@snappedly-tools/shipyard 0.7.0-staging.36082887921 → 0.7.0

package/dist/main.js

@@ -1,11 +1,13 @@
 #!/usr/bin/env node
-import { CODEX_MODELS, purgeRunLogs, withFriendlyErrors, DEFAULT_LOG_RETENTION_DAYS, resolveEnv } from './chunk-JI3HDDMS.js';
-import { buildImage, removeImage, RunnerLifecycleError, removeRepositoryRunner, defaultImageName, validateExistingRepositoryRunner, RUNNER_INSTALL_METADATA, RUNNER_CONTROLLER_LOCK, recoverRepositoryRunner, REPOSITORY_RUNNER_OWNER_ENV, removeOwnedRepositoryRunnerContainers, RUNNER_WORK_DIR } from './chunk-44I2BL6E.js';
-import { SANDBOX_REPO_DIR, Display, InitError, ACTIVATION_LABEL, PRODUCT_NAME, CONFIG_DIR, CLI_NAME, ClackDisplay, ConfigDirError, ExecHostError, LOCKS_DIR, RUNNER_DIR, assertProtectedDirectoryIdentities, repositoryRunnerEnvironment } from './chunk-L6PX5QTU.js';
+import { CODEX_MODELS, purgeRunLogs, withFriendlyErrors, DEFAULT_LOG_RETENTION_DAYS, resolveEnv } from './chunk-56TDSWFU.js';
+import { buildImage, removeImage, validateExistingRepositoryRunner, RunnerLifecycleError, RUNNER_INSTALL_METADATA, removeRepositoryRunner, RUNNER_CONTROLLER_LOCK, recoverRepositoryRunner, REPOSITORY_RUNNER_OWNER_ENV, removeOwnedRepositoryRunnerContainers, RUNNER_WORK_DIR } from './chunk-WAXEMZUV.js';
+import { SANDBOX_REPO_DIR, Display, InitError, ACTIVATION_LABEL, PRODUCT_NAME, CONFIG_DIR, CLI_NAME, ClackDisplay, RUNNER_DIR, RUNNER_SANDBOX_MASK_DIR, assertProtectedDirectoryIdentities, repositoryRunnerEnvironment, ConfigDirError, defaultImageName, ExecHostError, LOCKS_DIR } from './chunk-FDYOTN55.js';
+import './chunk-KMGNFXKN.js';
+import './chunk-ACD46ZM4.js';
 import { NodeContext, NodeRuntime, NodeFileSystem } from '@effect/platform-node';
-import { Effect, Layer, Option, Exit, Cause } from 'effect';
+import { Effect, Layer, Option } from 'effect';
 import { Options, Command } from '@effect/cli';
-import * as clack2 from '@clack/prompts';
+import * as clack from '@clack/prompts';
 import { execFile, execSync, spawn, execFileSync } from 'child_process';
 import { existsSync, constants, statSync } from 'fs';
 import { join, resolve, dirname } from 'path';
@@ -17,12 +19,18 @@ import { createHash } from 'crypto';
 import { chmod, lstat, realpath, rm, mkdir, writeFile, readFile, access } from 'fs/promises';
 import 'module';
 
-var configDirExists = (repoDir) => Effect.gen(function* () {
+var pathExists = (path) => Effect.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
-  return yield* fs.exists(join(repoDir, CONFIG_DIR)).pipe(Effect.catchAll(() => Effect.succeed(false)));
+  return yield* fs.exists(path).pipe(Effect.catchAll(() => Effect.succeed(false)));
+});
+var getConfigDirState = (repoDir) => Effect.gen(function* () {
+  const canonicalExists = yield* pathExists(join(repoDir, CONFIG_DIR));
+  if (canonicalExists) return "canonical";
+  return "missing";
 });
 var requireCanonicalConfigDir = (repoDir) => Effect.gen(function* () {
-  if (!(yield* configDirExists(repoDir))) {
+  const state = yield* getConfigDirState(repoDir);
+  if (state === "missing") {
     return yield* Effect.fail(
       new ConfigDirError({
         message: `No ${CONFIG_DIR}/ found. Run \`${CLI_NAME} init\` first.`
@@ -32,7 +40,8 @@ var requireCanonicalConfigDir = (repoDir) => Effect.gen(function* () {
   return join(repoDir, CONFIG_DIR);
 });
 var assertConfigDirAvailable = (repoDir) => Effect.gen(function* () {
-  if (yield* configDirExists(repoDir)) {
+  const state = yield* getConfigDirState(repoDir);
+  if (state === "canonical") {
     return yield* Effect.fail(
       new ConfigDirError({
         message: `${CONFIG_DIR}/ directory already exists. ${CLI_NAME} did not modify it. Use the existing configuration or remove it deliberately after preserving any active worktrees before re-initializing.`
@@ -62,16 +71,11 @@ var CODEX_CHATGPT_AUTH_OPTIONS = `{
     },
   ],
 }`;
-var roleModelEnvExample = (agentName) => agentName === "codex" ? `# Optional model choices for Shipyard workflows.
