totopo 2.1.0 → 3.0.0-rc-2

package/bin/totopo.js

@@ -17,8 +17,7 @@ import { run as onboard } from "../dist/commands/onboard.js";
 import { run as rebuild } from "../dist/commands/rebuild.js";
 import { run as settings } from "../dist/commands/settings.js";
 import { run as stop } from "../dist/commands/stop.js";
-import { run as syncDockerfile } from "../dist/commands/sync-dockerfile.js";
-import { listProjectIds, resolveProject, TOTOPO_YAML } from "../dist/lib/project-identity.js";
+import { listProjectIds, resolveProject } from "../dist/lib/project-identity.js";
 
 // --- Guard: inside container -------------------------------------------------------------------------------------------------------------
 try {
@@ -36,12 +35,11 @@ try {
 }
 
 // --- Paths -------------------------------------------------------------------------------------------------------------------------------
-// dirname(dirname(...)) walks up from bin/ to the package root.
 const packageDir = dirname(dirname(fileURLToPath(import.meta.url)));
 const cwd = process.cwd();
 
 // --- Guard: dist/ must exist -------------------------------------------------------------------------------------------------------------
-if (!existsSync(new URL("../dist/commands/sync-dockerfile.js", import.meta.url))) {
+if (!existsSync(new URL("../dist/commands/dev.js", import.meta.url))) {
     console.error("");
     console.error("  totopo: compiled output not found.");
     console.error("  This should not happen with a published package.");
@@ -50,58 +48,54 @@ if (!existsSync(new URL("../dist/commands/sync-dockerfile.js", import.meta.url))
     process.exit(1);
 }
 
-// --- Resolve project from CWD (walk-up through ~/.totopo/projects/) ----------------------------------------------------------------------
-let project = resolveProject(cwd);
+// --- v2 migration check ------------------------------------------------------------------------------------------------------------------
+try {
+    const { runMigration } = await import("../dist/lib/migrate-v2.js");
+    await runMigration();
+} catch {
+    // migrate-v2 module may not exist yet during development - that's fine
+}
+
+// --- Resolve project from CWD (walk-up looking for totopo.yaml) --------------------------------------------------------------------------
+let project;
+try {
+    project = resolveProject(cwd);
+} catch (err) {
+    console.error("");
+    console.error(`  ${err instanceof Error ? err.message : err}`);
+    console.error("");
+    process.exit(1);
+}
 
 // --- Onboarding (if not in a registered project) -----------------------------------------------------------------------------------------
 if (!project) {
-    // Detect project context: git root or totopo.yaml present?
-    let gitRoot = null;
-    try {
-        gitRoot = execSync("git rev-parse --show-toplevel", { encoding: "utf8", stdio: "pipe" }).trim();
-    } catch {
-        // Not in a git repo - that's fine
-    }
-
-    const totopoJsonPath = `${gitRoot ?? cwd}/${TOTOPO_YAML}`;
-    const hasTotopoYaml = existsSync(totopoJsonPath);
-
-    if (gitRoot !== null || hasTotopoYaml) {
-        // Has project context - if other projects already exist, let the user choose first
-        if (listProjectIds().length > 0) {
-            process.stdout.write("\n");
-            const choice = await select({
-                message: "What would you like to do?",
-                options: [
-                    { value: "setup", label: "Set up totopo for this directory" },
-                    { value: "manage", label: "Manage totopo →" },
-                ],
-            });
-            if (isCancel(choice)) {
-                cancel();
-                process.exit(0);
-            }
-            if (choice === "manage") {
-                await advanced(packageDir);
-                process.exit(0);
-            }
+    // If other projects already exist, let the user choose setup vs manage
+    if (listProjectIds().length > 0) {
+        process.stdout.write("\n");
+        const choice = await select({
+            message: "What would you like to do?",
+            options: [
+                { value: "setup", label: "Set up totopo for this directory" },
+                { value: "manage", label: "Manage totopo →" },
+            ],
+        });
+        if (isCancel(choice)) {
+            cancel();
+            process.exit(0);
+        }
+        if (choice === "manage") {
+            await advanced();
+            process.exit(0);
         }
-
-        const ctx = await onboard(packageDir, cwd);
-        if (!ctx) process.exit(0); // cancelled -> exit cleanly
-        project = ctx;
-    } else {
-        // No project context -> show Manage totopo menu directly
-        await advanced(packageDir);
-        process.exit(0);
     }
-}
 
