nomarmy 0.1.0-alpha.2 → 0.1.0-alpha.21

package/lib/sandbox-images.mjs

@@ -1,37 +1,42 @@
-// nomArmy per-language sandbox images (v1.3).
+// nomArmy's sandbox images, composed from the harnesses a repo matches.
 //
-// The base sandbox (docker/Dockerfile) has python3/pip, but not any
-// third-party PACKAGE a real repo needs (boto3, pandas, ...) -- and it can't,
-// since those are repo-specific. A worker or verification run against a Go
-// or Rust repository needs `go`/`cargo` inside the sandbox for the same
-// underlying reason (the base image can't carry every toolchain), though
-// there the fix is simpler: the toolchain itself is repo-independent, so one
-// static image covers every Go repo and every Rust repo. None of this is
-// worth baking into the one image every job uses regardless of language --
-// a native compiler or a repo's own dependency set is real, non-trivial
-// memory pressure competing with the same tight local-inference budget
-// lib/sizing.mjs already fights to protect, and most installs will never
-// touch Go, Rust, or a Python repo with real third-party dependencies.
+// The base sandbox has python3/pip and Node, but not a repo's own packages
+// (boto3, pandas, a lockfile's dependencies) or other toolchains (Go, Rust),
+// and it can't: those are repo-specific. So each repo gets one image built
+// from a shared base plus a layer per matching harness (harnesses/, loaded
+// by lib/harnesses.mjs): toolchains first, so Podman's layer cache shares
+// them across repos, then Python, then Node, then declarative harnesses,
+// respecting each harness's `after`. A Go backend with a Node frontend gets
+// both.
 //
-// So these images are built lazily, on first use, and cached by Podman from
-// then on (an ordinary tagged image, indistinguishable from one built by
-// hand). The build itself needs network access to fetch packages/rustup/pip
-// packages -- that happens once, on the HOST, via `podman build`; the
-// resulting container a job actually runs in still gets --network none like
-// every other sandbox (this is the actual fix for "pip install has no
-// network in the sandbox": install at BUILD time, which has network, never
-// at run time, which never does). This only ever affects which image
-// nomArmy's OWN independent verification runs against (lib/verify.mjs) -- it
-// does not change what sandbox the worker's own tool calls execute in, which
-// is still whatever OpenClaw is configured with (see docs/experiments for
-// why: `openclaw agent exec` has no per-call sandbox override today).
-
+// Images are built lazily, on first use, and tagged by a hash of the
+// Dockerfile and every file copied into it, so a lockfile change rebuilds
+// once and is cached from then on. The build needs network to fetch
+// packages; that happens once, on the HOST, via `podman build`. The
+// containers jobs and verification run in still get --network none: install
+// at build time, which has network, never at run time, which doesn't.
 import crypto from "node:crypto";
+import { requirementsInputs, validatePythonProject } from "./registry-python.mjs";
+import { readRegistrySecrets, hasRegistryDeclarations, assertNoRegistryCopies, registryInstallRun } from "./registry-secrets.mjs";
+import { parse as parseYaml } from "yaml";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { loadHarnesses, matchHarnesses } from "./harnesses.mjs";
 import { execFileSync } from "node:child_process";
+import { toPosix } from "./path-utils.mjs";
+
+// The Node base every sandbox image starts from, read from docker/Dockerfile
+// so there's one place to change it (and Dependabot's bumps reach the
+// generated Python and Node dependency images too, which it can't see).
+const FALLBACK_BASE = "node:26-bookworm-slim";
+export function baseImage(dockerfile = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "docker", "Dockerfile")) {
+  try {
+    const m = /^FROM\s+(\S+)/m.exec(fs.readFileSync(dockerfile, "utf8"));
+    return m ? m[1] : FALLBACK_BASE;
+  } catch { return FALLBACK_BASE; }
+}
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 // lib/ and docker/ are always siblings, whether running from the dev
@@ -40,9 +45,7 @@ const HERE = path.dirname(fileURLToPath(import.meta.url));
 // location works in either case with no extra configuration.
 const DOCKER_DIR = path.join(HERE, "..", "docker");
 
-/** Marker files, checked at the worktree root only (cheap, no recursive
- * walk) -- this decides which SANDBOX IMAGE a job needs, a narrower and
- * hotter-path question than lib/scan.mjs's full evidence-gathering pass. */
+/** Legacy standalone toolchain builders; resolution uses composed harnesses. */
 export const LANGUAGE_IMAGES = Object.freeze({
   go: { image: "openclaw-nomarmy-coder-go:bookworm", dockerfile: "Dockerfile.go", markers: ["go.mod"] },
   rust: { image: "openclaw-nomarmy-coder-rust:bookworm", dockerfile: "Dockerfile.rust", markers: ["Cargo.toml"] },
@@ -57,9 +60,8 @@ export const LANGUAGE_IMAGES = Object.freeze({
  * explicitly. OpenClaw's exec tool does not inherit a sandbox image's own
  * ENV PATH on its own; this is the config knob that closes that gap. Paths
  * match each Dockerfile's own ENV lines (Dockerfile.go's GOPATH=/home/node/go,
- * Dockerfile.rust's CARGO_HOME=/home/node/.cargo). Python needs nothing here:
- * `pip3 install --break-system-packages` (no --user) puts entry-point
- * scripts on the image's already-default PATH.
+ * Dockerfile.rust's CARGO_HOME=/home/node/.cargo). Python project managers use /deps/python/.venv/bin; requirements-only
+ * repos retain their system pip entry points.
  */
 // Where a Node repo's installed packages live in its dependency image
 // (nodeDependencyFiles below). /node_modules links here: Node's resolver,
@@ -80,6 +82,7 @@ export const SANDBOX_NPM_ENV = Object.freeze({
 export const EXEC_PATH_PREPEND = Object.freeze({
   go: ["/usr/local/go/bin", "/home/node/go/bin"],
   rust: ["/home/node/.cargo/bin"],
+  python: ["/deps/python/.venv/bin"],
   node: [NODE_DEPS_BIN],
   "python+node": [NODE_DEPS_BIN],
 });
@@ -89,39 +92,131 @@ export const EXEC_PATH_PREPEND = Object.freeze({
  * `.nomarmy.yml`'s `environment.python.requirements` if declared (a repo
  * with several requirements files -- app, dev, a sub-package's own -- has no
  * single conventional name this could guess), otherwise bare
- * `requirements.txt` if that file actually exists. Never fabricated: a repo
- * with neither declares nothing to install and gets the base image, same as
- * before this existed.