-# Choose models available to your Codex CLI account: https://learn.chatgpt.com/docs/models
-# The provider must support each value. Aliases can change their target over time.
-# SHIPYARD_ROUTINE_MODEL=gpt-6-luna
-# SHIPYARD_STRONG_MODEL=gpt-6-sol` : `# Optional model choices for Shipyard workflows.
-# Choose aliases or model IDs available to your Claude Code provider: https://code.claude.com/docs/en/model-config
-# The provider must support each value. Aliases can change their target over time.
-# SHIPYARD_ROUTINE_MODEL=sonnet
-# SHIPYARD_STRONG_MODEL=opus`;
 var TEMPLATES = [
+  {
+    name: "blank",
+    description: "Bare scaffold \u2014 write your own prompt and orchestration"
+  },
   {
     name: "simple-loop",
     description: "Implements standalone issues one by one and opens review PRs"
@@ -171,7 +175,7 @@ RUN apt-get update && apt-get install -y \\
 
 # Build-args for UID/GID alignment: shipyard docker build-image
 # defaults these to the host user's UID/GID so image-built files
-# and explicit mounted files share an owner without runtime chown.
+# and bind-mounted files share an owner without runtime chown.
 ARG AGENT_UID=1000
 ARG AGENT_GID=1000
 
@@ -187,8 +191,8 @@ ENV PATH="/home/agent/.local/bin:$PATH"
 
 WORKDIR /home/agent
 
-# Shipyard syncs Git history into a sandbox-owned repository at ${SANDBOX_REPO_DIR}
-# and runs agent commands from ${SANDBOX_REPO_DIR}.
+# In worktree sandbox mode, Shipyard bind-mounts the git worktree at ${SANDBOX_REPO_DIR}
+# and overrides the working directory to ${SANDBOX_REPO_DIR} at container start.
 # Structure your Dockerfile so that ${SANDBOX_REPO_DIR} can serve as the project root.
 ENTRYPOINT ["sleep", "infinity"]
 `;
@@ -205,7 +209,7 @@ RUN apt-get update && apt-get install -y \\
 
 # Build-args for UID/GID alignment: shipyard docker build-image
 # defaults these to the host user's UID/GID so image-built files
-# and explicit mounted files share an owner without runtime chown.
+# and bind-mounted files share an owner without runtime chown.
 ARG AGENT_UID=1000
 ARG AGENT_GID=1000
 
@@ -219,8 +223,8 @@ USER \${AGENT_UID}:\${AGENT_GID}
 
 WORKDIR /home/agent
 
-# Shipyard syncs Git history into a sandbox-owned repository at ${SANDBOX_REPO_DIR}
-# and runs agent commands from ${SANDBOX_REPO_DIR}.
+# In worktree sandbox mode, Shipyard bind-mounts the git worktree at ${SANDBOX_REPO_DIR}
+# and overrides the working directory to ${SANDBOX_REPO_DIR} at container start.