-// --- Sync Dockerfile with host runtimes --------------------------------------------------------------------------------------------------
-await syncDockerfile(packageDir, project);
+    const ctx = await onboard(cwd);
+    if (!ctx) process.exit(0);
+    project = ctx;
+}
 
 // --- Doctor (silent pre-check) -----------------------------------------------------------------------------------------------------------
-const doctorResult = await doctor(project.projectDir, false);
+const doctorResult = await doctor(null, false);
 if (!doctorResult.ok) {
     console.error("  Fix the issues above and re-run totopo.");
     console.error("");
@@ -109,7 +103,7 @@ if (!doctorResult.ok) {
 }
 
 // --- Gather container state for menu -----------------------------------------------------------------------------------------------------
-const { containerName } = project.meta;
+const { containerName } = project;
 
 const dockerResult = spawnSync("docker", ["ps", "--filter", "name=totopo-", "--format", "{{.Names}}"], {
     encoding: "utf8",
@@ -130,22 +124,22 @@ while (showMenu) {
             await dev(packageDir, project);
             break;
         case "rebuild":
-            await rebuild(project.meta.containerName);
+            await rebuild(project.containerName);
             await dev(packageDir, project);
             break;
         case "stop":
-            await stop(project.meta.containerName);
+            await stop(project.containerName);
             break;
         case "settings":
-            await settings(packageDir, project);
+            await settings(project);
             showMenu = true;
             break;
         case "manage-totopo": {
-            const result = await advanced(packageDir, project.id);
+            const result = await advanced(project.projectId);
             if (result === "back") showMenu = true;
             break;
         }
         default:
-            break; // quit or cancelled
+            break;
     }
 }

