@yeaft/webchat-agent 1.0.385 → 1.0.387

package/Dockerfile

@@ -0,0 +1,26 @@
+FROM node:24-bookworm-slim
+
+ARG BUILD_VERSION=dev
+ENV NODE_ENV=production \
+    HOME=/home/yeaft \
+    YEAFT_DIR=/home/yeaft/.yeaft \
+    WORK_DIR=/workspace
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends ca-certificates git openssh-client tini \
+  && rm -rf /var/lib/apt/lists/* \
+  && useradd --create-home --uid 10001 --shell /usr/sbin/nologin yeaft \
+  && mkdir -p /app /workspace /home/yeaft/.yeaft \
+  && chown -R yeaft:yeaft /app /workspace /home/yeaft
+
+WORKDIR /app
+COPY package.json package-lock.json ./
+COPY agent/package.json ./agent/
+RUN npm ci --workspace=agent --omit=dev
+COPY --chown=yeaft:yeaft agent ./agent
+RUN node -e "const fs=require('fs'); const p='agent/package.json'; const j=JSON.parse(fs.readFileSync(p)); j.version=process.argv[1].replace(/^v/, ''); fs.writeFileSync(p, JSON.stringify(j, null, 2) + '\\n')" "$BUILD_VERSION" \
+  && chmod 0755 agent/container-entrypoint.sh
+
+VOLUME ["/home/yeaft/.yeaft", "/workspace"]
+ENTRYPOINT ["/app/agent/container-entrypoint.sh"]
+CMD []

package/cli.js

@@ -65,12 +65,12 @@ if (command === 'doctor') {
   await handleLlmCommand(subArgs);
 } else if (command === 'local') {
   await handleLocalCommand(subArgs);
-} else if (command === 'managed-sandbox') {
+} else if (command === 'container') {
   try {
-    const { runManagedSandboxAgent } = await import('./managed-sandbox/agent-runtime.js');
-    await runManagedSandboxAgent(subArgs);
+    const { runContainerCli } = await import('./container-cli.js');
+    await runContainerCli(subArgs);
   } catch (error) {
-    console.error(`Managed Sandbox Agent failed: ${error.message}`);
+    console.error(`Container Agent failed: ${error.code || error.message}`);
     process.exit(1);
   }
 } else if (command === 'upgrade') {
@@ -138,6 +138,7 @@ function printHelp() {
     yeaft-agent logs [options]         View service logs (follow mode)
     yeaft-agent doctor                 Diagnose service configuration
     yeaft-agent llm <command>          Configure local Yeaft LLM providers/models
+    yeaft-agent container <command>    Manage a Dockerized yeaft-agent
     yeaft-agent upgrade [--name <id>]  Upgrade and restart the selected service
     yeaft-agent --version              Show version
 

package/connection/index.js

@@ -66,18 +66,8 @@ export function connect(WebSocketImpl = WebSocket) {
       if (msg.type === 'auth_required' && msg.tempId) {
         console.log('Received auth challenge, sending credentials...');
         ctx.pendingAuthTempId = msg.tempId;
-        // Send authentication via WebSocket (not URL)
-        const managed = ctx.CONFIG.managedSandboxIdentity;
-        socket.send(JSON.stringify(managed ? {
-          type: 'auth',
-          tempId: msg.tempId,
-          authKind: 'sandbox',
-          credentialId: managed.credentialId,
-          secret: managed.secret,
-          sandboxClaims: managed.claims,
-          capabilities: ctx.agentCapabilities,
-          version: ctx.agentVersion
-        } : {
+        // Send the ordinary Agent credential via WebSocket (not URL).
+        socket.send(JSON.stringify({
           type: 'auth',
           tempId: msg.tempId,
           secret: ctx.CONFIG.agentSecret,