 # Structure your Dockerfile so that ${SANDBOX_REPO_DIR} can serve as the project root.
 ENTRYPOINT ["sleep", "infinity"]
 `;
@@ -335,26 +339,34 @@ var copyTemplateFiles = (templateDir, destDir, mainFilename) => Effect.gen(funct
     { concurrency: "unbounded" }
   );
 });
-var rewriteMainTs = (configDir, agent, model, modelExplicit, sandboxProvider, mainFilename, codexAuth) => Effect.gen(function* () {
+var rewriteMainTs = (configDir, agent, model, sandboxProvider, mainFilename, codexAuth) => Effect.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   const mainTsPath = join(configDir, mainFilename);
   const exists = yield* fs.exists(mainTsPath).pipe(Effect.mapError((e) => new Error(e.message)));
   if (!exists) return;
   let content = yield* fs.readFileString(mainTsPath).pipe(Effect.mapError((e) => new Error(e.message)));
+  if (mainFilename === "main.ts") {
+    content = content.replace(/main\.mts/g, "main.ts");
+  }
   content = content.replace(
     new RegExp(`\\b${TEMPLATE_AGENT_FACTORY}\\b`, "g"),
     agent.factoryImport
   );
+  const factoryCallRe = new RegExp(
+    `${agent.factoryImport}\\(([^)\\n]*)\\)`,
+    "g"
+  );
   content = content.replace(
-    "const CODEX_PROVIDER = true;",
-    `const CODEX_PROVIDER = ${agent.name === "codex"};`
+    factoryCallRe,
+    (match, modelExpression) => {
+      const keepsConfiguredModel = agent.name === "codex" && model === CODEX_MODELS.routine.model && /^(?:[A-Za-z_$][\w$]*\.)*CODEX_MODELS\.[A-Za-z_$][\w$]*$/.test(
+        modelExpression.trim()
+      );
+      return keepsConfiguredModel ? match : `${agent.factoryImport}("${model}")`;
+    }
   );
-  if (agent.name !== "codex" || modelExplicit) {
-    const modelLiteral = JSON.stringify(model);
-    content = content.replace(
-      /shipyard\.CODEX_MODELS\.(?:routine|strong)/g,
-      modelLiteral
-    );
+  if (agent.name !== "codex" || model !== CODEX_MODELS.routine.model) {
+    content = content.replace(/\bCODEX_MODELS,\s*/g, "");
   }
   if (agent.name === "codex" && codexAuth === "chatgpt") {
     content = content.replace(
@@ -422,20 +434,13 @@ var scaffold = (repoDir, options) => Effect.gen(function* () {
   const {
     agent,
     model,
-    modelExplicit = false,
-    templateName = "simple-loop",
+    templateName = "blank",
     issueTracker = ISSUE_TRACKER_REGISTRY[0],
     // default: github-issues
     sandboxProvider = SANDBOX_PROVIDER_REGISTRY[0],
     // default: docker
     codexAuth = "api-key"
   } = options;
-  const totalProgressSteps = 5;
-  const reportProgress2 = (current, message) => options.onProgress?.({
-    current,
-    total: totalProgressSteps,
-    message
-  });
   if (codexAuth === "chatgpt" && agent.name !== "codex") {
     return yield* Effect.fail(
       new Error(
@@ -447,14 +452,11 @@ var scaffold = (repoDir, options) => Effect.gen(function* () {
   yield* assertConfigDirAvailable(repoDir);
   const configDir = join(repoDir, CONFIG_DIR);
   const mainFilename = yield* detectMainFilename(repoDir);
-  reportProgress2(1, "Validated repository and configuration");
   yield* fs.makeDirectory(configDir, { recursive: false }).pipe(Effect.mapError((e) => new Error(e.message)));
   const templateDir = yield* getTemplateDir(templateName);
-  reportProgress2(2, `Prepared ${CONFIG_DIR}/ directory`);
   const envExampleParts = [
     agent.name === "codex" && codexAuth === "chatgpt" ? CODEX_CHATGPT_ENV_EXAMPLE : agent.envExample
   ];
-  envExampleParts.push(roleModelEnvExample(agent.name));
   if (issueTracker.envExample) {
     envExampleParts.push(issueTracker.envExample);
   }
@@ -473,19 +475,15 @@ var scaffold = (repoDir, options) => Effect.gen(function* () {
     ],
     { concurrency: "unbounded" }
   );
-  reportProgress2(3, "Wrote configuration and template files");
   yield* rewriteMainTs(
     configDir,
     agent,
     model,
-    modelExplicit,
     sandboxProvider,
     mainFilename,
     codexAuth
   );
-  reportProgress2(4, "Configured selected agent and sandbox");
   yield* substituteTemplateArgs(configDir, issueTracker);
-  reportProgress2(5, "Applied issue tracker settings");
