@madarco/agentbox 0.9.0 → 0.10.1

package/dist/{chunk-NCJP5MTN.js → chunk-CDKVD6UO.js}

@@ -5,7 +5,6 @@ import {
   STATE_DIR,
   STATE_FILE,
   allocateProjectIndex,
-  buildImage,
   computeDockerContextFingerprint,
   detectGitRepos,
   ensureImage,
@@ -13,19 +12,19 @@ import {
   imageExists,
   pickFreshBranch,
   preparedMatches,
+  pullOrBuild,
   readCliStamp,
   readPreparedDockerState,
   readState,
   recordBox,
-  removeBoxRecord,
-  writePreparedDockerState
-} from "./chunk-KL36BRN4.js";
+  removeBoxRecord
+} from "./chunk-PWUVHPN6.js";
 
 // ../../packages/sandbox-docker/dist/index.js
 import { randomBytes as randomBytes3 } from "crypto";
 import { mkdir as mkdir7, stat as stat6 } from "fs/promises";
 import { homedir as homedir9 } from "os";
-import { basename as basename2, join as join10, resolve as resolve3 } from "path";
+import { basename as basename3, join as join10, resolve as resolve3 } from "path";
 import { execa as execa13 } from "execa";
 
 // ../../packages/ctl/dist/index.js
@@ -744,6 +743,9 @@ var BUILT_IN_DEFAULTS = {
     isolateCodexConfig: false,
     isolateOpencodeConfig: false,
     image: "agentbox/box:dev",
+    // Mirrors BOX_IMAGE_REGISTRY in @agentbox/sandbox-docker. Empty disables the
+    // registry pull (always build the docker base image locally).
+    imageRegistry: "ghcr.io/madarco/agentbox/box",
     dockerCacheShared: false,
     memory: 0,
     cpus: 0,
@@ -758,10 +760,12 @@ var BUILT_IN_DEFAULTS = {
     maxLayers: 3
   },
   claude: {
-    sessionName: "claude"
+    sessionName: "claude",
+    dangerouslySkipPermissions: true
   },
   codex: {
-    sessionName: "codex"
+    sessionName: "codex",
+    dangerouslySkipPermissions: true
   },
   opencode: {
     sessionName: "opencode"
@@ -898,6 +902,12 @@ var KEY_REGISTRY = [
     description: "Box image ref (advanced).",
     advanced: true
   },
+  {
+    key: "box.imageRegistry",
+    type: "string",
+    description: "Registry repo to pull the prebuilt docker base image from before building locally. Empty = always build. Docker only (advanced).",
+    advanced: true
+  },
   {
     key: "box.dockerCacheShared",
     type: "bool",
@@ -949,11 +959,21 @@ var KEY_REGISTRY = [
     type: "string",
     description: "tmux session name for `agentbox claude`."
   },
+  {
+    key: "claude.dangerouslySkipPermissions",
+    type: "bool",
+    description: "Launch claude in new boxes with --dangerously-skip-permissions (auto-accept tool use). Safe because boxes are isolated; on by default. Override per-box with --no-dangerously-skip-permissions."
+  },
   {
     key: "codex.sessionName",
     type: "string",
     description: "tmux session name for `agentbox codex`."
   },
+  {
+    key: "codex.dangerouslySkipPermissions",
+    type: "bool",
+    description: "Launch codex in new boxes with --dangerously-bypass-approvals-and-sandbox (never prompt for approval). Safe because boxes are isolated; on by default. Override per-box with --no-dangerously-skip-permissions."