package/dist/commands/advanced.js

@@ -1,9 +1,8 @@
 // =========================================================================================================================================
 // src/commands/advanced.ts - Manage totopo menu (global, all projects)
-// Invoked by bin/totopo.js - shown directly when outside a project, or via "Manage totopo" from the project menu.
 // =========================================================================================================================================
 import { spawnSync } from "node:child_process";
-import { cpSync, existsSync, mkdirSync, rmSync } from "node:fs";
+import { existsSync, rmSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { cancel, confirm, isCancel, log, multiselect, outro, select, text } from "@clack/prompts";
@@ -11,8 +10,8 @@ import { listProjects } from "../lib/project-identity.js";
 import { run as runDoctor } from "./doctor.js";
 // --- Helpers -----------------------------------------------------------------------------------------------------------------------------
 function stopAndRemoveContainer(name) {
-    spawnSync("docker", ["stop", name], { stdio: "inherit" });
-    spawnSync("docker", ["rm", name], { stdio: "inherit" });
+    spawnSync("docker", ["stop", name], { stdio: "pipe" });
+    spawnSync("docker", ["rm", name], { stdio: "pipe" });
 }
 // --- Stop containers (multi-select across all projects) ----------------------------------------------------------------------------------
 async function stopContainers() {
@@ -54,18 +53,18 @@ async function clearAgentMemory() {
         log.info("No agent memory found.");
         return;
     }
-    let toClear; // project IDs
+    let toClear;
     if (projects.length === 1) {
         const p = projects[0];
         if (p === undefined)
             return;
-        toClear = [p.id];
-        log.info(`Clearing agent memory for ${p.meta.displayName}...`);
+        toClear = [p.projectId];
+        log.info(`Clearing agent memory for ${p.displayName}...`);
     }
     else {
         const selected = await multiselect({
             message: "Select projects to clear agent memory for:",
-            options: projects.map((p) => ({ value: p.id, label: p.meta.displayName, hint: p.meta.projectRoot })),
+            options: projects.map((p) => ({ value: p.projectId, label: p.displayName, hint: p.projectRoot })),
             required: false,
         });
         if (isCancel(selected)) {
@@ -75,27 +74,26 @@ async function clearAgentMemory() {
         toClear = selected;
     }
     for (const id of toClear) {
-        const p = projects.find((x) => x.id === id);
+        const p = projects.find((x) => x.projectId === id);
         if (!p)
             continue;
-        // Stop the container first if running
-        const inspectResult = spawnSync("docker", ["inspect", "--format", "{{.State.Status}}", p.meta.containerName], {
+        const inspectResult = spawnSync("docker", ["inspect", "--format", "{{.State.Status}}", p.containerName], {
             encoding: "utf8",
             stdio: "pipe",
         });
         const isRunning = inspectResult.status === 0 && inspectResult.stdout.trim() === "running";
         if (isRunning) {
             const confirmed = await confirm({
-                message: `Container for ${p.meta.displayName} is running. Stop it to clear memory?`,
+                message: `Container for ${p.displayName} is running. Stop it to clear memory?`,
             });
             if (isCancel(confirmed) || !confirmed)
                 continue;
-            log.step(`Stopping ${p.meta.containerName}...`);
-            stopAndRemoveContainer(p.meta.containerName);
+            log.step(`Stopping ${p.containerName}...`);
+            stopAndRemoveContainer(p.containerName);
         }
         const agentsDir = join(p.projectDir, "agents");
         rmSync(agentsDir, { recursive: true, force: true });
-        log.success(`Cleared agent memory for ${p.meta.displayName}.`);
+        log.success(`Cleared agent memory for ${p.displayName}.`);
     }
 }
 // --- Remove images (multi-select across all projects) ------------------------------------------------------------------------------------
@@ -123,8 +121,8 @@ async function removeImages() {
         cancel();
         return;
     }
+    // Stop any running container using this image first
     for (const repo of selected) {
-        // Stop any running container using this image first
         const psResult = spawnSync("docker", ["ps", "--filter", `name=${repo}`, "--format", "{{.Names}}"], {
             encoding: "utf8",
         });
@@ -134,24 +132,10 @@ async function removeImages() {
             stopAndRemoveContainer(c);
         }
         log.step(`Removing image ${repo}...`);
-        spawnSync("docker", ["rmi", repo], { stdio: "inherit" });
+        spawnSync("docker", ["rmi", repo], { stdio: "pipe" });
     }
     log.success("Done.");
 }
-// --- Reset API keys ----------------------------------------------------------------------------------------------------------------------
-async function resetApiKeys(packageDir) {
-    const globalEnvPath = join(homedir(), ".totopo", ".env");
-    const confirmed = await confirm({
-        message: `Reset ${globalEnvPath}? This affects all totopo projects on this machine.`,