   return { mainFilename };
 });
 var resolveCodexAuthMode = async (options) => {
@@ -564,11 +562,6 @@ var ensureCodexChatGptAuth = (options) => {
     });
   }
 };
-var runEffectPromise = async (effect) => {
-  const exit = await Effect.runPromiseExit(effect);
-  if (Exit.isFailure(exit)) throw Cause.squash(exit.cause);
-  return exit.value;
-};
 var REPOSITORY_RUNNER_WORKFLOW_PATH = ".github/workflows/shipyard-wake.yml";
 var REPOSITORY_RUNNER_WAKE_EXECUTABLE = "shipyard-wake";
 var REPOSITORY_RUNNER_WORKFLOW = `name: Shipyard wake-up
@@ -763,22 +756,6 @@ var RELEASES_API = "https://api.github.com/repos/actions/runner/releases/latest"
 var RunnerInstallError = class extends Error {
   name = "RunnerInstallError";
 };
-var RunnerInstallConflictError = class extends RunnerInstallError {
-  constructor(repository, runners) {
-    const names = runners.map(({ name }) => name).join(", ");
-    super(
-      `A repository runner labeled \`${ACTIVATION_LABEL}\` is already registered for ${repository}: ${names}. Remove it before installing another.`
-    );
-    this.repository = repository;
-    this.runners = runners;
-    const details = runners.map(
-      ({ id, name, status, busy }) => `${name}${id === void 0 ? "" : ` (#${id})`} (${status}${busy ? ", busy" : ""})`
-    ).join(", ");
-    this.confirmationMessage = `GitHub has ${runners.length} repository runner${runners.length === 1 ? "" : "s"} labeled \`${ACTIVATION_LABEL}\` for ${repository}: ${details}. Delete ${runners.length === 1 ? "this registration" : "these registrations"} and install a replacement?`;
-  }
-  name = "RunnerInstallConflictError";
-  confirmationMessage;
-};
 var defaultAdapters = {
   platform: () => process.platform,
   arch: () => process.arch,
@@ -902,7 +879,9 @@ var selectArm64Asset = (release) => {
 var appendRunnerIgnores = async (gitignorePath, adapters) => {
   const current = await adapters.exists(gitignorePath) ? await adapters.readText(gitignorePath) : "";
   const lines = new Set(current.split(/\r?\n/));
-  const additions = [`${RUNNER_DIR}/`].filter((line) => !lines.has(line));
+  const additions = [`${RUNNER_DIR}/`, `${RUNNER_SANDBOX_MASK_DIR}/`].filter(
+    (line) => !lines.has(line)
+  );
   if (additions.length === 0) return;
   const prefix = current.length === 0 || current.endsWith("\n") ? current : `${current}
 `;
@@ -913,88 +892,6 @@ var commandFailure = (purpose, error) => new RunnerInstallError(
   `${purpose} failed: ${error instanceof Error ? error.message : String(error)}`
 );
 var reportProgress = (options, current, total, message) => options.onProgress?.({ current, total, message });
-var parseExistingRunnerRegistrations = (stdout) => {
-  const lines = stdout.trim().split(/\r?\n/).filter(Boolean);
-  return lines.map((line) => {
-    let value;
-    try {
-      value = JSON.parse(line);
-    } catch {
-      return { id: void 0, name: line, status: "unknown", busy: false };
-    }
-    if (typeof value !== "object" || value === null) {
-      throw new RunnerInstallError(
-        "GitHub returned invalid repository runner information."
-      );
-    }
-    const registration = value;
-    if (typeof registration.id !== "number" || !Number.isInteger(registration.id) || registration.id <= 0 || typeof registration.name !== "string" || registration.name.length === 0 || typeof registration.status !== "string" || typeof registration.busy !== "boolean") {
-      throw new RunnerInstallError(
-        "GitHub returned invalid repository runner information."
-      );
-    }
-    return {
-      id: registration.id,
-      name: registration.name,
-      status: registration.status,
-      busy: registration.busy
-    };
-  });
-};
-var removeExistingRepositoryRunnerRegistrations = async (options, adapters = defaultAdapters) => {
-  if (options.conflict.runners.some(({ id }) => id === void 0)) {
-    throw new RunnerInstallError(
-      "GitHub did not provide runner IDs, so Shipyard cannot safely remove the existing registrations. Remove them in GitHub Settings > Actions > Runners, then retry."
