lastlight 0.1.8 → 0.2.0

package/dist/worktree/manager.js

@@ -1,5 +1,5 @@
-import { execSync } from "child_process";
-import { existsSync, rmSync } from "fs";
+import { execFileSync } from "child_process";
+import { existsSync, mkdirSync, rmSync } from "fs";
 import { join, resolve } from "path";
 const WORKTREE_DIR = ".worktrees";
 /**
@@ -14,8 +14,8 @@ export class WorktreeManager {
     constructor(baseDir) {
         this.baseDir = baseDir || resolve(WORKTREE_DIR);
     }
-    exec(cmd, opts) {
-        return execSync(cmd, { encoding: "utf-8", stdio: "pipe", ...opts });
+    execGit(args, opts) {
+        return execFileSync("git", args, { encoding: "utf-8", stdio: "pipe", ...opts });
     }
     /**
      * Create a new worktree for a task.
@@ -29,7 +29,7 @@ export class WorktreeManager {
         const worktreePath = join(this.baseDir, taskId);
         // Ensure base directory exists
         if (!existsSync(this.baseDir)) {
-            execSync(`mkdir -p ${this.baseDir}`);
+            mkdirSync(this.baseDir, { recursive: true });
         }
         // We need a bare/normal repo to create worktrees from.
         // Use a shared bare clone per repo to avoid re-cloning each time.
@@ -37,11 +37,11 @@ export class WorktreeManager {
         const bareDir = join(this.baseDir, `.bare-${repoName}`);
         if (!existsSync(bareDir)) {
             console.log(`[worktree] Bare clone: ${repoUrl}`);
-            this.exec(`git clone --bare ${repoUrl} ${bareDir}`);
+            this.execGit(["clone", "--bare", repoUrl, bareDir]);
         }
         else {
             // Fetch latest
-            this.exec(`git -C ${bareDir} fetch --all --prune`);
+            this.execGit(["-C", bareDir, "fetch", "--all", "--prune"]);
         }
         // Create worktree with new branch from base
         const base = baseBranch || "main";
@@ -49,7 +49,7 @@ export class WorktreeManager {
         // Check if branch already exists remotely
         let branchExists = false;
         try {
-            this.exec(`git -C ${bareDir} rev-parse --verify origin/${branch}`);
+            this.execGit(["-C", bareDir, "rev-parse", "--verify", `origin/${branch}`]);
             branchExists = true;
         }
         catch {
@@ -58,13 +58,13 @@ export class WorktreeManager {
         if (branchExists) {
             // Resume existing branch
             console.log(`[worktree] Resuming branch: ${branch}`);
-            this.exec(`git -C ${bareDir} worktree add ${worktreePath} origin/${branch}`);
-            this.exec(`git -C ${worktreePath} checkout -B ${branch} origin/${branch}`);
+            this.execGit(["-C", bareDir, "worktree", "add", worktreePath, `origin/${branch}`]);
+            this.execGit(["-C", worktreePath, "checkout", "-B", branch, `origin/${branch}`]);
         }
         else {
             // Create new branch from base
             console.log(`[worktree] New branch: ${branch} from ${baseRef}`);
-            this.exec(`git -C ${bareDir} worktree add -b ${branch} ${worktreePath} ${baseRef}`);
+            this.execGit(["-C", bareDir, "worktree", "add", "-b", branch, worktreePath, baseRef]);
         }
         const info = {
             taskId,
@@ -94,7 +94,7 @@ export class WorktreeManager {
         try {
             // Remove worktree
             if (existsSync(info.path)) {
-                this.exec(`git -C ${bareDir} worktree remove --force ${info.path}`);
+                this.execGit(["-C", bareDir, "worktree", "remove", "--force", info.path]);
             }
         }
         catch (err) {
@@ -102,7 +102,7 @@ export class WorktreeManager {
             if (existsSync(info.path)) {
                 rmSync(info.path, { recursive: true, force: true });
                 try {
-                    this.exec(`git -C ${bareDir} worktree prune`);
+                    this.execGit(["-C", bareDir, "worktree", "prune"]);
                 }
                 catch { /* best effort */ }
             }
@@ -110,7 +110,7 @@ export class WorktreeManager {
         // Optionally delete the branch
         if (opts?.deleteBranch) {
             try {
-                this.exec(`git -C ${bareDir} branch -D ${info.branch}`);
+                this.execGit(["-C", bareDir, "branch", "-D", info.branch]);
             }
             catch { /* branch may not exist locally */ }
         }

