totopo 3.3.0-rc-1 → 3.3.0

package/bin/totopo.js

@@ -50,10 +50,10 @@ if (!existsSync(new URL("../dist/commands/dev.js", import.meta.url))) {
     process.exit(1);
 }
 
-// --- v2 migration check ------------------------------------------------------------------------------------------------------------------
+// --- migrations check --------------------------------------------------------------------------------------------------------------------
 try {
     const { runMigration } = await import("../dist/lib/migrate-to-latest.js");
-    runMigration(process.cwd());
+    await runMigration(process.cwd(), false);
 } catch {
     // Non-fatal - migration failure should not block startup
 }

package/dist/lib/migrate-to-latest.js

@@ -22,10 +22,10 @@
 // All migrations are idempotent - each checks if needed and skips if not.
 // =========================================================================================================================================
 import { spawnSync } from "node:child_process";
-import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { log } from "@clack/prompts";
+import { confirm, isCancel, log } from "@clack/prompts";
 import { load as loadYaml } from "js-yaml";
 import { AGENTS_DIR, CONTAINER_STARTUP, LOCK_FILE, PROFILE, SHADOWS_DIR, TOTOPO_DIR, TOTOPO_YAML, WORKSPACES_DIR } from "./constants.js";
 import { safeRmSync } from "./safe-rm.js";
@@ -151,6 +151,55 @@ function migrateSingleV2Workspace(v2, existingIds) {
 // =========================================================================================================================================
 // Migration steps - each is idempotent and checks if needed before acting
 // =========================================================================================================================================
+const V1_WORKSPACE_FILES = ["Dockerfile", "README.md", "post-start.mjs", "settings.json"];
+function getCandidateWorkspaceRoots(cwd) {
+    const roots = [cwd];
+    const gitRoot = spawnSync("git", ["rev-parse", "--show-toplevel"], {
+        cwd,
+        encoding: "utf8",
+        stdio: "pipe",
+    });
+    const root = (gitRoot.stdout ?? "").trim();
+    if (gitRoot.status === 0 && root.length > 0 && root !== cwd)
+        roots.push(root);
+    return roots;
+}
+function detectLegacyV1WorkspaceDir(cwd) {
+    for (const root of getCandidateWorkspaceRoots(cwd)) {
+        const legacyDir = join(root, TOTOPO_DIR);
+        try {
+            if (!statSync(legacyDir).isDirectory())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        const hasLegacyFile = V1_WORKSPACE_FILES.some((file) => existsSync(join(legacyDir, file)));
+        if (hasLegacyFile)
+            return legacyDir;
+    }
+    return null;
+}
+/**
+ * v1.0.3 -> latest: Remove workspace-local .totopo/ artifacts.
+ * These files are now bundled in the totopo CLI package.
+ */
+async function migrateLegacyV1WorkspaceArtifacts(cwd, requireConfirmation = true) {
+    const legacyDir = detectLegacyV1WorkspaceDir(cwd);
+    if (!legacyDir)
+        return;
+    log.warn(`Found legacy v1 totopo artifacts at ${legacyDir}.\n` +
+        "  Latest totopo bundles these files in the binary, so this directory can be safely removed.");
+    if (requireConfirmation) {
+        const shouldRemove = await confirm({ message: "Remove legacy .totopo/ directory?", initialValue: true });
+        if (isCancel(shouldRemove) || !shouldRemove) {
+            log.info("Kept legacy .totopo/ directory.");
+            return;
+        }
+    }
+    safeRmSync(legacyDir, { recursive: true, force: true });
+    log.success("Removed legacy .totopo/ directory.");
+}
 /**
  * v3-rc-1/rc-2 → latest: Rename ~/.totopo/projects/ → ~/.totopo/workspaces/.
  * Stops running containers first because they have bind mounts into the old path.
@@ -393,24 +442,31 @@ function migrateRemoveDeprecatedYamlFields(cwd) {
 // migrateLockFileFormat and migrateLockKeyYamlToRoot must run last so all workspace
 // dirs are in their final location first. migrateLockKeyYamlToRoot runs after
 // migrateLockFileFormat so the latter always writes "root=" for freshly upgraded files.
-const MIGRATIONS = [
-    { from: "v3-rc-1/rc-2", description: "Rename ~/.totopo/projects/ to ~/.totopo/workspaces/", run: migrateProjectsDir },
-    { from: "v2.x", description: "Hash-based dirs to workspace_id-based dirs + totopo.yaml", run: migrateV2Workspaces },
-    { from: "v3-rc-1/rc-2", description: "Rename project_id to workspace_id in totopo.yaml", run: migrateTotopoYaml },
-    { from: "v2.x", description: "Remove legacy ~/.totopo/.env global key file", run: migrateGlobalEnv },
-    { from: "v3-rc-6", description: "Upgrade .lock files from positional to key=value format", run: migrateLockFileFormat },
-    { from: "v3-rc-8", description: "Rename 'yaml' key to 'root' in .lock files", run: migrateLockKeyYamlToRoot },
-    { from: "v3.1.0", description: "Remove last-cli-update key from .lock files", run: migrateRemoveLastCliUpdate },
-    {
-        from: "v3.2.1",
-        description: "Remove deprecated fields (schema_version, name, yaml-language-server) from totopo.yaml",
-        run: migrateRemoveDeprecatedYamlFields,
-    },
-];
+function buildMigrations(cwd, skipAnyConfirmations) {
+    return [
+        {
+            from: "v1.0.3",
+            description: "Remove workspace-local .totopo/ artifacts",
+            run: () => migrateLegacyV1WorkspaceArtifacts(cwd, !skipAnyConfirmations),
+        },
+        { from: "v3-rc-1/rc-2", description: "Rename ~/.totopo/projects/ to ~/.totopo/workspaces/", run: migrateProjectsDir },
+        { from: "v2.x", description: "Hash-based dirs to workspace_id-based dirs + totopo.yaml", run: migrateV2Workspaces },
+        { from: "v3-rc-1/rc-2", description: "Rename project_id to workspace_id in totopo.yaml", run: () => migrateTotopoYaml(cwd) },
+        { from: "v2.x", description: "Remove legacy ~/.totopo/.env global key file", run: migrateGlobalEnv },
+        { from: "v3-rc-6", description: "Upgrade .lock files from positional to key=value format", run: migrateLockFileFormat },
+        { from: "v3-rc-8", description: "Rename 'yaml' key to 'root' in .lock files", run: migrateLockKeyYamlToRoot },
+        { from: "v3.1.0", description: "Remove last-cli-update key from .lock files", run: migrateRemoveLastCliUpdate },
+        {
+            from: "v3.2.1",
+            description: "Remove deprecated fields (schema_version, name, yaml-language-server) from totopo.yaml",
+            run: () => migrateRemoveDeprecatedYamlFields(cwd),
+        },
+    ];
+}
 /** Run all migrations in order. Called early in bin/totopo.js startup. */
-export function runMigration(cwd) {
-    for (const migration of MIGRATIONS) {
-        migration.run(cwd);
+export async function runMigration(cwd, skipAnyConfirmations = true) {
+    for (const migration of buildMigrations(cwd, skipAnyConfirmations)) {
+        await migration.run();
     }
 }
 // =========================================================================================================================================
@@ -421,8 +477,16 @@ export function runMigration(cwd) {
 /** Check if a running container's image is stale (missing expected files/features). */
 export function isImageStale(containerName) {
     // v3.2.0: startup.mjs replaced post-start.mjs + update-ai-clis.mjs
-    const check = spawnSync("docker", ["exec", containerName, "test", "-f", CONTAINER_STARTUP], { stdio: "pipe" });
-    if (check.status !== 0)
+    const startupCheck = spawnSync("docker", ["exec", containerName, "test", "-f", CONTAINER_STARTUP], { stdio: "pipe" });
+    if (startupCheck.status !== 0)
+        return true;
+    // v3.3.0: file added to the base image for artifact inspection
+    const fileCheck = spawnSync("docker", ["exec", containerName, "test", "-x", "/usr/bin/file"], { stdio: "pipe" });
+    if (fileCheck.status !== 0)
+        return true;
+    // v3.3.0: bubblewrap added for Codex sandboxing prerequisites
+    const bubblewrapCheck = spawnSync("docker", ["exec", containerName, "test", "-x", "/usr/bin/bwrap"], { stdio: "pipe" });
+    if (bubblewrapCheck.status !== 0)
         return true;
     return false;
 }