package/container-cli.js

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import {
+  createContainerAgent,
+  inspectContainerAgent,
+  logsContainerAgent,
+  readSecretInput,
+  removeContainerAgent,
+  startContainerAgent,
+  stopContainerAgent,
+  writeAgentSecretFile,
+} from './container-manager.js';
+
+function help() {
+  console.log(`
+Usage:
+  yeaft-agent container create --server <ws-url> --name <name> (--secret <value> | --secret-file <path>) [--image <image>]
+  yeaft-agent container start|stop|status|remove|logs --name <name>
+
+The container is an ordinary yeaft-agent. This command only manages its Docker lifecycle.
+Use --keep-volumes with remove to preserve its Yeaft data and workspace volumes.
+`);
+}
+
+export function parseContainerArgs(args) {
+  const options = {};
+  const positionals = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === '--keep-volumes' || arg === '--follow') {
+      options[arg.slice(2).replace(/-([a-z])/g, (_, c) => c.toUpperCase())] = true;
+      continue;
+    }
+    if (!arg.startsWith('--')) {
+      positionals.push(arg);
+      continue;
+    }
+    const value = args[++i];
+    if (!value || value.startsWith('--')) throw new Error(`${arg} requires a value`);
+    options[arg.slice(2).replace(/-([a-z])/g, (_, c) => c.toUpperCase())] = value;
+  }
+  return { action: positionals[0], options };
+}
+
+export async function runContainerCli(args) {
+  if (args.length === 0 || args[0] === 'help' || args[0] === '--help' || args[0] === '-h') return help();
+  const { action, options } = parseContainerArgs(args);
+  const name = options.name;
+  let result;
+  if (action === 'create') {
+    const secret = await readSecretInput(options);
+    const secretFile = options.secretFile
+      ? resolve(options.secretFile)
+      : join(homedir(), '.yeaft', 'container-agents', name, 'agent-secret');
+    await writeAgentSecretFile(secretFile, secret);
+    result = await createContainerAgent({
+      name,
+      serverUrl: options.server,
+      secretFile,
+      image: options.image,
+    });
+  } else if (action === 'start') {
+    result = await startContainerAgent(name);
+  } else if (action === 'stop') {
+    result = await stopContainerAgent(name);
+  } else if (action === 'status') {
+    result = await inspectContainerAgent(name);
+  } else if (action === 'remove') {
+    result = await removeContainerAgent(name, { removeVolumes: !options.keepVolumes });
+  } else if (action === 'logs') {
+    result = await logsContainerAgent(name, { follow: options.follow });
+    if (!options.follow && result.stdout) console.log(result.stdout);
+    return;
+  } else {
+    throw new Error(`Unknown container action: ${action}`);
+  }
+  console.log(JSON.stringify({ name, ...result }, null, 2));
+}
+
+if (process.argv[1] && import.meta.url === new URL(`file://${resolve(process.argv[1])}`).href) {
+  runContainerCli(process.argv.slice(2)).catch(error => {
+    console.error(`Container Agent failed: ${error.code || error.message}`);
+    process.exitCode = 1;
+  });
+}