package/dist/worktree/manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/worktree/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAwB,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAErC,MAAM,YAAY,GAAG,YAAY,CAAC;AAUlC;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAClB,OAAO,CAAS;IAChB,MAAM,GAA8B,IAAI,GAAG,EAAE,CAAC;IAEtD,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IAEO,IAAI,CAAC,GAAW,EAAE,IAAsB;QAC9C,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,CAAW,CAAC;IAChF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,IAKZ;QACC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAErD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;QAClC,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEhD,+BAA+B;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,CAAC;QAED,uDAAuD;QACvD,kEAAkE;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC,CAAC;QAExD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,oBAAoB,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,eAAe;YACf,IAAI,CAAC,IAAI,CAAC,UAAU,OAAO,sBAAsB,CAAC,CAAC;QACrD,CAAC;QAED,4CAA4C;QAC5C,MAAM,IAAI,GAAG,UAAU,IAAI,MAAM,CAAC;QAClC,MAAM,OAAO,GAAG,UAAU,IAAI,EAAE,CAAC;QAEjC,0CAA0C;QAC1C,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,UAAU,OAAO,8BAA8B,MAAM,EAAE,CAAC,CAAC;YACnE,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,yBAAyB;YACzB,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI,CAAC,UAAU,OAAO,iBAAiB,YAAY,WAAW,MAAM,EAAE,CAAC,CAAC;YAC7E,IAAI,CAAC,IAAI,CAAC,UAAU,YAAY,gBAAgB,MAAM,WAAW,MAAM,EAAE,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,8BAA8B;YAC9B,OAAO,CAAC,GAAG,CAAC,0BAA0B,MAAM,SAAS,OAAO,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,UAAU,OAAO,oBAAoB,MAAM,IAAI,YAAY,IAAI,OAAO,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAiB;YACzB,MAAM;YACN,IAAI,EAAE,YAAY;YAClB,MAAM;YACN,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,MAAc;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,IAAiC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC,CAAC;QAExD,IAAI,CAAC;YACH,kBAAkB;YAClB,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,UAAU,OAAO,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6CAA6C;YAC7C,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpD,IAAI,CAAC;oBACH,IAAI,CAAC,IAAI,CAAC,UAAU,OAAO,iBAAiB,CAAC,CAAC;gBAChD,CAAC;gBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,IAAI,IAAI,EAAE,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,UAAU,OAAO,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/worktree/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAwB,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAErC,MAAM,YAAY,GAAG,YAAY,CAAC;AAUlC;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAClB,OAAO,CAAS;IAChB,MAAM,GAA8B,IAAI,GAAG,EAAE,CAAC;IAEtD,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IAEO,OAAO,CAAC,IAAc,EAAE,IAAsB;QACpD,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,CAAW,CAAC;IAC5F,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,IAKZ;QACC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAErD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;QAClC,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEhD,+BAA+B;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QAED,uDAAuD;QACvD,kEAAkE;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC,CAAC;QAExD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,eAAe;YACf,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,4CAA4C;QAC5C,MAAM,IAAI,GAAG,UAAU,IAAI,MAAM,CAAC;QAClC,MAAM,OAAO,GAAG,UAAU,IAAI,EAAE,CAAC;QAEjC,0CAA0C;QAC1C,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,MAAM,EAAE,CAAC,CAAC,CAAC;YAC3E,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,yBAAyB;YACzB,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,MAAM,EAAE,CAAC,CAAC,CAAC;YACnF,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,MAAM,EAAE,CAAC,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,8BAA8B;YAC9B,OAAO,CAAC,GAAG,CAAC,0BAA0B,MAAM,SAAS,OAAO,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,IAAI,GAAiB;YACzB,MAAM;YACN,IAAI,EAAE,YAAY;YAClB,MAAM;YACN,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,MAAc;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,IAAiC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC,CAAC;QAExD,IAAI,CAAC;YACH,kBAAkB;YAClB,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6CAA6C;YAC7C,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpD,IAAI,CAAC;oBACH,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,IAAI,IAAI,EAAE,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/worktree/manager.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/worktree/manager.test.js

