vibebox 0.0.0 → 0.0.2

package/dist/index.js

@@ -0,0 +1,883 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logo = void 0;
+exports.buildImage = buildImage;
+exports.ensureSandbox = ensureSandbox;
+const commander_1 = require("commander");
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_crypto_1 = require("node:crypto");
+const node_readline_1 = require("node:readline");
+const update_1 = require("./update");
+const agents_1 = require("./agents");
+exports.logo = `
+█ █ █ █▄▄ █▀▀ █▄▄ █▀█ ▀▄▀
+▀▄▀ █ █▄█ ██▄ █▄█ █▄█ █ █
+`;
+// ============ CLI ============
+commander_1.program
+    .name("vibebox")
+    .version("0.1.0")
+    .description("Run CLI agents in sandboxes. Each folder gets its own sandbox.")
+    .enablePositionalOptions();
+// Agent command group
+const agent = commander_1.program.command("agent").description("Manage and run agents");
+agent
+    .command("run <name> [args...]")
+    .description("Run an agent in the sandbox")
+    .option("--temp", "Temporary new workspace, prompts to save on exit")
+    .option("-w, --workspace <path>", "Use specific workspace directory")
+    .allowUnknownOption()
+    .action(async (name, args, opts) => {
+    await runAgent(name, args, opts);
+});
+agent
+    .command("ls")
+    .description("List available agents with install status")
+    .action(() => {
+    const workspace = process.cwd();
+    const containerName = getSandboxName(workspace);
+    for (const [name, agentDef] of Object.entries(agents_1.agents)) {
+        const hostInstalled = agentDef.isInstalledOnHost();
+        const sandboxInstalled = containerName ? (0, agents_1.isAgentInstalled)(containerName, agentDef) : false;
+        let status = "○ not installed";
+        if (sandboxInstalled)
+            status = "✓ installed in sandbox";
+        else if (hostInstalled)
+            status = "○ not in sandbox (host: detected)";
+        console.log(`  ${name.padEnd(10)} ${status}`);
+    }
+});
+agent
+    .command("install <name>")
+    .description("Install an agent in the current sandbox")
+    .action(async (name) => {
+    const agentDef = agents_1.agents[name];
+    if (!agentDef) {
+        console.error(`Unknown agent: ${name}`);
+        console.log(`Available: ${Object.keys(agents_1.agents).join(", ")}`);
+        process.exit(1);
+    }
+    await ensureDocker();
+    const workspace = process.cwd();
+    const hostInstalled = agentDef.isInstalledOnHost();
+    let containerOnly = false;
+    if (!hostInstalled) {
+        if (!await promptContainerOnly(agentDef.name))
+            process.exit(0);
+        containerOnly = true;
+    }
+    agentDef.setup?.({ workspace, containerOnly });
+    const containerName = ensureSandbox({ workspace, agents: [agentDef], containerOnly });
+    agentDef.install(containerName);
+    console.log(`✓ ${agentDef.name} installed`);
+});
+async function runAgent(name, args, opts) {
+    const agent = agents_1.agents[name];
+    if (!agent) {
+        console.error(`Unknown agent: ${name}`);
+        console.log(`Available: ${Object.keys(agents_1.agents).join(", ")}`);
+        process.exit(1);
+    }
+    await ensureDocker();
+    await (0, update_1.checkForUpdates)();
+    let workspace = opts.workspace ?? process.cwd();
+    if (opts.temp) {
+        workspace = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "vibebox-"));
+        console.log(`Temp workspace: ${workspace}`);
+        const handleSignal = async () => {
+            await promptKeep(workspace);
+            process.exit(0);
+        };
+        process.on("SIGINT", handleSignal);
+        process.on("SIGTERM", handleSignal);
+    }
+    // Check if we need container-only mode
+    const existing = getSandboxName(workspace);
+    const existingRunning = existing && isContainerRunning(existing);
+    const needsInstall = !existingRunning || !(0, agents_1.isAgentInstalled)(existing, agent);
+    const hostInstalled = agent.isInstalledOnHost();
+    let containerOnly = false;
+    if (needsInstall && !hostInstalled) {
+        if (!await promptContainerOnly(agent.name))
+            process.exit(0);
+        containerOnly = true;
+    }
+    // Run agent setup (auth, config files)
+    agent.setup?.({ workspace, containerOnly });
+    const containerName = ensureSandbox({ workspace, agents: [agent], containerOnly });
+    if (agent.versionCommand && !containerOnly) {
