@madarco/agentbox 0.6.0 → 0.8.0

package/dist/chunk-HHMWQNLF.js

@@ -1,1709 +0,0 @@
-#!/usr/bin/env node
-
-// ../../packages/sandbox-docker/dist/chunk-FTYSR4JQ.js
-import { execa } from "execa";
-import { mkdir as mkdir2, readFile as readFile3 } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
-import { execa as execa2 } from "execa";
-
-// ../../packages/config/dist/index.js
-import { parse as parseYaml } from "yaml";
-import { createHash } from "crypto";
-import { realpath, stat } from "fs/promises";
-import { homedir } from "os";
-import { basename, dirname, join, resolve } from "path";
-import { readFile } from "fs/promises";
-import { parse as parseYaml2 } from "yaml";
-import { mkdir, readFile as readFile2, rename, rm, stat as stat2, writeFile } from "fs/promises";
-import { dirname as dirname2, isAbsolute, join as join2 } from "path";
-import { stringify as stringifyYaml } from "yaml";
-import { readdir } from "fs/promises";
-var BUILT_IN_DEFAULTS = {
-  box: {
-    hostSnapshot: void 0,
-    defaultCheckpoint: "",
-    withPlaywright: false,
-    withEnv: false,
-    vnc: true,
-    isolateClaudeConfig: false,
-    image: "agentbox/box:dev",
-    dockerCacheShared: false,
-    memory: 0,
-    cpus: 0,
-    pidsLimit: 0,
-    disk: ""
-  },
-  checkpoint: {
-    maxLayers: 3
-  },
-  claude: {
-    sessionName: "claude"
-  },
-  code: {
-    ide: "auto",
-    wait: true,
-    timeoutMs: 12e4,
-    autoTerminals: true
-  },
-  shell: {
-    user: "vscode",
-    login: true
-  },
-  engine: {
-    kind: "auto"
-  },
-  browser: {
-    default: "agent-browser"
-  },
-  relay: {
-    port: 8787
-  },
-  vnc: {
-    containerPort: 6080
-  },
-  autopause: {
-    enabled: true,
-    maxRunningBoxes: 5,
-    idleMinutes: 5
-  },
-  maintenance: {
-    pruneProjectConfigs: true,
-    pruneProjectConfigsEvery: 50
-  }
-};
-var KEY_REGISTRY = [
-  {
-    key: "box.hostSnapshot",
-    type: "bool",
-    description: "Use a frozen APFS clone of the host workspace as the overlay lower (default: prompt). Was box.snapshot."
-  },
-  {
-    key: "box.defaultCheckpoint",
-    type: "string",
-    description: "Checkpoint ref new boxes in this project start from when --snapshot is not given (set via `agentbox checkpoint set-default`)."
-  },
-  {
-    key: "checkpoint.maxLayers",
-    type: "int",
-    description: "Max stacked checkpoint layers before a new checkpoint is materialized merged (flattened) instead of layered.",
-    advanced: true
-  },
-  {
-    key: "box.withPlaywright",
-    type: "bool",
-    description: "Install @playwright/cli@latest in the box at create time."
-  },
-  {
-    key: "box.withEnv",
-    type: "bool",
-    description: "Copy host env/config files (.env*, secrets.toml, agentbox.yaml, ...) into /workspace at box create time (gitignore-bypassing)."
-  },
-  {
-    key: "box.vnc",
-    type: "bool",
-    description: "Run the per-box Xvnc + noVNC stack."
-  },
-  {
-    key: "box.isolateClaudeConfig",
-    type: "bool",
-    description: "Use a per-box ~/.claude volume instead of the shared one."
-  },
-  {
-    key: "box.image",
-    type: "string",
-    description: "Box image ref (advanced).",
-    advanced: true
-  },
-  {
-    key: "box.dockerCacheShared",
-    type: "bool",
-    description: "Share the in-box docker image cache across boxes via the 'agentbox-docker-cache' volume (preserved on destroy/prune; only one box can run at a time when set)."
-  },
-  {
-    key: "box.memory",
-    type: "int",
-    description: "Hard memory ceiling in MiB for new boxes (0 = unlimited). Use --memory on create/claude for byte/k/m/g strings."
-  },
-  {
-    key: "box.cpus",
-    type: "int",
-    description: "CPU count cap for new boxes (0 = unlimited). Whole cores via config; use --cpus for fractional (e.g. 1.5)."
-  },
-  {
-    key: "box.pidsLimit",
-    type: "int",
-    description: "Max process count (PIDs cgroup) for new boxes (0 = unlimited)."
-  },
-  {
-    key: "box.disk",
-    type: "string",
-    description: "Best-effort writable-layer size for new boxes, e.g. '10G'. No-op on overlay2 / the macOS engines.",
-    advanced: true
-  },
-  {
-    key: "claude.sessionName",
-    type: "string",
-    description: "tmux session name for `agentbox claude`."
-  },
-  {
-    key: "code.ide",
-    type: "enum",
-    enumValues: ["vscode", "cursor", "auto"],
-    description: 'Which IDE `agentbox code` launches; "auto" prefers code, falls back to cursor.'
-  },
-  {
-    key: "code.wait",
-    type: "bool",
-    description: "Block on agentbox-ctl wait-ready before opening the IDE."
-  },
-  {
-    key: "code.timeoutMs",
-    type: "int",
-    description: "wait-ready timeout in milliseconds."
-  },
-  {
-    key: "code.autoTerminals",
-    type: "bool",
-    description: "Generate /workspace/.vscode/tasks.json so the IDE auto-opens log panels."
-  },
-  {
-    key: "shell.user",
-    type: "string",
-    description: "Default in-container user for `agentbox shell`."
-  },
-  {
-    key: "shell.login",
-    type: "bool",
-    description: "Pass `-l` to bash so the login profile loads."
-  },
-  {
-    key: "engine.kind",
-    type: "enum",
-    enumValues: ["orbstack", "docker-desktop", "other", "auto"],
-    description: "Override the docker-engine auto-detection (used for OrbStack-only optimisations)."
-  },
-  {
-    key: "browser.default",
-    type: "enum",
-    enumValues: ["agent-browser", "playwright", "both"],
-    description: 'Default browser stack inside the box. "playwright" or "both" implies box.withPlaywright.'
-  },
-  {
-    key: "relay.port",
-    type: "int",
-    description: "Host relay TCP port (advanced).",
-    advanced: true
-  },
-  {
-    key: "vnc.containerPort",
-    type: "int",
-    description: "Container-side noVNC port (advanced).",
-    advanced: true
-  },
-  {
-    key: "autopause.enabled",
-    type: "bool",
-    description: "Let the host relay periodically pause idle boxes when more than autopause.maxRunningBoxes are running."
-  },
-  {
-    key: "autopause.maxRunningBoxes",
-    type: "int",
-    description: "Target maximum number of simultaneously-running boxes before idle ones get auto-paused."
-  },
-  {
-    key: "autopause.idleMinutes",
-    type: "int",
-    description: "Minutes a box must be continuously idle (claude state) before it is eligible for auto-pause."
-  },
-  {
-    key: "maintenance.pruneProjectConfigs",
-    type: "bool",
-    description: "Periodically delete ~/.agentbox/projects/<hash>/ dirs whose source workspace folder no longer exists."
-  },
-  {
-    key: "maintenance.pruneProjectConfigsEvery",
-    type: "int",
-    description: "Run the orphan project-config sweep every N successful `agentbox create`."