@@ -0,0 +1,87 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+vi.mock("child_process", () => ({
+    execSync: vi.fn(),
+    execFileSync: vi.fn().mockReturnValue(""),
+}));
+vi.mock("fs", async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        existsSync: vi.fn().mockReturnValue(false),
+        mkdirSync: vi.fn(),
+        rmSync: vi.fn(),
+    };
+});
+import { execSync, execFileSync } from "child_process";
+import { existsSync, mkdirSync } from "fs";
+import { WorktreeManager } from "./manager.js";
+const mockExecSync = vi.mocked(execSync);
+const mockExecFileSync = vi.mocked(execFileSync);
+const mockExistsSync = vi.mocked(existsSync);
+const mockMkdirSync = vi.mocked(mkdirSync);
+describe("WorktreeManager — no shell injection via execFileSync", () => {
+    let manager;
+    beforeEach(() => {
+        vi.clearAllMocks();
+        manager = new WorktreeManager("/tmp/test-worktrees");
+        // baseDir doesn't exist → triggers mkdir and clone
+        mockExistsSync.mockReturnValue(false);
+    });
+    it("create() does not use execSync", async () => {
+        await manager.create({
+            taskId: "task-001",
+            repoUrl: "https://github.com/cliftonc/lastlight.git",
+            branch: "feature/test",
+        });
+        expect(mockExecSync).not.toHaveBeenCalled();
+    });
+    it("create() calls execFileSync with 'git' as the command", async () => {
+        await manager.create({
+            taskId: "task-002",
+            repoUrl: "https://github.com/cliftonc/lastlight.git",
+            branch: "feature/test",
+        });
+        expect(mockExecFileSync).toHaveBeenCalled();
+        for (const call of mockExecFileSync.mock.calls) {
+            expect(call[0]).toBe("git");
+            expect(Array.isArray(call[1])).toBe(true);
+        }
+    });
+    it("create() uses mkdirSync instead of execSync for directory creation", async () => {
+        await manager.create({
+            taskId: "task-003",
+            repoUrl: "https://github.com/cliftonc/lastlight.git",
+            branch: "feature/test",
+        });
+        expect(mockMkdirSync).toHaveBeenCalledWith(expect.any(String), expect.objectContaining({ recursive: true }));
+        // execSync must not have been used for mkdir
+        const mkdirCalls = mockExecSync.mock.calls.filter((c) => String(c[0]).includes("mkdir"));
+        expect(mkdirCalls).toHaveLength(0);
+    });
+    it("create() passes repoUrl as a separate argument (not shell-interpolated)", async () => {
+        const repoUrl = "https://github.com/cliftonc/lastlight.git";
+        await manager.create({
+            taskId: "task-004",
+            repoUrl,
+            branch: "feature/test",
+        });
+        const cloneCall = mockExecFileSync.mock.calls.find((c) => Array.isArray(c[1]) && c[1].includes("clone"));
+        expect(cloneCall).toBeDefined();
+        const args = cloneCall[1];
+        expect(args).toContain(repoUrl);
+    });
+    it("cleanup() does not use execSync", async () => {
+        // First create so cleanup has something to work with
+        mockExistsSync.mockReturnValue(true);
+        await manager.create({
+            taskId: "task-005",
+            repoUrl: "https://github.com/cliftonc/lastlight.git",
+            branch: "feature/test",
+        });
+        vi.clearAllMocks();
+        mockExistsSync.mockReturnValue(true);
+        await manager.cleanup("task-005", { deleteBranch: true });
+        expect(mockExecSync).not.toHaveBeenCalled();
+    });
+});
+//# sourceMappingURL=manager.test.js.map

package/dist/worktree/manager.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.test.js","sourceRoot":"","sources":["../../src/worktree/manager.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9B,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE;IACjB,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;CAC1C,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACrC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAuB,CAAC;IAC3D,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC;QAC1C,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE;QAClB,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;KAChB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,YAAY,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACzC,MAAM,gBAAgB,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACjD,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAC7C,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAE3C,QAAQ,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACrE,IAAI,OAAwB,CAAC;IAE7B,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,GAAG,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;QACrD,mDAAmD;QACnD,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,OAAO,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,2CAA2C;YACpD,MAAM,EAAE,cAAc;SACvB,CAAC,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,OAAO,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,2CAA2C;YACpD,MAAM,EAAE,cAAc;SACvB,CAAC,CAAC;QACH,MAAM,CAAC,gBAAgB,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,OAAO,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,2CAA2C;YACpD,MAAM,EAAE,cAAc;SACvB,CAAC,CAAC;QACH,MAAM,CAAC,aAAa,CAAC,CAAC,oBAAoB,CACxC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAClB,MAAM,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAC7C,CAAC;QACF,6CAA6C;QAC7C,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CACtC,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,OAAO,GAAG,2CAA2C,CAAC;QAC5D,MAAM,OAAO,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,UAAU;YAClB,OAAO;YACP,MAAM,EAAE,cAAc;SACvB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAChD,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,CAAC,CAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CACnE,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,SAAU,CAAC,CAAC,CAAa,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,qDAAqD;QACrD,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,OAAO,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,2CAA2C;YACpD,MAAM,EAAE,cAAc;SACvB,CAAC,CAAC;QACH,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/docker-compose.yml

