
+    });
+  });
+}
+function resolveSandboxMode(config, flags) {
+  if (flags.noSandbox) {
+    return "disabled";
+  }
+  if (flags.sandbox !== undefined) {
+    if (flags.sandbox === "require") {
+      return "required";
+    }
+    throw new Error(`Invalid --sandbox value: "${flags.sandbox}". Valid values: require`);
+  }
+  if (!config.enabled) {
+    return "disabled";
+  }
+  return "auto";
+}
+async function displaySandboxWarning(mode, status) {
+  if (mode === "required" && !status.available) {
+    process.stderr.write(`
+${red("✖")}  Docker sandbox required but not available: ${bold(status.reason ?? "Docker Desktop 4.58+ with sandbox support required")}
+`);
+    process.stderr.write(`   Install Docker Desktop 4.58+ or remove --sandbox=require to continue.
+
+`);
+    process.exit(1);
+  }
+  if (mode === "disabled") {
+    process.stderr.write(`
+${yellow("⚠")}  ${bold("WARNING:")} Running without sandbox. The AI agent will have unrestricted
+`);
+    process.stderr.write(`   access to your filesystem, network, and environment variables.
+`);
+    if (process.stdin.isTTY) {
+      process.stderr.write(`   Press ${bold("Enter")} to continue or ${bold("Ctrl+C")} to abort.
+`);
+      await waitForEnter();
+    }
+    process.stderr.write(`
+`);
+    return false;
+  }
+  if (mode === "auto" && !status.available) {
+    process.stderr.write(`
+${yellow("⚠")}  Docker sandbox not available. Install Docker Desktop 4.58+ for secure execution.
+`);
+    process.stderr.write(`   Running without sandbox. Use ${dim("--no-sandbox")} to suppress this warning.
+
+`);
+    return false;
+  }
+  return true;
+}
+function waitForEnter() {
+  return new Promise((resolve) => {
+    const rl = createInterface({
+      input: process.stdin,
+      output: process.stderr
+    });
+    rl.once("line", () => {
+      rl.close();
+      resolve();
+    });
+    rl.once("close", () => {
+      resolve();
+    });
+  });
+}
+var TIMEOUT_MS = 5000, cachedStatus = null;
+var init_sandbox = __esm(() => {
+  init_terminal();
+  init_logger();
+});
+
 // src/commands/upgrade.ts
 var exports_upgrade = {};
 __export(exports_upgrade, {
@@ -1840,7 +1991,8 @@ var init_init = __esm(() => {
     ".locus/logs/",
     ".locus/worktrees/",
     ".locus/artifacts/",
-    ".locus/discussions/"
+    ".locus/discussions/",
+    ".locus/tmp/"
   ];
 });
 
@@ -2911,14 +3063,87 @@ var init_stream_renderer = __esm(() => {
   init_terminal();
 });
 
+// src/repl/clipboard.ts
+import { execSync as execSync4 } from "node:child_process";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7 } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join9 } from "node:path";
+function readClipboardImage() {
+  if (process.platform === "darwin") {
+    return readMacOSClipboardImage();
+  }
+  if (process.platform === "linux") {
+    return readLinuxClipboardImage();
+  }
+  return null;
+}
+function ensureStableDir() {
+  if (!existsSync10(STABLE_DIR)) {
+    mkdirSync7(STABLE_DIR, { recursive: true });
+  }
+}
+function readMacOSClipboardImage() {
+  try {
+    ensureStableDir();
+    const destPath = join9(STABLE_DIR, `clipboard-${Date.now()}.png`);
+    const script = [
+      `set destPath to POSIX file "${destPath}"`,
+      "try",
+      `  set imgData to the clipboard as «class PNGf»`,
+      "on error",
+      "  try",
+      `    set imgData to the clipboard as «class TIFF»`,
+      "  on error",
+      `    return "no-image"`,
+      "  end try",
+      "end try",
+      "set fRef to open for access destPath with write permission",
+      "write imgData to fRef",
+      "close access fRef",
+      `return "ok"`
+    ].join(`
+`);
+    const result = execSync4("osascript", {
+      input: script,
+      encoding: "utf-8",
+      timeout: 5000,
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+    if (result === "ok" && existsSync10(destPath)) {
+      return destPath;
+    }
+  } catch {}
+  return null;
+}
+function readLinuxClipboardImage() {
+  try {
+    const targets = execSync4("xclip -selection clipboard -t TARGETS -o 2>/dev/null", { encoding: "utf-8", timeout: 3000 });
+    if (!targets.includes("image/png")) {
+      return null;
+    }
+    ensureStableDir();
+    const destPath = join9(STABLE_DIR, `clipboard-${Date.now()}.png`);
+    execSync4(`xclip -selection clipboard -t image/png -o > "${destPath}" 2>/dev/null`, { timeout: 5000 });
+    if (existsSync10(destPath)) {
+      return destPath;
+    }
+  } catch {}
+  return null;
+}
+var STABLE_DIR;
+var init_clipboard = __esm(() => {
+  STABLE_DIR = join9(tmpdir(), "locus-images");
+});
+
 // src/repl/image-detect.ts
-import { copyFileSync, existsSync as existsSync10, mkdirSync as mkdirSync7 } from "node:fs";
-import { homedir as homedir3, tmpdir } from "node:os";
-import { basename, extname, join as join9, resolve } from "node:path";
+import { copyFileSync, existsSync as existsSync11, mkdirSync as mkdirSync8 } from "node:fs";
+import { homedir as homedir3, tmpdir as tmpdir2 } from "node:os";
+import { basename, extname, join as join10, resolve } from "node:path";
 function detectImages(input) {
   const detected = [];
   const byResolved = new Map;
-  for (const line of input.split(`
+  const sanitized = input.replace(/!\[Screenshot:[^\]]*\]\(locus:\/\/screenshot-\d+\)/g, "");
+  for (const line of sanitized.split(`
 `)) {
     const trimmed = line.trim();
     if (!trimmed)
@@ -2929,20 +3154,20 @@ function detectImages(input) {
     }
   }
   const quotedPattern = /["']([^"']+\.(?:png|jpg|jpeg|gif|webp|bmp|svg))["']/gi;
-  for (const match of input.matchAll(quotedPattern)) {
+  for (const match of sanitized.matchAll(quotedPattern)) {
     if (!match[0] || !match[1])
       continue;
     addIfImage(match[1], match[0], detected, byResolved);
   }
   const escapedPattern = /(?:\/|~\/|\.\/)?(?:[^\s"'\\]|\\ )+\.(?:png|jpg|jpeg|gif|webp|bmp|svg|tiff?)/gi;
-  for (const match of input.matchAll(escapedPattern)) {
+  for (const match of sanitized.matchAll(escapedPattern)) {
     if (!match[0])
       continue;
     const path = match[0].replace(/\\ /g, " ");
     addIfImage(path, match[0], detected, byResolved);
   }
   const plainPattern = /(?:\/|~\/|\.\/)[^\s"']+\.(?:png|jpg|jpeg|gif|webp|bmp|svg|tiff?)/gi;
-  for (const match of input.matchAll(plainPattern)) {
+  for (const match of sanitized.matchAll(plainPattern)) {
     if (!match[0])
       continue;
     addIfImage(match[0], match[0], detected, byResolved);
@@ -3006,13 +3231,28 @@ function collectReferencedAttachments(input, attachments) {
   const selected = attachments.filter((attachment) => ids.has(attachment.id));
   return dedupeByResolvedPath(selected);
 }
+function relocateImages(images, projectRoot) {
+  const targetDir = join10(projectRoot, ".locus", "tmp", "images");
+  for (const img of images) {
+    if (!img.exists)
+      continue;
+    try {
+      if (!existsSync11(targetDir)) {
+        mkdirSync8(targetDir, { recursive: true });
+      }
+      const dest = join10(targetDir, basename(img.stablePath));
+      copyFileSync(img.stablePath, dest);
+      img.stablePath = dest;
+    } catch {}
+  }
+}
 function addIfImage(rawPath, rawMatch, detected, byResolved) {
   const ext = extname(rawPath).toLowerCase();
   if (!IMAGE_EXTENSIONS.has(ext))
     return;
   let resolved = stripQuotes(rawPath).replace(/\\ /g, " ");
   if (resolved.startsWith("~/")) {
-    resolved = join9(homedir3(), resolved.slice(2));
+    resolved = join10(homedir3(), resolved.slice(2));
   }
   resolved = resolve(resolved);
   const existing = byResolved.get(resolved);
@@ -3025,7 +3265,7 @@ function addIfImage(rawPath, rawMatch, detected, byResolved) {
     ]);
     return;
   }
-  const exists = existsSync10(resolved);
+  const exists = existsSync11(resolved);
   let stablePath = resolved;
   if (exists) {
     stablePath = copyToStable(resolved);
@@ -3079,17 +3319,17 @@ function dedupeByResolvedPath(images) {
 }
 function copyToStable(sourcePath) {
   try {
-    if (!existsSync10(STABLE_DIR)) {
-      mkdirSync7(STABLE_DIR, { recursive: true });
+    if (!existsSync11(STABLE_DIR2)) {
+      mkdirSync8(STABLE_DIR2, { recursive: true });
     }
-    const dest = join9(STABLE_DIR, `${Date.now()}-${basename(sourcePath)}`);
+    const dest = join10(STABLE_DIR2, `${Date.now()}-${basename(sourcePath)}`);
     copyFileSync(sourcePath, dest);
     return dest;
   } catch {
     return sourcePath;
   }
 }
-var IMAGE_EXTENSIONS, STABLE_DIR, PLACEHOLDER_SCHEME = "locus://screenshot-", PLACEHOLDER_ID_PATTERN;
+var IMAGE_EXTENSIONS, STABLE_DIR2, PLACEHOLDER_SCHEME = "locus://screenshot-", PLACEHOLDER_ID_PATTERN;
 var init_image_detect = __esm(() => {
   IMAGE_EXTENSIONS = new Set([
     ".png",
@@ -3102,7 +3342,7 @@ var init_image_detect = __esm(() => {
     ".tif",
     ".tiff"
   ]);
-  STABLE_DIR = join9(tmpdir(), "locus-images");
+  STABLE_DIR2 = join10(tmpdir2(), "locus-images");
   PLACEHOLDER_ID_PATTERN = /\(locus:\/\/screenshot-(\d+)\)/g;
 });
 
