@ycs77/devbox 0.5.1 → 0.7.0

package/README.md

@@ -47,11 +47,16 @@ From your project directory, initialize Devbox:
 devbox init
 ```
 
-The interactive setup lets you choose the Node.js versions and AI agents to include, then select a Node.js version for the current project.
+**Global configuration** selects the Node.js versions and AI agents installed in the shared Workspace image. These choices apply to every Project; adding more makes the image larger and uses more disk space.
 
-Global configuration controls what goes into the shared Workspace Image. Each Node.js version or AI agent you add makes the image larger and uses more disk space. Projects can use only the Node.js versions included in the image.
+**Local configuration** selects the Node.js version for the current Project. A Project can use only a version included in the Global configuration.
 
-Build the shared Workspace Image once after setup or whenever you change global configuration:
+Published ports accept one mapping per line. The following are the supported port mapping formats:
+
+- `5173:5173` maps host port `5173` to container port `5173`.
+- `APP_PORT:5173:5173` maps the host port from the `APP_PORT` environment variable (default port: `5173`) to container port `5173`.
+
+Build the shared Workspace image once after setup or whenever you change global configuration:
 
 ```bash
 devbox build
@@ -81,8 +86,8 @@ Run these commands from the initialized project directory:
 | `devbox sh` | Open a Bash shell in the running sandbox. |
 | `devbox stop` | Stop the sandbox and preserve it for a later restart. |
 | `devbox down` | Stop and remove the sandbox container. |
+| `devbox rm` | Stop and remove the current Project's Sandbox, then remove its Devbox state. |
 | `devbox config` | Change global settings or this project's configuration. |
-| `devbox cleanup --missing-projects` | Remove registrations for projects whose root directory no longer exists. |
 
 ## Troubleshooting
 

package/dist/cli.mjs

@@ -10,6 +10,9 @@ import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import { parse as parse$1, parseDocument, stringify } from "yaml";
 import { once } from "node:events";
+//#region package.json
+var version = "0.7.0";
+//#endregion
 //#region src/catalog/index.ts
 const NODE_RELEASE_KEYS = [
 	"5BE8A3F6C8A5C01D106C0AD820B1A390B168D356",
@@ -27,12 +30,14 @@ const PACKAGED_NODE_RECIPES = {
 		releaseLine: "24",
 		version: "24.19.0",
 		runtimeRoot: "/opt/devbox/runtimes/node/24",
+		distributionBaseUrl: "https://nodejs.org/dist",
 		trustedReleaseKeys: NODE_RELEASE_KEYS
 	},
 	"22": {
 		releaseLine: "22",
 		version: "22.23.2",
 		runtimeRoot: "/opt/devbox/runtimes/node/22",
+		distributionBaseUrl: "https://nodejs.org/dist",
 		trustedReleaseKeys: NODE_RELEASE_KEYS
 	}
 };
@@ -50,7 +55,7 @@ const PACKAGED_AGENTS = {
 		},
 		supportsNotifications: true,
 		notificationInstallationCommands: ["claude plugin marketplace add ycs77/claude-code-notifications", "claude plugin install notification-basic-wsl@ycs77-notifications"],
-		supportsSkillInstallation: true
+		skillInstallationTarget: "claude-code"
 	},
 	codex: {
 		home: {
@@ -62,7 +67,7 @@ const PACKAGED_AGENTS = {
 			shell: "sh"
 		},
 		supportsNotifications: true,
-		supportsSkillInstallation: true,
+		skillInstallationTarget: "codex",
 		notificationInstallationCommands: ["codex plugin marketplace add ycs77/codex-notifications", "codex plugin add notification-basic-wsl@ycs77-notifications"]
 	},
 	agy: {
@@ -74,8 +79,7 @@ const PACKAGED_AGENTS = {
 			url: "https://antigravity.google/cli/install.sh",
 			shell: "bash"
 		},
-		supportsNotifications: false,
-		supportsSkillInstallation: false
+		supportsNotifications: false
 	},
 	omp: {
 		home: {
@@ -87,7 +91,7 @@ const PACKAGED_AGENTS = {
 			shell: "sh"
 		},
 		supportsNotifications: true,
-		supportsSkillInstallation: false,
+		skillInstallationTarget: "codex",
 		notificationInstallationCommands: ["omp plugin marketplace add ycs77/omp-notifications", "omp plugin install notification-basic@ycs77-notifications"]
 	}
 };
@@ -467,10 +471,7 @@ function isMissingFileError$1(error) {
 	return typeof error === "object" && error !== null && error.code === "ENOENT";
 }
 //#endregion
-//#region src/workspace/image.ts
-const WORKSPACE_IMAGE = "devbox-workspace:latest";
-//#endregion
-//#region src/project/compose-fragments.ts
+//#region src/agent/compose.ts
 const NOTIFICATION_FRAGMENT = {
 	environment: { PULSE_SERVER: "unix:/tmp/pulse-socket" },
 	volume: {
@@ -479,7 +480,7 @@ const NOTIFICATION_FRAGMENT = {
 		readOnly: true
 	}
 };
-function selectComposeFragments({ selectedNode, configuredAgents, agentNotifications }) {
+function selectAgentComposeFragments(configuredAgents, notificationsEnabled) {
 	const agents = [];
 	let hasNotificationAgent = false;
 	for (const agent of configuredAgents) {
@@ -497,18 +498,27 @@ function selectComposeFragments({ selectedNode, configuredAgents, agentNotificat
 		}
 	}
 	return {
-		node: selectedNode === null ? void 0 : { environment: { NODE_VERSION: selectedNode } },
 		agents,
-		notification: agentNotifications && hasNotificationAgent ? NOTIFICATION_FRAGMENT : void 0
+		notification: notificationsEnabled && hasNotificationAgent ? NOTIFICATION_FRAGMENT : void 0
 	};
 }
 //#endregion
+//#region src/runtimes/node/compose.ts
+function selectNodeComposeFragment(selectedNode) {
+	return selectedNode === null ? void 0 : { environment: { NODE_VERSION: selectedNode } };
+}
+//#endregion
+//#region src/workspace/image.ts
+const WORKSPACE_IMAGE = "devbox-workspace:latest";
+//#endregion
 //#region src/project/compose.ts
 function renderProjectCompose(input) {
-	const fragments = selectComposeFragments(input);
+	const containerName = `devbox-${input.sandboxName}`;
+	const node = selectNodeComposeFragment(input.selectedNode);
+	const agent = selectAgentComposeFragments(input.configuredAgents, input.agentNotifications);
 	const environment = {
-		...fragments.node?.environment,
-		...fragments.notification?.environment
+		...node?.environment,
+		...agent.notification?.environment
 	};
 	const volumes = [
 		{
@@ -516,7 +526,7 @@ function renderProjectCompose(input) {
 			source: input.projectRoot,
 			target: `/workspace/${input.sandboxName}`
 		},
-		...fragments.agents.map((fragment) => ({
+		...agent.agents.map((fragment) => ({
 			type: "volume",
 			source: fragment.volume.name,
 			target: fragment.volume.target
@@ -526,51 +536,51 @@ function renderProjectCompose(input) {
 			source: input.claudeHostConfiguration,
 			target: "/home/devbox/.claude.json"
 		}],
-		...fragments.notification === void 0 ? [] : [{
+		...agent.notification === void 0 ? [] : [{
 			type: "bind",
-			source: fragments.notification.volume.source,
-			target: fragments.notification.volume.target,
-			read_only: fragments.notification.volume.readOnly
+			source: agent.notification.volume.source,
+			target: agent.notification.volume.target,
+			read_only: agent.notification.volume.readOnly
 		}]
 	];
 	const definition = {
-		name: input.sandboxName,
+		name: containerName,
 		"x-devbox": {
 			version: 1,
 			project_root: input.projectRoot,
-			compose_name: input.sandboxName,
+			container_name: containerName,
 			sandbox_service: "devbox"
 		},
 		services: { devbox: {
 			image: WORKSPACE_IMAGE,
 			hostname: "devbox",
-			container_name: `devbox-${input.sandboxName}`,
+			container_name: containerName,
 			working_dir: `/workspace/${input.sandboxName}`,
 			...input.ports.length === 0 ? {} : { ports: input.ports.map((port) => renderComposePortMapping(port)) },
 			...Object.keys(environment).length === 0 ? {} : { environment },
 			volumes
 		} },
-		...fragments.agents.length === 0 ? {} : { volumes: Object.fromEntries(fragments.agents.map((fragment) => [fragment.volume.name, {
+		...agent.agents.length === 0 ? {} : { volumes: Object.fromEntries(agent.agents.map((fragment) => [fragment.volume.name, {
 			name: fragment.volume.name,
 			external: fragment.volume.external
 		}])) }
 	};
 	const source = stringify(definition);
-	return validatesProjectCompose(source, input) ? success(source) : failure({
+	return validatesProjectCompose(source, input, containerName) ? success(source) : failure({
 		kind: "operational",
 		code: "invalid-project-compose",
 		observed: `Devbox generated an invalid Compose definition for Project ${input.projectRoot}.`,
 		nextAction: "Run the command again. If the problem continues, report it as a Devbox bug."