+  },
   {
     key: "opencode.sessionName",
     type: "string",
@@ -1637,7 +1657,7 @@ async function touchProjectMeta(absPath) {
 
 // ../../packages/sandbox-docker/dist/index.js
 import { chmod, mkdir as mkdir32, readFile as readFile32 } from "fs/promises";
-import { join as join32 } from "path";
+import { basename as basename2, join as join32 } from "path";
 import { execa as execa4 } from "execa";
 import { spawnSync as spawnSync2 } from "child_process";
 import { stat as stat22 } from "fs/promises";
@@ -1662,7 +1682,7 @@ import { homedir as homedir6, platform } from "os";
 import { join as join7, resolve as resolve2 } from "path";
 import { mkdir as mkdir5, mkdtemp as mkdtemp2, readFile as readFile5, readdir as readdir32, rm as rm3, writeFile as writeFile22 } from "fs/promises";
 import { homedir as homedir7, tmpdir as tmpdir2 } from "os";
-import { basename as basename3, join as join8 } from "path";
+import { basename as basename22, join as join8 } from "path";
 import { execa as execa10 } from "execa";
 import { stat as stat5 } from "fs/promises";
 import { execa as execa11 } from "execa";
@@ -1670,10 +1690,11 @@ import { execa as execa12 } from "execa";
 import { spawn } from "child_process";
 import { randomBytes as randomBytes22 } from "crypto";
 import { existsSync as existsSync2, openSync } from "fs";
-import { mkdir as mkdir6, readFile as readFile6, unlink as unlink2, writeFile as writeFile32 } from "fs/promises";
+import { cp, mkdir as mkdir6, readFile as readFile6, readdir as readdir4, rename as rename3, rm as rm4, unlink as unlink2, writeFile as writeFile32 } from "fs/promises";
 import { request as httpRequest } from "http";
+import { createRequire } from "module";
 import { homedir as homedir8 } from "os";
-import { dirname as dirname3, join as join9, resolve as resolve22 } from "path";
+import { dirname as dirname3, join as join9, resolve as resolve22, sep } from "path";
 import { setTimeout as delay2 } from "timers/promises";
 import { fileURLToPath } from "url";
 
@@ -1864,7 +1885,7 @@ function queueLogPath(id) {
 
 // ../../packages/sandbox-docker/dist/index.js
 import { execa as execa15 } from "execa";
-import { readdir as readdir4, rm as rm4, stat as stat7 } from "fs/promises";
+import { readdir as readdir5, rm as rm5, stat as stat7 } from "fs/promises";
 import { join as join12 } from "path";
 
 // ../../packages/core/dist/index.js
@@ -1925,11 +1946,11 @@ import { homedir as homedir10 } from "os";
 import { join as join13 } from "path";
 import { execa as execa16 } from "execa";
 import { existsSync as existsSync3, mkdirSync, renameSync, statSync } from "fs";
-import { basename as basename32, dirname as dirname22, posix, resolve as resolve4 } from "path";
+import { basename as basename4, dirname as dirname22, posix, resolve as resolve4 } from "path";
 import { execa as execa17 } from "execa";
-import { copyFile, mkdtemp as mkdtemp3, readdir as readdir5, readFile as readFile7, rm as rm5, stat as stat8, writeFile as writeFile4 } from "fs/promises";
+import { copyFile, mkdtemp as mkdtemp3, readdir as readdir6, readFile as readFile7, rm as rm6, stat as stat8, writeFile as writeFile4 } from "fs/promises";
 import { homedir as homedir11, tmpdir as tmpdir3 } from "os";
-import { basename as basename4, join as join14, relative as relative2 } from "path";
+import { basename as basename5, join as join14, relative as relative2 } from "path";
 import { execa as execa18 } from "execa";
 function isHostPathHookCommand(command, hostHome) {