@@ -3521,6 +3761,15 @@ ${dim("Press Ctrl+C again to exit")}\r
             pasteBuffer += pending.slice(0, endIdx);
             pending = pending.slice(endIdx + PASTE_END.length);
             isPasting = false;
+            if (pasteBuffer.trim() === "") {
+              const clipboardImagePath = readClipboardImage();
+              if (clipboardImagePath) {
+                insertText(clipboardImagePath);
+                pasteBuffer = "";
+                render();
+                continue;
+              }
+            }
             insertText(normalizeLineEndings(pasteBuffer));
             pasteBuffer = "";
             render();
@@ -3812,6 +4061,7 @@ var CSI = "\x1B[", SAVE_CURSOR = "\x1B7", RESTORE_CURSOR = "\x1B8", ENABLE_BRACK
 `, ESC = "\x1B", BACKSPACE = "", SEQ_LEFT, SEQ_RIGHT, SEQ_UP, SEQ_DOWN, SEQ_HOME, SEQ_END, SEQ_HOME_1, SEQ_END_4, SEQ_HOME_O = "\x1BOH", SEQ_END_O = "\x1BOF", SEQ_DELETE, SEQ_WORD_LEFT, SEQ_WORD_RIGHT, SEQ_SHIFT_LEFT, SEQ_SHIFT_RIGHT, SEQ_META_LEFT, SEQ_META_RIGHT, SEQ_META_SHIFT_LEFT, SEQ_META_SHIFT_RIGHT, SEQ_SHIFT_ENTER_CSI_U, SEQ_SHIFT_ENTER_MODIFY, SEQ_SHIFT_ENTER_TILDE, SEQ_ALT_ENTER, CONTROL_SEQUENCES;
 var init_input_handler = __esm(() => {
   init_terminal();
+  init_clipboard();
   init_image_detect();
   ENABLE_BRACKETED_PASTE = `${CSI}?2004h`;
   DISABLE_BRACKETED_PASTE = `${CSI}?2004l`;
@@ -3874,7 +4124,7 @@ __export(exports_claude, {
   buildClaudeArgs: () => buildClaudeArgs,
   ClaudeRunner: () => ClaudeRunner
 });
-import { execSync as execSync4, spawn as spawn2 } from "node:child_process";
+import { execSync as execSync5, spawn as spawn2 } from "node:child_process";
 function buildClaudeArgs(options) {
   const args = [
     "--dangerously-skip-permissions",
@@ -3895,7 +4145,7 @@ class ClaudeRunner {
   aborted = false;
   async isAvailable() {
     try {
-      execSync4("claude --version", {
+      execSync5("claude --version", {
         encoding: "utf-8",
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -3906,7 +4156,7 @@ class ClaudeRunner {
   }
   async getVersion() {
     try {
-      const output = execSync4("claude --version", {
+      const output = execSync5("claude --version", {
         encoding: "utf-8",
         stdio: ["pipe", "pipe", "pipe"]
       }).trim();
@@ -4071,11 +4321,11 @@ var init_claude = __esm(() => {
 
 // src/core/sandbox-ignore.ts
 import { exec } from "node:child_process";
-import { existsSync as existsSync11, readFileSync as readFileSync8 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync8 } from "node:fs";
+import { join as join11 } from "node:path";
 import { promisify } from "node:util";
 function parseIgnoreFile(filePath) {
-  if (!existsSync11(filePath))
+  if (!existsSync12(filePath))
     return [];
   const content = readFileSync8(filePath, "utf-8");
   const rules = [];
@@ -4122,7 +4372,7 @@ function buildCleanupScript(rules, workspacePath) {
 }
 async function enforceSandboxIgnore(sandboxName, projectRoot) {
   const log = getLogger();
-  const ignorePath = join10(projectRoot, ".sandboxignore");
+  const ignorePath = join11(projectRoot, ".sandboxignore");
   const rules = parseIgnoreFile(ignorePath);
   if (rules.length === 0)
     return;
@@ -4151,19 +4401,19 @@ var init_sandbox_ignore = __esm(() => {
 
 // src/core/run-state.ts
 import {
-  existsSync as existsSync12,
-  mkdirSync as mkdirSync8,
+  existsSync as existsSync13,
+  mkdirSync as mkdirSync9,
   readFileSync as readFileSync9,
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import { dirname as dirname3, join as join11 } from "node:path";
+import { dirname as dirname3, join as join12 } from "node:path";
 function getRunStatePath(projectRoot) {
-  return join11(projectRoot, ".locus", "run-state.json");
+  return join12(projectRoot, ".locus", "run-state.json");
 }
 function loadRunState(projectRoot) {
   const path = getRunStatePath(projectRoot);
-  if (!existsSync12(path))
+  if (!existsSync13(path))
     return null;
   try {
     return JSON.parse(readFileSync9(path, "utf-8"));
@@ -4175,15 +4425,15 @@ function loadRunState(projectRoot) {
 function saveRunState(projectRoot, state) {
   const path = getRunStatePath(projectRoot);
   const dir = dirname3(path);
-  if (!existsSync12(dir)) {
-    mkdirSync8(dir, { recursive: true });
+  if (!existsSync13(dir)) {
+    mkdirSync9(dir, { recursive: true });
   }
   writeFileSync6(path, `${JSON.stringify(state, null, 2)}
 `, "utf-8");
 }
 function clearRunState(projectRoot) {
   const path = getRunStatePath(projectRoot);
-  if (existsSync12(path)) {
+  if (existsSync13(path)) {
     unlinkSync3(path);
   }
 }
@@ -4257,7 +4507,7 @@ var init_run_state = __esm(() => {
 });
 
 // src/core/shutdown.ts
-import { execSync as execSync5 } from "node:child_process";
+import { execSync as execSync6 } from "node:child_process";
 function registerActiveSandbox(name) {
   activeSandboxes.add(name);
 }
@@ -4267,7 +4517,7 @@ function unregisterActiveSandbox(name) {
 function cleanupActiveSandboxes() {
   for (const name of activeSandboxes) {
     try {
-      execSync5(`docker sandbox rm ${name}`, { timeout: 1e4 });
+      execSync6(`docker sandbox rm ${name}`, { timeout: 1e4 });
     } catch {}
   }
   activeSandboxes.clear();
@@ -4340,7 +4590,7 @@ var init_shutdown = __esm(() => {
 });
 
 // src/ai/claude-sandbox.ts
-import { execSync as execSync6, spawn as spawn3 } from "node:child_process";
+import { execSync as execSync7, spawn as spawn3 } from "node:child_process";
 
 class SandboxedClaudeRunner {
   name = "claude-sandboxed";
@@ -4556,7 +4806,7 @@ class SandboxedClaudeRunner {
         sandboxName: this.sandboxName
       });
       try {
-        execSync6(`docker sandbox rm ${this.sandboxName}`, { timeout: 60000 });
+        execSync7(`docker sandbox rm ${this.sandboxName}`, { timeout: 60000 });
       } catch {}
     }
   }
@@ -4570,7 +4820,7 @@ class SandboxedClaudeRunner {
     const log = getLogger();
     log.debug("Destroying sandbox", { sandboxName: this.sandboxName });
     try {
-      execSync6(`docker sandbox rm ${this.sandboxName}`, { timeout: 60000 });
+      execSync7(`docker sandbox rm ${this.sandboxName}`, { timeout: 60000 });
     } catch {}
     unregisterActiveSandbox(this.sandboxName);
     this.sandboxName = null;
@@ -4582,7 +4832,7 @@ class SandboxedClaudeRunner {
     const log = getLogger();
     log.debug("Cleaning up sandbox", { sandboxName: this.sandboxName });
     try {
-      execSync6(`docker sandbox rm ${this.sandboxName}`, {
+      execSync7(`docker sandbox rm ${this.sandboxName}`, {
         timeout: 60000
       });
     } catch {}
@@ -4658,7 +4908,7 @@ var init_claude_sandbox = __esm(() => {
 });
 