 	});
 }
-function validatesProjectCompose(source, input) {
+function validatesProjectCompose(source, input, containerName) {
 	try {
 		const definition = parse$1(source);
-		if (definition.name !== input.sandboxName) return false;
+		if (definition.name !== containerName) return false;
 		const metadata = definition["x-devbox"];
-		if (metadata.version !== 1 || metadata.project_root !== input.projectRoot || metadata.compose_name !== input.sandboxName || metadata.sandbox_service !== "devbox") return false;
+		if (metadata.version !== 1 || metadata.project_root !== input.projectRoot || metadata.container_name !== containerName || metadata.sandbox_service !== "devbox") return false;
 		const service = definition.services.devbox;
-		if (service.image !== "devbox-workspace:latest" || service.container_name !== `devbox-${input.sandboxName}` || service.working_dir !== `/workspace/${input.sandboxName}` || "build" in service) return false;
+		if (service.image !== "devbox-workspace:latest" || service.container_name !== containerName || service.working_dir !== `/workspace/${input.sandboxName}` || "build" in service) return false;
 		const ports = input.ports.map((port) => renderComposePortMapping(port));
 		return JSON.stringify(service.ports ?? []) === JSON.stringify(ports) && (input.selectedNode === null && service.environment?.NODE_VERSION === void 0 || input.selectedNode !== null && service.environment?.NODE_VERSION === input.selectedNode);
 	} catch {
@@ -1050,13 +1060,20 @@ async function removeProjectUnlocked(input = {}) {
 	const registration = registryCheck.value.projects[projectRoot];
 	if (registration === void 0) return notRegistered(projectRoot);
 	if (!input.yes) {
-		if (!await (input.confirm ?? (async () => false))(`Remove Project ${projectRoot} and its Devbox state?`)) return success({
+		if (!await (input.confirm ?? (async () => false))(`Remove Project ${projectRoot}, its Sandbox, and Devbox state?`)) return success({
 			root: projectRoot,
 			removed: false
 		});
 	}
 	if (input.signal?.aborted) throw new InterruptedError();
 	const stateDirectory = projectStateDirectory(registration.identity, paths.home);
+	const environment = input.environment ?? currentHostEnvironment();
+	await (environment.runDirect ?? environment.run)("docker", [
+		"compose",
+		"--file",
+		join(stateDirectory, "compose.yaml"),
+		"down"
+	]);
 	try {
 		await rm(stateDirectory, {
 			recursive: true,
@@ -1082,107 +1099,6 @@ async function removeProjectUnlocked(input = {}) {
 		removed: true
 	});
 }
-async function cleanupMissingProjects(input = {}) {
-	return withStateLocks({
-		devboxHome: input.devboxHome ?? join(homedir(), ".devbox"),
-		global: true,
-		projectRoots: [],
-		signal: input.signal
-	}, async (locks) => {
-		const discovery = await discoverMissingProjects(input);
-		if (!discovery.ok) return discovery;
-		await locks.acquireProjectScopes(discovery.value.missingRoots);
-		return cleanupMissingProjectsUnlocked(input, discovery.value);
-	});
-}
-async function discoverMissingProjects(input) {
-	if (input.signal?.aborted) throw new InterruptedError();
-	const paths = devboxPaths(input.devboxHome);
-	const registryState = await readOptionalFile(paths.projectRegistry);
-	if (!registryState.ok) return registryState;
-	if (!registryState.value.exists) return success({
-		paths,
-		registry: {
-			version: 1,
-			projects: {}
-		},
-		missingRoots: []
-	});
-	const registryCheck = parseProjectRegistry(registryState.value.content);
-	if (!registryCheck.ok) return registryCheck;
-	const missingRoots = [];
-	for (const root of Object.keys(registryCheck.value.projects)) {
-		if (input.signal?.aborted) throw new InterruptedError();
-		const exists = await projectRootExists(root);
-		if (exists === void 0) return failure({
-			kind: "operational",
-			code: "project-root-observation-failed",
-			observed: `Devbox could not inspect Project root: ${root}.`,
-			nextAction: "Check access to the registered Project root and try cleanup again."
-		});
-		if (!exists) missingRoots.push(root);
-	}
-	return success({
-		paths,
-		registry: registryCheck.value,
-		missingRoots
-	});
-}
-async function cleanupMissingProjectsUnlocked(input, discovery) {
-	if (input.signal?.aborted) throw new InterruptedError();
-	if (discovery.missingRoots.length === 0) return success({
-		roots: [],
-		removed: false
-	});
-	if (!input.yes) {
-		if (!await (input.confirm ?? (async () => false))(`Remove Missing-root Project registrations?\n${discovery.missingRoots.map((root) => `- ${root}`).join("\n")}`)) return success({
-			roots: [],
-			removed: false
-		});
-	}
-	const removedRoots = [];
-	const projects = { ...discovery.registry.projects };
-	for (const root of discovery.missingRoots) {
-		const rootExists = await projectRootExists(root);
-		if (rootExists === void 0) return failure({
-			kind: "operational",
-			code: "project-root-observation-failed",
-			observed: `Devbox could not recheck Project root: ${root}.`,
-			nextAction: "Check access to the registered Project root and try cleanup again."
-		});
-		if (rootExists) continue;
-		const registration = projects[root];
-		if (registration === void 0) continue;
-		try {
-			await rm(projectStateDirectory(registration.identity, discovery.paths.home), {
-				recursive: true,
-				force: true
-			});
-		} catch {
-			return failure({
-				kind: "operational",
-				code: "missing-project-state-removal-failed",
-				observed: `Devbox could not remove Missing-root Project state for ${root}.`,
-				nextAction: "Check write access to ~/.devbox and try cleanup again."
-			});
-		}
-		delete projects[root];
-		removedRoots.push(root);
-	}
-	if (removedRoots.length === 0) return success({
-		roots: [],
-		removed: false
-	});
-	const written = await writeAtomically(discovery.paths.projectRegistry, serializeProjectRegistry({
-		version: 1,
-		projects
-	}));
-	if (!written.ok) return written;
-	return success({
-		roots: removedRoots,
-		removed: true
-	});
-}
 async function runSandboxLifecycle(command, input = {}) {
 	const projectRoot = input.root ?? process.cwd();
 	return withStateLocks({
@@ -1301,14 +1217,6 @@ function allocateSandboxName(projectRoot, registry) {
 		nextAction: "Remove stale Devbox state only through its supported command and try again."