-  }
-];
-var REGISTRY_BY_KEY = new Map(KEY_REGISTRY.map((d) => [d.key, d]));
-function lookupKey(key) {
-  return REGISTRY_BY_KEY.get(key);
-}
-var UserConfigError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "UserConfigError";
-  }
-};
-function isPlainObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-var RENAMED_KEYS = /* @__PURE__ */ new Map([["box.snapshot", "box.hostSnapshot"]]);
-var BRANCHES = (() => {
-  const out = /* @__PURE__ */ new Map();
-  for (const desc of KEY_REGISTRY) {
-    const idx = desc.key.indexOf(".");
-    if (idx < 0) {
-      throw new Error(`KEY_REGISTRY entry ${desc.key} must use dot-path form (branch.leaf)`);
-    }
-    const branch = desc.key.slice(0, idx);
-    const leaf = desc.key.slice(idx + 1);
-    let entry = out.get(branch);
-    if (!entry) {
-      entry = { name: branch, leaves: /* @__PURE__ */ new Map() };
-      out.set(branch, entry);
-    }
-    entry.leaves.set(leaf, desc);
-  }
-  return out;
-})();
-function coerceTypedValue(raw, desc, where) {
-  if (raw === null) {
-    throw new UserConfigError(`${where} must not be null (use \`agentbox config unset\` to clear)`);
-  }
-  switch (desc.type) {
-    case "bool":
-      if (typeof raw !== "boolean") {
-        throw new UserConfigError(`${where} must be a boolean (got ${typeof raw})`);
-      }
-      return raw;
-    case "string":
-      if (typeof raw !== "string") {
-        throw new UserConfigError(`${where} must be a string (got ${typeof raw})`);
-      }
-      if (raw.length === 0) {
-        throw new UserConfigError(`${where} must not be empty`);
-      }
-      return raw;
-    case "int":
-      if (typeof raw !== "number" || !Number.isInteger(raw)) {
-        throw new UserConfigError(`${where} must be an integer (got ${String(raw)})`);
-      }
-      return raw;
-    case "enum":
-      if (typeof raw !== "string" || !desc.enumValues.includes(raw)) {
-        throw new UserConfigError(
-          `${where} must be one of: ${desc.enumValues.join(", ")} (got ${String(raw)})`
-        );
-      }
-      return raw;
-  }
-}
-function parseUserConfig(text, where) {
-  let doc;
-  try {
-    doc = parseYaml(text);
-  } catch (err) {
-    throw new UserConfigError(
-      `${where}: yaml parse error: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-  if (doc === null || doc === void 0) return {};
-  if (!isPlainObject(doc)) {
-    throw new UserConfigError(`${where}: top-level must be a mapping`);
-  }
-  return parseUserConfigObject(doc, where);
-}
-function parseUserConfigObject(doc, where) {
-  if (doc === null || doc === void 0) return {};
-  if (!isPlainObject(doc)) {
-    throw new UserConfigError(`${where}: must be a mapping`);
-  }
-  const out = {};
-  for (const [branchName, branchRaw] of Object.entries(doc)) {
-    const branchSpec = BRANCHES.get(branchName);
-    if (!branchSpec) {
-      throw new UserConfigError(
-        `${where}: unknown config section "${branchName}" (known: ${[...BRANCHES.keys()].join(", ")})`
-      );
-    }
-    if (branchRaw === null || branchRaw === void 0) continue;
-    if (!isPlainObject(branchRaw)) {
-      throw new UserConfigError(`${where}.${branchName}: must be a mapping`);
-    }
-    const branchOut = {};
-    for (const [leafName, leafRaw] of Object.entries(branchRaw)) {
-      const desc = branchSpec.leaves.get(leafName);
-      if (!desc) {
-        const renamedTo = RENAMED_KEYS.get(`${branchName}.${leafName}`);
-        if (renamedTo) {
-          throw new UserConfigError(
-            `${where}.${branchName}.${leafName} was renamed to ${renamedTo} \u2014 update your config`
-          );
-        }
-        throw new UserConfigError(
-          `${where}.${branchName}: unknown key "${leafName}" (known: ${[...branchSpec.leaves.keys()].join(", ")})`
-        );
-      }
-      if (leafRaw === void 0) continue;
-      branchOut[leafName] = coerceTypedValue(leafRaw, desc, `${where}.${desc.key}`);
-    }
-    if (Object.keys(branchOut).length > 0) {
-      out[branchName] = branchOut;
-    }
-  }
-  return out;
-}
-function coerceFromString(key, raw) {
-  const desc = lookupKeyOrThrow(key);
-  switch (desc.type) {
-    case "bool": {
-      const v = raw.trim().toLowerCase();
-      if (v === "true" || v === "yes" || v === "1" || v === "on") return true;
-      if (v === "false" || v === "no" || v === "0" || v === "off") return false;
-      throw new UserConfigError(`${key}: expected a boolean (true/false), got "${raw}"`);
-    }
-    case "string":
-      if (raw.length === 0) throw new UserConfigError(`${key}: must not be empty`);
-      return raw;
-    case "int": {
-      const n = Number(raw);
-      if (!Number.isFinite(n) || !Number.isInteger(n)) {
-        throw new UserConfigError(`${key}: expected an integer, got "${raw}"`);
-      }
-      return n;
-    }
-    case "enum":
-      if (!desc.enumValues.includes(raw)) {
-        throw new UserConfigError(
-          `${key}: expected one of ${desc.enumValues.join(", ")}, got "${raw}"`
-        );
-      }
-      return raw;
-  }
-}
-function lookupKeyOrThrow(key) {
-  const renamedTo = RENAMED_KEYS.get(key);
-  if (renamedTo) {
-    throw new UserConfigError(`${key} was renamed to ${renamedTo} \u2014 use ${renamedTo} instead`);
-  }
-  const idx = key.indexOf(".");
-  if (idx < 0) {
-    throw new UserConfigError(`unknown key "${key}" (must be in branch.leaf form)`);
-  }
-  const branch = BRANCHES.get(key.slice(0, idx));
-  if (!branch) {
-    throw new UserConfigError(
-      `unknown config section "${key.slice(0, idx)}" (known: ${[...BRANCHES.keys()].join(", ")})`
-    );
-  }
-  const desc = branch.leaves.get(key.slice(idx + 1));
-  if (!desc) {
-    throw new UserConfigError(
-      `unknown key "${key}" (known in ${branch.name}: ${[...branch.leaves.keys()].join(", ")})`
-    );
-  }
-  return desc;
-}
-var STATE_DIR = join(homedir(), ".agentbox");
-var GLOBAL_CONFIG_FILE = join(STATE_DIR, "config.yaml");
-var PROJECTS_DIR = join(STATE_DIR, "projects");
-var WORKSPACE_CONFIG_BASENAME = "agentbox.yaml";
-async function findProjectRoot(cwd) {
-  const start = await canonicalize(cwd);
-  let dir = start;
-  for (let i = 0; i < 64; i++) {
-    if (await fileExists(join(dir, WORKSPACE_CONFIG_BASENAME))) {
-      return { root: dir, hasAgentboxYaml: true };
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return { root: start, hasAgentboxYaml: false };
-}
-async function canonicalize(p) {
-  const abs = resolve(p);
-  try {
-    return await realpath(abs);
-  } catch {
-    return abs;
-  }
-}
-async function fileExists(p) {
-  try {
-    const st = await stat(p);
-    return st.isFile();
-  } catch {
-    return false;
-  }
-}
-function hashProjectPath(absPath) {
-  const normalised = absPath.length > 1 && absPath.endsWith("/") ? absPath.slice(0, -1) : absPath;
-  return createHash("sha1").update(normalised).digest("hex").slice(0, 16);
-}
-function sanitizeMnemonic(raw) {
-  return raw.toLowerCase().replace(/-/g, "_").replace(/[^a-z0-9_]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").slice(0, 32) || "unnamed";
-}
-function projectDirSegment(absPath) {
-  return `${hashProjectPath(absPath)}-${sanitizeMnemonic(basename(absPath))}`;
-}
-function projectConfigDir(absPath) {
-  return join(PROJECTS_DIR, projectDirSegment(absPath));
-}
-function projectConfigFile(absPath) {
-  return join(projectConfigDir(absPath), "config.yaml");
-}
-function projectMetaFile(absPath) {
-  return join(projectConfigDir(absPath), "meta.json");
-}
-function workspaceConfigFile(workspacePath) {