+ * `requirements.txt` if no higher-priority root project manager applies.
+ * Project manifests are handled separately by the composed Python layer;
+ * they must never be passed to the legacy pip -r builders.
  */
 export function pythonRequirementsFor(cwd, config) {
   const declared = config?.environment?.python?.requirements;
-  if (Array.isArray(declared) && declared.length > 0) return declared;
+  if (Array.isArray(declared) && declared.length > 0) {
+    declared.forEach(source => assertRepositorySource(cwd, source, true));
+    return declared;
+  }
+  if (pythonProjectManager(cwd)) return [];
   return cwd && fs.existsSync(path.join(cwd, "requirements.txt")) ? ["requirements.txt"] : [];
 }
 
-/** One package directory's own install: { files, reason } (dir is "." or a relative path). */
+/** Root manager precedence; explicit requirements are resolved by the caller. */
+function pythonProjectManager(cwd) {
+  if (!cwd || typeof cwd !== "string" || !fs.existsSync(cwd)) return null;
+  if (repositoryFile(cwd, "uv.lock")) return "uv";
+  const manifest = repositoryFile(cwd, "pyproject.toml")
+    ? fs.readFileSync(path.join(cwd, "pyproject.toml"), "utf8") : "";
+  if (repositoryFile(cwd, "poetry.lock") || /^\s*\[tool\.poetry\]\s*(?:#.*)?$/m.test(manifest)) return "poetry";
+  return /^\s*\[project\]\s*(?:#.*)?$/m.test(manifest) ? "pyproject" : null;
+}
+
+function pythonProjectLayer(cwd, manager, files, secrets = []) {
+  const credentialed = secrets.some(secret => secret.ecosystem === "pip");
+  if (credentialed && manager === "poetry") {
+    throw new Error("registries: poetry installs can't be made build-free; use uv, or wheels via pip");
+  }
+  if (credentialed) validatePythonProject(cwd, manager);
+  for (const source of ["pyproject.toml", ...(manager === "uv" ? ["uv.lock"] : manager === "poetry" ? ["poetry.lock"] : [])]) {
+    if (repositoryFile(cwd, source)) files.push({ source: toPosix(source), destination: toPosix(`py/${source}`) });
+  }
+  // Parse TOML with Python 3.11's standard library, not shell interpolation or
+  // an approximation of dependency strings. Never install the project itself.
+  const readProject = 'import tomllib; d=tomllib.load(open("pyproject.toml", "rb")); ';
+  let install;
+  if (manager === "uv") {
+    install = credentialed ? "uv sync --frozen --no-install-project --all-groups --no-build" : "pip3 install --no-cache-dir --break-system-packages uv && uv sync --frozen --no-install-project --all-groups";
+  } else if (manager === "poetry") {
+    const dev = readProject + 'p=d.get("tool", {}).get("poetry", {}); print("--with dev" if "dev" in p.get("group", {}) else "")';
+    install = `pip3 install --no-cache-dir --break-system-packages poetry && poetry install --no-root --no-interaction $(python3 -c ${shellQuote(dev)})`;
+  } else {
+    const deps = readProject + 'import subprocess; p=d.get("project", {}); extras=p.get("optional-dependencies", {}); deps=p.get("dependencies", []) + [dep for name in ("test", "tests", "dev") for dep in extras.get(name, [])]; subprocess.check_call(["/deps/python/.venv/bin/python", "-m", "pip", "install", "--no-cache-dir", ' + (credentialed ? '"--only-binary=:all:", ' : '') + '"--", *deps]) if deps else None';
+    install = `python3 -c ${shellQuote(deps)}`;
+  }
+  return `COPY py/ /deps/python/
+ENV UV_PROJECT_ENVIRONMENT=/deps/python/.venv
+ENV POETRY_VIRTUALENVS_CREATE=false
+${credentialed ? "RUN python3 -m venv /deps/python/.venv\n" + (manager === "uv" ? "RUN pip3 install --no-cache-dir --break-system-packages --only-binary=:all: --index-url https://pypi.org/simple uv==0.8.22\n" : "") : ""}${registryInstallRun(`cd /deps/python && (${credentialed ? "" : "python3 -m venv /deps/python/.venv && "}${manager === "poetry" ? "export VIRTUAL_ENV=/deps/python/.venv && " : ""}${install} || touch .nomarmy-${manager}-install-failed)`, "pip", secrets)}
+RUN chown -R node:node /deps/python`;
+}
+
+const NODE_LOCKS = ["pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb", "package-lock.json", "npm-shrinkwrap.json"];
+
+/** Resolve workspace globs against real directories, never following symlinks. */
+function workspaceMembers(root, patterns) {
+  if (!patterns.length) return [];
+  const regex = (glob) => {
+    let out = "";
+    for (let i = 0; i < glob.length; i++) {
+      const c = glob[i];
+      if (c === "*" && glob[i + 1] === "*") {
+        i++;
+        if (glob[i + 1] === "/") { i++; out += "(?:.*/)?"; }
+        else out += ".*";
+      } else if (c === "*") out += "[^/]*";
+      else if (c === "?") out += "[^/]";
+      else if (c === "{") out += "(?:";
+      else if (c === "}") out += ")";
+      else if (c === ",") out += "|";