@@ -8,11 +8,35 @@ services:
       - 8.8.8.8
       - 1.1.1.1
     volumes:
-      - ./secrets:/app/secrets:ro
+      # Single private deployment folder: overlay config.yaml + asset overrides
+      # plus a gitignored secrets/ subdir (.env, *.pem). LASTLIGHT_OVERLAY_DIR
+      # points the harness at /app/instance; the entrypoint reads secrets from
+      # /app/instance/secrets. This is the only deployment-specific input, and
+      # the harness reads it at startup — edit it and `docker compose restart
+      # agent` to apply, no image rebuild. Built-in assets (config/, workflows/,
+      # skills/, agent-context/) stay baked into the image; they're lastlight
+      # source and change via a normal rebuild.
+      - ./instance:/app/instance:ro
       - agent-data:/app/data
       - /var/run/docker.sock:/var/run/docker.sock   # spawn sandbox containers
+    # Env comes from the consolidated overlay (instance/secrets/.env). The
+    # entrypoint also sources it inside the container; this env_file is the
+    # belt-and-suspenders copy. required: false so a fresh checkout (no
+    # instance/ yet) doesn't error. No repo-root .env is needed.
     env_file:
-      - .env
+      - path: ./instance/secrets/.env
+        required: false
+    environment:
+      # V8's default old-space cap (~1.5 GB on 64-bit) is well below the 2g
+      # cgroup limit, so Node would OOM before docker did. Raise it close to
+      # the container limit so transient bursts have somewhere to land.
+      - NODE_OPTIONS=--max-old-space-size=1800
+    # Steady-state ~150 MB; bursts during webhook fan-out, the in-process
+    # chat skill (full Agent SDK), and the dispatch screening call. 2 GB
+    # gives headroom for those bursts while still preventing a runaway leak
+    # from taking the host down.
+    mem_limit: 2g
+    memswap_limit: 2g
     networks:
       - internal
 
@@ -25,6 +49,150 @@ services:
     profiles:
       - build-only     # never started as a service, just built
 