-    );
-  }
-  const environment = adapters.environment();
-  const removed = [];
-  for (const runner of options.conflict.runners) {
-    try {
-      await adapters.run(
-        "gh",
-        [
-          "api",
-          "--method",
-          "DELETE",
-          `repos/${options.conflict.repository}/actions/runners/${runner.id}`
-        ],
-        { cwd: options.repoDir, env: environment }
-      );
-      removed.push(runner.name);
-    } catch (error) {
-      const previous = removed.length === 0 ? "" : ` Earlier registrations were already removed: ${removed.join(", ")}.`;
-      throw new RunnerInstallError(
-        `${commandFailure(
-          `Removing GitHub runner ${runner.name} (#${runner.id}) from ${options.conflict.repository}`,
-          error
-        ).message}${previous}`
-      );
-    }
-  }
-};
-var installRepositoryRunnerWithReplacement = async (options, adapters = defaultAdapters) => {
-  try {
-    return await options.install();
-  } catch (error) {
-    if (!(error instanceof RunnerInstallConflictError) || !options.interactive) {
-      throw error;
-    }
-    if (!await options.confirmReplacement(error)) {
-      throw new RunnerInstallError(
-        `${error.message} Existing runner registrations were left unchanged; installation cancelled.`
-      );
-    }
-    await removeExistingRepositoryRunnerRegistrations(
-      {
-        repoDir: options.repoDir,
-        conflict: error
-      },
-      adapters
-    );
-    return options.install();
-  }
-};
 var installRepositoryRunner = async (options, adapters = defaultAdapters) => {
   if (adapters.platform() !== "darwin" || adapters.arch() !== "arm64") {
     throw new RunnerInstallError(
@@ -1003,6 +900,7 @@ var installRepositoryRunner = async (options, adapters = defaultAdapters) => {
   }
   const configDir = join(options.repoDir, CONFIG_DIR);
   const runnerDir = join(configDir, RUNNER_DIR);
+  const maskDir = join(configDir, RUNNER_SANDBOX_MASK_DIR);
   if (!await adapters.exists(configDir)) {
     throw new RunnerInstallError(
       `No ${CONFIG_DIR}/ found. Run \`shipyard init\` in this repository first.`
@@ -1058,6 +956,7 @@ var installRepositoryRunner = async (options, adapters = defaultAdapters) => {
         {
           repoDir: options.repoDir,
           runnerDir,
+          maskDir,
           repository,
           runnerName
         },
@@ -1070,8 +969,10 @@ var installRepositoryRunner = async (options, adapters = defaultAdapters) => {
     }
     await appendRunnerIgnores(join(configDir, ".gitignore"), adapters);
     await adapters.chmod(runnerDir, 448);
+    await adapters.chmod(maskDir, 448);
     await assertProtectedDirectoryIdentities(
       runnerDir,
+      maskDir,
       adapters.inspectDirectory
     ).catch((error) => {
       throw commandFailure("Validating protected runner directories", error);
@@ -1102,7 +1003,7 @@ var installRepositoryRunner = async (options, adapters = defaultAdapters) => {
       "--paginate",
       `repos/${repository}/actions/runners`,
       "--jq",
-      `.runners[] | select(any(.labels[]; .name == "${ACTIVATION_LABEL}")) | {id, name, status, busy}`
+      `.runners[] | select(any(.labels[]; .name == "${ACTIVATION_LABEL}")) | .name`
     ],
     { cwd: options.repoDir, env: hostEnv }
   ).catch((error) => {
@@ -1111,11 +1012,10 @@ var installRepositoryRunner = async (options, adapters = defaultAdapters) => {
       error
     );
   });
-  const existingRegistrations = parseExistingRunnerRegistrations(
-    existing.stdout
-  );
-  if (existingRegistrations.length > 0) {
-    throw new RunnerInstallConflictError(repository, existingRegistrations);
+  if (existing.stdout.trim().length > 0) {
+    throw new RunnerInstallError(
+      `A repository runner labeled \`${ACTIVATION_LABEL}\` is already registered for ${repository}. Remove it before installing another.`
+    );
   }
   reportProgress(
     options,
@@ -1188,13 +1088,18 @@ var installRepositoryRunner = async (options, adapters = defaultAdapters) => {
   await adapters.makeDirectory(runnerDir).catch((error) => {
     throw commandFailure("Creating the protected runner directory", error);
   });
+  if (!await adapters.exists(maskDir)) {
+    await adapters.makeDirectory(maskDir);