   if (typeof command !== "string" || command.length === 0) return false;
@@ -2728,13 +2749,13 @@ async function copyOneEntry(container, entry) {
     throw new Error(`mkdir -p ${parentDir} failed: ${String(mkdir8.stderr).slice(0, 300)}`);
   }
   if (entry.kind === "file") {
-    const cp = await execa22(
+    const cp2 = await execa22(
       "docker",
       ["cp", entry.absSrc, `${container}:${boxDest}`],
       { reject: false }
     );
-    if (cp.exitCode !== 0) {
-      throw new Error(`docker cp failed: ${String(cp.stderr).slice(0, 300)}`);
+    if (cp2.exitCode !== 0) {
+      throw new Error(`docker cp failed: ${String(cp2.stderr).slice(0, 300)}`);
     }
   } else {
     const packed = await execa22(
@@ -3744,6 +3765,54 @@ function isRealAgentCredential(agent, text) {
   }
   return Object.keys(parsed).length > 0;
 }
+async function hostClaudeBackupExpired(path = CREDENTIALS_BACKUP_FILE, now = Date.now()) {
+  try {
+    const parsed = JSON.parse(await readFile32(path, "utf8"));
+    const exp = parsed?.claudeAiOauth?.expiresAt;
+    return typeof exp === "number" && Number.isFinite(exp) && exp < now;
+  } catch {
+    return false;
+  }
+}
+function parseExtractResult(stdout) {
+  return { copied: /\bCOPIED=yes\b/.test(stdout) };
+}
+async function extractVolumeAuthToBackup(opts) {
+  try {
+    await mkdir32(STATE_DIR, { recursive: true });
+    const script = 'COPIED=no; if [ -s /dst/auth.json ]; then cp -a /dst/auth.json "/host-state/$DEST" && COPIED=yes; fi; echo "COPIED=$COPIED"';
+    const { stdout } = await execa4("docker", [
+      "run",
+      "--rm",
+      "--user",
+      "0",
+      "-v",
+      `${opts.volume}:/dst`,
+      "-v",
+      `${STATE_DIR}:/host-state`,
+      "-e",
+      // Pass the destination filename via env so the path isn't interpolated
+      // into the script string (keeps the docker arg list static + injection-safe).
+      `DEST=${basename2(opts.backupFile)}`,
+      opts.image,
+      "sh",
+      "-c",
+      script
+    ]);
+    const result = parseExtractResult(stdout);
+    if (result.copied) await chmod(opts.backupFile, 384).catch(() => {
+    });
+    return result;
+  } catch {
+    return { copied: false };
+  }
+}
+function extractCodexCredentials(volume, image) {
+  return extractVolumeAuthToBackup({ volume, image, backupFile: CODEX_CREDENTIALS_BACKUP_FILE });
+}
+function extractOpencodeCredentials(volume, image) {
+  return extractVolumeAuthToBackup({ volume, image, backupFile: OPENCODE_CREDENTIALS_BACKUP_FILE });
+}
 async function hostBackupHasCredentials(path = CREDENTIALS_BACKUP_FILE) {
   try {
     const parsed = JSON.parse(await readFile32(path, "utf8"));
@@ -4998,7 +5067,7 @@ async function createSnapshot(opts) {
 var CHECKPOINTS_ROOT = join8(homedir7(), ".agentbox", "checkpoints");
 var CHECKPOINT_IMAGE_PREFIX = "agentbox-ckpt-";
 function checkpointImageTag(projectRoot, name) {
-  const mnemonic = sanitizeMnemonic(basename3(projectRoot));
+  const mnemonic = sanitizeMnemonic(basename22(projectRoot));
   return `${CHECKPOINT_IMAGE_PREFIX}${hashProjectPath(projectRoot)}_${mnemonic}:${name}`;
 }
 function projectCheckpointsDir(projectRoot) {
@@ -5348,6 +5417,7 @@ async function ensureHomeOwnedByVscode(container) {
 var STATE_DIR22 = join9(homedir8(), ".agentbox");
 var PID_FILE = join9(STATE_DIR22, "relay.pid");
 var LOG_FILE = join9(STATE_DIR22, "relay.log");
+var RELAY_HOME_DIR = join9(STATE_DIR22, "relay");
 var PORT = DEFAULT_RELAY_PORT;
 var ENDPOINT = {
   // host.docker.internal is the Docker Desktop / OrbStack-supplied alias for