package/container-manager.js

@@ -0,0 +1,165 @@
+import { spawn } from 'node:child_process';
+import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+
+export const DEFAULT_AGENT_IMAGE = 'ghcr.io/yeaft/yeaft-web-code-agent-agent:dev';
+const NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$/;
+
+export class ContainerAgentError extends Error {
+  constructor(code, message = code) {
+    super(message);
+    this.name = 'ContainerAgentError';
+    this.code = code;
+  }
+}
+
+export function normalizeContainerAgentName(name) {
+  const value = String(name || '').trim();
+  if (!NAME_PATTERN.test(value)) throw new ContainerAgentError('CONTAINER_AGENT_INVALID_NAME');
+  return value;
+}
+
+export function containerNameForAgent(name) {
+  return `yeaft-agent-${normalizeContainerAgentName(name)}`;
+}
+
+export async function runDocker(args, { spawnImpl = spawn, allowFailure = false, stdout = 'pipe' } = {}) {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawnImpl('docker', args, {
+      stdio: ['ignore', stdout, 'pipe'],
+      windowsHide: true,
+    });
+    const output = [];
+    const errors = [];
+    child.stdout?.on('data', chunk => output.push(chunk));
+    child.stderr?.on('data', chunk => errors.push(chunk));
+    child.once('error', error => reject(new ContainerAgentError('CONTAINER_AGENT_DOCKER_UNAVAILABLE', error.message)));
+    child.once('close', code => {
+      const result = {
+        code: code ?? 1,
+        stdout: Buffer.concat(output).toString('utf8').trim(),
+        stderr: Buffer.concat(errors).toString('utf8').trim(),
+      };
+      if (result.code === 0 || allowFailure) resolvePromise(result);
+      else reject(new ContainerAgentError('CONTAINER_AGENT_DOCKER_FAILED', result.stderr || `docker ${args[0]} failed`));
+    });
+  });
+}
+
+export async function writeAgentSecretFile(path, secret) {
+  const value = String(secret || '').trim();
+  if (!value) throw new ContainerAgentError('CONTAINER_AGENT_SECRET_REQUIRED');
+  const absolute = resolve(path);
+  await mkdir(dirname(absolute), { recursive: true, mode: 0o700 });
+  await writeFile(absolute, `${value}\n`, { mode: 0o600 });
+  await chmod(absolute, 0o600);
+  return absolute;
+}
+
+export function buildCreateArgs({
+  name,
+  serverUrl,
+  secretFile,
+  image = DEFAULT_AGENT_IMAGE,
+  dataVolume,
+  workspaceVolume,
+  restart = 'unless-stopped',
+}) {
+  const agentName = normalizeContainerAgentName(name);
+  if (!String(serverUrl || '').match(/^wss?:\/\//)) {
+    throw new ContainerAgentError('CONTAINER_AGENT_INVALID_SERVER_URL');
+  }
+  if (!secretFile) throw new ContainerAgentError('CONTAINER_AGENT_SECRET_REQUIRED');
+  const containerName = containerNameForAgent(agentName);
+  const safeImage = String(image || '').trim();
+  if (!safeImage || safeImage.startsWith('-')) throw new ContainerAgentError('CONTAINER_AGENT_INVALID_IMAGE');
+  return [
+    'create', '--name', containerName,
+    '--label', 'io.yeaft.container-agent=true',
+    '--label', `io.yeaft.agent-name=${agentName}`,
+    '--restart', restart,
+    '--init',
+    '--mount', `type=volume,src=${dataVolume || `${containerName}-data`},dst=/home/yeaft/.yeaft`,
+    '--mount', `type=volume,src=${workspaceVolume || `${containerName}-workspace`},dst=/workspace`,