 	});
 }
-async function projectRootExists(projectRoot) {
-	try {
-		return (await lstat(projectRoot)).isDirectory();
-	} catch (error) {
-		if (isMissingFileError(error)) return false;
-		return;
-	}
-}
 async function readOptionalFile(path) {
 	try {
 		return success({
@@ -1537,17 +1445,15 @@ function createConfigurationPrompter({ signal, input, output }) {
 			message: "Where should this configuration apply?",
 			options: [{
 				value: "local",
-				label: "Current project",
-				hint: "Enabled when this project’s container starts."
+				label: "Current project"
 			}, {
 				value: "global",
-				label: "Workspace Docker image",
-				hint: "Built into the shared image. It affects image size and disk usage."
+				label: "Workspace Docker image"
 			}],
 			...common
 		})),
 		editGlobal: async (configuration, catalog) => {
-			p.log.step(`${c.bold(c.cyan("Workspace Docker image"))}\n${c.dim("Add runtimes and agents to the shared image. They are available to every project and increase the image size.")}`, common);
+			p.log.step(c.bold(c.cyan("Workspace Docker image")), common);
 			return {
 				version: 1,
 				node: await promptValue(p.multiselect({
@@ -1572,7 +1478,7 @@ function createConfigurationPrompter({ signal, input, output }) {
 			};
 		},
 		editLocal: async (configuration, catalog, globalConfiguration, editPorts = true) => {
-			p.log.step(`${c.bold(c.cyan("Project configuration"))}\n${c.dim(editPorts ? "Choose the Node version and ports to use when this project’s container starts." : "Choose the Node version to use when this project’s container starts.")}`, common);
+			p.log.step(c.bold(c.cyan("Project configuration")), common);
 			const node = await promptValue(p.select({
 				message: "Selected Node release line",
 				options: [{
@@ -1590,7 +1496,7 @@ function createConfigurationPrompter({ signal, input, output }) {
 				node
 			};
 			const ports = normalizePortMappings((await promptValue(p.multiline({
-				message: "Published ports",
+				message: "Published ports" + c.dim(" (multiline; one mapping per line; press Enter twice to submit)"),
 				initialValue: configuration.ports.join("\n"),
 				validate: (value) => {
 					const ports = normalizePortMappings((value ?? "").split("\n"));
@@ -1642,34 +1548,210 @@ function showLogo() {
 	for (let i = 0; i < ASCII_ART.length; i++) console.log(`${COLORS[i]}${ASCII_ART[i]}${REST}`);
 }
 //#endregion
-//#region \0devbox-workspace-image-default:.bash_aliases.mjs
-var _devbox_workspace_image_default__bash_aliases_default = "alias ..='cd ..'\nalias ...='cd ../..'\nalias c='clear'\nalias g='git'\nalias ccc='claude --dangerously-skip-permissions'\nalias ccx='codex --sandbox workspace-write --ask-for-approval never'\nalias ggg='agy --dangerously-skip-permissions'\n\nfunction mkcd() {\n  mkdir \"$1\"\n  cd \"$1\"\n}\n\n# Laravel Artisan\nalias pa='php artisan'\nalias pav='php artisan serve'\nalias pam='php artisan migrate'\nalias pams='php artisan migrate --seed'\nalias pamr='php artisan migrate:rollback'\nalias pamf='php artisan migrate:fresh'\nalias pamfs='php artisan migrate:fresh --seed'\nalias pas='php artisan db:seed'\nalias par='php artisan route:list'\nalias paq='php artisan queue:work'\nalias pah='php artisan horizon'\nalias pat='php artisan tinker'\nalias phpunit='./vendor/bin/phpunit --colors=always'\nalias pu='phpunit'\nalias pest='./vendor/bin/pest --colors=always'\nalias p='pest'\nalias pint='./vendor/bin/pint'\nalias phpstan='./vendor/bin/phpstan analyse --ansi'\nalias rector='./vendor/bin/rector'\n\n# NPM (requires @antfu/ni)\nalias nv='nr dev' # nd exists in @antfu/ni\nalias nb='nr build'\nalias nll='nr lint' # nl is a Linux command\nalias nlf='nr lint --fix'\nalias nf='nr fmt'\nalias nfc='nr fmt --check'\nalias nc='nr check'\nalias nt='nr test'\nalias ntr='nr test --run'\n";
-//#endregion
-//#region \0devbox-workspace-image-default:.claude/settings.json.mjs
+//#region \0devbox-image-default:/home/runner/work/devbox/devbox/src/agent/image-defaults/.claude/settings.json.mjs
 var settings_json_default = "{\n  \"$schema\": \"https://json.schemastore.org/claude-code-settings.json\",\n  \"env\": {\n    \"CLAUDE_CODE_USE_POWERSHELL_TOOL\": \"0\"\n  },\n  \"attribution\": {\n    \"commit\": \"\",\n    \"pr\": \"\"\n  },\n  \"includeGitInstructions\": false,\n  \"autoMemoryEnabled\": false\n}\n";
 //#endregion
-//#region \0devbox-workspace-image-default:.gitconfig.mjs
-var _devbox_workspace_image_default__gitconfig_default = "[core]\n	autocrlf = input\n	fileMode = false\n	pager = less -r\n	quotepath = false\n[init]\n	defaultBranch = main\n[color]\n	diff = auto\n	status = auto\n	branch = auto\n[alias]\n	cf = config\n	cfl = config --list\n	s = status\n	a = add .\n	l = log --oneline --graph\n	la = log --oneline --graph --all\n	last = log -1 HEAD\n	c = commit\n	cm = commit -m\n	ca = commit --amend -m\n	can = commit --amend --no-edit\n	co = checkout\n	cp = cherry-pick\n	b = branch\n	m = merge\n	mnf = merge --no-ff\n	rs = reset\n	rs0h = reset HEAD --hard\n	rs1 = reset HEAD~1\n	rs1h = reset HEAD~1 --hard\n	rb = rebase\n	rbo = rebase --onto\n	rbi = rebase -i\n	rbc = rebase --continue\n	rba = rebase --abort\n	rm = remote\n	r = remote -v\n	ra = remote add\n	rr = remote remove\n	rp = remote prune\n	f = fetch\n	fp = fetch --prune\n	p = push\n	pl = pull\n";
-//#endregion
-//#region \0devbox-workspace-image-default:.omp/agent/config.yml.mjs
+//#region \0devbox-image-default:/home/runner/work/devbox/devbox/src/agent/image-defaults/.omp/agent/config.yml.mjs
 var config_yml_default = "setupVersion: 2\n\n# Basic\nmodelRoles:\n  default: openai-codex/gpt-5.6-terra:high\n  smol: openai-codex/gpt-5.6-luna:high\n  slow: openai-codex/gpt-5.6-sol:max\n  plan: openai-codex/gpt-5.6-sol:max\nsymbolPreset: unicode\n\n# Theme\ntheme:\n  dark: titanium\n  light: light\ncomposer:\n  shape: claude\n\n# Auto QA\ndev:\n  autoqa: false\n  autoqaConsent: denied\n";
 //#endregion
+//#region \0devbox-image-default:/home/runner/work/devbox/devbox/src/agent/image-defaults/AGENTS.md.mjs