+      else out += c.replace(/[.*+?^$()|[\]\\]/g, "\\$&");
+    }
+    return new RegExp("^" + out + "$");
+  };
+  const globs = patterns.filter((p) => typeof p === "string").map((p) => ({
+    exclude: p.startsWith("!"), re: regex(p.replace(/^!/, "").replace(/^\.\//, "").replace(/\/$/, "")),
+  }));
+  const members = [];
+  const walk = (dir) => {
+    for (const e of fs.readdirSync(path.join(root, dir), { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (!e.isDirectory() || e.name === "node_modules" || e.name.startsWith(".")) continue;
+      const rel = dir ? dir + "/" + e.name : e.name;
+      if (globs.some((g) => !g.exclude && g.re.test(rel)) &&
+          !globs.some((g) => g.exclude && g.re.test(rel)) &&
+          fs.existsSync(path.join(root, rel, "package.json"))) members.push(rel);
+      walk(rel);
+    }
+  };
+  walk("");
+  return members;
+}
+
 function nodePackageAt(cwd, dir) {
-  const at = (f) => path.join(cwd, dir, f), rel = (f) => (dir === "." ? f : `${dir}/${f}`);
+  const at = (f) => path.join(cwd, dir, f), rel = (f) => (dir === "." ? f : dir + "/" + f);
   if (!fs.existsSync(at("package.json"))) return { files: [], reason: "no package.json" };
-  const lock = ["package-lock.json", "npm-shrinkwrap.json"].find((f) => fs.existsSync(at(f)));
-  if (!lock) {
-    const other = ["pnpm-lock.yaml", "yarn.lock", "bun.lockb", "bun.lock"].find((f) => fs.existsSync(at(f)));
-    return { files: [], reason: other ? `${other} isn't supported yet (npm lockfiles only)` : "no package-lock.json" };
+  const lock = NODE_LOCKS.find((f) => fs.existsSync(at(f)));
+  if (!lock) return { files: [], reason: "no package-lock.json" };
+  let pkg;
+  try { pkg = JSON.parse(fs.readFileSync(at("package.json"), "utf8")); }
+  catch { return { files: [], reason: "package.json doesn't parse" }; }
+  const manager = lock === "pnpm-lock.yaml" ? "pnpm" : lock === "yarn.lock"
+    ? (fs.existsSync(at(".yarnrc.yml")) || /^__metadata:/m.test(fs.readFileSync(at(lock), "utf8")) ? "yarn-berry" : "yarn")
+    : lock.startsWith("bun.") ? "bun" : "npm";
+  const files = [rel("package.json"), rel(lock)];
+  let patterns = Array.isArray(pkg.workspaces) ? pkg.workspaces : pkg.workspaces?.packages;
+  const workspace = Boolean(pkg.workspaces) || fs.existsSync(at("pnpm-workspace.yaml"));
+  if (fs.existsSync(at("pnpm-workspace.yaml"))) {
+    files.push(rel("pnpm-workspace.yaml"));
+    patterns = parseYaml(fs.readFileSync(at("pnpm-workspace.yaml"), "utf8"))?.packages ?? [];
   }
-  try {
-    if (JSON.parse(fs.readFileSync(at("package.json"), "utf8")).workspaces) return { files: [], reason: "npm workspaces aren't supported yet" };
-  } catch { return { files: [], reason: "package.json doesn't parse" }; }
-  return { files: [rel("package.json"), rel(lock)], reason: null };
+  if (fs.existsSync(at(".yarnrc.yml"))) files.push(rel(".yarnrc.yml"));
+  const members = workspaceMembers(at("."), Array.isArray(patterns) ? patterns : []).map(rel);
+  files.push(...members.map((m) => m + "/package.json"));
+  return { files, manager, workspace, members, yarnFallback: !pkg.packageManager && manager.startsWith("yarn") ? (manager === "yarn" ? "1" : "stable") : null, reason: null };
 }
 
-// Every directory holding an npm lockfile: git's tracked files when this is
+// Every directory holding a supported lockfile: git's tracked files when this is
 // a checkout (which skips node_modules and anything ignored), else a
 // shallow walk.
 function lockfileDirs(cwd) {
-  const isLock = (f) => /(^|\/)(package-lock|npm-shrinkwrap)\.json$/.test(f) && !/(^|\/)node_modules\//.test(f);
+  const isLock = (f) => NODE_LOCKS.includes(path.posix.basename(f)) && !/(^|\/)node_modules\//.test(f);
   let files = null;
   try {
-    files = execFileSync("git", ["ls-files", "-z", "--", "*package-lock.json", "*npm-shrinkwrap.json"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).split("\0").filter(Boolean);
+    files = execFileSync("git", ["ls-files", "-z", "--", ...NODE_LOCKS.map((name) => "*" + name)], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).split("\0").filter(Boolean);
   } catch { /* not a checkout */ }
   if (files === null) {
     files = [];
@@ -150,8 +245,9 @@ function lockfileDirs(cwd) {
  *
  * `packages` are the directories ("." for the root) that will install;
  * `files` their package.json and lockfile paths; `skipped` those that
- * won't, each with its reason. npm workspaces, yarn, pnpm and bun aren't
- * installed yet. `environment.node.install: false` turns it off.
+ * won't, each with its reason. Workspace members share their root install.
+ * `installs` selects each root's manager; `links` includes workspace members.
+ * `environment.node.install: false` turns it off.