+  }
   await assertProtectedDirectoryIdentities(
     runnerDir,
+    maskDir,
     adapters.inspectDirectory
   ).catch((error) => {
     throw commandFailure("Validating protected runner directories", error);
   });
   await adapters.chmod(runnerDir, 448);
+  await adapters.chmod(maskDir, 448);
   reportProgress(
     options,
     5,
@@ -1234,12 +1139,15 @@ var installRepositoryRunner = async (options, adapters = defaultAdapters) => {
       { cwd: runnerDir, env: repositoryRunnerEnvironment(hostEnv) }
     );
   } catch {
-    const cleanup = await Promise.allSettled([adapters.remove(runnerDir)]);
+    const cleanup = await Promise.allSettled([
+      adapters.remove(runnerDir),
+      adapters.remove(maskDir)
+    ]);
     const cleanupSucceeded = cleanup.every(
       (result) => result.status === "fulfilled"
     );
     throw new RunnerInstallError(
-      cleanupSucceeded ? `Registering ${runnerName} failed. Partial local runner files were removed so installation can be retried. Check GitHub Settings > Actions > Runners for an orphan registration; the one-time token was not stored.` : `Registering ${runnerName} failed and partial local runner files could not be fully removed. Remove only ${runnerDir}, check GitHub Settings > Actions > Runners for an orphan registration, then retry. The one-time token was not stored.`
+      cleanupSucceeded ? `Registering ${runnerName} failed. Partial local runner files were removed so installation can be retried. Check GitHub Settings > Actions > Runners for an orphan registration; the one-time token was not stored.` : `Registering ${runnerName} failed and partial local runner files could not be fully removed. Remove only ${runnerDir} and ${maskDir}, check GitHub Settings > Actions > Runners for an orphan registration, then retry. The one-time token was not stored.`
     );
   }
   reportProgress(options, 7, progressTotal, "Registered runner with GitHub");
@@ -1481,6 +1389,7 @@ var requireRunnerContext = async (repoDir, adapters) => {
   }
   const configDir = join(repoDir, CONFIG_DIR);
   const runnerDir = join(configDir, RUNNER_DIR);
+  const maskDir = join(configDir, RUNNER_SANDBOX_MASK_DIR);
   if (!await adapters.exists(configDir)) {
     throw new RunnerControlError(
       `No ${CONFIG_DIR}/ found. Run \`shipyard init\` in this repository first.`
@@ -1630,6 +1539,7 @@ var requireRunnerContext = async (repoDir, adapters) => {
   });
   return {
     runnerDir,
+    maskDir,
     repository,
     metadata,
     hostEnvironment,
@@ -1683,6 +1593,7 @@ var startRepositoryRunnerManaged = async (options, adapters = defaultAdapters2)
     {
       repoDir: options.repoDir,
       runnerDir: context.runnerDir,
+      maskDir: context.maskDir,
       metadata: context.metadata,
       runnerEnvironment: repositoryRunnerEnvironment(context.hostEnvironment),
       dockerEnvironment: context.runtimeEnvironment
@@ -2212,38 +2123,19 @@ var installRunnerCommand = Command.make(
   { registrationToken: registrationTokenOption },
   ({ registrationToken }) => Effect.gen(function* () {
     const display = yield* Display;
-    const repoDir = process.cwd();
-    const result = yield* Effect.tryPromise({
-      try: () => installRepositoryRunnerWithReplacement({
-        repoDir,
-        interactive: process.stdin.isTTY === true,
-        confirmReplacement: async (conflict) => {
-          const confirmed = await clack2.confirm({
-            message: conflict.confirmationMessage,
-            initialValue: false
-          });
-          return !clack2.isCancel(confirmed) && confirmed === true;
-        },
-        install: () => runEffectPromise(
-          display.progress(
-            "Installing repository runner",
-            (report) => Effect.tryPromise({
-              try: () => installRepositoryRunner({
-                repoDir,
-                registrationToken: registrationToken._tag === "Some" ? registrationToken.value : void 0,
-                onProgress: report
-              }),
-              catch: (error) => error instanceof RunnerInstallError ? error : new InitError({
-                message: `Repository runner installation failed: ${error instanceof Error ? error.message : String(error)}`
-              })
-            })