+var AGENTS_md_default = "# 協作規範\n\n## 語言\n\n- 一律使用繁體中文台灣用語產生對話及結果\n- 嚴禁使用簡體字，或是繁體字但中國大陸用語\n- 用詞要口語、常見，避免生硬或翻譯腔的詞彙；例如「根因」改用「原因」、「根本原因」、「主要原因」\n\n## 開發規範\n\n### 共用原則\n\n- 優先遵循專案既有的 `AGENTS.md`、文件、設定檔、lockfile、指令與程式碼慣例；專案沒有既有規範時，才使用本文件的預設選擇\n- 優先使用目前環境提供的專用工具；只有在專用工具無法完成工作或需要執行專案指令時，才使用適合的 CLI 工具\n- 執行會修改檔案、安裝套件或變更環境的指令前，確認目前位於預期的工作目錄\n- 可以在目前 workspace 內存取所需的上層目錄；存取 workspace 以外的檔案或目錄前，必須先取得使用者同意\n- 嚴禁執行任何會遞迴刪除根目錄的指令（例如 `rm -rf /`），也不得改寫或規避為效果相同的形式\n- 執行其他可能造成不可逆資料遺失的操作前，必須說明影響並取得使用者明確同意\n\n### JavaScript / TypeScript\n\n- 優先使用專案既有的 Node.js 版本設定與套件管理器\n- 專案未指定套件管理器且不存在 lockfile 時，使用 npm\n- 需要執行專案套件提供的 CLI 時，使用專案既有套件管理器對應的執行方式；使用 npm 時使用 npx\n- 不得擅自更換套件管理器、刪除 lockfile 或產生不同格式的 lockfile\n- TypeScript 格式規則\n  - 陣列型別優先使用 `T[]`，避免使用 `Array<T>`\n  - 字典型物件優先使用 `Record<string, T>`，避免使用 `{ [key: string]: T }`\n- Vue 3 程式碼變更前，先讀取 `/ycs77-vue` skill\n\n### PHP\n\n- 優先使用專案既有的 Composer scripts\n\n### 常見 CLI 工具\n\n- 版本控制操作使用 `git`\n- 所有 Git 操作都必須直接執行 `git` CLI\n- 禁止透過 Eval、JavaScript、Bun、Node.js、Python 或臨時程式碼間接包裝或呼叫 Git 指令\n- GitHub 相關操作優先使用 `gh` CLI\n\n## 安全\n\n- 在任何對話、指令輸出或程式碼中，不得揭露密碼、金鑰、Access Token、API Key 等機密資料\n- 不得讀取或輸出 `.env`、`.env.*` 等可能包含機密資料的檔案；不含真實機密的範本檔案（例如 `.env.example`）除外\n- 開發時需要使用機密資料，應以環境變數名稱或假值代稱，不得嘗試取得實際值\n";
+//#endregion
+//#region src/agent/build.ts
+function createAgentWorkspaceContribution(input) {
+	const agents = input.configuredAgents.map((name) => ({
+		name,
+		recipe: PACKAGED_AGENTS[name]
+	}));
+	const buildContextAssets = selectBuildContextAssets(agents);
+	const skillAgents = [...new Set(agents.flatMap((agent) => agent.recipe.skillInstallationTarget === void 0 ? [] : [agent.recipe.skillInstallationTarget]))];
+	return {
+		buildContextAssets,
+		dockerignoreEntries: selectDockerignoreEntries(buildContextAssets),
+		installationDockerfileLines: renderAgentInstallations(agents, input.buildNodeRuntimeRoot, skillAgents),
+		assetDockerfileLines: renderAgentAssets(agents),
+		notificationDockerfileLines: renderAgentNotifications(agents, input.notificationsEnabled),
+		entrypointSetup: renderAgentEntrypointSetup(agents)
+	};
+}
+function renderAgentInstallations(agents, buildNodeRuntimeRoot, skillAgents) {
+	const lines = [];
+	for (const agent of agents) {
+		const preInstallCommands = agent.recipe.installation.preInstallCommands ?? [];
+		lines.push(`# Install ${agent.name}`, `RUN mkdir -p ${agent.recipe.home.target} \\`, ...preInstallCommands.map((command) => `    && ${command} \\`), `    && curl -fsSL ${agent.recipe.installation.url} | ${agent.recipe.installation.shell}`, "");
+	}
+	if (agents.length > 0) lines.push("# Set the PATH to include AI tools", "ENV PATH=\"/home/devbox/.local/bin:${PATH}\"", "");
+	if (buildNodeRuntimeRoot !== void 0 && skillAgents.length > 0) {
+		const skillAgentArguments = skillAgents.map((agent) => `-a ${agent}`).join(" ");
+		lines.push("# Install Agent Skills", "RUN set -eux \\", "    && mkdir -p /home/devbox/.agents/skills \\", `    && export PATH="${buildNodeRuntimeRoot}/bin:$PATH" \\`, `    && npx -y skills add ycs77/skills -g ${skillAgentArguments} -s '*' -y`, "");
+	}
+	return lines;
+}
+function selectDockerignoreEntries(assets) {
+	const entries = [];
+	if (assets.some((asset) => asset.relativePath === "AGENTS.md")) entries.push("!AGENTS.md");
+	if (assets.some((asset) => asset.relativePath.startsWith(".claude/"))) entries.push("!.claude", "!.claude/settings.json");
+	if (assets.some((asset) => asset.relativePath.startsWith(".omp/agent/"))) entries.push("!.omp", "!.omp/agent", "!.omp/agent/config.yml");
+	return entries;
+}
+function selectBuildContextAssets(agents) {
+	const assets = [];
+	if (agents.length > 0) assets.push({
+		relativePath: "AGENTS.md",
+		content: AGENTS_md_default
+	});
+	if (agents.some((agent) => agent.name === "claude-code")) assets.push({
+		relativePath: ".claude/settings.json",
+		content: settings_json_default
+	});
+	if (agents.some((agent) => agent.name === "omp")) assets.push({
+		relativePath: ".omp/agent/config.yml",
+		content: config_yml_default
+	});
+	return assets;
+}
+function renderAgentAssets(agents) {
+	const hasClaudeCode = agents.some((agent) => agent.name === "claude-code");
+	const hasCodex = agents.some((agent) => agent.name === "codex");
+	const hasAgy = agents.some((agent) => agent.name === "agy");
+	const hasOmp = agents.some((agent) => agent.name === "omp");
+	if (!hasClaudeCode && !hasCodex && !hasAgy && !hasOmp) return [];
+	const lines = ["# Copy AI dotfiles"];
+	if (hasClaudeCode) lines.push("COPY --chown=devbox:devbox .claude/settings.json /home/devbox/.claude/settings.json", "COPY --chown=devbox:devbox AGENTS.md /home/devbox/.claude/CLAUDE.md");
+	if (hasCodex) lines.push("COPY --chown=devbox:devbox AGENTS.md /home/devbox/.codex/AGENTS.md");
+	if (hasAgy) lines.push("COPY --chown=devbox:devbox AGENTS.md /home/devbox/.gemini/GEMINI.md");
+	if (hasOmp) lines.push("COPY --chown=devbox:devbox .omp/agent/config.yml /home/devbox/.omp/agent/config.yml", "COPY --chown=devbox:devbox AGENTS.md /home/devbox/.omp/agent/AGENTS.md");
+	lines.push("");
+	return lines;
+}
+function renderAgentNotifications(agents, notificationsEnabled) {
+	const commands = notificationsEnabled ? agents.flatMap((agent) => agent.recipe.supportsNotifications ? agent.recipe.notificationInstallationCommands : []) : [];
+	if (commands.length === 0) return [];
+	return [
+		"# Install Agent Notification Plugins",
+		"USER devbox",
+		"RUN set -eux \\",
+		...commands.map((command, index) => `    && ${command}${index < commands.length - 1 ? " \\" : ""}`),
+		"USER root",
+		""
+	];
+}
+function renderAgentEntrypointSetup(agents) {
+	if (!agents.some((agent) => agent.name === "agy")) return [];
+	return [
+		"# Link shared Agent Skills",
+		"if [ ! -L \"/home/devbox/.gemini/skills\" ]; then",
+		"  ln -sfn /home/devbox/.agents/skills /home/devbox/.gemini/skills",
+		"  chown -h devbox:devbox /home/devbox/.gemini/skills",
+		"fi",
+		""
+	];
+}
+//#endregion
+//#region src/runtimes/node/build.ts
+function createNodeWorkspaceContribution(configuredReleaseLines) {
+	const runtimes = configuredReleaseLines.map((releaseLine) => PACKAGED_NODE_RECIPES[releaseLine]);
+	const buildRuntime = selectBuildNodeRuntime(runtimes);
+	return {