-    });
-    if (isCancel(confirmed) || !confirmed) {
-        cancel("Cancelled.");
-        return;
-    }
-    mkdirSync(join(homedir(), ".totopo"), { recursive: true });
-    cpSync(join(packageDir, "templates", "env"), globalEnvPath);
-    log.success(`API keys reset. Edit ${globalEnvPath} to add your keys.`);
-}
 // --- Uninstall projects (multi-select, remove container + image + project dir) -----------------------------------------------------------
 async function uninstallProjects(currentProjectId) {
     const projects = listProjects();
@@ -161,14 +145,14 @@ async function uninstallProjects(currentProjectId) {
     }
     // Show current project first if known
     const sorted = currentProjectId
-        ? [...projects].sort((a, b) => (a.id === currentProjectId ? -1 : b.id === currentProjectId ? 1 : 0))
+        ? [...projects].sort((a, b) => (a.projectId === currentProjectId ? -1 : b.projectId === currentProjectId ? 1 : 0))
         : projects;
     const selected = await multiselect({
         message: "Select projects to uninstall:",
         options: sorted.map((p) => ({
-            value: p.id,
-            label: p.meta.displayName,
-            hint: p.meta.projectRoot + (p.id === currentProjectId ? " (current)" : ""),
+            value: p.projectId,
+            label: p.displayName,
+            hint: p.projectRoot + (p.projectId === currentProjectId ? " (current)" : ""),
         })),
         required: false,
     });
@@ -178,11 +162,11 @@ async function uninstallProjects(currentProjectId) {
     }
     const selectedIds = selected;
     for (const id of selectedIds) {
-        const p = projects.find((x) => x.id === id);
+        const p = projects.find((x) => x.projectId === id);
         if (!p)
             continue;
         // Stop and remove container if it exists (running or exited)
-        const psResult = spawnSync("docker", ["ps", "-a", "--filter", `name=${p.meta.containerName}`, "--format", "{{.Names}}"], {
+        const psResult = spawnSync("docker", ["ps", "-a", "--filter", `name=${p.containerName}`, "--format", "{{.Names}}"], {
             encoding: "utf8",
         });
         const containers = (psResult.stdout ?? "").trim().split("\n").filter(Boolean);
@@ -190,16 +174,15 @@ async function uninstallProjects(currentProjectId) {
             log.step(`Stopping and removing container ${c}...`);
             stopAndRemoveContainer(c);
         }
-        // Remove Docker image if it exists (image name = container name)
-        log.step(`Removing image ${p.meta.containerName}...`);
-        spawnSync("docker", ["rmi", p.meta.containerName], { stdio: "inherit" });
+        log.step(`Removing image ${p.containerName}...`);
+        spawnSync("docker", ["rmi", p.containerName], { stdio: "inherit" });
         // Delete project directory
         rmSync(p.projectDir, { recursive: true, force: true });
-        log.success(`Uninstalled project ${p.meta.displayName}.`);
+        log.success(`Uninstalled project ${p.displayName}.`);
     }
     return currentProjectId !== undefined && selectedIds.includes(currentProjectId);
 }
-// --- Uninstall totopo (global - wipes ~/.totopo/ and all containers/images) --------------------------------------------------------------
+// --- Uninstall totopo (global) -----------------------------------------------------------------------------------------------------------
 async function uninstallTotopo() {
     const confirmed = await text({
         message: 'Type "uninstall-totopo" to confirm full uninstall:',
@@ -236,7 +219,7 @@ async function uninstallTotopo() {
     outro("totopo uninstalled. Re-run npx totopo to set up again.");
 }
 // --- Manage totopo menu ------------------------------------------------------------------------------------------------------------------
-export async function run(packageDir, currentProjectId) {
+export async function run(currentProjectId) {
     while (true) {
         const action = await select({
             message: "Manage totopo:",
@@ -244,7 +227,6 @@ export async function run(packageDir, currentProjectId) {
                 { value: "stop-containers", label: "Stop containers", hint: "pick running containers" },
                 { value: "clear-memory", label: "Clear agent memory", hint: "pick projects to clear" },
                 { value: "remove-images", label: "Remove images", hint: "pick images to remove" },
-                { value: "reset-keys", label: "Reset API keys", hint: "overwrites ~/.totopo/.env" },
                 { value: "doctor", label: "Doctor", hint: "check Docker health" },
                 { value: "uninstall-project", label: "Uninstall project", hint: "pick projects to remove" },
                 { value: "uninstall", label: "Uninstall totopo", hint: "wipe ~/.totopo/ and all containers/images" },
@@ -264,9 +246,6 @@ export async function run(packageDir, currentProjectId) {
             case "remove-images":
                 await removeImages();
                 break;
-            case "reset-keys":
-                await resetApiKeys(packageDir);
-                break;
             case "uninstall-project": {
                 const currentDeleted = await uninstallProjects(currentProjectId);
                 if (currentDeleted)