@@ -5358,6 +5428,13 @@ var ENDPOINT = {
   hostUrl: `http://127.0.0.1:${String(PORT)}`,
   port: PORT
 };
+function shouldReclaimForVersion(health, currentVersion) {
+  if (health.cliEntry === false) return true;
+  if (typeof health.version === "string" && health.version.length > 0 && typeof currentVersion === "string" && currentVersion.length > 0 && health.version !== currentVersion) {
+    return true;
+  }
+  return false;
+}
 async function ensureRelay(opts = {}) {
   const log = opts.onLog ?? (() => {
   });
@@ -5366,12 +5443,19 @@ async function ensureRelay(opts = {}) {
     await removeContainer(RELAY_CONTAINER_NAME);
     log(`removed legacy relay container ${RELAY_CONTAINER_NAME}`);
   }
+  const currentVersion = process.env.AGENTBOX_CLI_VERSION;
   const health = await fetchHealthz(500);
   if (health !== null) {
-    if (health.cliEntry !== false) {
+    if (!shouldReclaimForVersion(health, currentVersion)) {
       return ENDPOINT;
     }
-    log("relay is alive but lacks AGENTBOX_CLI_ENTRY (cp/download/checkpoint would fail) \u2014 reclaiming");
+    if (health.cliEntry === false) {
+      log("relay is alive but lacks AGENTBOX_CLI_ENTRY (cp/download/checkpoint would fail) \u2014 reclaiming");
+    } else {
+      log(
+        `relay was spawned by agentbox ${health.version ?? "?"} but this CLI is ${currentVersion ?? "?"} \u2014 reclaiming to keep the relay version-consistent`
+      );
+    }
     await reclaimRelay(health.pid, log);
   } else {
     const existingPid = await readPidFile();
@@ -5388,8 +5472,9 @@ async function ensureRelay(opts = {}) {
       });
     }
   }
-  const relayBin = resolveRelayBin();
-  const cliEntry = resolveCliEntry();
+  const staged = await stageRelayHome(currentVersion ?? "", log).catch(() => null);
+  const relayBin = staged?.relayBin ?? resolveRelayBin();
+  const cliEntry = staged?.cliEntry ?? resolveCliEntry();
   if (cliEntry === null) {
     throw new Error(
       "cannot start the host relay: agentbox CLI entry not found (is the build complete / dist present?). Set AGENTBOX_CLI_ENTRY to override."
@@ -5411,7 +5496,7 @@ async function reclaimRelay(reportedPid, log) {
   });
   if (await pingHealthz(300)) {
     throw new Error(
-      `a relay without AGENTBOX_CLI_ENTRY is still listening on :${String(PORT)} and could not be stopped (reported pid ${String(reportedPid ?? "unknown")}); kill it manually and retry`
+      `a relay is still listening on :${String(PORT)} and could not be stopped (reported pid ${String(reportedPid ?? "unknown")}); kill it manually and retry`
     );
   }
 }
@@ -5494,6 +5579,80 @@ function resolveCliEntry() {
   }
   return null;
 }
+async function stageRelayHome(version, log) {
+  if (!version || version === "0.0.0-dev") return null;
+  if (process.env.AGENTBOX_RELAY_BIN || process.env.AGENTBOX_CLI_ENTRY) return null;
+  const cliRoot = findCliRoot(dirname3(fileURLToPath(import.meta.url)));
+  if (cliRoot === null) return null;
+  const homeDir = join9(RELAY_HOME_DIR, version);
+  const stagedEntry = join9(homeDir, "dist", "index.js");
+  const stagedBin = join9(homeDir, "runtime", "relay", "bin.cjs");
+  if (existsSync2(stagedEntry) && existsSync2(stagedBin)) {
+    return { relayBin: stagedBin, cliEntry: stagedEntry };
+  }
+  const nodeModules = resolveDepRoot(join9(cliRoot, "dist", "index.js"));
+  if (nodeModules === null) return null;
+  const tmpDir = `${homeDir}.tmp-${String(process.pid)}`;
+  try {
+    await mkdir6(RELAY_HOME_DIR, { recursive: true });
+    await rm4(tmpDir, { recursive: true, force: true });