  */
 export function nodeDependencyFiles(cwd, config) {
   const none = (reason) => ({ files: [], packages: [], skipped: [], reason });
@@ -159,18 +255,25 @@ export function nodeDependencyFiles(cwd, config) {
   if (config?.environment?.node?.install === false) return none("environment.node.install is false");
   const dirs = lockfileDirs(cwd);
   if (!dirs.includes(".")) dirs.unshift(".");
-  const packages = [], skipped = [], files = [];
+  const packages = [], skipped = [], files = [], installs = [], links = [];
+  const covered = new Set();
   for (const dir of dirs) {
+    if (covered.has(dir)) continue;
     const found = nodePackageAt(cwd, dir);
-    if (found.files.length) { packages.push(dir); files.push(...found.files); }
+    if (found.files.length) {
+      packages.push(dir); files.push(...found.files);
+      installs.push({ dir, manager: found.manager, yarnFallback: found.yarnFallback });
+      links.push(...(dir !== "." || found.workspace ? [dir] : []), ...found.members);
+      for (const member of found.members) covered.add(member);
+    }
     else if (dir !== "." || fs.existsSync(path.join(cwd, "package.json"))) skipped.push({ dir, reason: found.reason });
   }
   const reason = packages.length ? null : (skipped[0]?.reason ?? "no package.json");
-  return { files, packages, skipped, reason };
+  return { files: [...new Set(files)], packages, skipped, reason, installs, links: [...new Set(links)] };
 }
 
 /**
- * Give each non-root package in `worktree` a node_modules that resolves to
+ * Give each non-root package and workspace root/member a node_modules that resolves to
  * its install in the dependency image: a symlink to /deps/<dir>/node_modules,
  * dangling on the host, valid in the sandbox (both mount the worktree at
  * /workspace). Node and TypeScript look for node_modules beside the package
@@ -181,11 +284,10 @@ export function nodeDependencyFiles(cwd, config) {
 export function linkNodePackages(worktree, config, { env = process.env } = {}) {
   if (env.NOMARMY_AGENT_IMAGE) return []; // someone else's image: /deps may not exist
   const made = [];
-  for (const dir of nodeDependencyFiles(worktree, config).packages) {
-    if (dir === ".") continue;
+  for (const dir of nodeDependencyFiles(worktree, config).links ?? []) {
     const link = path.join(worktree, dir, "node_modules");
     try { fs.lstatSync(link); continue; } catch { /* nothing there yet */ }
-    try { fs.symlinkSync(`${NODE_DEPS_ROOT}/${dir}/node_modules`, link, "dir"); made.push(`${dir}/node_modules`); } catch { /* best-effort */ }
+    try { fs.symlinkSync(dir === "." ? NODE_DEPS_DIR : `${NODE_DEPS_ROOT}/${dir}/node_modules`, link, "dir"); made.push(dir === "." ? "node_modules" : `${dir}/node_modules`); } catch { /* best-effort */ }
   }
   return made;
 }
@@ -209,7 +311,7 @@ export function detectPrimaryLanguage(cwd, config = null) {
 }
 
 function defaultRun(cmd, args) {
-  return execFileSync(cmd, args, { encoding: "utf8" });
+  return execFileSync(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
 }
 
 function imageExists(image, run) {
@@ -278,7 +380,7 @@ function pythonDockerfile(requirements) {
   // packaged pip refuses to install into the system environment at all
   // (PEP 668) without --break-system-packages; this container IS the
   // dedicated environment, there is no venv to prefer it over.
-  return `FROM node:24-bookworm-slim
+  return `FROM ${baseImage()}
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \\
     bash ca-certificates curl git jq python3 python3-pip python3-venv ripgrep build-essential \\
@@ -332,25 +434,51 @@ export function dependencyImageTag(cwd, files) {
   return `openclaw-nomarmy-coder-deps-${hash.digest("hex").slice(0, 8)}:bookworm`;
 }
 
-export function dependencyDockerfile({ requirements = [], nodeFiles = [], nodePackages = null }) {
-  const reqCopies = requirements.map((_, i) => `COPY py/req-${i}.txt /tmp/reqs/req-${i}.txt`).join("\n");
-  const pip = requirements.length ? `RUN pip3 install --no-cache-dir --break-system-packages ${requirements.map((_, i) => `-r /tmp/reqs/req-${i}.txt`).join(" ")}` : "";
+export function dependencyDockerfile({ requirements = [], nodeFiles = [], nodePackages = null, nodeInstalls = null, secrets = [], requirementCount = requirements.length, requirementIndexes = requirements.map((_, i) => i) }) {
+  const reqRoot = secrets.some((s) => s.ecosystem === "pip") ? "/deps/requirements" : "/tmp/reqs";
+  const reqCopies = Array.from({ length: requirementCount }, (_, i) => `COPY py/req-${i}.txt ${reqRoot}/req-${i}.txt`).join("\n");
+  const pip = requirements.length ? registryInstallRun(`pip3 install --no-cache-dir --break-system-packages ${secrets.some(s => s.ecosystem === "pip") ? "--only-binary=:all: " : ""}${requirementIndexes.map(i => `-r ${reqRoot}/req-${i}.txt`).join(" ")}${secrets.some(s => s.ecosystem === "pip") ? " || touch /deps/requirements/.nomarmy-pip-install-failed" : ""}`, "pip", secrets) : "";
   const packages = nodePackages ?? (nodeFiles.length ? ["."] : []);
   // Owned by the sandbox's "node" user from the start and installed as it,
   // so a tool that writes a cache under node_modules (vite, babel) can, and
   // no chown -R layer doubles the image.
-  const nodeCopies = packages.length ? [`RUN mkdir -p ${NODE_DEPS_ROOT} && chown node:node ${NODE_DEPS_ROOT}`, ...nodeFiles.map((f) => `COPY --chown=node:node node/${f} ${NODE_DEPS_ROOT}/${f}`), "USER node"].join("\n") : "";
+  const managers = nodeInstalls ?? packages.map((dir) => ({ dir, manager: "npm" }));
+  const setup = [
+    ...(managers.some(({ manager }) => manager === "pnpm" || manager.startsWith("yarn")) ? ["RUN npm install -g corepack && corepack enable"] : []),
+    ...(managers.some(({ manager }) => manager === "bun") ? ["RUN npm install -g bun"] : []),
+  ];
+  const nodeCopies = packages.length ? [...setup, `RUN mkdir -p ${NODE_DEPS_ROOT} && chown node:node ${NODE_DEPS_ROOT}`, ...nodeFiles.map((f) => `COPY --chown=node:node node/${f} ${NODE_DEPS_ROOT}/${f}`), "USER node"].join("\n") : "";
   // One layer per package, each laid out at its repo path under /deps. A
   // package that can't install (a private registry, say) leaves a marker
   // instead of failing the image, so the others still work.