+    '--mount', `type=bind,src=${resolve(secretFile)},dst=/run/yeaft-host-secret,readonly`,
+    '--env', `SERVER_URL=${serverUrl}`,
+    '--env', `AGENT_NAME=${agentName}`,
+    '--env', 'AGENT_SECRET_FILE=/run/yeaft-host-secret',
+    '--env', 'YEAFT_DIR=/home/yeaft/.yeaft',
+    '--env', 'WORK_DIR=/workspace',
+    safeImage,
+  ];
+}
+
+export async function inspectContainerAgent(name, options = {}) {
+  const result = await runDocker([
+    'inspect', '--format', '{{json .State}}', containerNameForAgent(name),
+  ], { ...options, allowFailure: true });
+  if (result.code !== 0) {
+    if (/no such (object|container)/i.test(result.stderr)) {
+      return { exists: false, status: 'absent', running: false };
+    }
+    throw new ContainerAgentError('CONTAINER_AGENT_DOCKER_FAILED', result.stderr || 'docker inspect failed');
+  }
+  try {
+    const state = JSON.parse(result.stdout);
+    return {
+      exists: true,
+      status: state.Status || 'unknown',
+      running: state.Running === true,
+      startedAt: state.StartedAt || null,
+      error: state.Error || null,
+    };
+  } catch {
+    throw new ContainerAgentError('CONTAINER_AGENT_INVALID_DOCKER_RESPONSE');
+  }
+}
+
+export async function createContainerAgent(options, runtime = {}) {
+  const current = await inspectContainerAgent(options.name, runtime);
+  if (current.exists) throw new ContainerAgentError('CONTAINER_AGENT_ALREADY_EXISTS');
+  const containerName = containerNameForAgent(options.name);
+  await runDocker(buildCreateArgs(options), runtime);
+  try {
+    await runDocker(['start', containerName], runtime);
+  } catch (error) {
+    await runDocker(['rm', '-f', containerName], { ...runtime, allowFailure: true });
+    throw error;
+  }
+  return inspectContainerAgent(options.name, runtime);
+}
+
+export async function startContainerAgent(name, runtime = {}) {
+  await runDocker(['start', containerNameForAgent(name)], runtime);
+  return inspectContainerAgent(name, runtime);
+}
+
+export async function stopContainerAgent(name, runtime = {}) {
+  await runDocker(['stop', '--time', '10', containerNameForAgent(name)], runtime);
+  return inspectContainerAgent(name, runtime);
+}
+
+export async function removeContainerAgent(name, { removeVolumes = true, ...runtime } = {}) {
+  const containerName = containerNameForAgent(name);
+  const current = await inspectContainerAgent(name, runtime);
+  if (current.exists) await runDocker(['rm', '-f', containerName], runtime);
+  if (removeVolumes) {
+    await runDocker(['volume', 'rm', `${containerName}-data`, `${containerName}-workspace`], {
+      ...runtime,
+      allowFailure: true,
+    });
+  }
+  return { exists: false, status: 'absent', running: false };
+}
+
+export async function logsContainerAgent(name, { follow = false, ...runtime } = {}) {
+  const args = ['logs'];
+  if (follow) args.push('--follow');
+  args.push(containerNameForAgent(name));
+  return runDocker(args, { ...runtime, stdout: follow ? 'inherit' : 'pipe' });
+}
+
+export async function readSecretInput({ secret, secretFile }) {
+  if (secretFile) return (await readFile(resolve(secretFile), 'utf8')).trim();
+  return String(secret || '').trim();
+}