 // src/ai/codex.ts
-import { execSync as execSync7, spawn as spawn4 } from "node:child_process";
+import { execSync as execSync8, spawn as spawn4 } from "node:child_process";
 function buildCodexArgs(model) {
   const args = ["exec", "--full-auto", "--skip-git-repo-check", "--json"];
   if (model) {
@@ -4674,7 +4924,7 @@ class CodexRunner {
   aborted = false;
   async isAvailable() {
     try {
-      execSync7("codex --version", {
+      execSync8("codex --version", {
         encoding: "utf-8",
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -4685,7 +4935,7 @@ class CodexRunner {
   }
   async getVersion() {
     try {
-      const output = execSync7("codex --version", {
+      const output = execSync8("codex --version", {
         encoding: "utf-8",
         stdio: ["pipe", "pipe", "pipe"]
       }).trim();
@@ -4833,7 +5083,7 @@ var init_codex = __esm(() => {
 });
 
 // src/ai/codex-sandbox.ts
-import { execSync as execSync8, spawn as spawn5 } from "node:child_process";
+import { execSync as execSync9, spawn as spawn5 } from "node:child_process";
 
 class SandboxedCodexRunner {
   name = "codex-sandboxed";
@@ -5076,7 +5326,7 @@ class SandboxedCodexRunner {
         sandboxName: this.sandboxName
       });
       try {
-        execSync8(`docker sandbox rm ${this.sandboxName}`, { timeout: 60000 });
+        execSync9(`docker sandbox rm ${this.sandboxName}`, { timeout: 60000 });
       } catch {}
     }
   }
@@ -5090,7 +5340,7 @@ class SandboxedCodexRunner {
     const log = getLogger();
     log.debug("Destroying sandbox", { sandboxName: this.sandboxName });
     try {
-      execSync8(`docker sandbox rm ${this.sandboxName}`, { timeout: 60000 });
+      execSync9(`docker sandbox rm ${this.sandboxName}`, { timeout: 60000 });
     } catch {}
     unregisterActiveSandbox(this.sandboxName);
     this.sandboxName = null;
@@ -5102,7 +5352,7 @@ class SandboxedCodexRunner {
     const log = getLogger();
     log.debug("Cleaning up sandbox", { sandboxName: this.sandboxName });
     try {
-      execSync8(`docker sandbox rm ${this.sandboxName}`, {
+      execSync9(`docker sandbox rm ${this.sandboxName}`, {
         timeout: 60000
       });
     } catch {}
@@ -5493,7 +5743,7 @@ var exports_issue = {};
 __export(exports_issue, {
   issueCommand: () => issueCommand
 });
-import { createInterface } from "node:readline";
+import { createInterface as createInterface2 } from "node:readline";
 function parseIssueArgs(args) {
   const flags = {};
   const positional = [];
@@ -5726,7 +5976,7 @@ function extractJSON(text) {
 }
 function askQuestion(question) {
   return new Promise((resolve2) => {
-    const rl = createInterface({
+    const rl = createInterface2({
       input: process.stdin,
       output: process.stderr
     });
@@ -6765,9 +7015,9 @@ var init_sprint = __esm(() => {
 });
 
 // src/core/prompt-builder.ts
-import { execSync as execSync9 } from "node:child_process";
-import { existsSync as existsSync13, readdirSync as readdirSync3, readFileSync as readFileSync10 } from "node:fs";
-import { join as join12 } from "node:path";
+import { execSync as execSync10 } from "node:child_process";
+import { existsSync as existsSync14, readdirSync as readdirSync3, readFileSync as readFileSync10 } from "node:fs";
+import { join as join13 } from "node:path";
 function buildExecutionPrompt(ctx) {
   const sections = [];
   sections.push(buildSystemContext(ctx.projectRoot));
@@ -6797,13 +7047,13 @@ function buildFeedbackPrompt(ctx) {
 }
 function buildReplPrompt(userMessage, projectRoot, _config, previousMessages) {
   const sections = [];
-  const locusmd = readFileSafe(join12(projectRoot, "LOCUS.md"));
+  const locusmd = readFileSafe(join13(projectRoot, "LOCUS.md"));
   if (locusmd) {
     sections.push(`# Project Instructions
 
 ${locusmd}`);
   }
-  const learnings = readFileSafe(join12(projectRoot, ".locus", "LEARNINGS.md"));
+  const learnings = readFileSafe(join13(projectRoot, ".locus", "LEARNINGS.md"));
   if (learnings) {
     sections.push(`# Past Learnings
 
@@ -6829,24 +7079,24 @@ ${userMessage}`);
 }
 function buildSystemContext(projectRoot) {
   const parts = ["# System Context"];
-  const locusmd = readFileSafe(join12(projectRoot, "LOCUS.md"));
+  const locusmd = readFileSafe(join13(projectRoot, "LOCUS.md"));
   if (locusmd) {
     parts.push(`## Project Instructions (LOCUS.md)
 
 ${locusmd}`);
   }
-  const learnings = readFileSafe(join12(projectRoot, ".locus", "LEARNINGS.md"));
+  const learnings = readFileSafe(join13(projectRoot, ".locus", "LEARNINGS.md"));
   if (learnings) {
     parts.push(`## Past Learnings
 
 ${learnings}`);
   }
-  const discussionsDir = join12(projectRoot, ".locus", "discussions");
-  if (existsSync13(discussionsDir)) {
+  const discussionsDir = join13(projectRoot, ".locus", "discussions");
+  if (existsSync14(discussionsDir)) {
     try {
       const files = readdirSync3(discussionsDir).filter((f) => f.endsWith(".md")).slice(0, 3);
       for (const file of files) {
-        const content = readFileSafe(join12(discussionsDir, file));
+        const content = readFileSafe(join13(discussionsDir, file));
         if (content) {
           parts.push(`## Discussion: ${file.replace(".md", "")}
 
@@ -6909,7 +7159,7 @@ ${diffSummary}
 function buildRepoContext(projectRoot) {
   const parts = ["# Repository Context"];
   try {
-    const tree = execSync9("find . -maxdepth 2 -not -path '*/node_modules/*' -not -path '*/.git/*' -not -path '*/.locus/*' -not -path '*/dist/*' -not -path '*/build/*' | head -80", { cwd: projectRoot, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    const tree = execSync10("find . -maxdepth 2 -not -path '*/node_modules/*' -not -path '*/.git/*' -not -path '*/.locus/*' -not -path '*/dist/*' -not -path '*/build/*' | head -80", { cwd: projectRoot, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (tree) {
       parts.push(`## File Tree
 
@@ -6919,7 +7169,7 @@ ${tree}
     }
   } catch {}
   try {
-    const gitLog = execSync9("git log --oneline -10", {
+    const gitLog = execSync10("git log --oneline -10", {
       cwd: projectRoot,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -6933,7 +7183,7 @@ ${gitLog}
     }
   } catch {}
   try {
-    const branch = execSync9("git rev-parse --abbrev-ref HEAD", {
+    const branch = execSync10("git rev-parse --abbrev-ref HEAD", {
       cwd: projectRoot,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -6992,7 +7242,7 @@ function buildFeedbackInstructions() {
 }
 function readFileSafe(path) {
   try {
-    if (!existsSync13(path))
+    if (!existsSync14(path))
       return null;
     return readFileSync10(path, "utf-8");
   } catch {
@@ -7186,7 +7436,7 @@ var init_diff_renderer = __esm(() => {
 });
 
 // src/repl/commands.ts
-import { execSync as execSync10 } from "node:child_process";
+import { execSync as execSync11 } from "node:child_process";
 function getSlashCommands() {
   return [
     {
@@ -7378,7 +7628,7 @@ function cmdModel(args, ctx) {
 }
 function cmdDiff(_args, ctx) {
   try {
-    const diff = execSync10("git diff", {
+    const diff = execSync11("git diff", {
       cwd: ctx.projectRoot,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -7414,7 +7664,7 @@ function cmdDiff(_args, ctx) {
 }
 function cmdUndo(_args, ctx) {
   try {
-    const status = execSync10("git status --porcelain", {
+    const status = execSync11("git status --porcelain", {
       cwd: ctx.projectRoot,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -7424,7 +7674,7 @@ function cmdUndo(_args, ctx) {
 `);
       return;
     }
-    execSync10("git checkout .", {
+    execSync11("git checkout .", {
       cwd: ctx.projectRoot,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -7458,7 +7708,7 @@ var init_commands = __esm(() => {
 
 // src/repl/completions.ts
 import { readdirSync as readdirSync4 } from "node:fs";
-import { basename as basename2, dirname as dirname4, join as join13 } from "node:path";
+import { basename as basename2, dirname as dirname4, join as join14 } from "node:path";
 
 class SlashCommandCompletion {
   commands;
@@ -7513,7 +7763,7 @@ class FilePathCompletion {
   }
   findMatches(partial) {
     try {
-      const dir = partial.includes("/") ? join13(this.projectRoot, dirname4(partial)) : this.projectRoot;
+      const dir = partial.includes("/") ? join14(this.projectRoot, dirname4(partial)) : this.projectRoot;
       const prefix = basename2(partial);
       const entries = readdirSync4(dir, { withFileTypes: true });
       return entries.filter((e) => {
@@ -7549,14 +7799,14 @@ class CombinedCompletion {
 var init_completions = () => {};
 