-  const installs = packages.map((dir) => {
+  const installs = managers.map(({ dir, manager, yarnFallback, packageManager }) => {
+    if (manager === "yarn-berry" && secrets.some((secret) => secret.ecosystem === "npm")) {
+      throw new Error("registries: Yarn Berry does not read .npmrc; private registry builds currently require Yarn Classic");
+    }
     const at = dir === "." ? NODE_DEPS_ROOT : `${NODE_DEPS_ROOT}/${dir}`;
-    return `RUN cd ${at} && (npm ci --no-audit --no-fund || touch .nomarmy-npm-ci-failed) && npm cache clean --force`;
+    const command = { pnpm: "pnpm install --frozen-lockfile", yarn: "yarn install --frozen-lockfile",
+      "yarn-berry": "YARN_NODE_LINKER=node-modules yarn install --immutable", bun: "bun install --frozen-lockfile" }[manager];
+    if (secrets.some(secret => secret.ecosystem === "npm")) {
+      const marker = manager === "npm" ? ".nomarmy-npm-ci-failed" : `.nomarmy-${manager}-install-failed`;
+      const install = command ?? "npm ci --no-audit --no-fund";
+      // Bun creates an npm-compatible node_modules tree. npm rebuild actually
+      // runs its dependency lifecycle scripts; bun pm untrusted only lists them.
+      const rebuild = manager === "pnpm" ? "pnpm rebuild" : "npm rebuild";
+      return [
+        ...((manager === "pnpm" || manager.startsWith("yarn")) ? [`RUN cd ${shellQuote(at)} && ${packageManager ? "corepack install" : `${yarnFallback ? `corepack prepare yarn@${yarnFallback} --activate && ` : ""}${manager} --version`}`] : []),
+        registryInstallRun(`cd ${shellQuote(at)} && (${install} --ignore-scripts || touch ${marker})`, "npm", secrets),
+        // The mount must be gone before any dependency code executes. No
+        // scripts can copy its contents during the preceding install.
+        `RUN cd ${shellQuote(at)} && ((test ! -e /home/node/.npmrc && test ! -L /home/node/.npmrc) || { touch ${marker}; exit 1; }) && (${rebuild} || touch ${marker})`,
+      ].join("\n");
+    }
+    if (command) return registryInstallRun(`cd ${shellQuote(at)} && (${yarnFallback ? `corepack prepare yarn@${yarnFallback} --activate && ` : ""}${command} || touch .nomarmy-${manager}-install-failed)`, "npm", secrets);
+    return registryInstallRun(`cd ${at} && (npm ci --no-audit --no-fund || touch .nomarmy-npm-ci-failed) && npm cache clean --force`, "npm", secrets);
   }).join("\n");
   // The root's packages are reachable from anywhere under /workspace via
   // /node_modules; each other package gets a worktree link (linkNodePackages).
   const root = packages.length ? ["USER root", ...(packages.includes(".") ? [`RUN ln -s ${NODE_DEPS_DIR} /node_modules`, `ENV PATH=${NODE_DEPS_BIN}:$PATH`] : [])].join("\n") : "";
-  return `FROM node:24-bookworm-slim
+  return `FROM ${baseImage()}
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \\
     bash ca-certificates curl git jq python3 python3-pip python3-venv ripgrep build-essential \\
@@ -378,7 +506,7 @@ export function ensureDependencyImageBuilt(cwd, config, { run = defaultRun } = {
       fs.mkdirSync(path.dirname(path.join(context, "node", f)), { recursive: true });
       fs.copyFileSync(path.join(cwd, f), path.join(context, "node", f));
     }
-    fs.writeFileSync(path.join(context, "Dockerfile"), dependencyDockerfile({ requirements, nodeFiles, nodePackages: node.packages }));
+    fs.writeFileSync(path.join(context, "Dockerfile"), dependencyDockerfile({ requirements, nodeFiles, nodePackages: node.packages, nodeInstalls: node.installs }));
     run("podman", ["build", "-t", image, "-f", path.join(context, "Dockerfile"), context]);
   } catch (error) {
     throw new Error(`failed to build the dependency sandbox image (${image}) from ${all.join(", ")}: ${error.message}`);
@@ -388,28 +516,316 @@ export function ensureDependencyImageBuilt(cwd, config, { run = defaultRun } = {
   return image;
 }
 
-/**
- * The image a verification run against `cwd` should use: an explicit
- * override always wins (matches every other explicit-config-beats-
- * auto-detect choice in this codebase); otherwise a detected Go/Rust repo
- * gets its language image, a Python repo with real dependencies gets its
- * own dependency-hashed image (both built lazily), and everything else gets
- * `defaultImage` unchanged -- zero behavior change for Node repos, or
- * Python repos that declare nothing to install.
+/** Matched registry layers plus the existing config-only Python and shrinkwrap installs. */
+export function sandboxHarnesses(cwd, config = null, harnesses = loadHarnesses().harnesses) {
+  if (!cwd || typeof cwd !== "string") return { harnesses, matched: [] };
+  const matched = matchHarnesses(cwd, harnesses, config?.harnesses ?? []);
+  for (const [name, needed] of [["python", pythonRequirementsFor(cwd, config).length], ["node", nodeDependencyFiles(cwd, config).files.length]]) {
+    if (needed && harnesses[name] && !matched.includes(name)) matched.push(name);
+  }
+  return { harnesses, matched };
+}
+
+// A priority topological sort: explicit after edges take precedence over
+// cache-friendly defaults. Unmatched predecessors do not force an install.
+function imageHarnessOrder(harnesses, matched) {
+  const rank = (name) => ({ go: 0, rust: 1, python: 2, node: 3 }[harnesses[name].image.builtin] ?? 4);
+  const pending = new Set(matched), order = [];
+  while (pending.size) {
+    const ready = [...pending].filter((name) => !(harnesses[name].after ?? []).some((parent) => pending.has(parent)));
+    ready.sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
+    if (!ready.length) throw new Error(`sandbox harness after cycle: ${[...pending].join(", ")}`);
+    order.push(ready[0]); pending.delete(ready[0]);
+  }
+  return order;
+}
+
+export function sandboxPathEntries(cwd, config = null, selection = sandboxHarnesses(cwd, config)) {
+  const entries = [...new Set(imageHarnessOrder(selection.harnesses, selection.matched)
+    .flatMap((name) => {
+      const builtin = selection.harnesses[name].image.builtin;
+      if (builtin === "python" && (pythonRequirementsFor(cwd, config).length || !pythonProjectManager(cwd))) return [];
+      return EXEC_PATH_PREPEND[builtin] ?? [];
+    }))];
+  const pythonBin = EXEC_PATH_PREPEND.python[0];
+  return entries.includes(pythonBin) ? [pythonBin, ...entries.filter((entry) => entry !== pythonBin)] : entries;
+}
+
+const shellQuote = (value) => "'" + value.replaceAll("'", "'\\''") + "'";
+
+// Only regular, repository-contained inputs enter the build context. In
+// particular, workspace paths must not pull files from outside the checkout.