package/index.js

@@ -21,7 +21,6 @@ import {
 import { loadNodePty } from './terminal.js';
 import { connect } from './connection.js';
 import { loadMcpServers } from './mcp.js';
-import { getManagedSandboxIdentity } from './managed-sandbox/identity-store.js';
 import { SAFE_REMOTE_UPGRADE_CAPABILITY } from './upgrade-command.js';
 import { loadConfig as loadYeaftConfig } from './yeaft/config.js';
 import {
@@ -50,7 +49,6 @@ ctx.pkgName = pkg.name;
 // service instances must stay scoped to their standard per-instance config.
 const LOCAL_CONFIG_FILE = join(process.cwd(), '.claude-agent.json');
 const IS_LOCAL_RUN = process.env.YEAFT_LOCAL_RUN === 'true';
-const MANAGED_SANDBOX_IDENTITY = getManagedSandboxIdentity();
 const DEFAULT_AGENT_NAME = getDefaultAgentName();
 
 // 加载或创建配置
@@ -113,6 +111,10 @@ try {
   console.warn(`[Agent] Could not ensure yeaft dir ${YEAFT_DIR}: ${err?.message || err}`);
 }
 
+const agentSecret = process.env.AGENT_SECRET_FILE
+  ? readFileSync(process.env.AGENT_SECRET_FILE, 'utf8').trim()
+  : (process.env.AGENT_SECRET || fileConfig.agentSecret);
+
 const CONFIG = {
   instanceId: INSTANCE_ID,
   serverUrl: process.env.SERVER_URL || fileConfig.serverUrl,
@@ -121,8 +123,7 @@ const CONFIG = {
   yeaftDir: YEAFT_DIR,
   telemetry: loadYeaftConfig({ dir: YEAFT_DIR }).telemetry,
   reconnectInterval: fileConfig.reconnectInterval,
-  agentSecret: process.env.AGENT_SECRET || fileConfig.agentSecret,
-  managedSandboxIdentity: MANAGED_SANDBOX_IDENTITY,
+  agentSecret,
   // 显式禁用的工具（非 MCP 相关）
   explicitDisallowedTools: (() => {
     const raw = process.env.DISALLOWED_TOOLS || fileConfig.disallowedTools || '';
@@ -159,7 +160,6 @@ async function detectCapabilities() {
   // flip `agent.encryptOutbound = false`, stopping outbound encryption
   // to this peer. Old servers ignore the unknown capability token.
   const capabilities = ['background_tasks', 'file_editor', 'ping_session', 'plaintext-ok', SAFE_REMOTE_UPGRADE_CAPABILITY, 'work_center', 'work_center_message_v2', 'session_history_search', 'session_history_outline', 'session_history_window_prefetch'];
-  if (MANAGED_SANDBOX_IDENTITY) capabilities.push('managed-sandbox');
   if (process.platform === 'linux') capabilities.push('work_item_attachments');
   const pty = await loadNodePty();
   if (pty) capabilities.push('terminal');

package/local-runtime/server/config.js

@@ -3,7 +3,7 @@ import { readFileSync, existsSync, writeFileSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
 import { userDb } from './database.js';
-import { validateSandboxDeploymentConfig } from './sandbox-config.js';
+import { homedir } from 'node:os';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -115,42 +115,13 @@ export const CONFIG = {
   // Agent authentication (global fallback — per-user agent_secret is preferred)
   agentSecret: process.env.AGENT_SECRET || DEFAULT_AGENT_SECRET,
 
-  // Managed Sandbox is fail-closed. Enabling the product flag is not enough:
-  // entitlement and a qualified dedicated Host with capacity are also required.
+  // A Sandbox is an ordinary yeaft-agent container managed by this Server's Docker daemon.