-          )
-        )
-      }),
-      catch: (error) => new InitError({
-        message: error instanceof RunnerInstallError ? error.message : `Repository runner installation failed: ${error instanceof Error ? error.message : String(error)}`
+    const result = yield* display.progress(
+      "Installing repository runner",
+      (report) => Effect.tryPromise({
+        try: () => installRepositoryRunner({
+          repoDir: process.cwd(),
+          registrationToken: registrationToken._tag === "Some" ? registrationToken.value : void 0,
+          onProgress: report
+        }),
+        catch: (error) => new InitError({
+          message: error instanceof RunnerInstallError ? error.message : `Repository runner installation failed: ${error instanceof Error ? error.message : String(error)}`
+        })
       })
-    });
+    );
     yield* display.status(
       `Installed ${result.name} for ${result.repository}.`,
       "success"
@@ -2367,7 +2259,7 @@ var runnerCommand = Command.make(
     purgeRunnerCommand
   ])
 );
-var VERSION = "0.7.0-staging.36082887921" ;
+var VERSION = "0.7.0" ;
 
 // src/cli.ts
 var imageNameOption = Options.text("image-name").pipe(
@@ -2535,7 +2427,7 @@ var runCommand2 = Command.make(
 );
 var templateOption = Options.text("template").pipe(
   Options.withDescription(
-    "Template to scaffold (e.g. simple-loop, parallel-planner)"
+    "Template to scaffold (e.g. blank, simple-loop, parallel-planner)"
   ),
   Options.optional
 );
@@ -2669,12 +2561,12 @@ var initCommand = Command.make(
         yield* failIfNonInteractive(params.flag);
       }
       const confirmed = yield* Effect.promise(
-        () => clack2.confirm({
+        () => clack.confirm({
           message: params.promptMessage,
           initialValue: true
         })
       );
-      if (clack2.isCancel(confirmed)) {
+      if (clack.isCancel(confirmed)) {
         yield* Effect.fail(
           new InitError({ message: params.cancelMessage })
         );
@@ -2699,7 +2591,7 @@ var initCommand = Command.make(
         yield* failIfNonInteractive("--agent");
       }
       const selected = yield* Effect.promise(
-        () => clack2.select({
+        () => clack.select({
           message: "Select an agent:",
           initialValue: DEFAULT_AGENT_NAME,
           options: agents.map((a) => ({
@@ -2709,7 +2601,7 @@ var initCommand = Command.make(
           }))
         })
       );
-      if (clack2.isCancel(selected)) {
+      if (clack.isCancel(selected)) {
         yield* Effect.fail(
           new InitError({ message: "Agent selection cancelled." })
         );
@@ -2722,7 +2614,7 @@ var initCommand = Command.make(
         requested: codexAuthFlag._tag === "Some" ? codexAuthFlag.value : void 0,
         interactive: isInteractive,
         select: async () => {
-          const selected = await clack2.select({
+          const selected = await clack.select({
             message: "How will you authenticate Codex?",
             initialValue: "chatgpt",
             options: [
@@ -2738,7 +2630,7 @@ var initCommand = Command.make(
               }
             ]
           });
-          return clack2.isCancel(selected) ? void 0 : selected;
+          return clack.isCancel(selected) ? void 0 : selected;
         }
       }),
       catch: (error) => error instanceof InitError ? error : new InitError({
@@ -2757,7 +2649,32 @@ var initCommand = Command.make(
         })
       });
     }
-    const selectedSandboxProvider = getSandboxProvider("docker");
+    const sandboxProviders = listSandboxProviders();
+    let selectedSandboxProvider;
+    if (sandboxFlag._tag === "Some") {
+      selectedSandboxProvider = getSandboxProvider(sandboxFlag.value);
+    } else {
+      if (!isInteractive) {
+        yield* failIfNonInteractive("--sandbox");
+      }
+      const selected = yield* Effect.promise(
+        () => clack.select({
+          message: "Select a sandbox provider:",
+          options: sandboxProviders.map((p) => ({
+            value: p.name,
+            label: p.label
+          }))
+        })
+      );
+      if (clack.isCancel(selected)) {
+        yield* Effect.fail(
+          new InitError({
+            message: "Sandbox provider selection cancelled."