+  # Build the enriched browser-QA sandbox image (Tier B). Separate + heavier
+  # (Playwright + a baked Chromium), built only when QA is enabled. Its FROM
+  # depends on lastlight-sandbox:latest existing first, so build in that order:
+  #   docker compose --profile build-only build sandbox sandbox-qa
+  sandbox-qa:
+    build:
+      context: .
+      dockerfile: sandbox-qa.Dockerfile
+    image: lastlight-sandbox-qa:latest
+    profiles:
+      - build-only     # never started as a service, just built
+
+  # ── Egress firewall (replaces the earlier tinyproxy CONNECT-proxy) ────
+  #
+  # See src/sandbox/egress-firewall-config.ts for the architecture rationale.
+  # Two pairs: (coredns-strict + nginx-egress-strict) and
+  # (coredns-open + nginx-egress-open). Sandbox containers spawn with
+  # `--dns <coredns-ip>` and dial allowlisted hosts directly — coredns
+  # resolves the hostname to the nginx IP, nginx peeks SNI and tunnels.
+  #
+  # The sandbox sees no proxy at all. Works for any SDK regardless of
+  # whether it honours HTTP(S)_PROXY env vars.
+
+  # One-shot init that writes nginx-strict.conf / nginx-open.conf /
+  # Corefile.strict / Corefile.open into the agent-data volume before
+  # coredns + nginx try to read them. Without this, the firewall
+  # services boot first, fail to find the configs, and run with empty
+  # state (returning NXDOMAIN for everything) — even after the harness
+  # later writes the files, the running processes never re-read them.
+  # `condition: service_completed_successfully` on the firewalls below
+  # makes them wait for this to exit 0.
+  egress-init:
+    image: lastlight-agent
+    restart: "no"
+    # Mounts the same overlay + secrets the agent does and runs the SAME
+    # config loader, so the collector config it pre-writes is computed from
+    # the effective config (env AND instance/config.yaml) — identical to what
+    # the harness writes at boot. This is what keeps the running collector's
+    # forwarding gate from diverging from the harness when OTEL is enabled via
+    # YAML rather than env.
+    env_file:
+      - path: ./instance/secrets/.env
+        required: false
+    volumes:
+      - ./instance:/app/instance:ro
+      - agent-data:/app/data
+    command:
+      ["node", "-e",
+       "const c=require('/app/dist/config.js').loadConfig();const m=require('/app/dist/sandbox/egress-firewall-config.js');const d=c.stateDir;m.writeEgressFirewallConfigs(d);m.writeOtelCollectorConfig(d,{active:c.otel.enabled&&c.otel.forwardToSandbox})"]
+    depends_on:
+      - agent          # ensures the image has been built when init runs
+
+  coredns-strict:
+    image: coredns/coredns:1.11.3
+    restart: unless-stopped
+    command: ["-conf", "/app/data/proxy/Corefile.strict"]
+    volumes:
+      - agent-data:/app/data:ro
+    depends_on:
+      egress-init:
+        condition: service_completed_successfully
+    networks:
+      sandbox-egress:
+        ipv4_address: 172.30.0.10
+
+  coredns-open:
+    image: coredns/coredns:1.11.3
+    restart: unless-stopped
+    command: ["-conf", "/app/data/proxy/Corefile.open"]
+    volumes:
+      - agent-data:/app/data:ro
+    depends_on:
+      egress-init:
+        condition: service_completed_successfully
+    networks:
+      sandbox-egress:
+        ipv4_address: 172.30.0.11
+
+  nginx-egress-strict:
+    image: nginx:alpine
+    restart: unless-stopped
+    command:
+      ["nginx", "-c", "/app/data/proxy/nginx-strict.conf", "-g", "daemon off;"]
+    volumes:
+      - agent-data:/app/data:ro
+    depends_on:
+      egress-init:
+        condition: service_completed_successfully
+    # Deliberately NOT on `internal`. Splitting ingress (sandbox-egress)
+    # and egress (proxy-egress) onto separate networks that don't include
+    # harness services keeps compose-internal hostnames unresolvable to
+    # the firewall — so an `unrestricted_egress` phase can't ask nginx to
+    # tunnel to `agent:8644` or similar.
+    networks:
+      sandbox-egress:
+        ipv4_address: 172.30.0.20
+      proxy-egress: {}
+
+  nginx-egress-open:
+    image: nginx:alpine
+    restart: unless-stopped
+    command:
+      ["nginx", "-c", "/app/data/proxy/nginx-open.conf", "-g", "daemon off;"]
+    volumes:
+      - agent-data:/app/data:ro
+    depends_on:
+      egress-init:
+        condition: service_completed_successfully
+    networks:
+      sandbox-egress:
+        ipv4_address: 172.30.0.21
+      proxy-egress: {}
+
+  # In-network OTEL collector. Sandboxes export telemetry here (by IP, on
+  # sandbox-egress) and it re-exports to the configured backend over
+  # proxy-egress. This is why the strict SNI firewall doesn't need to know
+  # about collector hosts or non-443 ports: the sandbox only ever dials this
+  # fixed internal endpoint, and the backend hop runs from a trusted,
+  # harness-controlled service that can use any port/scheme/headers. Backend
+  # auth headers live in the generated config (mode 0600 on the host volume)
+  # and are never forwarded into a sandbox.
+  #
+  # Dual-homed like the nginx firewalls — sandbox-egress (ingress) +
+  # proxy-egress (outbound). Deliberately NOT on `internal`, so it can't
+  # bridge a sandbox into harness services.
+  otel-collector:
+    image: otel/opentelemetry-collector:0.115.0
+    restart: unless-stopped
+    # Runs as the image's default non-root UID (10001). The harness `lastlight`
+    # user is pinned to that same UID (Dockerfile `useradd -u 10001`), so the
+    # collector reads the mode-0600 config the harness writes as its owner —
+    # no root, no world-readable secret. The image tag and that pinned UID must
+    # move together if a future image changes its user.
+    command: ["--config=/app/data/proxy/otel-collector.yaml"]
+    volumes:
+      - agent-data:/app/data:ro
+    depends_on:
+      egress-init:
+        condition: service_completed_successfully
+    networks:
+      sandbox-egress:
+        ipv4_address: 172.30.0.30
+      proxy-egress: {}
+
   caddy:
     image: caddy:2-alpine
     restart: unless-stopped
@@ -35,15 +203,48 @@ services:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
       - caddy-data:/data
       - caddy-config:/config
-    environment:
-      - DOMAIN=${DOMAIN:-localhost}
+    # Caddyfile uses `{$DOMAIN:localhost}` (Caddy's own env substitution), so
+    # DOMAIN just needs to be in the container env. Read it from the overlay
+    # secrets file directly — no repo-root .env / ${DOMAIN} interpolation.
+    env_file:
+      - path: ./instance/secrets/.env
+        required: false
+    # Caddy's memory footprint is tiny (typically <50 MB even under load).
+    mem_limit: 256m
+    memswap_limit: 256m
     networks:
       - internal
 