+		buildNodeRuntimeRoot: buildRuntime?.runtimeRoot,
+		runtimeInstallations: runtimes.flatMap(renderNodeRuntimeStage),
+		sandboxUserSetup: buildRuntime === void 0 ? [] : [
+			"# Configure pnpm for the non-root Sandbox user",
+			"RUN mkdir -p /home/devbox/.config/pnpm /home/devbox/.pnpm-store \\",
+			"    && printf 'storeDir: /home/devbox/.pnpm-store\\n' > /home/devbox/.config/pnpm/config.yaml \\",
+			"    && chown devbox:devbox /home/devbox/.config/pnpm/config.yaml",
+			""
+		],
+		entrypointSetup: renderNodeEntrypointSetup(runtimes)
+	};
+}
+function selectBuildNodeRuntime(runtimes) {
+	let buildRuntime;
+	for (const runtime of runtimes) if (buildRuntime === void 0 || Number.parseFloat(runtime.releaseLine) > Number.parseFloat(buildRuntime.releaseLine)) buildRuntime = runtime;
+	return buildRuntime;
+}
+function renderNodeEntrypointSetup(runtimes) {
+	if (runtimes.length === 0) return [];
+	return [
+		"# Set the Node.js release line to use",
+		"NODE_VERSION=\"${NODE_VERSION:-}\"",
+		"if [ -n \"$NODE_VERSION\" ]; then",
+		"  case \"$NODE_VERSION\" in",
+		"    *[!0-9]*)",
+		"      echo \"NODE_VERSION must be a numeric release line: $NODE_VERSION\" >&2",
+		"      exit 1",
+		"      ;;",
+		"  esac",
+		"",
+		"  NODE_RUNTIME_ROOT=\"/opt/devbox/runtimes/node/$NODE_VERSION\"",
+		"  if [ ! -x \"$NODE_RUNTIME_ROOT/bin/node\" ]; then",
+		"    echo \"Node.js release line $NODE_VERSION is not installed.\" >&2",
+		"    exit 1",
+		"  fi",
+		"",
+		"  if ! grep -q \"# Devbox\" /etc/bash.bashrc; then",
+		"    printf \"\\n# Devbox\\nexport PATH=\\\"$NODE_RUNTIME_ROOT/bin:\\$PATH\\\"\\n\" >> /etc/bash.bashrc",
+		"  fi",
+		"",
+		"  export PATH=\"$NODE_RUNTIME_ROOT/bin:$PATH\"",
+		"fi",
+		""
+	];
+}
+function renderNodeRuntimeStage(recipe) {
+	const keys = recipe.trustedReleaseKeys.map((key) => `      ${key}`).join(" \\\n");
+	return [
+		`# Install Node.js ${recipe.releaseLine}`,
+		"RUN ARCH= OPENSSL_ARCH= && dpkgArch=\"$(dpkg --print-architecture)\" \\",
+		"    && case \"${dpkgArch##*-}\" in \\",
+		"      amd64) ARCH='x64' OPENSSL_ARCH='linux-x86_64';; \\",
+		"      ppc64el) ARCH='ppc64le' OPENSSL_ARCH='linux-ppc64le';; \\",
+		"      s390x) ARCH='s390x' OPENSSL_ARCH='linux*-s390x';; \\",
+		"      arm64) ARCH='arm64' OPENSSL_ARCH='linux-aarch64';; \\",
+		"      *) echo \"unsupported architecture\"; exit 1 ;; \\",
+		"    esac \\",
+		"    && set -eux \\",
+		`    && NODE_RUNTIME_VERSION=${recipe.version} \\`,
+		`    && NODE_RUNTIME_ROOT=${recipe.runtimeRoot} \\`,
+		"    && mkdir -p \"$NODE_RUNTIME_ROOT\" /tmp/node-source \\",
+		"    && cd /tmp/node-source \\",
+		"    && export GNUPGHOME=\"$(mktemp -d)\" \\",
+		"    && for key in \\",
+		`${keys} \\`,
+		"    ; do \\",
+		"      { gpg --batch --no-options --keyserver hkps://keys.openpgp.org --recv-keys \"$key\" && gpg --batch --no-options --fingerprint \"$key\"; } || \\",
+		"      { gpg --batch --no-options --keyserver keyserver.ubuntu.com --recv-keys \"$key\" && gpg --batch --no-options --fingerprint \"$key\"; }; \\",
+		"    done \\",
+		"    && archive=\"node-v${NODE_RUNTIME_VERSION}-linux-${ARCH}.tar.xz\" \\",
+		`    && curl -fsSLO --compressed "${recipe.distributionBaseUrl}/v\${NODE_RUNTIME_VERSION}/node-v\${NODE_RUNTIME_VERSION}-linux-\${ARCH}.tar.xz" \\`,
+		`    && curl -fsSLO --compressed "${recipe.distributionBaseUrl}/v\${NODE_RUNTIME_VERSION}/SHASUMS256.txt.asc" \\`,
+		"    && gpg --batch --no-options --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \\",
+		"    && gpgconf --kill all \\",
+		"    && rm -rf \"$GNUPGHOME\" \\",
+		"    && grep \" node-v${NODE_RUNTIME_VERSION}-linux-${ARCH}.tar.xz\\$\" SHASUMS256.txt | sha256sum -c - \\",
+		"    && tar -xJf \"node-v${NODE_RUNTIME_VERSION}-linux-${ARCH}.tar.xz\" -C \"$NODE_RUNTIME_ROOT\" --strip-components=1 --no-same-owner \\",
+		"    && rm \"node-v${NODE_RUNTIME_VERSION}-linux-${ARCH}.tar.xz\" SHASUMS256.txt.asc SHASUMS256.txt \\",
+		"    && find \"$NODE_RUNTIME_ROOT/include/node/openssl/archs\" -mindepth 1 -maxdepth 1 ! -name \"$OPENSSL_ARCH\" -exec rm -rf {} \\; \\",
+		"    && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \\",
+		"    && export PATH=\"$NODE_RUNTIME_ROOT/bin:$PATH\" \\",
+		"    && npm install -g npm \\",
+		"    && npm uninstall -g corepack \\",
+		"    && npm install -g yarn pnpm @antfu/ni --allow-scripts=pnpm,yarn \\",
+		"    && \"$NODE_RUNTIME_ROOT/bin/node\" --version \\",
+		"    && \"$NODE_RUNTIME_ROOT/bin/npm\" --version \\",
+		"    && rm -rf /tmp/node-source",
+		""
+	];
+}
+//#endregion
 //#region src/workspace/build.ts
 const BASE_WORKSPACE_IMAGE_DEFAULTS = [{
 	relativePath: ".bash_aliases",
-	content: _devbox_workspace_image_default__bash_aliases_default
+	content: "alias ..='cd ..'\nalias ...='cd ../..'\nalias c='clear'\nalias g='git'\nalias ccc='claude --dangerously-skip-permissions'\nalias ccx='codex --sandbox workspace-write --ask-for-approval never'\nalias ggg='agy --dangerously-skip-permissions'\n\nfunction mkcd() {\n  mkdir \"$1\"\n  cd \"$1\"\n}\n\n# Laravel Artisan\nalias pa='php artisan'\nalias pav='php artisan serve'\nalias pam='php artisan migrate'\nalias pams='php artisan migrate --seed'\nalias pamr='php artisan migrate:rollback'\nalias pamf='php artisan migrate:fresh'\nalias pamfs='php artisan migrate:fresh --seed'\nalias pas='php artisan db:seed'\nalias par='php artisan route:list'\nalias paq='php artisan queue:work'\nalias pah='php artisan horizon'\nalias pat='php artisan tinker'\nalias phpunit='./vendor/bin/phpunit --colors=always'\nalias pu='phpunit'\nalias pest='./vendor/bin/pest --colors=always'\nalias p='pest'\nalias pint='./vendor/bin/pint'\nalias phpstan='./vendor/bin/phpstan analyse --ansi'\nalias rector='./vendor/bin/rector'\n\n# NPM (requires @antfu/ni)\nalias nv='nr dev' # nd exists in @antfu/ni\nalias nb='nr build'\nalias nll='nr lint' # nl is a Linux command\nalias nlf='nr lint --fix'\nalias nf='nr fmt'\nalias nfc='nr fmt --check'\nalias nc='nr check'\nalias nt='nr test'\nalias ntr='nr test --run'\n"
 }, {
 	relativePath: ".gitconfig",
-	content: _devbox_workspace_image_default__gitconfig_default