+    await mkdir6(tmpDir, { recursive: true });
+    for (const sub of ["dist", "runtime", "share"]) {
+      const src = join9(cliRoot, sub);
+      if (existsSync2(src)) await cp(src, join9(tmpDir, sub), { recursive: true });
+    }
+    await cp(nodeModules, join9(tmpDir, "node_modules"), { recursive: true, dereference: true });
+    await rm4(homeDir, { recursive: true, force: true });
+    await rename3(tmpDir, homeDir);
+  } catch (err) {
+    await rm4(tmpDir, { recursive: true, force: true }).catch(() => {
+    });
+    if (existsSync2(stagedEntry) && existsSync2(stagedBin)) {
+      return { relayBin: stagedBin, cliEntry: stagedEntry };
+    }
+    log(`relay home staging failed (${err instanceof Error ? err.message : String(err)}); using bundle paths`);
+    return null;
+  }
+  log(`staged relay home for ${version} at ${homeDir}`);
+  await gcOldRelayHomes(version).catch(() => {
+  });
+  return { relayBin: stagedBin, cliEntry: stagedEntry };
+}
+function findCliRoot(moduleDir) {
+  for (const root of [resolve22(moduleDir, ".."), resolve22(moduleDir, "..", "..")]) {
+    if (existsSync2(join9(root, "dist", "index.js")) && existsSync2(join9(root, "runtime", "relay", "bin.cjs"))) {
+      return root;
+    }
+  }
+  return null;
+}
+function resolveDepRoot(fromFile) {
+  try {
+    const req = createRequire(fromFile);
+    const main = req.resolve("commander");
+    if (main.includes(`${sep}.pnpm${sep}`)) return null;
+    const marker = `${sep}node_modules${sep}`;
+    const idx = main.lastIndexOf(marker);
+    if (idx === -1) return null;
+    const nm = main.slice(0, idx + marker.length - 1);
+    return existsSync2(join9(nm, "commander")) ? nm : null;
+  } catch {
+    return null;
+  }
+}
+async function gcOldRelayHomes(keepVersion) {
+  let entries;
+  try {
+    entries = await readdir4(RELAY_HOME_DIR);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    if (name === keepVersion) continue;
+    await rm4(join9(RELAY_HOME_DIR, name), { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
 async function stopRelay() {
   const pid = await readPidFile();
   if (pid === null) {
@@ -5532,7 +5691,7 @@ async function getRelayStatus() {
     pidAlive: pidAlive2,
     port: PORT,
     endpoint: ENDPOINT,
-    health: health === null ? null : { boxes: health.boxes, events: health.events },
+    health: health === null ? null : { boxes: health.boxes, events: health.events, version: health.version, commit: health.commit },
     pidFile: PID_FILE,
     logFile: LOG_FILE
   };
@@ -5577,7 +5736,9 @@ function fetchHealthz(timeoutMs) {
                 boxes: parsed.boxes,
                 events: parsed.events,
                 pid: typeof parsed.pid === "number" ? parsed.pid : void 0,
-                cliEntry: typeof parsed.cliEntry === "boolean" ? parsed.cliEntry : void 0
+                cliEntry: typeof parsed.cliEntry === "boolean" ? parsed.cliEntry : void 0,
+                version: typeof parsed.version === "string" && parsed.version.length > 0 ? parsed.version : void 0,
+                commit: typeof parsed.commit === "string" && parsed.commit.length > 0 ? parsed.commit : void 0
               });
             } else {
               resolveP(null);
@@ -5930,7 +6091,7 @@ function generateBoxId() {
   return randomBytes3(4).toString("hex");
 }
 function sanitizeBasename(workspacePath) {
-  const raw = basename2(resolve3(workspacePath));
+  const raw = basename3(resolve3(workspacePath));