+function assertRepositorySource(cwd, source, allowMissing = false) {
+  const fail = () => { throw new Error("sandbox dependency source must be a repository-contained regular file (no absolute or escaping paths)"); };
+  if (typeof source !== "string" || !source || path.isAbsolute(source) ||
+      source.split(/[\\/]/).includes("..")) fail();
+  if (repositoryFile(cwd, source)) return;
+  if (allowMissing) {
+    // Language detection also accepts not-yet-created requirements. Check the
+    // nearest existing ancestor, including symlinks, before allowing absence.
+    const root = fs.realpathSync(cwd);
+    let target = path.resolve(cwd, source);
+    while (target.startsWith(path.resolve(cwd) + path.sep)) {
+      try {
+        fs.lstatSync(target);
+      } catch (error) {
+        if (error.code !== "ENOENT") fail();
+        target = path.dirname(target);
+        continue;
+      }
+      let real;
+      try { real = fs.realpathSync(target); } catch { fail(); }
+      if (target !== path.resolve(cwd, source) &&
+          real.startsWith(root + path.sep) && fs.statSync(target).isDirectory()) return;
+      fail();
+    }
+    if (target === path.resolve(cwd) && target !== path.resolve(cwd, source)) return;
+  }
+  fail();
+}
+
+function repositoryFile(cwd, rel) {
+  const root = fs.realpathSync(cwd);
+  const target = path.resolve(cwd, rel);
+  if (path.isAbsolute(rel) || !target.startsWith(path.resolve(cwd) + path.sep)) return false;
+  try {
+    return fs.realpathSync(target).startsWith(root + path.sep) && fs.statSync(target).isFile();
+  } catch { return false; }
+}
+
+function goDependencyLayer(cwd, files, secrets = []) {
+  const offline = "ENV GOPROXY=off\nENV GOSUMDB=off";
+  if (fs.existsSync(path.join(cwd, "vendor"))) return offline;
+  const inputs = new Set(["go.mod", "go.sum", "go.work", "go.work.sum"]);
+  if (repositoryFile(cwd, "go.work")) {
+    // Go work files allow use ./dir, use ( ... ), and quoted paths.
+    const tokens = fs.readFileSync(path.join(cwd, "go.work"), "utf8")
+      .match(/"(?:\\.|[^"\\])*"|`[^`]*`|\/\/[^\n]*|[^\s()]+|[()]/g) ?? [];
+    let use = false, block = false;
+    for (const token of tokens) {
+      if (token.startsWith("//")) continue;
+      if (token === "use") { use = true; continue; }
+      if (!use) continue;
+      if (token === "(") { block = true; continue; }
+      if (token === ")") { use = block = false; continue; }
+      let dir = token;
+      if (token.startsWith('"')) { try { dir = JSON.parse(token); } catch { continue; } }
+      else if (token.startsWith("`")) dir = token.slice(1, -1);
+      for (const name of ["go.mod", "go.sum"]) inputs.add(path.posix.join(dir, name));
+      if (!block) use = false;
+    }
+  }
+  const copied = [...inputs].filter((rel) => repositoryFile(cwd, rel));
+  if (!copied.some((rel) => rel === "go.mod" || rel === "go.work")) return offline;
+  // Dockerfile COPY sources and Linux-container destinations use POSIX separators.
+  for (const source of copied) files.push({ source: toPosix(source), destination: toPosix(`go/${source}`) });
+  return `COPY --chown=node:node go/ /deps/go/
+USER node
+${registryInstallRun("cd /deps/go && (go mod download || touch .nomarmy-go-mod-download-failed)", "go", secrets)}
+${offline}`;
+}
+
+function rustDependencyLayer(cwd, files, secrets = []) {
+  const manifests = [];
+  const walk = (dir, depth) => {
+    for (const entry of fs.readdirSync(path.join(cwd, dir), { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const rel = path.posix.join(dir, entry.name);
+      if (entry.isDirectory() && depth < 4 && entry.name !== "target" && !entry.name.startsWith(".")) walk(rel, depth + 1);
+      else if (entry.isFile() && entry.name === "Cargo.toml") manifests.push(rel);
+    }
+  };
+  walk("", 0);
+  for (const source of manifests) files.push({ source: toPosix(source), destination: toPosix(`rust/${source}`) });
+  // Private registry names/indexes are project metadata, not credentials.
+  for (const source of [".cargo/config", ".cargo/config.toml"]) {
+    if (repositoryFile(cwd, source)) files.push({ source: toPosix(source), destination: toPosix(`rust/${source}`) });
+  }
+  const locked = repositoryFile(cwd, "Cargo.lock");
+  if (locked) files.push({ source: "Cargo.lock", destination: "rust/Cargo.lock" });
+  const stubs = new Map();
+  for (const manifest of manifests) {
+    const text = fs.readFileSync(path.join(cwd, manifest), "utf8");
+    if (!/^\s*\[package\]/m.test(text)) continue; // virtual workspace
+    const dir = path.posix.dirname(manifest);
+    const add = (target, content) => {
+      const rel = path.posix.normalize(path.posix.join(dir, target));
+      if (path.posix.isAbsolute(target) || rel === ".." || rel.startsWith("../")) return;
+      stubs.set(`rust/${rel}`, content);
+    };
+    add("src/lib.rs", "// Dependency-fetch placeholder.\n");
+    add("src/main.rs", "fn main() {}\n");
+    // Explicit lib/bin/example/test/bench targets may live outside src/.