+	content: "[core]\n	autocrlf = input\n	fileMode = false\n	pager = less -r\n	quotepath = false\n[init]\n	defaultBranch = main\n[color]\n	diff = auto\n	status = auto\n	branch = auto\n[alias]\n	cf = config\n	cfl = config --list\n	s = status\n	a = add .\n	l = log --oneline --graph\n	la = log --oneline --graph --all\n	last = log -1 HEAD\n	c = commit\n	cm = commit -m\n	ca = commit --amend -m\n	can = commit --amend --no-edit\n	co = checkout\n	cp = cherry-pick\n	b = branch\n	m = merge\n	mnf = merge --no-ff\n	rs = reset\n	rs0h = reset HEAD --hard\n	rs1 = reset HEAD~1\n	rs1h = reset HEAD~1 --hard\n	rb = rebase\n	rbo = rebase --onto\n	rbi = rebase -i\n	rbc = rebase --continue\n	rba = rebase --abort\n	rm = remote\n	r = remote -v\n	ra = remote add\n	rr = remote remove\n	rp = remote prune\n	f = fetch\n	fp = fetch --prune\n	p = push\n	pl = pull\n"
 }];
-const CLAUDE_SETTINGS_DEFAULT = {
-	relativePath: ".claude/settings.json",
-	content: settings_json_default
-};
-const OMP_AGENT_CONFIG_DEFAULT = {
-	relativePath: ".omp/agent/config.yml",
-	content: config_yml_default
-};
 async function buildWorkspace(input = {}) {
 	return withStateLocks({
 		devboxHome: input.devboxHome ?? join(homedir(), ".devbox"),
@@ -1691,7 +1773,7 @@ async function buildWorkspaceUnlocked(input) {
 			kind: "operational",
 			code: "global-configuration-missing",
 			observed: "Global configuration is required before building the Workspace image.",
-			nextAction: "Run devbox config to commit Global configuration before devbox build."
+			nextAction: "Run devbox init to commit Global configuration before devbox build."
 		});
 	}
 	const parsedGlobal = parseGlobalConfiguration(globalSource, catalogCheck.value);
@@ -1699,27 +1781,25 @@ async function buildWorkspaceUnlocked(input) {
 	const globalConfiguration = parsedGlobal.value;
 	const hostIdentity = currentHostIdentity();
 	if (!hostIdentity.ok) return hostIdentity;
-	const agents = globalConfiguration.agent.map((name) => ({
-		name,
-		recipe: PACKAGED_AGENTS[name]
-	}));
-	const buildContextAssets = selectBuildContextAssets(agents);
-	const nodeRuntimes = globalConfiguration.node.map((releaseLine) => PACKAGED_NODE_RECIPES[releaseLine]);
+	const node = createNodeWorkspaceContribution(globalConfiguration.node);
+	const agent = createAgentWorkspaceContribution({
+		configuredAgents: globalConfiguration.agent,
+		notificationsEnabled: globalConfiguration.agent_notifications,
+		buildNodeRuntimeRoot: node.buildNodeRuntimeRoot
+	});
+	const buildContextAssets = [...BASE_WORKSPACE_IMAGE_DEFAULTS, ...agent.buildContextAssets];
 	const dockerfile = renderBuildDockerfile({
-		nodeRuntimes,
-		buildNodeRuntime: buildNodeRuntimeRecipe(globalConfiguration),
-		agents,
-		agentNotifications: globalConfiguration.agent_notifications,
-		skillAgents: globalConfiguration.agent.filter((agent) => PACKAGED_AGENTS[agent]?.supportsSkillInstallation === true)
+		node,
+		agent
 	});
 	await mkdir(paths.buildContext, { recursive: true });
 	await seedBuildContextAssets(paths.buildContext, buildContextAssets);
 	await Promise.all([
 		writeFile(join(paths.buildContext, "Dockerfile"), dockerfile),
-		writeFile(join(paths.buildContext, ".dockerignore"), renderDockerignore(buildContextAssets)),
+		writeFile(join(paths.buildContext, ".dockerignore"), renderDockerignore(buildContextAssets, agent.dockerignoreEntries)),
 		writeFile(join(paths.buildContext, "entrypoint.sh"), renderEntrypoint({
-			nodeRuntimes,
-			agents
+			node,
+			agent
 		})),
 		writeFile(join(paths.buildContext, "supervisord.conf"), renderSupervisorConfiguration())
 	]);
@@ -1733,14 +1813,6 @@ async function buildWorkspaceUnlocked(input) {
 	if (!buildResult.ok) return buildResult;
 	return success({ image: WORKSPACE_IMAGE });
 }
-function buildNodeRuntimeRecipe(globalConfiguration) {
-	let buildNodeRuntime;
-	for (const releaseLine of globalConfiguration.node) {
-		const recipe = PACKAGED_NODE_RECIPES[releaseLine];
-		if (buildNodeRuntime === void 0 || Number.parseFloat(releaseLine) > Number.parseFloat(buildNodeRuntime.releaseLine)) buildNodeRuntime = recipe;
-	}
-	return buildNodeRuntime;
-}
 function currentHostIdentity() {
 	const userId = typeof process.getuid === "function" ? process.getuid() : void 0;
 	const groupId = typeof process.getgid === "function" ? process.getgid() : void 0;
@@ -1797,51 +1869,26 @@ function renderBuildDockerfile(input) {
 		"    && chmod 0440 /etc/sudoers.d/devbox",
 		""
 	];
-	for (const recipe of input.nodeRuntimes) lines.push(...renderNodeRuntimeStage(recipe));
+	lines.push(...input.node.runtimeInstallations);
 	lines.push("WORKDIR /workspace", "USER devbox", "");
-	if (input.buildNodeRuntime !== void 0) lines.push("# Configure pnpm for the non-root Sandbox user", "RUN mkdir -p /home/devbox/.config/pnpm /home/devbox/.pnpm-store \\", "    && printf 'storeDir: /home/devbox/.pnpm-store\\n' > /home/devbox/.config/pnpm/config.yaml \\", "    && chown devbox:devbox /home/devbox/.config/pnpm/config.yaml", "");
-	for (const agent of input.agents) {
-		const preInstallCommands = agent.recipe.installation.preInstallCommands ?? [];
-		lines.push(`# Install ${agent.name}`, `RUN mkdir -p ${agent.recipe.home.target} \\`, ...preInstallCommands.map((command) => `    && ${command} \\`), `    && curl -fsSL ${agent.recipe.installation.url} | ${agent.recipe.installation.shell}`, "");
-	}
-	if (input.agents.length > 0) lines.push("# Set the PATH to include AI tools", "ENV PATH=\"/home/devbox/.local/bin:${PATH}\"", "");
-	if (input.buildNodeRuntime !== void 0 && input.skillAgents.length > 0) {
-		const skillAgentArguments = input.skillAgents.map((agent) => `-a ${agent}`).join(" ");
-		lines.push("# Install Agent Skills", "RUN set -eux \\", "    && mkdir -p /home/devbox/.agents/skills \\", `    && export PATH="${input.buildNodeRuntime.runtimeRoot}/bin:$PATH" \\`, `    && npx -y skills add ycs77/skills -g ${skillAgentArguments} -s '*' -y`, "");
-	}
-	lines.push("USER root", "", "# Copy dotfiles", "COPY .bash_aliases /home/devbox/.bash_aliases", "COPY .gitconfig /home/devbox/.gitconfig", "RUN chown devbox:devbox /home/devbox/.bash_aliases \\", "    && chown devbox:devbox /home/devbox/.gitconfig", "");