   return raw.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/-+/g, "-").replace(/^[-._]+|[-._]+$/g, "").slice(0, 30).replace(/[-._]+$/, "");
 }
 function defaultBoxName(workspacePath, id) {
@@ -6021,7 +6182,9 @@ async function createBox(opts) {
   const imageRef = checkpointImage ?? opts.image ?? DEFAULT_BOX_IMAGE;
   const ensureRef = checkpointImage ? opts.image ?? DEFAULT_BOX_IMAGE : imageRef;
   const { built } = await ensureImage(ensureRef, {
-    onProgress: (line) => log(`[image] ${line}`)
+    onProgress: (line) => log(`[image] ${line}`),
+    allowPull: opts.allowPull,
+    registry: opts.imageRegistry
   });
   log(built ? `built image ${ensureRef}` : `using cached image ${imageRef}`);
   let relayUp = false;
@@ -6771,10 +6934,11 @@ async function listBoxes() {
         };
         return {
           ...b,
-          state: "running",
+          state: b.cloud?.lastState ?? "running",
           endpoints: endpoints2,
           claudeActivity: persisted2?.claude.state,
           claudeSessionTitle: persisted2?.claude.sessionTitle,
+          claudeQuestion: persisted2?.claude.state === "question" ? persisted2.claude.question : void 0,
           codexActivity: persisted2?.codex?.state,
           codexSessionTitle: persisted2?.codex?.sessionTitle,
           opencodeSessionTitle: persisted2?.opencode?.sessionTitle,
@@ -6795,6 +6959,7 @@ async function listBoxes() {
         endpoints,
         claudeActivity: persisted?.claude.state,
         claudeSessionTitle: persisted?.claude.sessionTitle,
+        claudeQuestion: persisted?.claude.state === "question" ? persisted.claude.question : void 0,
         codexActivity: persisted?.codex?.state,
         codexSessionTitle: persisted?.codex?.sessionTitle,
         opencodeSessionTitle: persisted?.opencode?.sessionTitle,
@@ -7065,14 +7230,14 @@ async function destroyBox(idOrName, opts = {}) {
   let removedSnapshot = null;
   if (box.snapshotDir && !opts.keepSnapshot) {
     try {
-      await rm4(box.snapshotDir, { recursive: true, force: true });
+      await rm5(box.snapshotDir, { recursive: true, force: true });
       removedSnapshot = box.snapshotDir;
     } catch {
       removedSnapshot = null;
     }
   }
   try {
-    await rm4(boxRunDirFor(box), { recursive: true, force: true });
+    await rm5(boxRunDirFor(box), { recursive: true, force: true });
   } catch {
   }
   await removeBoxRecord(box.id);
@@ -7080,7 +7245,7 @@ async function destroyBox(idOrName, opts = {}) {
 }
 async function listSnapshotDirs() {
   try {
-    const entries = await readdir4(SNAPSHOTS_ROOT, { withFileTypes: true });
+    const entries = await readdir5(SNAPSHOTS_ROOT, { withFileTypes: true });
     return entries.filter((e) => e.isDirectory()).map((e) => join12(SNAPSHOTS_ROOT, e.name));
   } catch {
     return [];
@@ -7088,7 +7253,7 @@ async function listSnapshotDirs() {
 }
 async function listBoxDirs() {
   try {
-    const entries = await readdir4(BOXES_ROOT, { withFileTypes: true });
+    const entries = await readdir5(BOXES_ROOT, { withFileTypes: true });
     return entries.filter((e) => e.isDirectory()).map((e) => join12(BOXES_ROOT, e.name));
   } catch {
     return [];
@@ -7184,13 +7349,13 @@ async function pruneBoxes(opts = {}) {
   for (const v of orphanVolumes) await removeVolume(v);
   for (const d of orphanSnapshots) {
     try {
-      await rm4(d, { recursive: true, force: true });
+      await rm5(d, { recursive: true, force: true });
     } catch {
     }
   }
   for (const d of orphanBoxDirs) {
     try {
-      await rm4(d, { recursive: true, force: true });