+          })
+        );
+      }
+      selectedSandboxProvider = getSandboxProvider(selected);
+    }
     const issueTrackers = listIssueTrackers();
     let selectedIssueTracker;
     if (issueTrackerFlag._tag === "Some") {
@@ -2767,7 +2684,7 @@ var initCommand = Command.make(
         yield* failIfNonInteractive("--issue-tracker");
       }
       const selected = yield* Effect.promise(
-        () => clack2.select({
+        () => clack.select({
           message: "Select an issue tracker:",
           initialValue: "github-issues",
           options: issueTrackers.map((b) => ({
@@ -2776,7 +2693,7 @@ var initCommand = Command.make(
           }))
         })
       );
-      if (clack2.isCancel(selected)) {
+      if (clack.isCancel(selected)) {
         yield* Effect.fail(
           new InitError({
             message: "Issue tracker selection cancelled."
@@ -2793,9 +2710,9 @@ var initCommand = Command.make(
         yield* failIfNonInteractive("--template");
       }
       const selected = yield* Effect.promise(
-        () => clack2.select({
+        () => clack.select({
           message: "Select a template:",
-          initialValue: "simple-loop",
+          initialValue: "blank",
           options: templates.map((tmpl) => ({
             value: tmpl.name,
             label: tmpl.name,
@@ -2803,7 +2720,7 @@ var initCommand = Command.make(
           }))
         })
       );
-      if (clack2.isCancel(selected)) {
+      if (clack.isCancel(selected)) {
         yield* Effect.fail(
           new InitError({ message: "Template selection cancelled." })
         );
@@ -2855,17 +2772,15 @@ var initCommand = Command.make(
         console.warn(message);
       }
     }
-    yield* d.progress(
+    yield* d.spinner(
       `Scaffolding ${CONFIG_DIR}/ config directory...`,
-      (report) => scaffold(cwd, {
+      scaffold(cwd, {
         agent: selectedAgent,
         model: selectedModel,
-        modelExplicit: modelFlag._tag === "Some",
         templateName: selectedTemplate,
         issueTracker: selectedIssueTracker,
         sandboxProvider: selectedSandboxProvider,
-        codexAuth: selectedCodexAuth,
-        onProgress: report
+        codexAuth: selectedCodexAuth
       }).pipe(
         Effect.mapError(
           (e) => new InitError({
@@ -2928,39 +2843,28 @@ var initCommand = Command.make(
         interactive: isInteractive,
         requested: installRunnerChoice._tag === "Some" ? installRunnerChoice.value : void 0,
         confirm: async ({ message, initialValue }) => {
-          const confirmed = await clack2.confirm({ message, initialValue });
-          if (clack2.isCancel(confirmed)) {
+          const confirmed = await clack.confirm({ message, initialValue });
+          if (clack.isCancel(confirmed)) {
             throw new InitError({
               message: "Repository-runner installation selection cancelled."
             });
           }
           return confirmed === true;
         },
-        install: () => installRepositoryRunnerWithReplacement({
-          repoDir: cwd,
-          interactive: isInteractive,
-          confirmReplacement: async (conflict) => {
-            const confirmed = await clack2.confirm({
-              message: conflict.confirmationMessage,
-              initialValue: false
-            });
-            return !clack2.isCancel(confirmed) && confirmed === true;
-          },
-          install: () => runEffectPromise(
-            d.progress(
-              "Installing repository runner",
-              (report) => Effect.tryPromise({
-                try: () => installRepositoryRunner({
-                  repoDir: cwd,
-                  onProgress: report
-                }),
-                catch: (error) => error instanceof RunnerInstallError ? error : new InitError({
-                  message: `Repository runner installation failed: ${error instanceof Error ? error.message : String(error)}`
-                })
+        install: () => Effect.runPromise(
+          d.progress(
+            "Installing repository runner",
+            (report) => Effect.tryPromise({
+              try: () => installRepositoryRunner({
+                repoDir: cwd,
+                onProgress: report
+              }),
+              catch: (error) => new InitError({
+                message: error instanceof RunnerInstallError ? error.message : `Repository runner installation failed: ${error instanceof Error ? error.message : String(error)}`
               })
-            )
+            })
           )
-        })
+        )
       }),
       catch: (error) => error instanceof InitError ? error : new InitError({
         message: `Repository-runner setup failed: ${error instanceof Error ? error.message : String(error)}`