 // src/repl/input-history.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync9, readFileSync as readFileSync11, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname5, join as join14 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync10, readFileSync as readFileSync11, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname5, join as join15 } from "node:path";
 
 class InputHistory {
   entries = [];
   filePath;
   constructor(projectRoot) {
-    this.filePath = join14(projectRoot, ".locus", "sessions", ".input-history");
+    this.filePath = join15(projectRoot, ".locus", "sessions", ".input-history");
     this.load();
   }
   add(text) {
@@ -7595,7 +7845,7 @@ class InputHistory {
   }
   load() {
     try {
-      if (!existsSync14(this.filePath))
+      if (!existsSync15(this.filePath))
         return;
       const content = readFileSync11(this.filePath, "utf-8");
       this.entries = content.split(`
@@ -7605,8 +7855,8 @@ class InputHistory {
   save() {
     try {
       const dir = dirname5(this.filePath);
-      if (!existsSync14(dir)) {
-        mkdirSync9(dir, { recursive: true });
+      if (!existsSync15(dir)) {
+        mkdirSync10(dir, { recursive: true });
       }
       const content = this.entries.map((e) => this.escape(e)).join(`
 `);
@@ -7636,21 +7886,21 @@ var init_model_config = __esm(() => {
 
 // src/repl/session-manager.ts
 import {
-  existsSync as existsSync15,
-  mkdirSync as mkdirSync10,
+  existsSync as existsSync16,
+  mkdirSync as mkdirSync11,
   readdirSync as readdirSync5,
   readFileSync as readFileSync12,
   unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync8
 } from "node:fs";
-import { basename as basename3, join as join15 } from "node:path";
+import { basename as basename3, join as join16 } from "node:path";
 
 class SessionManager {
   sessionsDir;
   constructor(projectRoot) {
-    this.sessionsDir = join15(projectRoot, ".locus", "sessions");
-    if (!existsSync15(this.sessionsDir)) {
-      mkdirSync10(this.sessionsDir, { recursive: true });
+    this.sessionsDir = join16(projectRoot, ".locus", "sessions");
+    if (!existsSync16(this.sessionsDir)) {
+      mkdirSync11(this.sessionsDir, { recursive: true });
     }
   }
   create(options) {
@@ -7675,12 +7925,12 @@ class SessionManager {
   }
   isPersisted(sessionOrId) {
     const sessionId = typeof sessionOrId === "string" ? sessionOrId : sessionOrId.id;
-    return existsSync15(this.getSessionPath(sessionId));
+    return existsSync16(this.getSessionPath(sessionId));
   }
   load(idOrPrefix) {
     const files = this.listSessionFiles();
     const exactPath = this.getSessionPath(idOrPrefix);
-    if (existsSync15(exactPath)) {
+    if (existsSync16(exactPath)) {
       try {
         return JSON.parse(readFileSync12(exactPath, "utf-8"));
       } catch {
@@ -7730,7 +7980,7 @@ class SessionManager {
   }
   delete(sessionId) {
     const path = this.getSessionPath(sessionId);
-    if (existsSync15(path)) {
+    if (existsSync16(path)) {
       unlinkSync4(path);
       return true;
     }
@@ -7760,7 +8010,7 @@ class SessionManager {
     const remaining = withStats.length - pruned;
     if (remaining > MAX_SESSIONS) {
       const toRemove = remaining - MAX_SESSIONS;
-      const alive = withStats.filter((e) => existsSync15(e.path));
+      const alive = withStats.filter((e) => existsSync16(e.path));
       for (let i = 0;i < toRemove && i < alive.length; i++) {
         try {
           unlinkSync4(alive[i].path);
@@ -7775,7 +8025,7 @@ class SessionManager {
   }
   listSessionFiles() {
     try {
-      return readdirSync5(this.sessionsDir).filter((f) => f.endsWith(".json") && !f.startsWith(".")).map((f) => join15(this.sessionsDir, f));
+      return readdirSync5(this.sessionsDir).filter((f) => f.endsWith(".json") && !f.startsWith(".")).map((f) => join16(this.sessionsDir, f));
     } catch {
       return [];
     }
@@ -7784,7 +8034,7 @@ class SessionManager {
     return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
   }
   getSessionPath(sessionId) {
-    return join15(this.sessionsDir, `${sessionId}.json`);
+    return join16(this.sessionsDir, `${sessionId}.json`);
   }
 }
 var MAX_SESSIONS = 50, SESSION_MAX_AGE_MS;
@@ -7794,7 +8044,7 @@ var init_session_manager = __esm(() => {
 });
 
 // src/repl/repl.ts
-import { execSync as execSync11 } from "node:child_process";
+import { execSync as execSync12 } from "node:child_process";
 async function startRepl(options) {
   const { projectRoot, config } = options;
   const sessionManager = new SessionManager(projectRoot);
@@ -7812,7 +8062,7 @@ async function startRepl(options) {
   } else {
     let branch = "main";
     try {
-      branch = execSync11("git rev-parse --abbrev-ref HEAD", {
+      branch = execSync12("git rev-parse --abbrev-ref HEAD", {
         cwd: projectRoot,
         encoding: "utf-8",
         stdio: ["pipe", "pipe", "pipe"]
@@ -7837,6 +8087,7 @@ async function executeOneShotPrompt(prompt, session, sessionManager, options) {
   const normalized = normalizeImagePlaceholders(prompt);
   const text = normalized.text;
   const images = collectReferencedAttachments(text, normalized.attachments);
+  relocateImages(images, projectRoot);
   const imageContext = buildImageContext(images);
   const fullPrompt = buildReplPrompt(text + imageContext, projectRoot, config, session.messages);
   sessionManager.addMessage(session, {
@@ -7931,6 +8182,7 @@ async function runInteractiveRepl(session, sessionManager, options) {
           continue;
         }
         history.add(text);
+        relocateImages(result.images, projectRoot);
         const imageContext = buildImageContext(result.images);
         const fullPrompt = buildReplPrompt(text + imageContext, projectRoot, { ...config, ai: { provider: currentProvider, model: currentModel } }, session.messages);
         sessionManager.addMessage(session, {
@@ -8223,7 +8475,7 @@ var init_exec = __esm(() => {
 });
 
 // src/core/agent.ts
-import { execSync as execSync12 } from "node:child_process";
+import { execSync as execSync13 } from "node:child_process";
 async function executeIssue(projectRoot, options) {
   const log = getLogger();
   const timer = createTimer();
@@ -8252,7 +8504,7 @@ ${cyan("●")} ${bold(`#${issueNumber}`)} ${issue.title}
   }
   let issueComments = [];
   try {
-    const commentsRaw = execSync12(`gh issue view ${issueNumber} --json comments --jq '.comments[].body'`, { cwd: projectRoot, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    const commentsRaw = execSync13(`gh issue view ${issueNumber} --json comments --jq '.comments[].body'`, { cwd: projectRoot, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
     if (commentsRaw) {
       issueComments = commentsRaw.split(`
 `).filter(Boolean);
@@ -8416,12 +8668,12 @@ ${aiResult.success ? green("✓") : red("✗")} Iteration ${aiResult.success ? "
 }
 async function createIssuePR(projectRoot, config, issue) {
   try {
-    const currentBranch = execSync12("git rev-parse --abbrev-ref HEAD", {
+    const currentBranch = execSync13("git rev-parse --abbrev-ref HEAD", {
       cwd: projectRoot,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
-    const diff = execSync12(`git diff origin/${config.agent.baseBranch}..HEAD --stat`, {
+    const diff = execSync13(`git diff origin/${config.agent.baseBranch}..HEAD --stat`, {
       cwd: projectRoot,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -8430,7 +8682,7 @@ async function createIssuePR(projectRoot, config, issue) {
       getLogger().verbose("No changes to create PR for");
       return;
     }
-    execSync12(`git push -u origin ${currentBranch}`, {
+    execSync13(`git push -u origin ${currentBranch}`, {
       cwd: projectRoot,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -8476,9 +8728,9 @@ var init_agent = __esm(() => {
 });
 
 // src/core/conflict.ts
-import { execSync as execSync13 } from "node:child_process";
+import { execSync as execSync14 } from "node:child_process";
 function git2(args, cwd) {
-  return execSync13(`git ${args}`, {
+  return execSync14(`git ${args}`, {
     cwd,
     encoding: "utf-8",
     stdio: ["pipe", "pipe", "pipe"]
@@ -8603,144 +8855,12 @@ var init_conflict = __esm(() => {
   init_logger();
 });
 