+      await rm5(d, { recursive: true, force: true });
     } catch {
     }
   }
@@ -7455,7 +7620,7 @@ function asText(s) {
 async function uploadToBox(box, hostSrc, boxDst) {
   const srcAbs = resolve4(hostSrc);
   if (!existsSync3(srcAbs)) throw new Error(`source not found: ${hostSrc}`);
-  const srcBasename = basename32(srcAbs);
+  const srcBasename = basename4(srcAbs);
   const srcParent = dirname22(srcAbs);
   let boxParent;
   let finalName;
@@ -7539,7 +7704,7 @@ async function downloadFromBox(box, boxSrc, hostDst) {
     finalName = srcBasename;
   } else {
     hostParent = dirname22(dstAbs);
-    finalName = basename32(dstAbs);
+    finalName = basename4(dstAbs);
   }
   mkdirSync(hostParent, { recursive: true });
   const finalPath = posix.join(hostParent, finalName);
@@ -7575,6 +7740,8 @@ var dockerProvider = {
       fromBranch: req.fromBranch,
       useBranch: req.useBranch,
       image: req.image,
+      allowPull: req.allowPull,
+      imageRegistry: req.imageRegistry,
       onLog: req.onLog,
       claudeConfig: po.claudeConfig,
       claudeEnv: po.claudeEnv,
@@ -7681,15 +7848,19 @@ var dockerProvider = {
         return {};
       }
     }
-    opts.onLog?.(`building docker image ${ref}\u2026`);
-    await buildImage({ ref, onProgress: opts.onLog });
+    const { source } = await pullOrBuild(ref, fingerprint, {
+      onProgress: opts.onLog,
+      allowPull: opts.force ? false : opts.allowPull,
+      registry: opts.registry
+    });
     if (fingerprint) {
-      writePreparedDockerState({ imageRef: ref, contextSha256: fingerprint.contextSha256 });
       opts.onLog?.(
-        `docker image ${ref} built; recorded fingerprint ${fingerprint.contextSha256.slice(0, 12)}`
+        `docker image ${ref} ${source}; recorded fingerprint ${fingerprint.contextSha256.slice(0, 12)}`
       );
     } else {
-      opts.onLog?.(`docker image ${ref} built (fingerprint unavailable, prepared state not written)`);
+      opts.onLog?.(
+        `docker image ${ref} ${source} (fingerprint unavailable, prepared state not written)`
+      );
     }
     return {};
   }
@@ -7708,7 +7879,7 @@ async function findBrokenSymlinks2(root) {
   async function walk(dir) {
     let entries;
     try {
-      entries = await readdir5(dir, { withFileTypes: true });
+      entries = await readdir6(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -7736,7 +7907,7 @@ function emptyResult(warnings = []) {
   }, warnings };
 }
 async function tarballFromDir(stageDir, agent) {
-  const tarballPath = join14(tmpdir3(), `agentbox-${agent}-${basename4(stageDir)}.tar.gz`);
+  const tarballPath = join14(tmpdir3(), `agentbox-${agent}-${basename5(stageDir)}.tar.gz`);
   await execa18("tar", ["-czf", tarballPath, "-C", stageDir, "."], {
     env: { ...process.env, COPYFILE_DISABLE: "1" }
   });
@@ -7745,7 +7916,7 @@ async function tarballFromDir(stageDir, agent) {
 function makeCleanup(paths) {
   return async () => {
     for (const p of paths) {
-      await rm5(p, { recursive: true, force: true });
+      await rm6(p, { recursive: true, force: true });
     }
   };
 }
@@ -7761,8 +7932,8 @@ async function stageSingleFileTarball(agent, sourcePath, tarballEntryName) {
       warnings: []
     };
   } catch (err) {
-    await rm5(stageDir, { recursive: true, force: true });
-    if (tarballPath) await rm5(tarballPath, { force: true });
+    await rm6(stageDir, { recursive: true, force: true });
+    if (tarballPath) await rm6(tarballPath, { force: true });
     throw err;
   }
 }
@@ -7845,7 +8016,7 @@ async function stageClaudeStaticForUpload(opts = {}) {