-  return join(workspacePath, WORKSPACE_CONFIG_BASENAME);
-}
-async function configPathFor(scope, cwd) {
-  if (scope === "global") return GLOBAL_CONFIG_FILE;
-  const root = await findProjectRoot(cwd);
-  if (scope === "project") return projectConfigFile(root.root);
-  return workspaceConfigFile(root.root);
-}
-async function loadOptionalUserConfig(path) {
-  let text;
-  try {
-    text = await readFile(path, "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") return {};
-    throw err;
-  }
-  return parseUserConfig(text, path);
-}
-async function loadProjectAgentboxDefaults(workspacePath) {
-  const path = workspaceConfigFile(workspacePath);
-  let text;
-  try {
-    text = await readFile(path, "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") return {};
-    throw err;
-  }
-  let doc;
-  try {
-    doc = parseYaml2(text);
-  } catch {
-    return {};
-  }
-  if (doc === null || doc === void 0 || typeof doc !== "object" || Array.isArray(doc)) {
-    return {};
-  }
-  const defaults = doc["defaults"];
-  if (defaults === void 0 || defaults === null) return {};
-  return parseUserConfigObject(defaults, `${path} defaults`);
-}
-async function loadEffectiveConfig(cwd, opts = {}) {
-  const projectRoot = await findProjectRoot(cwd);
-  const projectPath = projectConfigFile(projectRoot.root);
-  const workspacePath = projectRoot.hasAgentboxYaml ? workspaceConfigFile(projectRoot.root) : null;
-  const [globalValues, projectValues, workspaceValues] = await Promise.all([
-    loadOptionalUserConfig(GLOBAL_CONFIG_FILE),
-    loadOptionalUserConfig(projectPath),
-    workspacePath ? loadProjectAgentboxDefaults(projectRoot.root) : Promise.resolve({})
-  ]);
-  const cliValues = opts.cliOverrides ?? {};
-  const { effective, sources } = mergeLayers({
-    cli: cliValues,
-    workspace: workspaceValues,
-    project: projectValues,
-    global: globalValues
-  });
-  return {
-    effective,
-    layers: {
-      cli: { values: cliValues },
-      workspace: { path: workspacePath, values: workspaceValues },
-      project: { path: projectPath, values: projectValues },
-      global: { path: GLOBAL_CONFIG_FILE, values: globalValues },
-      defaults: BUILT_IN_DEFAULTS
-    },
-    sources,
-    projectRoot: projectRoot.root,
-    projectHash: hashProjectPath(projectRoot.root),
-    hasAgentboxYaml: projectRoot.hasAgentboxYaml
-  };
-}
-function mergeLayers(input) {
-  const effective = JSON.parse(JSON.stringify(BUILT_IN_DEFAULTS));
-  const sources = {};
-  const layerOrder = [
-    { source: "cli", values: input.cli },
-    { source: "workspace", values: input.workspace },
-    { source: "project", values: input.project },
-    { source: "global", values: input.global }
-  ];
-  for (const desc of KEY_REGISTRY) {
-    const idx = desc.key.indexOf(".");
-    const branch = desc.key.slice(0, idx);
-    const leaf = desc.key.slice(idx + 1);
-    let chosen = null;
-    for (const layer of layerOrder) {
-      const v = readLeaf(layer.values, branch, leaf);
-      if (v !== void 0) {
-        chosen = { source: layer.source, value: v };
-        break;
-      }
-    }
-    if (chosen) {
-      writeLeaf(effective, branch, leaf, chosen.value);
-      sources[desc.key] = chosen.source;
-    } else {
-      sources[desc.key] = "default";
-    }
-  }
-  return { effective, sources };
-}
-function readLeaf(obj, branch, leaf) {
-  const b = obj[branch];
-  if (b === void 0 || b === null || typeof b !== "object") return void 0;
-  return b[leaf];
-}
-function writeLeaf(obj, branch, leaf, value) {
-  const b = obj[branch];
-  if (!b) return;
-  b[leaf] = value;
-}
-async function setConfigValue(scope, key, value, cwd, opts = {}) {
-  if (!lookupKey(key)) {
-    throw new UserConfigError(`unknown key "${key}"`);
-  }
-  const coerced = opts.raw && typeof value === "string" ? coerceFromString(key, value) : value;
-  const path = await configPathFor(scope, cwd);
-  const current = await readExistingDoc(path);
-  setLeaf(current, key, coerced);
-  parseUserConfig(stringifyYaml(current), path);
-  await atomicWriteYaml(path, current);
-  if (scope === "project") {
-    const root = (await findProjectRoot(cwd)).root;
-    await touchProjectMeta(root);
-  }
-  return { path, coerced };
-}
-async function unsetConfigValue(scope, key, cwd) {
-  if (!lookupKey(key)) {
-    throw new UserConfigError(`unknown key "${key}"`);
-  }
-  const path = await configPathFor(scope, cwd);
-  const current = await readExistingDoc(path);
-  const existed = unsetLeaf(current, key);
-  if (!existed) return { path, existed: false };
-  await atomicWriteYaml(path, current);
-  if (scope === "project") {
-    const root = (await findProjectRoot(cwd)).root;
-    await touchProjectMeta(root);
-  }
-  return { path, existed: true };
-}
-async function listProjectsConfigured() {
-  let entries;
-  try {
-    entries = await readdir(PROJECTS_DIR);
-  } catch (err) {
-    if (err.code === "ENOENT") return [];
-    throw err;
-  }
-  const out = [];
-  for (const dirName of entries) {
-    const m = /^([0-9a-f]{16})(?:-.+)?$/.exec(dirName);
-    if (!m) continue;
-    const hash = m[1];
-    const meta = await readMeta(dirName);
-    if (!meta) continue;
-    const cfgPath = projectConfigFile(meta.originalPath);
-    const hasConfig = await fileExists2(cfgPath);
-    out.push({
-      hash,
-      dirName,
-      originalPath: meta.originalPath,
-      createdAt: meta.createdAt,
-      lastSeenAt: meta.lastSeenAt,
-      configPath: cfgPath,
-      hasConfigFile: hasConfig
-    });
-  }
-  out.sort((a, b) => a.originalPath.localeCompare(b.originalPath));
-  return out;
-}
-async function pruneOrphanProjectConfigs(opts = {}) {
-  const dryRun = opts.dryRun ?? false;
-  const keep = new Set(opts.protectedPaths ?? []);
-  const removed = [];
-  for (const entry of await listProjectsConfigured()) {
-    if (!isAbsolute(entry.originalPath) || keep.has(entry.originalPath)) continue;
-    let missing = false;
-    try {
-      await stat2(entry.originalPath);
-    } catch (err) {
-      if (err.code === "ENOENT") missing = true;
-    }
-    if (!missing) continue;
-    removed.push({ hash: entry.hash, originalPath: entry.originalPath });
-    if (!dryRun) {
-      try {
-        await rm(join2(PROJECTS_DIR, entry.dirName), { recursive: true, force: true });
-      } catch {
-      }
-    }
-  }
-  return { removed, dryRun };
-}
-var PROJECT_GC_COUNTER_FILE = join2(PROJECTS_DIR, ".gc.json");
-async function bumpProjectGcCounter() {
-  let prior = 0;
-  try {
-    const parsed = JSON.parse(await readFile2(PROJECT_GC_COUNTER_FILE, "utf8"));
-    if (typeof parsed.creates === "number" && Number.isFinite(parsed.creates)) {
-      prior = parsed.creates;
-    }
-  } catch {
-  }
-  const next = prior + 1;
-  await mkdir(PROJECTS_DIR, { recursive: true });
-  const tmp = `${PROJECT_GC_COUNTER_FILE}.tmp-${process.pid.toString()}-${Date.now().toString(36)}`;
-  await writeFile(tmp, JSON.stringify({ creates: next }) + "\n", { encoding: "utf8", mode: 420 });
-  await rename(tmp, PROJECT_GC_COUNTER_FILE);
-  return next;
-}
-async function readMeta(dirName) {
-  const metaPath = `${PROJECTS_DIR}/${dirName}/meta.json`;
-  try {
-    const text = await readFile2(metaPath, "utf8");
-    const parsed = JSON.parse(text);
-    if (typeof parsed["originalPath"] !== "string") return null;
-    return {
-      originalPath: parsed["originalPath"],
-      createdAt: typeof parsed["createdAt"] === "string" ? parsed["createdAt"] : null,
-      lastSeenAt: typeof parsed["lastSeenAt"] === "string" ? parsed["lastSeenAt"] : null