+  // The Server controls only the container lifecycle; Agent behavior stays on the existing wire.
   sandbox: {
     enabled: process.env.SANDBOX_ENABLED === 'true',
-    maxReservedSandboxes: parseInt(process.env.SANDBOX_MAX_RESERVED, 10) || 2,
-    hostMemoryReserveMiB: parseInt(process.env.SANDBOX_HOST_MEMORY_RESERVE_MIB, 10) || 2048,
-    hostFreshnessMs: parseInt(process.env.SANDBOX_HOST_FRESHNESS_MS, 10) || 30_000,
-    agentRecoveryGraceMs: parseInt(process.env.SANDBOX_AGENT_RECOVERY_GRACE_MS, 10) || 60_000,
-    operationTimeoutMs: parseInt(process.env.SANDBOX_OPERATION_TIMEOUT_MS, 10) || 10 * 60_000,
-    reconcileIntervalMs: parseInt(process.env.SANDBOX_RECONCILE_INTERVAL_MS, 10) || 5_000,
-    controllerRequestTimeoutMs: parseInt(process.env.SANDBOX_CONTROLLER_TIMEOUT_MS, 10) || 10_000,
-    bootstrapTtlMs: parseInt(process.env.SANDBOX_BOOTSTRAP_TTL_MS, 10) || 5 * 60_000,
-    bootstrapSigningKey: process.env.SANDBOX_BOOTSTRAP_SIGNING_KEY || '',
-    hostAttestationKey: process.env.SANDBOX_HOST_ATTESTATION_KEY || '',
-    controllerAttestationFingerprint: process.env.SANDBOX_CONTROLLER_ATTESTATION_FINGERPRINT || '',
-    hostAttestationListenerHost: process.env.SANDBOX_HOST_ATTESTATION_LISTENER_HOST || '',
-    hostAttestationListenerPort: parseInt(process.env.SANDBOX_HOST_ATTESTATION_LISTENER_PORT, 10) || 0,
-    hostAttestationServerCert: process.env.SANDBOX_HOST_ATTESTATION_SERVER_CERT || '',
-    hostAttestationServerKey: process.env.SANDBOX_HOST_ATTESTATION_SERVER_KEY || '',
-    hostAttestationClientCa: process.env.SANDBOX_HOST_ATTESTATION_CLIENT_CA || '',
-    hostAttestationBodyLimitBytes:
-      parseInt(process.env.SANDBOX_HOST_ATTESTATION_BODY_LIMIT_BYTES, 10) || 64 * 1024,
-    hostAttestationShutdownTimeoutMs:
-      parseInt(process.env.SANDBOX_HOST_ATTESTATION_SHUTDOWN_TIMEOUT_MS, 10) || 1_000,
-    helperAttestationPublicKey: process.env.SANDBOX_HELPER_ATTESTATION_PUBLIC_KEY || '',
-    hostAttestationMaxSkewMs: parseInt(process.env.SANDBOX_HOST_ATTESTATION_MAX_SKEW_MS, 10) || 30_000,
-    imageDigest: process.env.SANDBOX_IMAGE_DIGEST || '',
-    controllerUrl: process.env.SANDBOX_CONTROLLER_URL || '',
-    controllerToken: process.env.SANDBOX_CONTROLLER_TOKEN || '',
-    controllerClientCert: process.env.SANDBOX_CONTROLLER_CLIENT_CERT || '',
-    controllerClientKey: process.env.SANDBOX_CONTROLLER_CLIENT_KEY || '',
-    controllerCaCert: process.env.SANDBOX_CONTROLLER_CA_CERT || '',
-    operationSigningPrivateKey: process.env.SANDBOX_OPERATION_SIGNING_PRIVATE_KEY || '',
-    controllerResultPublicKey: process.env.SANDBOX_CONTROLLER_RESULT_PUBLIC_KEY || '',
-    controllerProtocolMaxSkewMs: parseInt(process.env.SANDBOX_CONTROLLER_PROTOCOL_MAX_SKEW_MS, 10) || 30_000,
-    controllerHostId: process.env.SANDBOX_CONTROLLER_HOST_ID || ''
+    image: process.env.SANDBOX_AGENT_IMAGE || 'ghcr.io/yeaft/yeaft-web-code-agent-agent:dev',
+    serverUrl: process.env.SANDBOX_SERVER_URL || '',
+    stateDir: process.env.SANDBOX_STATE_DIR || join(homedir(), '.yeaft', 'container-agents')
   },
 