     const pluginsDir = join14(stageDir, "plugins");
     if (await pathExists7(pluginsDir)) {
       try {
-        const entries = await readdir5(pluginsDir, { withFileTypes: true });
+        const entries = await readdir6(pluginsDir, { withFileTypes: true });
         for (const ent of entries) {
           if (!ent.isFile() || !ent.name.endsWith(".json")) continue;
           const file = join14(pluginsDir, ent.name);
@@ -7863,8 +8034,8 @@ async function stageClaudeStaticForUpload(opts = {}) {
       warnings: []
     };
   } catch (err) {
-    await rm5(stageDir, { recursive: true, force: true });
-    if (tarballPath) await rm5(tarballPath, { force: true });
+    await rm6(stageDir, { recursive: true, force: true });
+    if (tarballPath) await rm6(tarballPath, { force: true });
     throw err;
   }
 }
@@ -7924,16 +8095,17 @@ async function stageCodexStaticForUpload(opts = {}) {
       warnings: []
     };
   } catch (err) {
-    await rm5(stageDir, { recursive: true, force: true });
-    if (tarballPath) await rm5(tarballPath, { force: true });
+    await rm6(stageDir, { recursive: true, force: true });
+    if (tarballPath) await rm6(tarballPath, { force: true });
     throw err;
   }
 }
 async function stageCodexCredentialsForUpload(opts = {}) {
-  if (await pathExists7(CODEX_CREDENTIALS_BACKUP_FILE)) {
-    return stageSingleFileTarball("codex-creds", CODEX_CREDENTIALS_BACKUP_FILE, "auth.json");
-  }
   const hostHome = opts.hostHome ?? homedir11();
+  const cloudBackup = join14(hostHome, ".agentbox", "codex-credentials.json");
+  if (await pathExists7(cloudBackup)) {
+    return stageSingleFileTarball("codex-creds", cloudBackup, "auth.json");
+  }
   const hostAuth = join14(hostHome, ".codex", "auth.json");
   if (!await pathExists7(hostAuth)) return emptyResult([CODEX_KEYCHAIN_WARNING]);
   return stageSingleFileTarball("codex-creds", hostAuth, "auth.json");
@@ -7991,16 +8163,17 @@ async function stageOpencodeStaticForUpload(opts = {}) {
       warnings: []
     };
   } catch (err) {
-    await rm5(stageDir, { recursive: true, force: true });
-    if (tarballPath) await rm5(tarballPath, { force: true });
+    await rm6(stageDir, { recursive: true, force: true });
+    if (tarballPath) await rm6(tarballPath, { force: true });
     throw err;
   }
 }
 async function stageOpencodeCredentialsForUpload(opts = {}) {
-  if (await pathExists7(OPENCODE_CREDENTIALS_BACKUP_FILE)) {
-    return stageSingleFileTarball("opencode-creds", OPENCODE_CREDENTIALS_BACKUP_FILE, "auth.json");
-  }
   const hostHome = opts.hostHome ?? homedir11();
+  const cloudBackup = join14(hostHome, ".agentbox", "opencode-credentials.json");
+  if (await pathExists7(cloudBackup)) {
+    return stageSingleFileTarball("opencode-creds", cloudBackup, "auth.json");
+  }
   const hostAuth = join14(hostHome, ".local", "share", "opencode", "auth.json");
   if (!await pathExists7(hostAuth)) return emptyResult();
   return stageSingleFileTarball("opencode-creds", hostAuth, "auth.json");
@@ -8123,6 +8296,11 @@ export {
   CODEX_CREDENTIALS_BACKUP_FILE,
   OPENCODE_CREDENTIALS_BACKUP_FILE,
   isRealAgentCredential,
+  hostClaudeBackupExpired,
+  parseExtractResult,
+  extractVolumeAuthToBackup,
+  extractCodexCredentials,
+  extractOpencodeCredentials,
   hostBackupHasCredentials,
   parseSyncResult,
   syncClaudeCredentials,
@@ -8268,4 +8446,4 @@ export {
   browserSessionActive,
   ensureBoxBrowser
 };
-//# sourceMappingURL=chunk-NCJP5MTN.js.map
+//# sourceMappingURL=chunk-CDKVD6UO.js.map