-    };
-  } catch {
-    return null;
-  }
-}
-async function fileExists2(p) {
-  try {
-    const st = await stat2(p);
-    return st.isFile();
-  } catch {
-    return false;
-  }
-}
-async function readExistingDoc(path) {
-  let text;
-  try {
-    text = await readFile2(path, "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") return {};
-    throw err;
-  }
-  return parseUserConfig(text, path);
-}
-function setLeaf(doc, key, value) {
-  const idx = key.indexOf(".");
-  const branch = key.slice(0, idx);
-  const leaf = key.slice(idx + 1);
-  const root = doc;
-  if (!root[branch] || typeof root[branch] !== "object") {
-    root[branch] = {};
-  }
-  root[branch][leaf] = value;
-}
-function unsetLeaf(doc, key) {
-  const idx = key.indexOf(".");
-  const branch = key.slice(0, idx);
-  const leaf = key.slice(idx + 1);
-  const root = doc;
-  const b = root[branch];
-  if (!b || typeof b !== "object" || !(leaf in b)) return false;
-  delete b[leaf];
-  if (Object.keys(b).length === 0) {
-    delete root[branch];
-  }
-  return true;
-}
-async function atomicWriteYaml(path, doc) {
-  await mkdir(dirname2(path), { recursive: true });
-  const text = Object.keys(doc).length === 0 ? "# managed by agentbox config \u2014 empty\n" : stringifyYaml(doc);
-  const tmp = `${path}.tmp-${process.pid.toString()}-${Date.now().toString(36)}`;
-  await writeFile(tmp, text, { encoding: "utf8", mode: 420 });
-  await rename(tmp, path);
-}
-async function touchProjectMeta(absPath) {
-  const dir = dirname2(projectMetaFile(absPath));
-  await mkdir(dir, { recursive: true });
-  const metaPath = projectMetaFile(absPath);
-  let prior = {};
-  try {
-    prior = JSON.parse(await readFile2(metaPath, "utf8"));
-  } catch {
-  }
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const next = {
-    originalPath: absPath,
-    hash: hashProjectPath(absPath),
-    createdAt: prior.createdAt ?? now,
-    lastSeenAt: now
-  };
-  const tmp = `${metaPath}.tmp-${process.pid.toString()}-${Date.now().toString(36)}`;
-  await writeFile(tmp, JSON.stringify(next, null, 2) + "\n", { encoding: "utf8", mode: 420 });
-  await rename(tmp, metaPath);
-}
-
-// ../../packages/sandbox-docker/dist/chunk-FTYSR4JQ.js
-import { execa as execa3 } from "execa";
-import { existsSync } from "fs";
-import { fileURLToPath } from "url";
-import { dirname as dirname3, resolve as resolve2 } from "path";
-import { mkdir as mkdir22, mkdtemp, readFile as readFile22, readdir as readdir2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
-import { homedir as homedir22, tmpdir } from "os";
-import { basename as basename2, join as join22 } from "path";
-import { execa as execa4 } from "execa";
-async function dockerInfo() {
-  const result = await execa("docker", ["info"], { reject: false });
-  if (result.exitCode !== 0) {
-    throw new Error(
-      `docker info failed (exit ${String(result.exitCode)}). Is the Docker daemon running?
-${String(result.stderr)}`
-    );
-  }
-}
-async function runBox(spec) {
-  const args = [
-    "run",
-    "-d",
-    "--name",
-    spec.name,
-    "--hostname",
-    spec.name,
-    "--cap-add=SYS_ADMIN",
-    // dockerd inside the box (always-on, see launchDockerdDaemon) needs
-    // NET_ADMIN to set up its bridge + iptables NAT for inner containers.
-    // seccomp:unconfined is required because the default profile blocks
-    // syscalls (notably keyctl, clone3 in some kernels) that nested containers
-    // need. Both are scoped to the outer box's namespaces — inner containers
-    // can't escape it. We still avoid --privileged for cloud portability.
-    "--cap-add=NET_ADMIN",
-    // /dev/fuse + SYS_ADMIN + apparmor:unconfined used to be required for the
-    // outer /workspace FUSE overlay. That overlay is gone, but they're still
-    // load-bearing for the *inner* dockerd's storage driver, which
-    // agentbox-dockerd-start selects at runtime: SYS_ADMIN lets it `mount -t
-    // overlay` for the preferred kernel-native overlay2 driver, and /dev/fuse
-    // + SYS_ADMIN + apparmor:unconfined are needed for the fuse-overlayfs
-    // fallback (used where overlay2's runtime probe fails).
-    "--device=/dev/fuse",
-    "--security-opt=apparmor:unconfined",
-    "--security-opt=seccomp=unconfined",
-    // cgroup v2 + DinD: with --cgroupns=host (the OrbStack default) the
-    // outer container sees the host's read-only cgroup hierarchy at
-    // /sys/fs/cgroup, so the inner dockerd can't `mkdir /sys/fs/cgroup/docker`
-    // for its own slice and inner `docker run` fails with "read-only file
-    // system". Private gives the box its own writable cgroup namespace; runc
-    // creates the docker slice there and inner containers nest under it.
-    "--cgroupns=private",
-    // Make the host reachable from inside the container at the well-known DNS
-    // name host.docker.internal. Docker Desktop / OrbStack ship this alias by
-    // default; on Linux native Docker it requires this explicit flag (no-op
-    // on the macOS engines). Boxes use it to reach the host relay process.
-    "--add-host=host.docker.internal:host-gateway"
-  ];
-  const lim = spec.limits;
-  if (lim) {
-    if (lim.memoryBytes && lim.memoryBytes > 0) {
-      args.push("--memory", String(Math.floor(lim.memoryBytes)));
-    }
-    if (lim.cpus && lim.cpus > 0) {
-      args.push("--cpus", String(lim.cpus));
-    }
-    if (lim.pidsLimit && lim.pidsLimit > 0) {
-      args.push("--pids-limit", String(Math.floor(lim.pidsLimit)));
-    }
-    if (lim.disk) {
-      args.push("--storage-opt", `size=${lim.disk}`);
-    }
-  }
-  for (const v of spec.extraVolumes ?? []) {
-    args.push("-v", v);
-  }
-  for (const pm of spec.portMappings ?? []) {
-    const host = pm.hostIp ? `${pm.hostIp}:${String(pm.hostPort)}` : String(pm.hostPort);
-    args.push("-p", `${host}:${String(pm.containerPort)}`);
-  }
-  for (const [k, val] of Object.entries(spec.env ?? {})) {
-    args.push("-e", `${k}=${val}`);
-  }
-  args.push(spec.image, "sleep", "infinity");
-  const { stdout } = await execa("docker", args);
-  return stdout.trim();
-}
-async function dockerStorageDriver() {
-  const result = await execa("docker", ["info", "--format", "{{.Driver}}"], { reject: false });
-  if (result.exitCode !== 0) return "";
-  return (result.stdout ?? "").trim();
-}
-async function execInBox(container, cmd, opts = {}) {
-  const args = ["exec"];
-  if (opts.detach) args.push("-d");
-  if (opts.user) args.push("--user", opts.user);
-  args.push(container, ...cmd);
-  const result = await execa("docker", args, {
-    reject: false,
-    ...opts.timeoutMs ? { timeout: opts.timeoutMs } : {}
-  });
-  return {
-    exitCode: result.exitCode ?? -1,
-    stdout: result.stdout ?? "",
-    stderr: result.stderr ?? ""
-  };
-}
-async function removeContainer(container) {
-  await execa("docker", ["rm", "-f", container], { reject: false });
-}
-async function removeVolume(name) {
-  await execa("docker", ["volume", "rm", name], { reject: false });
-}
-async function removeImage(ref, opts = {}) {
-  const args = ["image", "rm"];
-  if (opts.force !== false) args.push("-f");
-  args.push(ref);
-  const result = await execa("docker", args, { reject: false });
-  return result.exitCode === 0;
-}
-async function containerExists(name) {
-  const result = await execa("docker", ["container", "inspect", "--format", "{{.Id}}", name], {
-    reject: false
-  });
-  return result.exitCode === 0;
-}
-async function volumeExists(name) {
-  const result = await execa("docker", ["volume", "inspect", name], { reject: false });