 volumes:
-  agent-data:       # contains: lastlight.db, claude-home/, sandboxes/, logs/
+  agent-data:       # contains: lastlight.db, agent-sessions/, sandboxes/, secrets/, logs/, proxy/
+  # Shared package-manager download cache (npm/pnpm/yarn), mounted at /cache in
+  # every dynamically-created sandbox container by src/sandbox/docker.ts so
+  # repeated installs reuse already-fetched tarballs (issue #107). Declared
+  # here so the stack manages its lifecycle; the agent service does not mount
+  # it. Override the name with LASTLIGHT_PKG_CACHE_VOLUME (defaults to the
+  # compose-prefixed `lastlight_pkg-cache`).
+  pkg-cache:
   caddy-data:
   caddy-config:
 
 networks:
   internal:
+  # Sandbox containers (created dynamically by src/sandbox/docker.ts) attach
+  # to this network only with `--dns 172.30.0.10` (or .11 for open mode).
+  # `internal: true` disables direct host egress, so the only path to the
+  # public internet is through the nginx firewalls, which receive sandbox
+  # traffic on this network. Static subnet so the coredns + nginx IPs
+  # baked into the generated configs are stable.
+  sandbox-egress:
+    internal: true
+    ipam:
+      config:
+        - subnet: 172.30.0.0/24
+  # Egress-only network for the nginx firewalls. Regular bridge (has a
+  # default route to the host's network, so nginx can reach the public
+  # internet). Critically: NO other compose services attach here. That way
+  # docker's embedded DNS on this network resolves only public names — the
+  # harness service names (`agent`, `caddy`) are not reachable from the
+  # firewall's perspective, so an unrestricted sandbox can't ask nginx to
+  # bridge into the compose-internal services.
+  proxy-egress:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lastlight",
-  "version": "0.1.8",
+  "version": "0.2.0",
   "description": "GitHub repository maintenance agent — Agent SDK harness",
   "type": "module",
   "main": "dist/index.js",
@@ -9,12 +9,10 @@
   },
   "files": [
     "dist",
+    "config",
     "workflows",
     "skills",
     "agent-context",
-    "mcp-github-app/src",
-    "mcp-github-app/package.json",
-    "mcp-github-app/tsconfig.json",
     "deploy",
     "sandbox.Dockerfile",
     "docker-compose.yml"
@@ -50,13 +48,27 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.1.0",
-    "@hono/node-server": "^1.0.0",
+    "@clack/prompts": "^1.2.0",
+    "@earendil-works/pi-ai": "^0.79.8",
+    "@hono/node-server": "^1.19.13",
+    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/exporter-logs-otlp-http": "^0.219.0",
+    "@opentelemetry/exporter-metrics-otlp-http": "^0.219.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.219.0",
+    "@opentelemetry/resources": "^2.8.0",
+    "@opentelemetry/sdk-logs": "^0.219.0",
+    "@opentelemetry/sdk-metrics": "^2.8.0",
+    "@opentelemetry/sdk-node": "^0.219.0",
+    "@opentelemetry/semantic-conventions": "^1.41.1",
+    "@sinclair/typebox": "^0.34.49",
     "@slack/bolt": "^4.6.0",
+    "agentic-pi": "^0.2.7",
     "arctic": "^3.7.0",
     "better-sqlite3": "^11.0.0",
+    "chalk": "^5.6.2",
+    "cli-table3": "^0.6.5",
     "croner": "^9.0.0",
-    "hono": "^4.0.0",
+    "hono": "^4.12.14",
     "octokit": "^5.0.5",
     "yaml": "^2.8.3",
     "zod": "^4.3.6"

package/sandbox.Dockerfile

@@ -1,36 +1,108 @@
-# Sandbox image for Last Light agent tasks.
+# Sandbox image for Last Light agent tasks (LASTLIGHT_SANDBOX=docker
+# fallback only — the default production sandbox is gondolin, invoked
+# in-process by agentic-pi without docker).
+#
 # Immutable assets baked at /app/. Entrypoint wires them into the workspace
 # after volumes are mounted, then drops to the runtime user.
 FROM node:20-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     git ripgrep curl jq ca-certificates gettext-base gosu \
+    build-essential pkg-config python3 unzip \
     && rm -rf /var/lib/apt/lists/*
 