   // File upload settings
@@ -299,8 +270,8 @@ export function validateProductionConfig() {
     errors.push('JWT_SECRET must be set to a secure value in production mode');
   }
 
-  if (CONFIG.sandbox.enabled && !validateSandboxDeploymentConfig(CONFIG.sandbox)) {
-    errors.push('Sandbox requires an HTTPS dedicated Controller, Host binding, fixed image digest, a dedicated mTLS Host attestation listener with a pinned Controller certificate, Controller token, asymmetric operation/result keys, bootstrap signing key, Host attestation key, and Helper attestation public key');
+  if (CONFIG.sandbox.enabled && !/^wss?:\/\//.test(CONFIG.sandbox.serverUrl)) {
+    errors.push('SANDBOX_SERVER_URL must be the ws:// or wss:// URL that container Agents use to connect');
   }
 
   // Check that at least one user with a password exists (in DB or config)

package/local-runtime/server/container-agent-service.js

@@ -0,0 +1,78 @@
+import { join } from 'node:path';
+import { CONFIG } from './config.js';
+import {
+  createContainerAgent,
+  inspectContainerAgent,
+  removeContainerAgent,
+  startContainerAgent,
+  stopContainerAgent,
+  writeAgentSecretFile,
+} from '../agent/container-manager.js';
+
+function managedName(userId) {
+  return `sandbox-${String(userId).replace(/[^a-zA-Z0-9_.-]/g, '-').slice(0, 48)}`;
+}
+
+export class ContainerAgentService {
+  constructor(config = CONFIG.sandbox) {
+    this.config = config;
+  }
+
+  capability() {
+    return {
+      available: this.config.enabled,
+      reasonCode: this.config.enabled ? null : 'SANDBOX_DISABLED',
+      catalog: this.config.enabled ? [{ id: 'standard' }] : [],
+    };
+  }
+
+  nameForUser(userId) {
+    return managedName(userId);
+  }
+
+  async snapshot(userId) {
+    const name = this.nameForUser(userId);
+    const state = await inspectContainerAgent(name);
+    if (!state.exists) return null;
+    return {
+      id: name,
+      agentName: name,
+      sizeId: 'standard',
+      desiredState: state.running ? 'running' : 'stopped',
+      observedState: state.running ? 'running' : state.status,
+      reservationHeld: true,
+      operation: null,
+      lastErrorCode: state.error || null,
+    };
+  }
+
+  async create(user, { agentName } = {}) {
+    if (!this.config.enabled) throw Object.assign(new Error('SANDBOX_DISABLED'), { code: 'SANDBOX_DISABLED' });
+    const name = this.nameForUser(user.id);
+    const secretFile = join(this.config.stateDir, name, 'agent-secret');
+    await writeAgentSecretFile(secretFile, user.agent_secret);
+    await createContainerAgent({
+      name,
+      serverUrl: this.config.serverUrl,
+      secretFile,
+      image: this.config.image,
+    });
+    return { snapshot: await this.snapshot(user.id), replayed: false };
+  }
+
+  async action(userId, action) {
+    const name = this.nameForUser(userId);
+    if (action === 'start') await startContainerAgent(name);
+    else if (action === 'retry') {
+      const current = await inspectContainerAgent(name);
+      if (current.exists) await startContainerAgent(name);
+      else throw Object.assign(new Error('SANDBOX_NOT_FOUND'), { code: 'SANDBOX_NOT_FOUND' });
+    }
+    else if (action === 'stop') await stopContainerAgent(name);
+    else if (action === 'remove') await removeContainerAgent(name);
+    else throw Object.assign(new Error('SANDBOX_ACTION_NOT_ALLOWED'), { code: 'SANDBOX_ACTION_NOT_ALLOWED' });
+    return { snapshot: await this.snapshot(userId), replayed: false };
+  }
+}
+
+export const containerAgentService = new ContainerAgentService();

package/local-runtime/server/database.js

@@ -10,6 +10,5 @@ export { messageDb } from './db/message-db.js';
 export { userStatsDb } from './db/user-stats-db.js';
 export { expertDb } from './db/expert-db.js';
 export { identityDb } from './db/identity-db.js';
-export { sandboxDb } from './db/sandbox-db.js';
 export { closeDb } from './db/connection.js';
 export { default } from './db/connection.js';

package/local-runtime/server/db/connection.js

@@ -1316,6 +1316,11 @@ export const stmts = {
   deleteCustomExpertRolesForUser: db.prepare(`
     DELETE FROM custom_expert_roles WHERE user_id = ?
   `),
+  // Remove rows from the retired managed-Sandbox control plane before the user.
+  // Child operations, credentials, and audit rows cascade from sandboxes.
+  deleteLegacySandboxesForUser: db.prepare(`
+    DELETE FROM sandboxes WHERE user_id = ?
+  `),
   // Invitations: keep history but null-out the FK so it doesn't block deletion.
   // (created_by is NOT NULL, so for invitations the user created we just delete them.)
   deleteInvitationsCreatedBy: db.prepare(`
@@ -1324,12 +1329,6 @@ export const stmts = {
   clearInvitationUsedBy: db.prepare(`
     UPDATE invitations SET used_by = NULL WHERE used_by = ?
   `),
-  getReservedSandboxForUser: db.prepare(`
-    SELECT id FROM sandboxes WHERE user_id = ? AND reservation_held = 1 LIMIT 1
-  `),
-  deleteReleasedSandboxesForUser: db.prepare(`
-    DELETE FROM sandboxes WHERE user_id = ? AND reservation_held = 0
-  `),
   deleteUserById: db.prepare(`
     DELETE FROM users WHERE id = ?
   `),