-// src/core/sandbox.ts
-import { execFile } from "node:child_process";
-async function detectSandboxSupport() {
-  if (cachedStatus)
-    return cachedStatus;
-  const log = getLogger();
-  log.debug("Detecting Docker sandbox support...");
-  const status = await runDetection();
-  cachedStatus = status;
-  if (status.available) {
-    log.verbose("Docker sandbox support detected");
-  } else {
-    log.verbose(`Docker sandbox not available: ${status.reason}`);
-  }
-  return status;
-}
-function runDetection() {
-  return new Promise((resolve2) => {
-    let settled = false;
-    const child = execFile("docker", ["sandbox", "ls"], { timeout: TIMEOUT_MS }, (error, _stdout, stderr) => {
-      if (settled)
-        return;
-      settled = true;
-      if (!error) {
-        resolve2({ available: true });
-        return;
-      }
-      const code = error.code;
-      if (code === "ENOENT") {
-        resolve2({ available: false, reason: "Docker is not installed" });
-        return;
-      }
-      if (error.killed) {
-        resolve2({ available: false, reason: "Docker is not responding" });
-        return;
-      }
-      const stderrStr = (stderr ?? "").toLowerCase();
-      if (stderrStr.includes("unknown") || stderrStr.includes("not a docker command") || stderrStr.includes("is not a docker command")) {
-        resolve2({
-          available: false,
-          reason: "Docker Desktop 4.58+ with sandbox support required"
-        });
-        return;
-      }
-      resolve2({
-        available: false,
-        reason: "Docker Desktop 4.58+ with sandbox support required"
-      });
-    });
-    child.on?.("error", (err) => {
-      if (settled)
-        return;
-      settled = true;
-      if (err.code === "ENOENT") {
-        resolve2({ available: false, reason: "Docker is not installed" });
-      } else {
-        resolve2({
-          available: false,
-          reason: "Docker Desktop 4.58+ with sandbox support required"
-        });
-      }
-    });
-  });
-}
-async function cleanupStaleSandboxes() {
-  const log = getLogger();
-  try {
-    const { stdout } = await execFileAsync("docker", ["sandbox", "ls"], {
-      timeout: TIMEOUT_MS
-    });
-    const lines = stdout.trim().split(`
-`);
-    if (lines.length <= 1)
-      return 0;
-    const staleNames = [];
-    for (const line of lines.slice(1)) {
-      const name = line.trim().split(/\s+/)[0];
-      if (name?.startsWith("locus-")) {
-        staleNames.push(name);
-      }
-    }
-    if (staleNames.length === 0)
-      return 0;
-    log.verbose(`Found ${staleNames.length} stale sandbox(es) to clean up`);
-    let cleaned = 0;
-    for (const name of staleNames) {
-      try {
-        await execFileAsync("docker", ["sandbox", "rm", name], {
-          timeout: 1e4
-        });
-        log.debug(`Removed stale sandbox: ${name}`);
-        cleaned++;
-      } catch {
-        log.debug(`Failed to remove stale sandbox: ${name}`);
-      }
-    }
-    return cleaned;
-  } catch {
-    return 0;
-  }
-}
-function execFileAsync(file, args, options) {
-  return new Promise((resolve2, reject) => {
-    execFile(file, args, options, (error, stdout, stderr) => {
-      if (error)
-        reject(error);
-      else
-        resolve2({ stdout: stdout ?? "", stderr: stderr ?? "" });
-    });
-  });
-}
-function resolveSandboxMode(config, flags) {
-  if (flags.noSandbox) {
-    return "disabled";
-  }
-  if (flags.sandbox !== undefined) {
-    if (flags.sandbox === "require") {
-      return "required";
-    }
-    throw new Error(`Invalid --sandbox value: "${flags.sandbox}". Valid values: require`);
-  }
-  if (!config.enabled) {
-    return "disabled";
-  }
-  return "auto";
-}
-var TIMEOUT_MS = 5000, cachedStatus = null;
-var init_sandbox = __esm(() => {
-  init_terminal();
-  init_logger();
-});
-
 // src/core/worktree.ts
-import { execSync as execSync14 } from "node:child_process";
-import { existsSync as existsSync16, readdirSync as readdirSync6, realpathSync, statSync as statSync3 } from "node:fs";
-import { join as join16 } from "node:path";
+import { execSync as execSync15 } from "node:child_process";
+import { existsSync as existsSync17, readdirSync as readdirSync6, realpathSync, statSync as statSync3 } from "node:fs";
+import { join as join17 } from "node:path";
 function git3(args, cwd) {
-  return execSync14(`git ${args}`, {
+  return execSync15(`git ${args}`, {
     cwd,
     encoding: "utf-8",
     stdio: ["pipe", "pipe", "pipe"]
@@ -8754,10 +8874,10 @@ function gitSafe2(args, cwd) {
   }
 }
 function getWorktreeDir(projectRoot) {
-  return join16(projectRoot, ".locus", "worktrees");
+  return join17(projectRoot, ".locus", "worktrees");
 }
 function getWorktreePath(projectRoot, issueNumber) {
-  return join16(getWorktreeDir(projectRoot), `issue-${issueNumber}`);
+  return join17(getWorktreeDir(projectRoot), `issue-${issueNumber}`);
 }
 function generateBranchName(issueNumber) {
   const randomSuffix = Math.random().toString(36).slice(2, 8);
@@ -8765,7 +8885,7 @@ function generateBranchName(issueNumber) {
 }
 function getWorktreeBranch(worktreePath) {
   try {
-    return execSync14("git branch --show-current", {
+    return execSync15("git branch --show-current", {
       cwd: worktreePath,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -8777,7 +8897,7 @@ function getWorktreeBranch(worktreePath) {
 function createWorktree(projectRoot, issueNumber, baseBranch) {
   const log = getLogger();
   const worktreePath = getWorktreePath(projectRoot, issueNumber);
-  if (existsSync16(worktreePath)) {
+  if (existsSync17(worktreePath)) {
     log.verbose(`Worktree already exists for issue #${issueNumber}`);
     const existingBranch = getWorktreeBranch(worktreePath) ?? `locus/issue-${issueNumber}`;
     return {
@@ -8804,7 +8924,7 @@ function createWorktree(projectRoot, issueNumber, baseBranch) {
 function removeWorktree(projectRoot, issueNumber) {
   const log = getLogger();
   const worktreePath = getWorktreePath(projectRoot, issueNumber);
-  if (!existsSync16(worktreePath)) {
+  if (!existsSync17(worktreePath)) {
     log.verbose(`Worktree for issue #${issueNumber} does not exist`);
     return;
   }
@@ -8823,7 +8943,7 @@ function removeWorktree(projectRoot, issueNumber) {
 function listWorktrees(projectRoot) {
   const log = getLogger();
   const worktreeDir = getWorktreeDir(projectRoot);
-  if (!existsSync16(worktreeDir)) {
+  if (!existsSync17(worktreeDir)) {
     return [];
   }
   const entries = readdirSync6(worktreeDir).filter((entry) => entry.startsWith("issue-"));
@@ -8843,7 +8963,7 @@ function listWorktrees(projectRoot) {
     if (!match)
       continue;
     const issueNumber = Number.parseInt(match[1], 10);
-    const path = join16(worktreeDir, entry);
+    const path = join17(worktreeDir, entry);
     const branch = getWorktreeBranch(path) ?? `locus/issue-${issueNumber}`;
     let resolvedPath;
     try {
@@ -8890,7 +9010,7 @@ var exports_run = {};
 __export(exports_run, {
   runCommand: () => runCommand
 });
-import { execSync as execSync15 } from "node:child_process";
+import { execSync as execSync16 } from "node:child_process";
 function printRunHelp() {
   process.stderr.write(`
 ${bold("locus run")} — Execute issues using AI agents
@@ -8956,13 +9076,6 @@ async function runCommand(projectRoot, args, flags = {}) {
       process.stderr.write(`${yellow("⚠")} Running without sandbox. The AI agent will have unrestricted access to your filesystem, network, and environment variables.
 `);
     }
-    if (sandboxed) {
-      const staleCleaned = await cleanupStaleSandboxes();
-      if (staleCleaned > 0) {
-        process.stderr.write(`  ${dim(`Cleaned up ${staleCleaned} stale sandbox${staleCleaned === 1 ? "" : "es"}.`)}
-`);
-      }
-    }
     if (flags.resume) {
       return handleResume(projectRoot, config, sandboxed);
     }
@@ -9041,7 +9154,7 @@ ${yellow("⚠")} A sprint run is already in progress.
   }
   if (!flags.dryRun) {
     try {
-      execSync15(`git checkout -B ${branchName}`, {
+      execSync16(`git checkout -B ${branchName}`, {
         cwd: projectRoot,
         encoding: "utf-8",
         stdio: ["pipe", "pipe", "pipe"]
@@ -9091,7 +9204,7 @@ ${red("✗")} Auto-rebase failed. Resolve manually.
     let sprintContext;
     if (i > 0 && !flags.dryRun) {
       try {
-        sprintContext = execSync15(`git diff origin/${config.agent.baseBranch}..HEAD`, {
+        sprintContext = execSync16(`git diff origin/${config.agent.baseBranch}..HEAD`, {
           cwd: projectRoot,
           encoding: "utf-8",
           stdio: ["pipe", "pipe", "pipe"]
@@ -9111,13 +9224,16 @@ ${progressBar(i, state.tasks.length, { label: "Sprint Progress" })}
       dryRun: flags.dryRun,
       sprintContext,
       skipPR: true,
-      sandboxed,
-      sandboxName: config.sandbox.name
+      sandboxed
     });
     if (result.success) {
       if (!flags.dryRun) {
         const issueTitle = issue?.title ?? "";
         ensureTaskCommit(projectRoot, task.issue, issueTitle);
+        if (sandboxed && i < state.tasks.length - 1) {
+          process.stderr.write(`  ${dim("↻ Sandbox will resync on next task")}
+`);
+        }
       }
       markTaskDone(state, task.issue, result.prNumber);
     } else {
@@ -9152,7 +9268,7 @@ ${bold("Summary:")}
     const prNumber = await createSprintPR(projectRoot, config, sprintName, branchName, completedTasks);
     if (prNumber !== undefined) {
       try {
-        execSync15(`git checkout ${config.agent.baseBranch}`, {
+        execSync16(`git checkout ${config.agent.baseBranch}`, {
           cwd: projectRoot,
           encoding: "utf-8",
           stdio: ["pipe", "pipe", "pipe"]
@@ -9349,13 +9465,13 @@ ${bold("Resuming")} ${state.type} run ${dim(state.runId)}
 `);
   if (state.type === "sprint" && state.branch) {
     try {
-      const currentBranch = execSync15("git rev-parse --abbrev-ref HEAD", {
+      const currentBranch = execSync16("git rev-parse --abbrev-ref HEAD", {
         cwd: projectRoot,
         encoding: "utf-8",
         stdio: ["pipe", "pipe", "pipe"]
       }).trim();
       if (currentBranch !== state.branch) {
-        execSync15(`git checkout ${state.branch}`, {
+        execSync16(`git checkout ${state.branch}`, {
           cwd: projectRoot,
           encoding: "utf-8",
           stdio: ["pipe", "pipe", "pipe"]
@@ -9383,7 +9499,7 @@ ${bold("Resuming")} ${state.type} run ${dim(state.runId)}
       model: config.ai.model,
       skipPR: isSprintRun,
       sandboxed,
-      sandboxName: config.sandbox.name
+      sandboxName: isSprintRun ? undefined : config.sandbox.name
     });
     if (result.success) {
       if (isSprintRun) {
@@ -9393,6 +9509,10 @@ ${bold("Resuming")} ${state.type} run ${dim(state.runId)}
           issueTitle = iss.title;
         } catch {}
         ensureTaskCommit(projectRoot, task.issue, issueTitle);
+        if (sandboxed) {
+          process.stderr.write(`  ${dim("↻ Sandbox will resync on next task")}
+`);
+        }
       }
       markTaskDone(state, task.issue, result.prNumber);
     } else {
@@ -9418,7 +9538,7 @@ ${bold("Resume complete:")} ${green(`✓ ${finalStats.done}`)} ${finalStats.fail
     const prNumber = await createSprintPR(projectRoot, config, state.sprint, state.branch, completedTasks);
     if (prNumber !== undefined) {
       try {
-        execSync15(`git checkout ${config.agent.baseBranch}`, {
+        execSync16(`git checkout ${config.agent.baseBranch}`, {
           cwd: projectRoot,
           encoding: "utf-8",
           stdio: ["pipe", "pipe", "pipe"]
@@ -9449,14 +9569,14 @@ function getOrder2(issue) {
 }
 function ensureTaskCommit(projectRoot, issueNumber, issueTitle) {
   try {
-    const status = execSync15("git status --porcelain", {
+    const status = execSync16("git status --porcelain", {
       cwd: projectRoot,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
     if (!status)
       return;
-    execSync15("git add -A", {
+    execSync16("git add -A", {
       cwd: projectRoot,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -9464,7 +9584,7 @@ function ensureTaskCommit(projectRoot, issueNumber, issueTitle) {
     const message = `chore: complete #${issueNumber} - ${issueTitle}
 