+    let section = "";
+    for (const line of text.split("\n")) {
+      const header = line.match(/^\s*\[\[?([^\]]+)\]\]?/);
+      if (header) section = header[1].trim();
+      if (!["lib", "bin", "example", "test", "bench"].includes(section)) continue;
+      const target = line.match(/^\s*path\s*=\s*(?:"([^"\n]+)"|'([^'\n]+)')/);
+      if (target) add(target[1] ?? target[2], section === "lib" ? "// Dependency-fetch placeholder.\n" : "fn main() {}\n");
+    }
+  }
+  for (const [destination, content] of stubs) {
+    if (!files.some((file) => file.destination === destination)) files.push({ destination, content });
+  }
+  return `${manifests.length ? `COPY --chown=node:node rust/ /deps/rust/
+USER node
+${registryInstallRun(`cd /deps/rust && (cargo fetch${locked ? " --locked" : ""} || touch .nomarmy-cargo-fetch-failed)`, "cargo", secrets)}
+` : ""}ENV CARGO_NET_OFFLINE=true`;
+}
+
+/** Pure recipe composition except for reading its input files. No image builds.
+ * files maps repository paths to their small, isolated build-context paths.
  */
-export function resolveSandboxImage({ cwd, explicitImage, defaultImage, config = null, run = defaultRun }) {
+export function composeSandboxImage(cwd, config = null, selection = sandboxHarnesses(cwd, config), options = null) {
+  // No options means a recipe preview (never a build). Build callers must
+  // supply options, even when trustedDir is unavailable: that fails closed.
+  if (options === null) return composeWithRegistrySecrets(cwd, config, selection, []);
+  // A build-shaped call reads declarations the way ensureComposedImageBuilt does.
+  return trustedComposition(cwd, config, selection, options.trustedDir ? readRegistrySecrets(options.trustedDir) : [], options.trustedDir).composed;
+}
+
+function trustedComposition(cwd, config, selection, secrets, trustedDir) {
+  const plain = composeWithRegistrySecrets(cwd, config, selection, []);
+  if (!trustedDir) {
+    const note = "private-registry credentials were not used: this job changed dependency inputs (trusted checkout unavailable)";
+    return { composed: plain && hasRegistryDeclarations(cwd) ? { ...plain, note } : plain, secrets: [] };
+  }
+  if (!plain || !secrets.length) return { composed: plain, secrets: [] };
+  // Even an uncredentialed build must never COPY a declared credential.
+  assertNoRegistryCopies(cwd, plain.files, secrets);
+  let changed;
+  if (!trustedDir) changed = ["trusted checkout unavailable"];
+  else {
+    const trusted = composeWithRegistrySecrets(trustedDir, config, sandboxHarnesses(trustedDir, config), []);
+    const inputs = (recipe) => new Set((recipe?.files ?? []).filter(f => f.source).map(f => f.source));
+    const actual = inputs(plain), expected = inputs(trusted);
+    changed = [...new Set([...actual, ...expected])].sort().filter(source => {
+      if (!actual.has(source) || !expected.has(source)) return true;
+      try {
+        return !fs.readFileSync(path.join(cwd, source)).equals(fs.readFileSync(path.join(trustedDir, source)));
+      } catch { return true; }
+    });
+  }
+  if (!changed.length) return { composed: composeWithRegistrySecrets(trustedDir, config, sandboxHarnesses(trustedDir, config), secrets), secrets };
+  const note = `private-registry credentials were not used: this job changed dependency inputs (${changed.slice(0, 5).join(", ")}${changed.length > 5 ? ", ..." : ""})`;
+  return { composed: { ...plain, note }, secrets: [] };
+}
+
+function composeWithRegistrySecrets(cwd, config, selection, secrets) {
+  const order = imageHarnessOrder(selection.harnesses, selection.matched);
+  if (!order.length) return null;
+  const footer = 'USER node\nWORKDIR /workspace\nCMD ["sleep", "infinity"]\n';
+  const base = dependencyDockerfile({}).slice(0, -footer.length).trimEnd() + "\n";
+  const dependencyLayer = (options) => dependencyDockerfile({ ...options, secrets }).slice(base.length, -footer.length).trim();
+  const layers = [], files = [];
+  let pythonVenv = false;
+  for (const name of order) {
+    const { image } = selection.harnesses[name];
+    let layer = "";
+    if (image.builtin === "go" || image.builtin === "rust") {
+      const source = fs.readFileSync(path.join(DOCKER_DIR, `Dockerfile.${image.builtin}`), "utf8");
+      const begin = image.builtin === "go" ? "ENV GO_VERSION=" : "USER node";
+      layer = source.slice(source.indexOf(begin), source.indexOf("WORKDIR /workspace")).trim();
+      layer += "\n" + (image.builtin === "go" ? goDependencyLayer(cwd, files, secrets) : rustDependencyLayer(cwd, files, secrets));
+    } else if (image.builtin === "python") {
+      const requirements = pythonRequirementsFor(cwd, config);
+      const manager = requirements.length ? null : pythonProjectManager(cwd);
+      if (manager) {
+        layer = pythonProjectLayer(cwd, manager, files, secrets);
+        pythonVenv = true;
+      } else {
+        const inputs = requirementsInputs(cwd, requirements, secrets.some(s => s.ecosystem === "pip"));
+        files.push(...inputs.files);
+        layer = dependencyLayer({ requirements, requirementCount: inputs.files.length, requirementIndexes: inputs.indexes });
+      }
+    } else if (image.builtin === "node") {
+      const node = nodeDependencyFiles(cwd, config);
+      node.files.forEach((source) => files.push({ source: toPosix(source), destination: toPosix(`node/${source}`) }));
+      const installs = node.installs?.map(install => ({ ...install,
+        packageManager: Boolean(JSON.parse(fs.readFileSync(path.join(cwd, install.dir, "package.json"), "utf8")).packageManager),
+      }));
+      layer = dependencyLayer({ nodeFiles: node.files, nodePackages: node.packages, nodeInstalls: installs });
+    } else if (image.builtin === "playwright") {
+      const node = nodeDependencyFiles(cwd, config);
+      const dirs = [...new Set([...node.packages, ...(node.links ?? [])])].filter((dir) => {
+        try {
+          const pkg = JSON.parse(fs.readFileSync(path.join(cwd, dir, "package.json"), "utf8"));
+          return ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"].some((field) => pkg[field]?.["@playwright/test"]);
+        } catch { return false; }
+      });
+      const marker = "/ms-playwright/.nomarmy-playwright-install-failed";
+      layer = "ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright\nRUN mkdir -p /ms-playwright\n";
+      layer += dirs.length ? dirs.map((dir) =>
+        `RUN (cd ${shellQuote(path.posix.join("/deps", dir))} && npx --no-install playwright install --with-deps chromium) || touch ${marker}`
+      ).join("\n") : `RUN touch ${marker}`;
+      layer += "\nRUN chmod -R a+rX /ms-playwright";
+    } else if (image.builtin) {
+      throw new Error(`unknown sandbox builtin for harness ${name}: ${image.builtin}`);
+    } else {
+      // Run a child shell so even an explicit exit produces a named failure.