package/dist/lib/safe-rm.js

@@ -13,14 +13,19 @@ const TEST_TMP_PREFIX = join(tmpdir(), `${CONTAINER_NAME_PREFIX}test-`);
 /**
  * Safe wrapper around rmSync. Throws if the path is outside a totopo-owned location:
  *   - ~/.totopo/            (workspace caches, agents, shadows, global config)
+ *   - A directory named .totopo  (legacy v1 workspace-local artifacts)
  *   - A file named totopo.yaml  (workspace config file in any user workspace root)
  *   - <tmpdir>/totopo-test-*   (test temp directories)
  */
 export function safeRmSync(path, options) {
     const r = resolve(path);
-    const ok = r === TOTOPO_HOME || r.startsWith(TOTOPO_HOME + sep) || basename(r) === TOTOPO_YAML || r.startsWith(TEST_TMP_PREFIX);
+    const ok = r === TOTOPO_HOME ||
+        r.startsWith(TOTOPO_HOME + sep) ||
+        basename(r) === TOTOPO_DIR ||
+        basename(r) === TOTOPO_YAML ||
+        r.startsWith(TEST_TMP_PREFIX);
     if (!ok) {
-        throw new Error(`safeRmSync: refusing to delete '${r}' — must be under ~/.totopo/, named totopo.yaml, or a test temp dir`);
+        throw new Error(`safeRmSync: refusing to delete '${r}' - must be under ~/.totopo/, named .totopo, named totopo.yaml, or a test temp dir`);
     }
     rmSync(r, options);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "totopo",
-  "version": "3.3.0-rc-1",
+  "version": "3.3.0",
   "description": "Run AI coding agents safely in your local codebase",
   "type": "module",
   "bin": {

package/templates/Dockerfile

@@ -23,7 +23,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     # Build essentials
     build-essential pkg-config libssl-dev \
     # Utilities
-    jq unzip zip tree htop procps lsb-release gnupg ca-certificates sox \
+    jq unzip zip tree htop procps lsb-release gnupg ca-certificates sox file bubblewrap \
     # Modern search/navigation tools
     ripgrep fzf \
     # Database clients