-  return result.exitCode === 0;
-}
-async function ensureVolume(name) {
-  if (await volumeExists(name)) return;
-  await execa("docker", ["volume", "create", name]);
-}
-async function removeNetwork(name) {
-  await execa("docker", ["network", "rm", name], { reject: false });
-}
-async function pauseContainer(name) {
-  await execa("docker", ["pause", name]);
-}
-async function unpauseContainer(name) {
-  await execa("docker", ["unpause", name]);
-}
-async function stopContainer(name) {
-  await execa("docker", ["stop", name]);
-}
-async function startContainer(name) {
-  await execa("docker", ["start", name]);
-}
-async function inspectContainerStatus(name) {
-  const result = await execa("docker", ["inspect", "--format", "{{.State.Status}}", name], {
-    reject: false
-  });
-  if (result.exitCode !== 0) return "missing";
-  const status = (result.stdout ?? "").trim();
-  switch (status) {
-    case "running":
-      return "running";
-    case "paused":
-      return "paused";
-    case "created":
-    case "exited":
-    case "dead":
-    case "restarting":
-    case "removing":
-      return "stopped";
-    default:
-      return "missing";
-  }
-}
-async function inspectContainer(name) {
-  const result = await execa("docker", ["inspect", name], { reject: false });
-  if (result.exitCode !== 0) return null;
-  try {
-    const parsed = JSON.parse(result.stdout ?? "null");
-    return Array.isArray(parsed) ? parsed[0] ?? null : null;
-  } catch {
-    return null;
-  }
-}
-async function inspectVolumeMountpoint(name) {
-  const result = await execa("docker", ["volume", "inspect", "--format", "{{.Mountpoint}}", name], {
-    reject: false
-  });
-  if (result.exitCode !== 0) return null;
-  return (result.stdout ?? "").trim() || null;
-}
-var AGENTBOX_PREFIX = "agentbox-";
-async function listAgentboxContainers() {
-  const result = await execa(
-    "docker",
-    ["ps", "-a", "--filter", `name=^${AGENTBOX_PREFIX}`, "--format", "{{.Names}}"],
-    { reject: false }
-  );
-  if (result.exitCode !== 0) return [];
-  return (result.stdout ?? "").split("\n").map((s) => s.trim()).filter((s) => s.startsWith(AGENTBOX_PREFIX));
-}
-async function publishedHostPort(container, containerPort) {
-  const result = await execa("docker", ["port", container, `${String(containerPort)}/tcp`], {
-    reject: false
-  });
-  if (result.exitCode !== 0) return null;
-  const first = (result.stdout ?? "").split("\n")[0]?.trim();
-  if (!first) return null;
-  const m = /:(\d+)$/.exec(first);
-  return m ? Number(m[1]) : null;
-}
-async function listAgentboxVolumes() {
-  const result = await execa(
-    "docker",
-    ["volume", "ls", "--filter", `name=^${AGENTBOX_PREFIX}`, "--format", "{{.Name}}"],
-    { reject: false }
-  );
-  if (result.exitCode !== 0) return [];
-  return (result.stdout ?? "").split("\n").map((s) => s.trim()).filter((s) => s.startsWith(AGENTBOX_PREFIX));
-}
-var CONTAINER_EXPORT_MERGED = "/host-export";
-var cachedEngine = null;
-async function detectEngine() {
-  if (cachedEngine !== null) return cachedEngine;
-  const result = await execa2("docker", ["info", "--format", "{{.OperatingSystem}}"], {
-    reject: false
-  });
-  const os = (result.stdout ?? "").trim().toLowerCase();
-  if (os.includes("orbstack")) cachedEngine = "orbstack";
-  else if (os.includes("docker desktop")) cachedEngine = "docker-desktop";
-  else cachedEngine = "other";
-  return cachedEngine;
-}
-function setEngineOverride(engine) {
-  cachedEngine = engine;
-}
-var BOXES_ROOT = join3(homedir2(), ".agentbox", "boxes");
-function boxDirSegment(box) {
-  const mnemonic = sanitizeMnemonic(box.name);
-  const n = box.projectIndex;
-  if (typeof n === "number" && Number.isFinite(n) && n > 0) {
-    return `${box.id}-${String(n)}-${mnemonic}`;
-  }
-  return `${box.id}-${mnemonic}`;
-}
-function boxRunDirFor(box) {
-  return join3(BOXES_ROOT, boxDirSegment(box));
-}
-function boxStatusPathFor(box) {
-  return join3(boxRunDirFor(box), "status.json");
-}
-async function readBoxStatus(box) {
-  try {
-    const raw = await readFile3(boxStatusPathFor(box), "utf8");
-    const parsed = JSON.parse(raw);
-    if (parsed.schema !== 1) return null;
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function orbstackVolumePath(volume, ...sub) {
-  return join3(homedir2(), "OrbStack", "docker", "volumes", volume, ...sub);
-}
-async function getHostPaths(record) {
-  const boxDir = boxRunDirFor(record);
-  return {
-    boxDir,
-    mergedExport: join3(boxDir, "workspace")
-  };
-}
-async function hasContainerPath(container, path) {
-  const probe = await execInBox(container, ["test", "-d", path], { user: "root" });
-  return probe.exitCode === 0;
-}
-async function refreshExport(record, opts = {}) {
-  const paths = await getHostPaths(record);
-  const excludeNodeModules = !opts.includeNodeModules;
-  await mkdir2(paths.mergedExport, { recursive: true });
-  const bindAvailable = await hasContainerPath(record.container, CONTAINER_EXPORT_MERGED);
-  if (bindAvailable) {
-    const args = ["rsync", "-a", "--delete"];
-    if (excludeNodeModules) args.push("--exclude=node_modules");
-    args.push("/workspace/", `${CONTAINER_EXPORT_MERGED}/`);
-    const r = await execInBox(record.container, args, { user: "root" });
-    if (r.exitCode !== 0) {
-      throw new ExportError(`rsync into ${CONTAINER_EXPORT_MERGED} failed`, r.stdout, r.stderr);
-    }
-    return { hostPath: paths.mergedExport, copied: true, usedFallback: false };
-  }
-  const excludes = excludeNodeModules ? ["--exclude=node_modules"] : [];
-  const result = await execa2(
-    "docker",
-    ["exec", "--user", "root", record.container, "tar", "-cf", "-", ...excludes, "-C", "/workspace", "."],
-    { reject: false, encoding: "buffer" }
-  );
-  if (result.exitCode !== 0) {
-    throw new ExportError(
-      `tar from /workspace failed`,
-      "",
-      typeof result.stderr === "string" ? result.stderr : result.stderr.toString("utf8")
-    );
-  }
-  const extract = await execa2("tar", ["-xf", "-", "-C", paths.mergedExport], {
-    input: result.stdout,
-    reject: false
-  });
-  if (extract.exitCode !== 0) {
-    throw new ExportError("tar extract on host failed", extract.stdout, extract.stderr);
-  }
-  return { hostPath: paths.mergedExport, copied: true, usedFallback: true };
-}
-var DEFAULT_ENV_PATTERNS = [
-  ".env",
-  ".env.*",
-  ".envrc",
-  ".dev.vars",
-  "secrets.toml",
-  "local.settings.json",
-  "appsettings.*.json",
-  "agentbox.yaml"
-];
-var ENV_PRUNE_DIRS = [
-  "node_modules",
-  ".git",
-  ".venv",
-  "venv",
-  "__pycache__",
-  "dist",
-  ".next",
-  "build"
-];
-function buildEnvFindArgs(patterns) {
-  const nameGroup = (names) => {
-    const out = [];
-    names.forEach((n, i) => {
-      if (i > 0) out.push("-o");
-      out.push("-name", n);
-    });
-    return out;
-  };
-  return [
-    "find",
-    "/workspace",
-    "(",
-    "-type",
-    "d",
-    "(",
-    ...nameGroup(ENV_PRUNE_DIRS),
-    ")",
-    "-prune",
-    ")",
-    "-o",
-    "(",
-    "-type",
-    "f",
-    "(",
-    ...nameGroup(patterns),
-    ")",
-    "-printf",
-    "%P\\0",
-    ")"
-  ];
-}
-function buildHostEnvFindArgs(patterns) {
-  const nameGroup = (names) => {
-    const out = [];
-    names.forEach((n, i) => {
-      if (i > 0) out.push("-o");
-      out.push("-name", n);
-    });
-    return out;
-  };
-  return [
-    "find",
-    ".",
-    "(",
-    "-type",
-    "d",
-    "(",
-    ...nameGroup(ENV_PRUNE_DIRS),
-    ")",
-    "-prune",
-    ")",
-    "-o",
-    "(",
-    "-type",
-    "f",