 Co-Authored-By: LocusAgent <agent@locusai.team>`;
-    execSync15(`git commit -F -`, {
+    execSync16(`git commit -F -`, {
       input: message,
       cwd: projectRoot,
       encoding: "utf-8",
@@ -9478,7 +9598,7 @@ async function createSprintPR(projectRoot, config, sprintName, branchName, tasks
   if (!config.agent.autoPR)
     return;
   try {
-    const diff = execSync15(`git diff origin/${config.agent.baseBranch}..HEAD --stat`, {
+    const diff = execSync16(`git diff origin/${config.agent.baseBranch}..HEAD --stat`, {
       cwd: projectRoot,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -9488,7 +9608,7 @@ async function createSprintPR(projectRoot, config, sprintName, branchName, tasks
 `);
       return;
     }
-    execSync15(`git push -u origin ${branchName}`, {
+    execSync16(`git push -u origin ${branchName}`, {
       cwd: projectRoot,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -9535,6 +9655,8 @@ __export(exports_status, {
 });
 async function statusCommand(projectRoot) {
   const config = loadConfig(projectRoot);
+  const spinner = new Spinner;
+  spinner.start("Fetching project status...");
   const lines = [];
   lines.push(`  ${dim("Repo:")}     ${cyan(`${config.github.owner}/${config.github.repo}`)}`);
   lines.push(`  ${dim("Provider:")} ${config.ai.provider} / ${config.ai.model}`);
@@ -9611,6 +9733,7 @@ async function statusCommand(projectRoot) {
       }
     }
   } catch {}
+  spinner.stop();
   lines.push("");
   process.stderr.write(`
 ${drawBox(lines, { title: "Locus Status" })}
@@ -9634,13 +9757,13 @@ __export(exports_plan, {
   parsePlanArgs: () => parsePlanArgs
 });
 import {
-  existsSync as existsSync17,
-  mkdirSync as mkdirSync11,
+  existsSync as existsSync18,
+  mkdirSync as mkdirSync12,
   readdirSync as readdirSync7,
   readFileSync as readFileSync13,
   writeFileSync as writeFileSync9
 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 function printHelp() {
   process.stderr.write(`
 ${bold("locus plan")} — AI-powered sprint planning
@@ -9671,12 +9794,12 @@ function normalizeSprintName(name) {
   return name.trim().toLowerCase();
 }
 function getPlansDir(projectRoot) {
-  return join17(projectRoot, ".locus", "plans");
+  return join18(projectRoot, ".locus", "plans");
 }
 function ensurePlansDir(projectRoot) {
   const dir = getPlansDir(projectRoot);
-  if (!existsSync17(dir)) {
-    mkdirSync11(dir, { recursive: true });
+  if (!existsSync18(dir)) {
+    mkdirSync12(dir, { recursive: true });
   }
   return dir;
 }
@@ -9685,14 +9808,14 @@ function generateId() {
 }
 function loadPlanFile(projectRoot, id) {
   const dir = getPlansDir(projectRoot);
-  if (!existsSync17(dir))
+  if (!existsSync18(dir))
     return null;
   const files = readdirSync7(dir).filter((f) => f.endsWith(".json"));
   const match = files.find((f) => f.startsWith(id));
   if (!match)
     return null;
   try {
-    const content = readFileSync13(join17(dir, match), "utf-8");
+    const content = readFileSync13(join18(dir, match), "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
@@ -9738,7 +9861,7 @@ async function planCommand(projectRoot, args, flags = {}) {
 }
 function handleListPlans(projectRoot) {
   const dir = getPlansDir(projectRoot);
-  if (!existsSync17(dir)) {
+  if (!existsSync18(dir)) {
     process.stderr.write(`${dim("No saved plans yet.")}
 `);
     return;
@@ -9756,7 +9879,7 @@ ${bold("Saved Plans:")}
   for (const file of files) {
     const id = file.replace(".json", "");
     try {
-      const content = readFileSync13(join17(dir, file), "utf-8");
+      const content = readFileSync13(join18(dir, file), "utf-8");
       const plan = JSON.parse(content);
       const date = plan.createdAt ? plan.createdAt.slice(0, 10) : "";
       const issueCount = Array.isArray(plan.issues) ? plan.issues.length : 0;
@@ -9867,7 +9990,7 @@ ${bold("Approving plan:")}
 async function handleAIPlan(projectRoot, config, directive, sprintName, flags) {
   const id = generateId();
   const plansDir = ensurePlansDir(projectRoot);
-  const planPath = join17(plansDir, `${id}.json`);
+  const planPath = join18(plansDir, `${id}.json`);
   const planPathRelative = `.locus/plans/${id}.json`;
   const displayDirective = directive;
   process.stderr.write(`
@@ -9901,7 +10024,7 @@ ${red("✗")} Planning failed: ${aiResult.error}
 `);
     return;
   }
-  if (!existsSync17(planPath)) {
+  if (!existsSync18(planPath)) {
     process.stderr.write(`
 ${yellow("⚠")} Plan file was not created at ${bold(planPathRelative)}.
 `);
@@ -10068,15 +10191,15 @@ function buildPlanningPrompt(projectRoot, config, directive, sprintName, id, pla
     parts.push(`SPRINT: ${sprintName}`);
   }
   parts.push("");
-  const locusPath = join17(projectRoot, "LOCUS.md");
-  if (existsSync17(locusPath)) {
+  const locusPath = join18(projectRoot, "LOCUS.md");
+  if (existsSync18(locusPath)) {
     const content = readFileSync13(locusPath, "utf-8");
     parts.push("PROJECT CONTEXT (LOCUS.md):");
     parts.push(content.slice(0, 3000));
     parts.push("");
   }
-  const learningsPath = join17(projectRoot, ".locus", "LEARNINGS.md");
-  if (existsSync17(learningsPath)) {
+  const learningsPath = join18(projectRoot, ".locus", "LEARNINGS.md");
+  if (existsSync18(learningsPath)) {
     const content = readFileSync13(learningsPath, "utf-8");
     parts.push("PAST LEARNINGS:");
     parts.push(content.slice(0, 2000));
@@ -10253,9 +10376,9 @@ var exports_review = {};
 __export(exports_review, {
   reviewCommand: () => reviewCommand
 });
-import { execSync as execSync16 } from "node:child_process";
-import { existsSync as existsSync18, readFileSync as readFileSync14 } from "node:fs";
-import { join as join18 } from "node:path";
+import { execSync as execSync17 } from "node:child_process";
+import { existsSync as existsSync19, readFileSync as readFileSync14 } from "node:fs";
+import { join as join19 } from "node:path";
 function printHelp2() {
   process.stderr.write(`
 ${bold("locus review")} — AI-powered code review
@@ -10331,7 +10454,7 @@ ${bold("Review complete:")} ${green(`✓ ${reviewed}`)}${failed > 0 ? ` ${red(`
 async function reviewSinglePR(projectRoot, config, prNumber, focus, flags) {
   let prInfo;
   try {
-    const result = execSync16(`gh pr view ${prNumber} --json number,title,body,state,headRefName,baseRefName,labels,url,createdAt`, { cwd: projectRoot, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+    const result = execSync17(`gh pr view ${prNumber} --json number,title,body,state,headRefName,baseRefName,labels,url,createdAt`, { cwd: projectRoot, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
     const raw = JSON.parse(result);
     prInfo = {
       number: raw.number,
@@ -10397,7 +10520,7 @@ ${output.slice(0, 60000)}
 