+      const commands = [
+        ...(image.apt.length ? [`apt-get update && apt-get install -y --no-install-recommends ${image.apt.map(shellQuote).join(" ")} && rm -rf /var/lib/apt/lists/*`] : []),
+        ...image.run,
+      ];
+      layer = commands.map((command) => `RUN ${JSON.stringify(["/bin/sh", "-ec", `/bin/sh -ec ${shellQuote(command)} || { echo ${shellQuote(`sandbox harness ${name} failed`)} >&2; exit 1; }`])}`).join("\n");
+    }
+    if (layer) layers.push(`USER root\n# harness: ${name}\n${layer}`);
+  }
+  if (!layers.length) return null; // Matched metadata may have no supported install.
+  const runtime = pythonVenv ? 'ENV VIRTUAL_ENV=/deps/python/.venv\nENV PATH="/deps/python/.venv/bin:${PATH}"\n' : "";
+  for (const { source } of files) if (source !== undefined) assertRepositorySource(cwd, source);
+  assertNoRegistryCopies(cwd, files, secrets);
+  const dockerfile = (secrets.length ? "# syntax=docker/dockerfile:1\n" : "") + base + layers.join("\n") + "\n" + runtime + footer;
+  const hash = crypto.createHash("sha256").update(dockerfile).update("\0");
+  for (const { ecosystem, source, format, privatePatterns, digest } of secrets) {
+    hash.update(JSON.stringify({ ecosystem, source, format, privatePatterns, digest })).update("\0");
+  }
+  for (const { source, destination, content } of files) {
+    hash.update(source ?? "").update("\0").update(destination).update("\0")
+      .update(content ?? fs.readFileSync(path.join(cwd, source))).update("\0");
+  }
+  return { dockerfile, files, image: `openclaw-nomarmy-coder-deps-${hash.digest("hex").slice(0, 8)}:bookworm`, pathEntries: sandboxPathEntries(cwd, config, selection) };
+}
+
+export function ensureComposedImageBuilt(cwd, config, { run = defaultRun, trustedDir, onNote = () => {} } = {}) {
+  // With a trusted checkout, declarations come only from it: a job's worktree
+  // is worker-writable, and a .nomarmy.local.yml there must never choose
+  // which host file gets mounted into a build. Without one, a declaration is
+  // detected by its YAML key only; credential paths are never inspected.
+  const declared = trustedDir ? readRegistrySecrets(trustedDir) : [];
+  const { composed, secrets } = trustedComposition(cwd, config, sandboxHarnesses(cwd, config), declared, trustedDir);
+  if (!composed) return null;
+  if (composed.note) onNote(composed.note);
+  if (imageExists(composed.image, run)) return composed.image;
+  const context = fs.mkdtempSync(path.join(os.tmpdir(), "nomarmy-harnesses-"));
+  try {
+    for (const { source, destination, content } of composed.files) {
+      const target = path.join(context, destination);
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      if (content !== undefined) fs.writeFileSync(target, content);
+      else fs.copyFileSync(path.join(secrets.length ? trustedDir : cwd, source), target);
+    }
+    fs.writeFileSync(path.join(context, "Dockerfile"), composed.dockerfile);
+    run("podman", ["build", ...secrets.flatMap(({ id, source }) => ["--secret", `id=${id},src=${source}`]), "-t", composed.image, "-f", path.join(context, "Dockerfile"), context]);
+  } catch (error) {
+    throw new Error(`failed to build sandbox harness image (${composed.image}): ${declared.length ? "credentialed build failed (output withheld)" : error.message}${composed.note ? "; " + composed.note : ""}`);
+  } finally {
+    fs.rmSync(context, { recursive: true, force: true });
+  }
+  return composed.image;
+}
+
+/** Worker and verification share this resolver; explicit overrides always win. */
+export function resolveSandboxImage({ cwd, explicitImage, defaultImage, config = null, run = defaultRun, trustedDir, onNote }) {
   if (explicitImage) return explicitImage;
-  const lang = detectPrimaryLanguage(cwd, config);
-  if (!lang) return defaultImage;
-  if (lang === "python") return ensurePythonImageBuilt(cwd, config, { run }) ?? defaultImage;
-  if (lang === "node" || lang === "python+node") return ensureDependencyImageBuilt(cwd, config, { run }) ?? defaultImage;
-  return ensureLanguageImageBuilt(lang, { run });
+  return ensureComposedImageBuilt(cwd, config, { run, trustedDir, onNote }) ?? defaultImage;
 }
 
 /** What each npm package's node_modules is right now: "link", "dir" or "none", by package dir ("." is the root). */
 export function nodeModulesState(worktree, config) {
   const out = {};
-  for (const dir of nodeDependencyFiles(worktree, config).packages) {
+  const node = nodeDependencyFiles(worktree, config);
+  for (const dir of new Set([...node.packages, ...(node.links ?? [])])) {
     try { out[dir] = fs.lstatSync(path.join(worktree, dir, "node_modules")).isSymbolicLink() ? "link" : "dir"; } catch { out[dir] = "none"; }
   }
   return out;