-    "(",
-    ...nameGroup(patterns),
-    ")",
-    "-print0",
-    ")"
-  ];
-}
-async function copyHostEnvFilesToBox(opts) {
-  const log = opts.onLog ?? (() => {
-  });
-  const found = await execa2("find", buildHostEnvFindArgs(opts.patterns).slice(1), {
-    cwd: opts.workspaceDir,
-    reject: false
-  });
-  if (found.exitCode !== 0) {
-    log(`warning: env-file scan failed: ${String(found.stderr).slice(0, 300)}`);
-    return { copied: 0 };
-  }
-  const list = String(found.stdout).split("\0").filter((p) => p.length > 0);
-  if (list.length === 0) return { copied: 0 };
-  const packed = await execa2("tar", ["-C", opts.workspaceDir, "--null", "-T", "-", "-cf", "-"], {
-    input: list.join("\0"),
-    encoding: "buffer",
-    reject: false
-  });
-  if (packed.exitCode !== 0) {
-    log(`warning: env-file tar pack failed: ${String(packed.stderr).slice(0, 300)}`);
-    return { copied: 0 };
-  }
-  const extract = await execa2(
-    "docker",
-    ["exec", "-i", "--user", "1000:1000", opts.container, "tar", "-xf", "-", "-C", "/workspace"],
-    { input: packed.stdout, reject: false }
-  );
-  if (extract.exitCode !== 0) {
-    log(`warning: env-file copy into box failed: ${String(extract.stderr).slice(0, 300)}`);
-    return { copied: 0 };
-  }
-  return { copied: list.length };
-}
-async function scanHostEnvFiles(workspaceDir, patterns) {
-  if (patterns.length === 0) return [];
-  const found = await execa2("find", buildHostEnvFindArgs(patterns).slice(1), {
-    cwd: workspaceDir,
-    reject: false
-  });
-  if (found.exitCode !== 0) return [];
-  return String(found.stdout).split("\0").map((p) => p.replace(/^\.\//, "")).filter((p) => p.length > 0);
-}
-async function copyHostFilesToBox(opts) {
-  const log = opts.onLog ?? (() => {
-  });
-  const list = opts.files.map((p) => p.replace(/^\.\//, "")).filter((p) => p.length > 0);
-  if (list.length === 0) return { copied: 0 };
-  const packed = await execa2("tar", ["-C", opts.workspaceDir, "--null", "-T", "-", "-cf", "-"], {
-    input: list.join("\0"),
-    encoding: "buffer",
-    reject: false
-  });
-  if (packed.exitCode !== 0) {
-    log(`warning: env-file tar pack failed: ${String(packed.stderr).slice(0, 300)}`);
-    return { copied: 0 };
-  }
-  const extract = await execa2(
-    "docker",
-    ["exec", "-i", "--user", "1000:1000", opts.container, "tar", "-xf", "-", "-C", "/workspace"],
-    { input: packed.stdout, reject: false }
-  );
-  if (extract.exitCode !== 0) {
-    log(`warning: env-file copy into box failed: ${String(extract.stderr).slice(0, 300)}`);
-    return { copied: 0 };
-  }
-  return { copied: list.length };
-}
-function parseItemizedChanges(stdout) {
-  return stdout.split("\n").map((l) => l.trimEnd()).filter((l) => l.length > 0).filter((l) => {
-    const code = l[0];
-    const kind = l[1];
-    return (code === ">" || code === "<" || code === "c" || code === "*") && kind !== "d";
-  });
-}
-async function pullToHost(record, opts = {}) {
-  const paths = await getHostPaths(record);
-  let scratchDir;
-  if (opts.noRefresh) {
-    scratchDir = paths.mergedExport;
-    await mkdir2(scratchDir, { recursive: true });
-  } else {
-    const refreshed = await refreshExport(record, {
-      includeNodeModules: opts.includeNodeModules
-    });
-    scratchDir = refreshed.hostPath;
-  }
-  const segments = [];
-  let usedGitignore = false;
-  if (opts.respectGitignore !== false) {
-    const isGit = await execInBox(
-      record.container,
-      ["git", "-C", "/workspace", "rev-parse", "--is-inside-work-tree"],
-      { user: "root" }
-    );
-    if (isGit.exitCode === 0 && isGit.stdout.trim() === "true") {
-      const ls = await execInBox(
-        record.container,
-        ["git", "-C", "/workspace", "ls-files", "-z", "--cached", "--others", "--exclude-standard"],
-        { user: "root" }
-      );
-      if (ls.exitCode !== 0) {
-        throw new ExportError("git ls-files in box failed", ls.stdout, ls.stderr);
-      }
-      const tracked = ls.stdout.replace(/\0$/, "");
-      if (tracked.length > 0) segments.push(tracked);
-      usedGitignore = true;
-    }
-  }
-  if (opts.envPatterns && opts.envPatterns.length > 0) {
-    const found = await execInBox(
-      record.container,
-      buildEnvFindArgs(opts.envPatterns),
-      { user: "root" }
-    );
-    if (found.exitCode !== 0) {
-      throw new ExportError("find env files in box failed", found.stdout, found.stderr);
-    }
-    const envFiles = found.stdout.replace(/\0$/, "");
-    if (envFiles.length > 0) segments.push(envFiles);
-  }
-  const fileList = segments.length > 0 ? Array.from(new Set(segments.join("\0").split("\0"))).join("\0") : null;
-  const baseArgs = ["-a", "--checksum"];
-  if (fileList === null) {
-    baseArgs.push("--exclude=.git");
-    if (!opts.includeNodeModules) baseArgs.push("--exclude=node_modules");
-  } else {
-    baseArgs.push("--files-from=-", "--from0");
-  }
-  const src = `${scratchDir}/`;
-  const dst = `${record.workspacePath}/`;
-  const dry = await execa2("rsync", [...baseArgs, "--dry-run", "-i", src, dst], {
-    reject: false,
-    input: fileList !== null ? fileList : void 0
-  });
-  if (dry.exitCode !== 0) {
-    throw new ExportError("rsync dry-run failed", dry.stdout, dry.stderr);
-  }
-  const changes = parseItemizedChanges(dry.stdout);
-  if (opts.dryRun) {
-    return { hostPath: record.workspacePath, changes, applied: false, usedGitignore };
-  }
-  const real = await execa2("rsync", [...baseArgs, src, dst], {
-    reject: false,
-    input: fileList !== null ? fileList : void 0
-  });
-  if (real.exitCode !== 0) {
-    throw new ExportError(`rsync into ${record.workspacePath} failed`, real.stdout, real.stderr);
-  }
-  return { hostPath: record.workspacePath, changes, applied: true, usedGitignore };
-}
-async function openInFinder(record, opts) {
-  const engine = await detectEngine();
-  let hostPath;
-  let copied = false;
-  let usedFallback = false;
-  if (opts.noRefresh) {
-    const paths = await getHostPaths(record);
-    hostPath = paths.mergedExport;
-    await mkdir2(hostPath, { recursive: true });
-  } else {
-    const refreshed = await refreshExport(record, opts);
-    hostPath = refreshed.hostPath;
-    copied = refreshed.copied;
-    usedFallback = refreshed.usedFallback;
-  }
-  if (!opts.noOpen) {
-    const opened = await execa2("open", [hostPath], { reject: false });
-    if (opened.exitCode !== 0) {
-      throw new ExportError(`open ${hostPath} failed`, opened.stdout, opened.stderr);
-    }
-  }
-  return { hostPath, copied, usedFallback, engine };
-}
-var ExportError = class extends Error {
-  constructor(message, stdout, stderr) {
-    super(`${message}${stderr ? `: ${stderr.trim()}` : ""}`);
-    this.stdout = stdout;
-    this.stderr = stderr;
-    this.name = "ExportError";
-  }
-  stdout;
-  stderr;
-};
-var DEFAULT_BOX_IMAGE = "agentbox/box:dev";
-var here = dirname3(fileURLToPath(import.meta.url));
-function resolveDockerBuild() {
-  const override = process.env.AGENTBOX_DOCKER_CONTEXT;
-  if (override && existsSync(resolve2(override, "Dockerfile.box"))) {
-    return { dockerfile: resolve2(override, "Dockerfile.box"), context: override };
-  }
-  const staged = resolve2(here, "..", "runtime", "docker");
-  if (existsSync(resolve2(staged, "Dockerfile.box"))) {
-    return { dockerfile: resolve2(staged, "Dockerfile.box"), context: staged };
-  }
-  const packageRoot = resolve2(here, "..");
-  return {
-    dockerfile: resolve2(packageRoot, "Dockerfile.box"),
-    context: resolve2(packageRoot, "..", "..")