-# Create non-root agent user
-RUN useradd -m -s /bin/bash agent
+# fnm + multiple Node versions so repos pinning a specific Node via .nvmrc /
+# package.json#engines just work. System node from the base image stays at
+# /usr/local/bin; fnm-managed versions are pre-installed under FNM_DIR and
+# selected per-shell by the bashrc hook below.
+ENV FNM_DIR=/usr/local/share/fnm
+ENV PATH=$FNM_DIR/aliases/default/bin:$PATH
+RUN curl -fsSL https://fnm.vercel.app/install \
+      | bash -s -- --install-dir "$FNM_DIR" --skip-shell \
+ && ln -s "$FNM_DIR/fnm" /usr/local/bin/fnm \
+ && fnm install 22 \
+ && fnm install 24 \
+ && fnm default 22 \
+ && chmod -R a+rX "$FNM_DIR" \
+ && mkdir -p "$FNM_DIR/multishells" \
+ && chmod 1777 "$FNM_DIR/multishells"
 
-# Install Claude Code CLI (binary goes to ~/.local/bin/)
-# Remove ~/.claude/ after install — entrypoint recreates it at runtime.
-USER agent
-RUN curl -fsSL https://claude.ai/install.sh | bash && rm -rf /home/agent/.claude
-USER root
-ENV PATH="/home/agent/.local/bin:${PATH}"
+# Source fnm in every bash invocation (interactive or not). BASH_ENV makes
+# non-interactive `bash -c` read this file — that's how opencode's bash tool
+# inherits the right node version when it runs `npm ci` inside a repo with
+# an .nvmrc pinning Node 24.
+RUN printf '%s\n' \
+    'export FNM_DIR=/usr/local/share/fnm' \
+    'export PATH="$FNM_DIR:$PATH"' \
+    '# --shell bash is required: when sourced via BASH_ENV the parent process' \
+    '# is not a shell so fnm cannot auto-detect.' \
+    'eval "$(fnm env --shell bash --use-on-cd --version-file-strategy=recursive)"' \
+    '# The cd hook fires only on cd. Tools often launch `bash -c "..."` with' \
+    '# cwd already set via the spawn options — no cd happens — so also' \
+    '# auto-switch on shell start when the cwd has a version file.' \
+    'if [ -f "$PWD/.nvmrc" ] || [ -f "$PWD/.node-version" ]; then' \
+    '  fnm use --silent-if-unchanged 2>/dev/null \' \
+    '    || { fnm install 2>/dev/null && fnm use --silent-if-unchanged 2>/dev/null; } \' \
+    '    || true' \
+    'fi' \
+    > /etc/bash.bashrc.fnm \
+ && printf '\n[ -r /etc/bash.bashrc.fnm ] && . /etc/bash.bashrc.fnm\n' >> /etc/bash.bashrc \
+ && ln -s /etc/bash.bashrc.fnm /etc/profile.d/fnm.sh
+# Source the fnm file directly — Debian's /etc/bash.bashrc bails early on
+# non-interactive shells (`[ -z "$PS1" ] && return`), so pointing BASH_ENV
+# at it would skip our setup for `bash -c` invocations (which is the path
+# the agent's bash tool uses).
+ENV BASH_ENV=/etc/bash.bashrc.fnm
 
-# MCP server (baked at /app/)
-COPY mcp-github-app/package.json /app/mcp-github-app/package.json
-RUN cd /app/mcp-github-app && npm install --prefer-offline --no-audit && npm cache clean --force
-COPY mcp-github-app/ /app/mcp-github-app/
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    python3 python3-pip pipx \
+    && PIPX_HOME=/opt/pipx PIPX_BIN_DIR=/usr/local/bin pipx install semgrep \
+    && curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz \
+       | tar -xz -C /usr/local/bin gitleaks \
+    && apt-get purge -y python3-pip \
+    && rm -rf /var/lib/apt/lists/*
 