 ---
 _Reviewed by Locus AI (${config.ai.provider}/${flags.model ?? config.ai.model})_`;
-      execSync16(`gh pr comment ${pr.number} --body ${JSON.stringify(reviewBody)}`, { cwd: projectRoot, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+      execSync17(`gh pr comment ${pr.number} --body ${JSON.stringify(reviewBody)}`, { cwd: projectRoot, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
       process.stderr.write(`  ${green("✓")} Review posted ${dim(`(${timer.formatted()})`)}
 `);
     } catch (e) {
@@ -10414,8 +10537,8 @@ function buildReviewPrompt(projectRoot, config, pr, diff, focus) {
   const parts = [];
   parts.push(`You are an expert code reviewer for the ${config.github.owner}/${config.github.repo} repository.`);
   parts.push("");
-  const locusPath = join18(projectRoot, "LOCUS.md");
-  if (existsSync18(locusPath)) {
+  const locusPath = join19(projectRoot, "LOCUS.md");
+  if (existsSync19(locusPath)) {
     const content = readFileSync14(locusPath, "utf-8");
     parts.push("PROJECT CONTEXT:");
     parts.push(content.slice(0, 2000));
@@ -10468,7 +10591,7 @@ var exports_iterate = {};
 __export(exports_iterate, {
   iterateCommand: () => iterateCommand
 });
-import { execSync as execSync17 } from "node:child_process";
+import { execSync as execSync18 } from "node:child_process";
 function printHelp3() {
   process.stderr.write(`
 ${bold("locus iterate")} — Re-execute tasks with PR feedback
@@ -10678,12 +10801,12 @@ ${bold("Summary:")} ${green(`✓ ${succeeded}`)}${failed > 0 ? ` ${red(`✗ ${fa
 }
 function findPRForIssue(projectRoot, issueNumber) {
   try {
-    const result = execSync17(`gh pr list --search "Closes #${issueNumber}" --json number --state open`, { cwd: projectRoot, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+    const result = execSync18(`gh pr list --search "Closes #${issueNumber}" --json number --state open`, { cwd: projectRoot, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
     const parsed = JSON.parse(result);
     if (parsed.length > 0) {
       return parsed[0].number;
     }
-    const branchResult = execSync17(`gh pr list --head "locus/issue-${issueNumber}" --json number --state open`, { cwd: projectRoot, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+    const branchResult = execSync18(`gh pr list --head "locus/issue-${issueNumber}" --json number --state open`, { cwd: projectRoot, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
     const branchParsed = JSON.parse(branchResult);
     if (branchParsed.length > 0) {
       return branchParsed[0].number;
@@ -10718,14 +10841,14 @@ __export(exports_discuss, {
   discussCommand: () => discussCommand
 });
 import {
-  existsSync as existsSync19,
-  mkdirSync as mkdirSync12,
+  existsSync as existsSync20,
+  mkdirSync as mkdirSync13,
   readdirSync as readdirSync8,
   readFileSync as readFileSync15,
   unlinkSync as unlinkSync5,
   writeFileSync as writeFileSync10
 } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 function printHelp4() {
   process.stderr.write(`
 ${bold("locus discuss")} — AI-powered architectural discussions
@@ -10747,12 +10870,12 @@ ${bold("Examples:")}
 `);
 }
 function getDiscussionsDir(projectRoot) {
-  return join19(projectRoot, ".locus", "discussions");
+  return join20(projectRoot, ".locus", "discussions");
 }
 function ensureDiscussionsDir(projectRoot) {
   const dir = getDiscussionsDir(projectRoot);
-  if (!existsSync19(dir)) {
-    mkdirSync12(dir, { recursive: true });
+  if (!existsSync20(dir)) {
+    mkdirSync13(dir, { recursive: true });
   }
   return dir;
 }
@@ -10786,7 +10909,7 @@ async function discussCommand(projectRoot, args, flags = {}) {
 }
 function listDiscussions(projectRoot) {
   const dir = getDiscussionsDir(projectRoot);
-  if (!existsSync19(dir)) {
+  if (!existsSync20(dir)) {
     process.stderr.write(`${dim("No discussions yet.")}
 `);
     return;
@@ -10803,7 +10926,7 @@ ${bold("Discussions:")}
 `);
   for (const file of files) {
     const id = file.replace(".md", "");
-    const content = readFileSync15(join19(dir, file), "utf-8");
+    const content = readFileSync15(join20(dir, file), "utf-8");
     const titleMatch = content.match(/^#\s+(.+)/m);
     const title = titleMatch ? titleMatch[1] : id;
     const dateMatch = content.match(/\*\*Date:\*\*\s*(.+)/);
@@ -10821,7 +10944,7 @@ function showDiscussion(projectRoot, id) {
     return;
   }
   const dir = getDiscussionsDir(projectRoot);
-  if (!existsSync19(dir)) {
+  if (!existsSync20(dir)) {
     process.stderr.write(`${red("✗")} No discussions found.
 `);
     return;
@@ -10833,7 +10956,7 @@ function showDiscussion(projectRoot, id) {
 `);
     return;
   }
-  const content = readFileSync15(join19(dir, match), "utf-8");
+  const content = readFileSync15(join20(dir, match), "utf-8");
   process.stdout.write(`${content}
 `);
 }
@@ -10844,7 +10967,7 @@ function deleteDiscussion(projectRoot, id) {
     return;
   }
   const dir = getDiscussionsDir(projectRoot);
-  if (!existsSync19(dir)) {
+  if (!existsSync20(dir)) {
     process.stderr.write(`${red("✗")} No discussions found.
 `);
     return;
@@ -10856,7 +10979,7 @@ function deleteDiscussion(projectRoot, id) {
 `);
     return;
   }
-  unlinkSync5(join19(dir, match));
+  unlinkSync5(join20(dir, match));
   process.stderr.write(`${green("✓")} Deleted discussion: ${match.replace(".md", "")}
 `);
 }
@@ -10869,7 +10992,7 @@ async function convertDiscussionToPlan(projectRoot, id) {
     return;
   }
   const dir = getDiscussionsDir(projectRoot);
-  if (!existsSync19(dir)) {
+  if (!existsSync20(dir)) {
     process.stderr.write(`${red("✗")} No discussions found.
 `);
     return;
@@ -10881,7 +11004,7 @@ async function convertDiscussionToPlan(projectRoot, id) {
 `);
     return;
   }
-  const content = readFileSync15(join19(dir, match), "utf-8");
+  const content = readFileSync15(join20(dir, match), "utf-8");
   const titleMatch = content.match(/^#\s+(.+)/m);
   const discussionTitle = titleMatch ? titleMatch[1].trim() : id;
   await planCommand(projectRoot, [
@@ -10995,7 +11118,7 @@ ${turn.content}`;
     ...conversation.length > 1 ? [`---`, ``, `## Discussion Transcript`, ``, transcript, ``] : []
   ].join(`
 `);
-  writeFileSync10(join19(dir, `${id}.md`), markdown, "utf-8");
+  writeFileSync10(join20(dir, `${id}.md`), markdown, "utf-8");
   process.stderr.write(`
 ${green("✓")} Discussion saved: ${cyan(id)} ${dim(`(${timer.formatted()})`)}
 `);
@@ -11009,15 +11132,15 @@ function buildDiscussionPrompt(projectRoot, config, topic, conversation, forceFi
   const parts = [];
   parts.push(`You are a senior software architect and consultant for the ${config.github.owner}/${config.github.repo} project.`);
   parts.push("");
-  const locusPath = join19(projectRoot, "LOCUS.md");
-  if (existsSync19(locusPath)) {
+  const locusPath = join20(projectRoot, "LOCUS.md");
+  if (existsSync20(locusPath)) {
     const content = readFileSync15(locusPath, "utf-8");
     parts.push("PROJECT CONTEXT:");
     parts.push(content.slice(0, 3000));
     parts.push("");
   }
-  const learningsPath = join19(projectRoot, ".locus", "LEARNINGS.md");
-  if (existsSync19(learningsPath)) {
+  const learningsPath = join20(projectRoot, ".locus", "LEARNINGS.md");
+  if (existsSync20(learningsPath)) {
     const content = readFileSync15(learningsPath, "utf-8");
     parts.push("PAST LEARNINGS:");
     parts.push(content.slice(0, 2000));
@@ -11077,8 +11200,8 @@ __export(exports_artifacts, {
   formatDate: () => formatDate2,
   artifactsCommand: () => artifactsCommand
 });
-import { existsSync as existsSync20, readdirSync as readdirSync9, readFileSync as readFileSync16, statSync as statSync4 } from "node:fs";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync21, readdirSync as readdirSync9, readFileSync as readFileSync16, statSync as statSync4 } from "node:fs";
+import { join as join21 } from "node:path";
 function printHelp5() {
   process.stderr.write(`
 ${bold("locus artifacts")} — View and manage AI-generated artifacts
@@ -11098,14 +11221,14 @@ ${dim("Artifact names support partial matching.")}
 `);
 }
 function getArtifactsDir(projectRoot) {
-  return join20(projectRoot, ".locus", "artifacts");
+  return join21(projectRoot, ".locus", "artifacts");
 }
 function listArtifacts(projectRoot) {
   const dir = getArtifactsDir(projectRoot);
-  if (!existsSync20(dir))
+  if (!existsSync21(dir))
     return [];
   return readdirSync9(dir).filter((f) => f.endsWith(".md")).map((fileName) => {
-    const filePath = join20(dir, fileName);
+    const filePath = join21(dir, fileName);
     const stat = statSync4(filePath);
     return {
       name: fileName.replace(/\.md$/, ""),
@@ -11118,8 +11241,8 @@ function listArtifacts(projectRoot) {
 function readArtifact(projectRoot, name) {
   const dir = getArtifactsDir(projectRoot);
   const fileName = name.endsWith(".md") ? name : `${name}.md`;
-  const filePath = join20(dir, fileName);
-  if (!existsSync20(filePath))
+  const filePath = join21(dir, fileName);
+  if (!existsSync21(filePath))
     return null;
   const stat = statSync4(filePath);
   return {
@@ -11282,11 +11405,11 @@ var init_artifacts = __esm(() => {
 });
 