package/dist/commands/dev.js

@@ -1,17 +1,16 @@
 // =========================================================================================================================================
 // src/commands/dev.ts - Start the dev container and connect via docker exec
-// Invoked by bin/totopo.js - do not run directly.
+// In-memory Dockerfile build, profile selection, pattern-based shadows, env_file handling.
 // =========================================================================================================================================
 import { spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
+import { existsSync } from "node:fs";
 import { join, relative } from "node:path";
 import { cancel, isCancel, log, outro, select } from "@clack/prompts";
 import { buildAgentContextDocs, buildAgentMountArgs, injectAgentContext } from "../lib/agent-context.js";
-import { readSettings } from "../lib/config.js";
-import { ensureShadowsInSync } from "../lib/shadows.js";
-// The project config dir is always mounted here inside the container (read-only)
-const TOTOPO_CONTAINER_PATH = "/home/devuser/.totopo";
+import { buildDockerfile, buildImageWithTempfile } from "../lib/dockerfile-builder.js";
+import { readActiveProfile, writeActiveProfile } from "../lib/project-identity.js";
+import { buildShadowMountArgs, ensureShadowsInSync, expandShadowPatterns } from "../lib/shadows.js";
+import { readTotopoYaml } from "../lib/totopo-yaml.js";
 // --- Prompt: working directory selection -------------------------------------------------------------------------------------------------
 async function promptWorkdir(workspaceDir, cwd) {
     if (cwd === workspaceDir)
@@ -30,64 +29,45 @@ async function promptWorkdir(workspaceDir, cwd) {
     }
     return choice === "here" ? `/workspace/${relPath}` : "/workspace";
 }
-// --- Build shadow mount args -------------------------------------------------------------------------------------------------------------
-function buildShadowMountArgs(projectDir, workspaceDir) {
-    const settings = readSettings(projectDir);
-    const shadowPaths = settings.shadowPaths;
-    // Sync shadows/ dir with settings (create missing, remove stale, preserve existing)
-    ensureShadowsInSync(projectDir, workspaceDir);
-    const args = [];
-    for (const relPath of shadowPaths) {
-        args.push("-v", `${join(projectDir, "shadows", relPath)}:/workspace/${relPath}`);
+// --- Profile selection -------------------------------------------------------------------------------------------------------------------
+async function selectProfile(ctx, profiles) {
+    const profileNames = Object.keys(profiles);
+    if (profileNames.length <= 1) {
+        return profileNames[0] ?? "default";
     }
-    return { args, shadowPaths };
-}
-// --- Build mount args --------------------------------------------------------------------------------------------------------------------
-// Project config dir is always explicitly mounted - it's never inside the workspace.
-function buildMountArgs(workspaceDir, projectDir) {
-    const agentMounts = buildAgentMountArgs(projectDir);
-    const configMount = ["-v", `${projectDir}:${TOTOPO_CONTAINER_PATH}:ro`];
-    const { args: shadowArgs, shadowPaths } = buildShadowMountArgs(projectDir, workspaceDir);
-    // Shadow mounts must come AFTER the workspace mount to overlay correctly
-    return {
-        mountArgs: ["-v", `${workspaceDir}:/workspace`, ...shadowArgs, ...configMount, ...agentMounts],
-        shadowPaths,
-    };
-}
-// --- Run post-start ----------------------------------------------------------------------------------------------------------------------
-function runPostStart(containerName) {
-    log.step("Running post-start checks...");
-    const postStart = spawnSync("docker", ["exec", containerName, "node", `${TOTOPO_CONTAINER_PATH}/post-start.mjs`], {
-        stdio: "inherit",
+    const currentProfile = readActiveProfile(ctx.projectId) ?? "default";
+    const choice = await select({
+        message: "Profile:",
+        options: profileNames.map((name) => {
+            const opt = { value: name, label: name };
+            if (name === currentProfile)
+                opt.hint = "current";
+            return opt;
+        }),
+        initialValue: currentProfile,
     });
-    if (postStart.status !== 0) {
-        outro("Post-start checks failed.");
-        process.exit(postStart.status ?? 1);
+    if (isCancel(choice)) {
+        cancel("Cancelled.");
+        process.exit(0);
     }
-}
-// --- Ensure global env file exists -------------------------------------------------------------------------------------------------------
-function ensureGlobalEnvFile() {
-    const globalTotopoDir = join(homedir(), ".totopo");
-    const envFile = join(globalTotopoDir, ".env");
-    mkdirSync(globalTotopoDir, { recursive: true });
-    if (!existsSync(envFile)) {
-        writeFileSync(envFile, "");
+    const selected = choice;
+    if (selected !== currentProfile) {
+        writeActiveProfile(ctx.projectId, selected);
     }
-    return envFile;
+    return selected;
 }
-// --- Read container shadow label ---------------------------------------------------------------------------------------------------------