-	const hasClaudeCode = input.agents.some((agent) => agent.name === "claude-code");
-	const hasOmp = input.agents.some((agent) => agent.name === "omp");
-	if (hasClaudeCode || hasOmp) {
-		const ownershipCommands = [];
-		lines.push("# Copy AI dotfiles");
-		if (hasClaudeCode) {
-			lines.push("COPY .claude/settings.json /home/devbox/.claude/settings.json");
-			ownershipCommands.push("chown devbox:devbox /home/devbox/.claude/settings.json");
-		}
-		if (hasOmp) {
-			lines.push("COPY .omp/agent/config.yml /home/devbox/.omp/agent/config.yml");
-			ownershipCommands.push("chown devbox:devbox /home/devbox/.omp/agent", "chown devbox:devbox /home/devbox/.omp/agent/config.yml");
-		}
-		lines.push(`RUN ${ownershipCommands.join(" \\\n    && ")}`, "");
-	}
-	const notificationInstallationCommands = input.agentNotifications ? input.agents.flatMap((agent) => agent.recipe.supportsNotifications ? agent.recipe.notificationInstallationCommands : []) : [];
-	if (notificationInstallationCommands.length > 0) lines.push("# Install Agent Notification Plugins", "USER devbox", "RUN set -eux \\", ...notificationInstallationCommands.map((command, index) => `    && ${command}${index < notificationInstallationCommands.length - 1 ? " \\" : ""}`), "USER root", "");
+	lines.push(...input.node.sandboxUserSetup);
+	lines.push(...input.agent.installationDockerfileLines);
+	lines.push("USER root", "", "# Copy dotfiles", "COPY --chown=devbox:devbox .bash_aliases /home/devbox/.bash_aliases", "COPY --chown=devbox:devbox .gitconfig /home/devbox/.gitconfig", "");
+	lines.push(...input.agent.assetDockerfileLines);
+	lines.push(...input.agent.notificationDockerfileLines);
 	lines.push("COPY entrypoint.sh /usr/local/bin/entrypoint.sh", "COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf", "RUN chmod +x /usr/local/bin/entrypoint.sh", "", "ENTRYPOINT [\"/usr/local/bin/entrypoint.sh\"]");
 	return `${lines.join("\n")}\n`;
 }
-function renderDockerignore(assets) {
-	const lines = [
+function renderDockerignore(assets, additionalEntries) {
+	return `${[
 		"# Machine-owned Workspace build context",
 		"*",
 		"!Dockerfile",
 		"!entrypoint.sh",
 		"!supervisord.conf",
-		...assets.map((asset) => `!${asset.relativePath}`)
-	];
-	if (assets.some((asset) => asset.relativePath === ".claude/settings.json")) lines.push("!.claude", "!.claude/settings.json");
-	if (assets.some((asset) => asset.relativePath === ".omp/agent/config.yml")) lines.push("!.omp", "!.omp/agent", "!.omp/agent/config.yml");
-	return `${lines.join("\n")}\n`;
+		...assets.map((asset) => `!${asset.relativePath}`),
+		...additionalEntries
+	].join("\n")}\n`;
 }
 async function seedBuildContextAssets(buildContext, assets) {
 	await Promise.all(assets.map(async (asset) => {
@@ -1854,18 +1901,18 @@ async function seedBuildContextAssets(buildContext, assets) {
 		}
 	}));
 }
-function selectBuildContextAssets(agents) {
-	const assets = [...BASE_WORKSPACE_IMAGE_DEFAULTS];
-	if (agents.some((agent) => agent.name === "claude-code")) assets.push(CLAUDE_SETTINGS_DEFAULT);
-	if (agents.some((agent) => agent.name === "omp")) assets.push(OMP_AGENT_CONFIG_DEFAULT);
-	return assets;
-}
 function renderEntrypoint(input) {
-	const lines = ["#!/usr/bin/env bash", ""];
-	if (input.nodeRuntimes.length > 0) lines.push("# Set the Node.js release line to use", "NODE_VERSION=\"${NODE_VERSION:-}\"", "if [ -n \"$NODE_VERSION\" ]; then", "  case \"$NODE_VERSION\" in", "    *[!0-9]*)", "      echo \"NODE_VERSION must be a numeric release line: $NODE_VERSION\" >&2", "      exit 1", "      ;;", "  esac", "", "  NODE_RUNTIME_ROOT=\"/opt/devbox/runtimes/node/$NODE_VERSION\"", "  if [ ! -x \"$NODE_RUNTIME_ROOT/bin/node\" ]; then", "    echo \"Node.js release line $NODE_VERSION is not installed.\" >&2", "    exit 1", "  fi", "", "  if ! grep -q \"# Devbox\" /etc/bash.bashrc; then", "    printf \"\\n# Devbox\\nexport PATH=\\\"$NODE_RUNTIME_ROOT/bin:\\$PATH\\\"\\n\" >> /etc/bash.bashrc", "  fi", "", "  export PATH=\"$NODE_RUNTIME_ROOT/bin:$PATH\"", "fi", "");
-	if (input.agents.some((agent) => agent.name === "agy")) lines.push("# Link shared Agent Skills", "if [ ! -L \"/home/devbox/.gemini/skills\" ]; then", "  ln -sfn /home/devbox/.agents/skills /home/devbox/.gemini/skills", "  chown -h devbox:devbox /home/devbox/.gemini/skills", "fi", "");
-	lines.push("if [ $# -gt 0 ]; then", "  exec gosu devbox \"$@\"", "else", "  exec /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf", "fi");
-	return `${lines.join("\n")}\n`;
+	return `${[
+		"#!/usr/bin/env bash",
+		"",
+		...input.node.entrypointSetup,
+		...input.agent.entrypointSetup,
+		"if [ $# -gt 0 ]; then",
+		"  exec gosu devbox \"$@\"",
+		"else",
+		"  exec /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf",
+		"fi"
+	].join("\n")}\n`;
 }
 function renderSupervisorConfiguration() {
 	return `${[
@@ -1886,51 +1933,6 @@ function renderSupervisorConfiguration() {
 		"stderr_logfile=/dev/null"
 	].join("\n")}\n`;
 }
-function renderNodeRuntimeStage(recipe) {
-	const keys = recipe.trustedReleaseKeys.map((key) => `      ${key}`).join(" \\\n");
-	return [
-		`# Install Node.js ${recipe.releaseLine}`,
-		"RUN ARCH= OPENSSL_ARCH= && dpkgArch=\"$(dpkg --print-architecture)\" \\",
-		"    && case \"${dpkgArch##*-}\" in \\",
-		"      amd64) ARCH='x64' OPENSSL_ARCH='linux-x86_64';; \\",
-		"      ppc64el) ARCH='ppc64le' OPENSSL_ARCH='linux-ppc64le';; \\",
-		"      s390x) ARCH='s390x' OPENSSL_ARCH='linux*-s390x';; \\",
-		"      arm64) ARCH='arm64' OPENSSL_ARCH='linux-aarch64';; \\",
-		"      *) echo \"unsupported architecture\"; exit 1 ;; \\",
-		"    esac \\",
-		"    && set -eux \\",
-		`    && NODE_RUNTIME_VERSION=${recipe.version} \\`,
-		`    && NODE_RUNTIME_ROOT=${recipe.runtimeRoot} \\`,
-		"    && mkdir -p \"$NODE_RUNTIME_ROOT\" /tmp/node-source \\",
-		"    && cd /tmp/node-source \\",
-		"    && export GNUPGHOME=\"$(mktemp -d)\" \\",
-		"    && for key in \\",
-		`${keys} \\`,
-		"    ; do \\",
-		"      { gpg --batch --no-options --keyserver hkps://keys.openpgp.org --recv-keys \"$key\" && gpg --batch --no-options --fingerprint \"$key\"; } || \\",