 // src/commands/sandbox.ts
-var exports_sandbox = {};
-__export(exports_sandbox, {
+var exports_sandbox2 = {};
+__export(exports_sandbox2, {
   sandboxCommand: () => sandboxCommand
 });
-import { execSync as execSync18, spawn as spawn6 } from "node:child_process";
+import { execSync as execSync19, spawn as spawn6 } from "node:child_process";
 function printSandboxHelp() {
   process.stderr.write(`
 ${bold("locus sandbox")} — Manage Docker sandbox lifecycle
@@ -11400,7 +11523,7 @@ async function handleAgentLogin(projectRoot, agent) {
     process.stderr.write(`Creating sandbox ${bold(sandboxName)} with workspace ${dim(projectRoot)}...
 `);
     try {
-      execSync18(`docker sandbox run --name ${sandboxName} claude ${projectRoot} -- --version`, { stdio: ["pipe", "pipe", "pipe"], timeout: 120000 });
+      execSync19(`docker sandbox run --name ${sandboxName} claude ${projectRoot} -- --version`, { stdio: ["pipe", "pipe", "pipe"], timeout: 120000 });
     } catch {}
     if (!isSandboxAlive(sandboxName)) {
       process.stderr.write(`${red("✗")} Failed to create sandbox.
@@ -11463,7 +11586,7 @@ function handleRemove(projectRoot) {
   process.stderr.write(`Removing sandbox ${bold(sandboxName)}...
 `);
   try {
-    execSync18(`docker sandbox rm ${sandboxName}`, {
+    execSync19(`docker sandbox rm ${sandboxName}`, {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 15000
@@ -11500,7 +11623,7 @@ ${bold("Sandbox Status")}
 }
 async function ensureCodexInSandbox(sandboxName) {
   try {
-    execSync18(`docker sandbox exec ${sandboxName} which codex`, {
+    execSync19(`docker sandbox exec ${sandboxName} which codex`, {
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 5000
     });
@@ -11508,7 +11631,7 @@ async function ensureCodexInSandbox(sandboxName) {
     process.stderr.write(`Installing codex in sandbox...
 `);
     try {
-      execSync18(`docker sandbox exec ${sandboxName} npm install -g @openai/codex`, { stdio: "inherit", timeout: 120000 });
+      execSync19(`docker sandbox exec ${sandboxName} npm install -g @openai/codex`, { stdio: "inherit", timeout: 120000 });
     } catch {
       process.stderr.write(`${red("✗")} Failed to install codex in sandbox.
 `);
@@ -11517,7 +11640,7 @@ async function ensureCodexInSandbox(sandboxName) {
 }
 function isSandboxAlive(name) {
   try {
-    const output = execSync18("docker sandbox ls", {
+    const output = execSync19("docker sandbox ls", {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 5000
@@ -11540,13 +11663,13 @@ init_context();
 init_logger();
 init_rate_limiter();
 init_terminal();
-import { existsSync as existsSync21, readFileSync as readFileSync17 } from "node:fs";
-import { join as join21 } from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync17 } from "node:fs";
+import { join as join22 } from "node:path";
 import { fileURLToPath } from "node:url";
 function getCliVersion() {
   const fallbackVersion = "0.0.0";
-  const packageJsonPath = join21(fileURLToPath(new URL(".", import.meta.url)), "..", "package.json");
-  if (!existsSync21(packageJsonPath)) {
+  const packageJsonPath = join22(fileURLToPath(new URL(".", import.meta.url)), "..", "package.json");
+  if (!existsSync22(packageJsonPath)) {
     return fallbackVersion;
   }
   try {
@@ -11720,6 +11843,46 @@ function resolveAlias(command) {
   };
   return aliases[command] ?? command;
 }
+function requiresSandboxSync(command, args, flags) {
+  if (flags.noSandbox)
+    return false;
+  if (flags.help)
+    return false;
+  switch (command) {
+    case "run":
+    case "review":
+    case "iterate":
+      return true;
+    case "exec":
+      return args[0] !== "sessions" && args[0] !== "help";
+    case "issue":
+      return args[0] === "create";
+    case "plan":
+      if (args.length === 0)
+        return false;
+      return !["list", "show", "approve", "help"].includes(args[0]);
+    case "discuss":
+      if (args.length === 0)
+        return false;
+      return !["list", "show", "delete", "help"].includes(args[0]);
+    case "config":
+      return args[0] === "set";
+    default:
+      return false;
+  }
+}
+async function prepareSandbox() {
+  const { Spinner: Spinner2 } = await Promise.resolve().then(() => (init_progress(), exports_progress));
+  const { detectSandboxSupport: detectSandboxSupport2 } = await Promise.resolve().then(() => (init_sandbox(), exports_sandbox));
+  const spinner = new Spinner2;
+  spinner.start("Preparing sandbox...");
+  const status = await detectSandboxSupport2();
+  if (status.available) {
+    spinner.succeed("Sandbox ready");
+  } else {
+    spinner.warn(`Sandbox not available: ${status.reason}`);
+  }
+}
 async function main() {
   const parsed = parseArgs(process.argv);
   if (parsed.flags.version) {
@@ -11739,7 +11902,7 @@ async function main() {
     try {
       const root = getGitRoot(cwd);
       if (isInitialized(root)) {
-        logDir = join21(root, ".locus", "logs");
+        logDir = join22(root, ".locus", "logs");
         getRateLimiter(root);
       }
     } catch {}
@@ -11821,6 +11984,12 @@ async function main() {
 `);
     process.exit(1);
   }
+  if (requiresSandboxSync(command, parsed.args, parsed.flags)) {
+    const config = loadConfig(projectRoot);
+    if (config.sandbox.enabled) {
+      await prepareSandbox();
+    }
+  }
   switch (command) {
     case "config": {
       const { configCommand: configCommand2 } = await Promise.resolve().then(() => (init_config2(), exports_config));
@@ -11917,7 +12086,7 @@ async function main() {
       break;
     }
     case "sandbox": {
-      const { sandboxCommand: sandboxCommand2 } = await Promise.resolve().then(() => (init_sandbox2(), exports_sandbox));
+      const { sandboxCommand: sandboxCommand2 } = await Promise.resolve().then(() => (init_sandbox2(), exports_sandbox2));
       const sandboxArgs = parsed.flags.help ? ["help"] : parsed.args;
       await sandboxCommand2(projectRoot, sandboxArgs);
       break;