-function readContainerShadowLabel(containerName) {
-    const result = spawnSync("docker", ["inspect", "--format", '{{index .Config.Labels "totopo.shadows"}}', containerName], {
+// --- Read container label ----------------------------------------------------------------------------------------------------------------
+function readContainerLabel(containerName, label) {
+    const result = spawnSync("docker", ["inspect", "--format", `{{index .Config.Labels "${label}"}}`, containerName], {
         encoding: "utf8",
         stdio: "pipe",
     });
     if (result.status !== 0)
         return "";
     const val = result.stdout.trim();
-    // Docker returns "<no value>" when label is missing
     return val === "<no value>" ? "" : val;
 }
-// --- Normalize shadow label --------------------------------------------------------------------------------------------------------------
+// --- Shadow label ------------------------------------------------------------------------------------------------------------------------
 function shadowLabel(paths) {
     if (paths.length === 0)
         return "";
@@ -98,74 +78,129 @@ function stopAndRemoveContainer(containerName) {
     spawnSync("docker", ["stop", containerName], { stdio: "pipe" });
     spawnSync("docker", ["rm", containerName], { stdio: "pipe" });
 }
-// --- Run container -----------------------------------------------------------------------------------------------------------------------
-function runContainer(containerName, imageName, workspaceDir, projectDir) {
-    const envFile = ensureGlobalEnvFile();
-    const { mountArgs, shadowPaths } = buildMountArgs(workspaceDir, projectDir);
-    const labelArgs = ["--label", "totopo.managed=true", "--label", `totopo.shadows=${shadowLabel(shadowPaths)}`];
-    const run = spawnSync("docker", [
-        "run",
-        "-d",
-        "--name",
-        containerName,
-        ...mountArgs,
-        "--env-file",
-        envFile,
-        "--security-opt",
-        "no-new-privileges:true",
-        ...labelArgs,
-        imageName,
-        "sleep",
-        "infinity",
-    ], { stdio: "inherit" });
-    if (run.status !== 0) {
-        outro("Failed to start dev container.");
-        process.exit(run.status ?? 1);
+// --- Run post-start ----------------------------------------------------------------------------------------------------------------------
+function runPostStart(containerName) {
+    log.step("Running post-start checks...");
+    const postStart = spawnSync("docker", ["exec", containerName, "node", "/home/devuser/post-start.mjs"], {
+        stdio: "inherit",
+    });
+    if (postStart.status !== 0) {
+        outro("Post-start checks failed.");
+        process.exit(postStart.status ?? 1);
     }
 }
-export async function run(_packageDir, ctx) {
+// --- Main --------------------------------------------------------------------------------------------------------------------------------
+export async function run(packageDir, ctx) {
     const cwd = process.cwd();
-    const workspaceDir = ctx.meta.projectRoot;
-    const containerName = ctx.meta.containerName;
-    const imageName = ctx.meta.containerName;
+    const workspaceDir = ctx.projectRoot;
+    const containerName = ctx.containerName;
     const projectDir = ctx.projectDir;
+    const templatesDir = join(packageDir, "templates");
+    // --- Read totopo.yaml ----------------------------------------------------------------------------------------------------------------
+    const yaml = readTotopoYaml(workspaceDir);
+    if (!yaml) {
+        log.error("totopo.yaml not found or invalid.");
+        process.exit(1);
+    }
     // --- Prompt for working directory ----------------------------------------------------------------------------------------------------
     const workdir = await promptWorkdir(workspaceDir, cwd);
+    // --- Profile selection ---------------------------------------------------------------------------------------------------------------
+    const profiles = yaml.profiles ?? {};
+    const activeProfile = await selectProfile(ctx, profiles);
+    const profileConfig = profiles[activeProfile];
+    const profileHook = profileConfig?.dockerfile_hook;
+    // --- Shadow path expansion -----------------------------------------------------------------------------------------------------------
+    const shadowPatterns = yaml.shadow_paths ?? [];
+    const expandedShadows = expandShadowPatterns(shadowPatterns, workspaceDir);
+    if (expandedShadows.length > 0) {
+        log.warn(`Shadow paths active: ${expandedShadows.join(", ")}  (Settings > Shadow paths)`);
+    }
+    // --- Sync shadows and build mount args ------------------------------------------------------------------------------------------------
+    ensureShadowsInSync(projectDir, expandedShadows, workspaceDir);
+    const shadowMountArgs = buildShadowMountArgs(projectDir, expandedShadows);
+    // --- Agent context -------------------------------------------------------------------------------------------------------------------
     const hasGit = existsSync(join(workspaceDir, ".git"));
-    const settings = readSettings(projectDir);
-    const agentDocs = buildAgentContextDocs(hasGit, settings.shadowPaths);