-		"      { gpg --batch --no-options --keyserver keyserver.ubuntu.com --recv-keys \"$key\" && gpg --batch --no-options --fingerprint \"$key\"; }; \\",
-		"    done \\",
-		"    && archive=\"node-v${NODE_RUNTIME_VERSION}-linux-${ARCH}.tar.xz\" \\",
-		"    && curl -fsSLO --compressed \"https://nodejs.org/dist/v${NODE_RUNTIME_VERSION}/node-v${NODE_RUNTIME_VERSION}-linux-${ARCH}.tar.xz\" \\",
-		"    && curl -fsSLO --compressed \"https://nodejs.org/dist/v${NODE_RUNTIME_VERSION}/SHASUMS256.txt.asc\" \\",
-		"    && gpg --batch --no-options --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \\",
-		"    && gpgconf --kill all \\",
-		"    && rm -rf \"$GNUPGHOME\" \\",
-		"    && grep \" node-v${NODE_RUNTIME_VERSION}-linux-${ARCH}.tar.xz\\$\" SHASUMS256.txt | sha256sum -c - \\",
-		"    && tar -xJf \"node-v${NODE_RUNTIME_VERSION}-linux-${ARCH}.tar.xz\" -C \"$NODE_RUNTIME_ROOT\" --strip-components=1 --no-same-owner \\",
-		"    && rm \"node-v${NODE_RUNTIME_VERSION}-linux-${ARCH}.tar.xz\" SHASUMS256.txt.asc SHASUMS256.txt \\",
-		"    && find \"$NODE_RUNTIME_ROOT/include/node/openssl/archs\" -mindepth 1 -maxdepth 1 ! -name \"$OPENSSL_ARCH\" -exec rm -rf {} \\; \\",
-		"    && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \\",
-		"    && export PATH=\"$NODE_RUNTIME_ROOT/bin:$PATH\" \\",
-		"    && npm install -g npm \\",
-		"    && npm uninstall -g corepack \\",
-		"    && npm install -g yarn pnpm @antfu/ni --allow-scripts=pnpm,yarn \\",
-		"    && \"$NODE_RUNTIME_ROOT/bin/node\" --version \\",
-		"    && \"$NODE_RUNTIME_ROOT/bin/npm\" --version \\",
-		"    && rm -rf /tmp/node-source",
-		""
-	];
-}
 async function runDockerBuild(invocation, signal) {
 	const build = spawn("docker", [
 		"build",
@@ -1987,7 +1989,7 @@ function createCli(signal, interactive) {
 			outro("Project is already registered.");
 			return success({});
 		}
-		outro(`Next: run ${c.cyan(c.bold("devbox build"))} to prepare your workspace, then ${c.cyan(c.bold("devbox up"))} to start it.`);
+		outro(`Next: run ${command("devbox build")} to prepare your workspace, then ${command("devbox up")} to start it.`);
 		return success({});
 	});
 	cli.command("config", "Edit Global or Local configuration for the current Project.").action(async () => {
@@ -1999,7 +2001,7 @@ function createCli(signal, interactive) {
 				prompt
 			});
 			if (!result.ok) return result;
-			outro(result.value.changed ? "Global configuration updated." : "Global configuration was not changed.");
+			outro(result.value.changed ? `Global configuration updated. Run ${command("devbox build")} to rebuild the Workspace image.` : "Global configuration was not changed.");
 			return success({});
 		}
 		const result = await configureLocalProject({
@@ -2018,7 +2020,7 @@ function createCli(signal, interactive) {
 		if (!result.ok) return result;
 		return success({ message: `Built Workspace image: ${result.value.image}` });
 	});
-	cli.command("rm", "Remove the current registered Project and its state.").option("--yes", "Skip the confirmation prompt.").action(async (options = {}) => {
+	cli.command("rm", "Remove the current Project Sandbox and Devbox state.").option("--yes", "Skip the confirmation prompt.").action(async (options = {}) => {
 		if (!interactive && !options.yes) return interactiveFailure("devbox rm requires a TTY or --yes.", "Run devbox rm from a TTY, or pass --yes to confirm removal.");
 		const result = await removeProject({
 			signal,
@@ -2028,22 +2030,6 @@ function createCli(signal, interactive) {
 		if (!result.ok) return result;
 		return success({ message: result.value.removed ? `Removed Project: ${result.value.root}` : "Project removal was not changed." });
 	});
-	cli.command("cleanup", "Remove explicitly selected disposable Devbox state.").option("--missing-projects", "Remove Missing-root Project registrations.").option("--yes", "Skip the confirmation prompt.").action(async (options = {}) => {
-		if (!options.missingProjects) return failure({
-			kind: "usage",
-			code: "cleanup-mode-required",
-			observed: "cleanup requires --missing-projects.",
-			nextAction: "Run devbox cleanup --missing-projects."
-		});
-		if (!interactive && !options.yes) return interactiveFailure("devbox cleanup --missing-projects requires a TTY or --yes.", "Run devbox cleanup --missing-projects from a TTY, or pass --yes to confirm removal.");
-		const result = await cleanupMissingProjects({
-			signal,
-			confirm: prompt.confirm,
-			yes: options.yes
-		});
-		if (!result.ok) return result;
-		return success({ message: result.value.removed ? `Removed Missing-root Projects: ${result.value.roots.join(", ")}` : "No Missing-root Projects were removed." });
-	});
 	for (const [command, description] of [
 		["up", "Start the current Project Sandbox."],
 		["down", "Stop and remove the current Project Sandbox."],
@@ -2056,12 +2042,13 @@ function createCli(signal, interactive) {
 		const result = await runSandboxShell({ signal });
 		return result.ok ? success({}) : result;
 	});
+	cli.version(version);
 	cli.help();
 	return cli;
 }
 function present(result) {
 	if (!result.ok) {
-		process.stderr.write(`${result.error.observed}\n${result.error.nextAction}\n`);
+		process.stderr.write(`${highlightCommands(result.error.observed)}\n${highlightCommands(result.error.nextAction)}\n`);
 		return result.error.kind === "usage" ? 2 : 1;
 	}
 	if (result.value.message !== void 0) process.stdout.write(`${result.value.message}\n`);
@@ -2094,6 +2081,12 @@ async function main() {
 function isCacError(error) {
 	return error instanceof Error && error.name === "CACError";
 }
+function command(value) {
+	return c.cyan(c.bold(value));
+}
+function highlightCommands(message) {
+	return message.replace(/\bdevbox (?:init|build|config|up|down|stop|sh|rm)\b/g, command);
+}
 function interactiveFailure(observed, nextAction) {
 	return failure({
 		kind: "usage",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ycs77/devbox",
-  "version": "0.5.1",
+  "version": "0.7.0",
   "description": "A Lucas Yang's opinionated devbox for AI agents",
   "keywords": [
     "agent",