-# Skills (baked at /app/ — entrypoint symlinks into ~/.claude/skills/)
-COPY skills/ /app/skills/
+# Create non-root agent user, UID/GID pinned to 10001 to MATCH the harness
+# `lastlight` user (see Dockerfile: `useradd -u 10001 lastlight`). The
+# entrypoint chowns the bind-mounted workspace to `agent`; per-PR workspaces
+# are persistent and reused across runs (issue #107), so the harness re-stages
+# AGENTS.md + skills into them on the next run. If `agent` lands on the default
+# uid (1001) those files become unwritable by the harness (10001) on reuse —
+# EACCES, and the review silently runs with no skill/AGENTS.md. Sharing the uid
+# keeps the reused workspace mutually writable by both the agent (in-container)
+# and the harness (host). Also self-heals dirs left at 1001 by older images:
+# the entrypoint's `chown -R agent:agent` re-owns them to 10001 on next reuse.
+RUN groupadd -g 10001 agent && useradd -m -s /bin/bash -u 10001 -g 10001 agent
 
-# Agent context (baked at /app/ — entrypoint cats into workspace/CLAUDE.md)
+# Install agentic-pi globally so the harness can `docker exec ...
+# agentic-pi run ...` against this container. The version + integrity
+# come straight from lastlight's `package-lock.json` so `npm i agentic-pi@…`
+# in the harness automatically flows into the sandbox image — no
+# manual Dockerfile bumps. `npm install -g <tarball>` itself doesn't
+# consult a lockfile, hence the explicit integrity verification.
+COPY package-lock.json /tmp/lastlight-lock.json
+RUN node -e "const p=require('/tmp/lastlight-lock.json').packages['node_modules/agentic-pi']; \
+             if(!p) throw new Error('agentic-pi missing from lockfile'); \
+             process.stdout.write(p.version + '\n' + p.integrity + '\n')" > /tmp/agentic-pi.pin \
+ && version=$(sed -n '1p' /tmp/agentic-pi.pin) \
+ && expected=$(sed -n '2p' /tmp/agentic-pi.pin) \
+ && echo "Installing agentic-pi@${version} (${expected})" \
+ && curl -fsSL "https://registry.npmjs.org/agentic-pi/-/agentic-pi-${version}.tgz" -o /tmp/agentic-pi.tgz \
+ && actual="sha512-$(node -e "const c=require('crypto'),f=require('fs');process.stdout.write(c.createHash('sha512').update(f.readFileSync('/tmp/agentic-pi.tgz')).digest('base64'))")" \
+ && if [ "$actual" != "$expected" ]; then \
+      echo "agentic-pi tarball integrity mismatch:" >&2; \
+      echo "  expected: $expected" >&2; \
+      echo "  actual:   $actual" >&2; \
+      exit 1; \
+    fi \
+ && npm install -g --no-audit --no-fund /tmp/agentic-pi.tgz \
+ && rm /tmp/agentic-pi.tgz /tmp/agentic-pi.pin /tmp/lastlight-lock.json
+
+# Agent context (baked at /app/ — entrypoint cats into workspace/AGENTS.md)
 COPY agent-context/ /app/agent-context/
 
-# Entrypoint + MCP config template
+# Entrypoint
 COPY deploy/sandbox-entrypoint.sh /app/sandbox-entrypoint.sh
-COPY deploy/mcp-config.tmpl.json /app/mcp-config.tmpl.json
 RUN chmod +x /app/sandbox-entrypoint.sh
 
 # Own app dir for agent user
@@ -38,6 +110,13 @@ RUN chown -R agent:agent /app /home/agent
 
 WORKDIR /home/agent/workspace
 
+# Image-level env so every `docker exec` (the entrypoint just runs once at
+# container start) sees these. Exporting them in sandbox-entrypoint.sh only
+# affects PID 1 — subsequent `docker exec agentic-pi run …` calls get a
+# fresh environment and would otherwise miss these paths.
+ENV LASTLIGHT_WORKSPACE=/home/agent/workspace
+ENV LASTLIGHT_GIT_CREDENTIALS=/home/agent/.lastlight-git-credentials
+
 # Entrypoint runs as root, fixes permissions, then drops to agent via gosu
 ENTRYPOINT ["/app/sandbox-entrypoint.sh"]
 CMD ["sleep", "infinity"]