-    // --- Session start warning for shadow paths ------------------------------------------------------------------------------------------
-    if (settings.shadowPaths.length > 0) {
-        log.warn(`Shadow paths active: ${settings.shadowPaths.join(", ")}  (Settings > Shadow paths)`);
+    const agentDocs = buildAgentContextDocs(hasGit, shadowPatterns);
+    // --- Env file ------------------------------------------------------------------------------------------------------------------------
+    const envFileArgs = [];
+    if (yaml.env_file) {
+        const envFilePath = join(workspaceDir, yaml.env_file);
+        if (existsSync(envFilePath)) {
+            envFileArgs.push("--env-file", envFilePath);
+        }
+        else {
+            log.warn(`env_file "${yaml.env_file}" not found — skipping`);
+        }
     }
+    // --- Build mount args ----------------------------------------------------------------------------------------------------------------
+    const agentMounts = buildAgentMountArgs(projectDir);
+    // Shadow mounts must come AFTER the workspace mount to overlay correctly
+    const mountArgs = ["-v", `${workspaceDir}:/workspace`, ...shadowMountArgs, ...agentMounts];
+    // --- Container labels ----------------------------------------------------------------------------------------------------------------
+    const labelArgs = [
+        "--label",
+        "totopo.managed=true",
+        "--label",
+        `totopo.shadows=${shadowLabel(expandedShadows)}`,
+        "--label",
+        `totopo.profile=${activeProfile}`,
+    ];
     // --- Inspect container state ---------------------------------------------------------------------------------------------------------
     const inspect = spawnSync("docker", ["inspect", "--format", "{{.State.Status}}", containerName], {
         encoding: "utf8",
         stdio: "pipe",
     });
     let containerStatus = inspect.status === 0 ? inspect.stdout.trim() : null;
-    // --- Check for shadow path mismatch --------------------------------------------------------------------------------------------------
+    // --- Check for shadow or profile mismatch --------------------------------------------------------------------------------------------
     if (containerStatus !== null) {
-        const currentLabel = readContainerShadowLabel(containerName);
-        const expectedLabel = shadowLabel(settings.shadowPaths);
-        if (currentLabel !== expectedLabel) {
-            log.info("Shadow paths changed — recreating container...");
+        const currentShadowLabel = readContainerLabel(containerName, "totopo.shadows");
+        const expectedShadowLabel = shadowLabel(expandedShadows);
+        const currentProfileLabel = readContainerLabel(containerName, "totopo.profile");
+        const shadowChanged = currentShadowLabel !== expectedShadowLabel;
+        const profileChanged = currentProfileLabel !== activeProfile;
+        if (shadowChanged || profileChanged) {
             stopAndRemoveContainer(containerName);
             containerStatus = null;
+            if (profileChanged) {
+                // Profile change means different Dockerfile - must rebuild image
+                log.info(`Profile changed (${currentProfileLabel} → ${activeProfile}) — rebuilding...`);
+                spawnSync("docker", ["rmi", containerName], { stdio: "pipe" });
+            }
+            else {
+                log.info("Shadow paths changed — recreating container...");
+            }
         }
     }
     if (containerStatus === null) {
         // --- No container - build image and run ------------------------------------------------------------------------------------------
         log.step("Building container image...");
-        const build = spawnSync("docker", ["build", "--label", "totopo.managed=true", "-f", join(projectDir, "Dockerfile"), "-t", imageName, projectDir], { stdio: "inherit" });
-        if (build.status !== 0) {
+        const dockerfileContent = buildDockerfile(join(templatesDir, "Dockerfile"), profileHook);
+        const buildResult = buildImageWithTempfile(dockerfileContent, templatesDir, containerName);
+        if (buildResult.status !== 0) {
             outro("Failed to build container image.");
-            process.exit(build.status ?? 1);
+            process.exit(buildResult.status);
         }
         log.step("Preparing agent context...");
         injectAgentContext(projectDir, agentDocs);
         log.step("Starting dev container...");
-        runContainer(containerName, imageName, workspaceDir, projectDir);
+        const run = spawnSync("docker", [
+            "run",
+            "-d",
+            "--name",
+            containerName,
+            ...mountArgs,
+            ...envFileArgs,
+            "--security-opt",
+            "no-new-privileges:true",
+            ...labelArgs,
+            containerName,
+            "sleep",
+            "infinity",
+        ], { stdio: "inherit" });
+        if (run.status !== 0) {
+            outro("Failed to start dev container.");
+            process.exit(run.status ?? 1);
+        }
         runPostStart(containerName);
     }
     else if (containerStatus === "exited") {