-  };
-}
-var { dockerfile: DOCKERFILE_PATH_RESOLVED, context: BUILD_CONTEXT_DIR_RESOLVED } = resolveDockerBuild();
-var DOCKERFILE_PATH = DOCKERFILE_PATH_RESOLVED;
-var BUILD_CONTEXT_DIR = BUILD_CONTEXT_DIR_RESOLVED;
-async function imageExists(ref) {
-  const result = await execa3("docker", ["image", "inspect", ref], { reject: false });
-  return result.exitCode === 0;
-}
-async function buildImage(opts = {}) {
-  const ref = opts.ref ?? DEFAULT_BOX_IMAGE;
-  const dockerfile = opts.dockerfile ?? DOCKERFILE_PATH;
-  const contextDir = opts.contextDir ?? BUILD_CONTEXT_DIR;
-  const subprocess = execa3("docker", ["build", "-t", ref, "-f", dockerfile, contextDir], {
-    stderr: "pipe",
-    stdout: "pipe"
-  });
-  if (opts.onProgress) {
-    const forward = (chunk) => {
-      const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
-      for (const line of text.split(/\r?\n/)) {
-        if (line.length > 0) opts.onProgress?.(line);
-      }
-    };
-    subprocess.stdout?.on("data", forward);
-    subprocess.stderr?.on("data", forward);
-  }
-  await subprocess;
-  return ref;
-}
-async function ensureImage(ref = DEFAULT_BOX_IMAGE, opts = {}) {
-  if (await imageExists(ref)) {
-    return { ref, built: false };
-  }
-  await buildImage({
-    ref,
-    dockerfile: opts.dockerfile,
-    contextDir: opts.contextDir,
-    onProgress: opts.onProgress
-  });
-  return { ref, built: true };
-}
-var CHECKPOINTS_ROOT = join22(homedir22(), ".agentbox", "checkpoints");
-var CHECKPOINT_IMAGE_PREFIX = "agentbox-ckpt-";
-function checkpointImageTag(projectRoot, name) {
-  const mnemonic = sanitizeMnemonic(basename2(projectRoot));
-  return `${CHECKPOINT_IMAGE_PREFIX}${hashProjectPath(projectRoot)}_${mnemonic}:${name}`;
-}
-function projectCheckpointsDir(projectRoot) {
-  return join22(CHECKPOINTS_ROOT, projectDirSegment(projectRoot));
-}
-function checkpointDir(projectRoot, name) {
-  return join22(projectCheckpointsDir(projectRoot), name);
-}
-async function readManifest(dir) {
-  try {
-    const raw = await readFile22(join22(dir, "manifest.json"), "utf8");
-    const m = JSON.parse(raw);
-    if (m.schema !== 2) return null;
-    return m;
-  } catch {
-    return null;
-  }
-}
-async function listCheckpoints(projectRoot) {
-  const root = projectCheckpointsDir(projectRoot);
-  let entries;
-  try {
-    entries = (await readdir2(root, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
-  } catch {
-    return [];
-  }
-  const out = [];
-  for (const name of entries) {
-    const dir = join22(root, name);
-    const manifest = await readManifest(dir);
-    if (manifest) out.push({ name, dir, manifest });
-  }
-  out.sort((a, b) => a.manifest.createdAt.localeCompare(b.manifest.createdAt));
-  return out;
-}
-async function resolveCheckpoint(projectRoot, ref) {
-  const dir = checkpointDir(projectRoot, ref);
-  const manifest = await readManifest(dir);
-  if (!manifest) return null;
-  return { name: ref, dir, manifest };
-}
-async function listAllCheckpointImages() {
-  let projectDirs;
-  try {
-    projectDirs = (await readdir2(CHECKPOINTS_ROOT, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
-  } catch {
-    return [];
-  }
-  const out = /* @__PURE__ */ new Set();
-  for (const proj of projectDirs) {
-    const projPath = join22(CHECKPOINTS_ROOT, proj);
-    let names;
-    try {
-      names = (await readdir2(projPath, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
-    } catch {
-      continue;
-    }
-    for (const name of names) {
-      const manifest = await readManifest(join22(projPath, name));
-      if (manifest) out.add(manifest.image);
-    }
-  }
-  return Array.from(out);
-}
-async function removeCheckpoint(projectRoot, ref) {
-  const dir = checkpointDir(projectRoot, ref);
-  const manifest = await readManifest(dir);
-  if (!manifest) return false;
-  await rm2(dir, { recursive: true, force: true });
-  await removeImage(manifest.image, { force: true });
-  return true;
-}
-function computeNextCheckpointName(existingNames, boxName) {
-  const re = new RegExp(`^${boxName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}-(\\d+)$`);
-  let max = 0;
-  for (const n of existingNames) {
-    const m = re.exec(n);
-    if (m) max = Math.max(max, Number(m[1]));
-  }
-  return `${boxName}-${String(max + 1)}`;
-}
-async function nextCheckpointName(projectRoot, boxName) {
-  const existing = await listCheckpoints(projectRoot);
-  return computeNextCheckpointName(
-    existing.map((c) => c.name),
-    boxName
-  );
-}
-function chainDepth(box) {
-  return box.checkpointSource?.chain.length ?? 0;
-}
-async function runCleanup(container, log) {
-  const r = await execInBox(container, ["/usr/local/bin/agentbox-checkpoint-cleanup"], {
-    user: "root"
-  });
-  if (r.exitCode !== 0) {
-    log(`warning: checkpoint cleanup exited ${String(r.exitCode)}: ${r.stderr.slice(0, 200)}`);
-  }
-}
-async function inspectImageConfig(imageRef) {
-  const r = await execa4("docker", ["image", "inspect", imageRef], { reject: false });
-  if (r.exitCode !== 0) {
-    throw new CheckpointError(`docker image inspect ${imageRef} failed`, r.stdout, r.stderr);
-  }
-  const parsed = JSON.parse(r.stdout);
-  if (!Array.isArray(parsed) || parsed.length === 0 || !parsed[0]?.Config) {
-    throw new CheckpointError(`unexpected docker image inspect shape for ${imageRef}`, r.stdout, "");
-  }
-  return parsed[0].Config;
-}
-var RUNTIME_ENV_BLOCKLIST = /* @__PURE__ */ new Set([
-  "AGENTBOX",
-  "AGENTBOX_BOX_ID",
-  "AGENTBOX_BOX_NAME",
-  "AGENTBOX_HOST_WORKSPACE",
-  "AGENTBOX_PROJECT_ROOT",
-  "AGENTBOX_PROJECT_INDEX",
-  "AGENTBOX_RELAY_URL",
-  "AGENTBOX_RELAY_TOKEN",
-  "AGENTBOX_VNC_PASSWORD",
-  "CLAUDE_EFFORT",
-  "CLAUDE_CODE_OAUTH_TOKEN",
-  "ANTHROPIC_API_KEY",
-  "ANTHROPIC_MODEL"
-]);
-function renderConfigDirectives(cfg) {
-  const lines = [];
-  for (const kv of cfg.Env ?? []) {
-    const eq = kv.indexOf("=");
-    if (eq <= 0) continue;
-    const k = kv.slice(0, eq);
-    if (RUNTIME_ENV_BLOCKLIST.has(k)) continue;
-    const v = kv.slice(eq + 1);
-    lines.push(`ENV ${k}=${dockerfileQuote(v)}`);
-  }
-  if (cfg.WorkingDir) lines.push(`WORKDIR ${cfg.WorkingDir}`);
-  if (cfg.User) lines.push(`USER ${cfg.User}`);
-  for (const p of Object.keys(cfg.ExposedPorts ?? {})) lines.push(`EXPOSE ${p.replace("/tcp", "")}`);
-  if (cfg.Entrypoint && cfg.Entrypoint.length > 0) {
-    lines.push(`ENTRYPOINT ${JSON.stringify(cfg.Entrypoint)}`);
-  }
-  if (cfg.Cmd && cfg.Cmd.length > 0) {
-    lines.push(`CMD ${JSON.stringify(cfg.Cmd)}`);
-  }
-  return lines;
-}
-function dockerfileQuote(v) {
-  if (/^[A-Za-z0-9._/:+@,=-]+$/.test(v)) return v;
-  return `"${v.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-}
-async function createCheckpoint(opts) {
-  const log = opts.onLog ?? (() => {
-  });
-  const { box } = opts;
-  const type = opts.merged === true || chainDepth(box) >= opts.maxLayers ? "flattened" : "layered";
-  const name = opts.name ?? await nextCheckpointName(opts.projectRoot, box.name);
-  const dir = checkpointDir(opts.projectRoot, name);
-  const existing = await readManifest(dir);
-  if (existing) {
-    if (opts.replace) {
-      log(`replacing existing checkpoint ${name} (created ${existing.createdAt})`);
-      await removeCheckpoint(opts.projectRoot, name);
-    } else {
-      throw new CheckpointError(
-        `checkpoint ${name} already exists (created ${existing.createdAt}; rm it or pass --replace to recapture)`,
-        "",
-        ""
-      );
-    }
-  }
-  const tag = checkpointImageTag(opts.projectRoot, name);
-  await mkdir22(dir, { recursive: true });
-  log(`running pre-commit cleanup in ${box.container}`);
-  await runCleanup(box.container, log);
-  if (type === "layered") {
-    log(`docker commit ${box.container} -> ${tag} (layered)`);
-    const r = await execa4("docker", ["commit", box.container, tag], { reject: false });
-    if (r.exitCode !== 0) {
-      throw new CheckpointError(`docker commit failed for ${box.container}`, r.stdout, r.stderr);
-    }
-  } else {
-    log(`docker commit ${box.container} -> <intermediate> (flattened path)`);
-    const intermediate = `${tag}-intermediate`;
-    const commit = await execa4("docker", ["commit", box.container, intermediate], {
-      reject: false
-    });
-    if (commit.exitCode !== 0) {
-      throw new CheckpointError(`docker commit (intermediate) failed`, commit.stdout, commit.stderr);
-    }
-    try {
-      await flattenImage(intermediate, tag, log);
-    } finally {
-      await removeImage(intermediate, { force: true });
-    }
-  }
-  const base = (box.gitWorktrees ?? []).some((w) => w.kind === "root") ? "worktree" : "workspace";
-  const manifest = {
-    schema: 2,
-    name,
-    type,
-    image: tag,
-    // Layered carries lineage forward; flattened is self-contained.
-    parents: type === "layered" ? box.checkpointSource?.chain ?? [] : [],
-    base,
-    sourceBoxId: box.id,
-    sourceBoxName: box.name,
-    worktrees: box.gitWorktrees,
-    createdAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  await writeFile2(join22(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n", "utf8");
-  if (opts.setDefault) {
-    await setConfigValue("project", "box.defaultCheckpoint", name, opts.projectRoot);
-    log(`set project default checkpoint -> ${name}`);
-  }
-  return { name, dir, manifest };
-}
-async function flattenImage(sourceTag, destTag, log) {
-  const tmpName = `agentbox-flatten-${Date.now().toString(36)}`;
-  const create = await execa4(
-    "docker",
-    ["create", "--name", tmpName, sourceTag, "sleep", "0"],
-    { reject: false }
-  );
-  if (create.exitCode !== 0) {
-    throw new CheckpointError(`docker create for flatten failed`, create.stdout, create.stderr);
-  }
-  const scratch = await mkdtemp(join22(tmpdir(), "agentbox-flatten-"));
-  try {
-    const rootfsPath = join22(scratch, "rootfs.tar");
-    log(`exporting rootfs of ${sourceTag} to ${rootfsPath}`);
-    const exp = await execa4("docker", ["export", "-o", rootfsPath, tmpName], { reject: false });
-    if (exp.exitCode !== 0) {
-      throw new CheckpointError(`docker export failed`, exp.stdout, exp.stderr);
-    }
-    const cfg = await inspectImageConfig(sourceTag);
-    const lines = [
-      "FROM scratch",
-      // ADD untars during build (Docker's documented behavior for local tars).
-      "ADD rootfs.tar /",
-      ...renderConfigDirectives(cfg)
-    ];
-    await writeFile2(join22(scratch, "Dockerfile"), lines.join("\n") + "\n", "utf8");
-    log(`building flattened ${destTag} from rootfs.tar (FROM scratch)`);
-    const build = await execa4(
-      "docker",
-      ["build", "-t", destTag, "-f", join22(scratch, "Dockerfile"), scratch],
-      { reject: false }
-    );
-    if (build.exitCode !== 0) {
-      throw new CheckpointError(`flatten docker build failed`, build.stdout, build.stderr);
-    }
-  } finally {
-    await execa4("docker", ["rm", "-f", tmpName], { reject: false });
-    await rm2(scratch, { recursive: true, force: true });
-  }
-}
-var CheckpointError = class extends Error {
-  constructor(message, stdout, stderr) {
-    super(`${message}${stderr ? `: ${stderr.trim()}` : ""}`);
-    this.stdout = stdout;
-    this.stderr = stderr;
-    this.name = "CheckpointError";
-  }
-  stdout;
-  stderr;
-};
-
-export {
-  KEY_REGISTRY,
-  lookupKey,
-  UserConfigError,
-  findProjectRoot,
-  sanitizeMnemonic,
-  configPathFor,
-  loadEffectiveConfig,
-  setConfigValue,
-  unsetConfigValue,
-  listProjectsConfigured,
-  pruneOrphanProjectConfigs,
-  bumpProjectGcCounter,
-  dockerInfo,
-  runBox,
-  dockerStorageDriver,
-  execInBox,
-  removeContainer,
-  removeVolume,
-  removeImage,
-  containerExists,
-  volumeExists,
-  ensureVolume,
-  removeNetwork,
-  pauseContainer,
-  unpauseContainer,
-  stopContainer,
-  startContainer,
-  inspectContainerStatus,
-  inspectContainer,
-  inspectVolumeMountpoint,
-  listAgentboxContainers,
-  publishedHostPort,
-  listAgentboxVolumes,
-  CONTAINER_EXPORT_MERGED,
-  detectEngine,
-  setEngineOverride,
-  BOXES_ROOT,
-  boxRunDirFor,
-  readBoxStatus,
-  orbstackVolumePath,
-  getHostPaths,
-  refreshExport,
-  DEFAULT_ENV_PATTERNS,
-  copyHostEnvFilesToBox,
-  scanHostEnvFiles,
-  copyHostFilesToBox,
-  pullToHost,
-  openInFinder,
-  DEFAULT_BOX_IMAGE,
-  ensureImage,
-  CHECKPOINT_IMAGE_PREFIX,
-  checkpointImageTag,
-  listCheckpoints,
-  resolveCheckpoint,
-  listAllCheckpointImages,
-  removeCheckpoint,
-  createCheckpoint
-};
-//# sourceMappingURL=chunk-HHMWQNLF.js.map