+        await (0, update_1.checkVersions)(containerName, agent);
+    }
+    // Auto-install if not present
+    if (!(0, agents_1.isAgentInstalled)(containerName, agent)) {
+        if (hostInstalled) {
+            const answer = await promptConfirm(`${agent.name} detected on host. Install in sandbox?`);
+            if (answer)
+                agent.install(containerName);
+            else
+                process.exit(0);
+        }
+        else {
+            // Container-only mode - install without host
+            agent.install(containerName);
+        }
+    }
+    const r = withSessionLock({
+        name: containerName,
+        fn: () => (0, node_child_process_1.spawnSync)("docker", ["exec", "-it", containerName, agent.command, ...args], { stdio: "inherit" }),
+    });
+    if (opts.temp)
+        await promptKeep(workspace);
+    process.exit(r.status ?? 0);
+}
+async function promptContainerOnly(agentName) {
+    console.log(`\n${agentName} is not installed on your host machine.`);
+    console.log("\nContainer-only mode:");
+    console.log("  - Agent will be installed only inside the sandbox");
+    console.log("  - You'll need to log in separately (no shared auth with host)");
+    console.log("  - Settings/credentials won't sync across workspaces");
+    console.log("  - Each sandbox manages its own config\n");
+    return promptConfirm(`Install ${agentName} in container-only mode?`);
+}
+async function promptConfirm(question) {
+    const rl = (0, node_readline_1.createInterface)({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(`${question} [Y/n]: `, (answer) => {
+            rl.close();
+            resolve(answer.toLowerCase() !== "n");
+        });
+    });
+}
+commander_1.program
+    .command("enter")
+    .description("Shell into sandbox for current directory")
+    .action(async () => {
+    console.log(exports.logo);
+    await ensureDocker();
+    await (0, update_1.checkForUpdates)();
+    const workspace = process.cwd();
+    const installedAgents = setupInstalledAgents({ workspace });
+    const name = ensureSandbox({ workspace, agents: installedAgents });
+    await (0, update_1.checkVersions)(name);
+    withSessionLock({
+        name,
+        fn: () => (0, node_child_process_1.spawnSync)("docker", ["exec", "-it", name, "/bin/zsh"], { stdio: "inherit" }),
+    });
+});
+commander_1.program
+    .command("exec <cmd...>")
+    .description("Run command in sandbox")
+    .allowUnknownOption()
+    .passThroughOptions()
+    .action(async (cmd) => {
+    await ensureDocker();
+    const workspace = process.cwd();
+    const installedAgents = setupInstalledAgents({ workspace });
+    const name = ensureSandbox({ workspace, agents: installedAgents });
+    const r = withSessionLock({
+        name,
+        fn: () => (0, node_child_process_1.spawnSync)("docker", ["exec", name, ...cmd], { stdio: "inherit" }),
+    });
+    process.exit(r.status ?? 0);
+});
+commander_1.program
+    .command("ls")
+    .description("List sandboxes")
+    .action(() => {
+    try {
+        const out = (0, node_child_process_1.execSync)('docker ps -a --filter "label=docker/sandbox=true" --format "table {{.Names}}\t{{.Status}}\t{{.Label \\"com.docker.sandbox.workingDirectory\\"}}"', { encoding: "utf8" });
+        console.log(out || "No sandboxes");
+    }
+    catch {
+        console.log("No sandboxes");
+    }
+});
+commander_1.program
+    .command("stop")
+    .description("Stop sandbox(es)")
+    .option("--all", "Stop all sandboxes")
+    .action((opts) => {
+    if (opts.all) {
+        try {
+            const names = (0, node_child_process_1.execSync)('docker ps -q --filter "label=docker/sandbox=true"', { encoding: "utf8" }).trim();
+            if (names) {
+                (0, node_child_process_1.spawnSync)("docker", ["stop", ...names.split("\n")], { stdio: "inherit" });
+            }
+            else {
+                console.log("No running sandboxes");
+            }
+        }
+        catch {
+            console.log("No running sandboxes");
+        }
+    }
+    else {
+        const name = getSandboxName(process.cwd());
+        if (!name) {
+            console.error("No sandbox");
+            process.exit(1);
+        }
+        (0, node_child_process_1.execFileSync)("docker", ["stop", name], { stdio: "pipe" });
+        console.log("Stopped");
+    }
+});
+commander_1.program
+    .command("rm")
+    .description("Remove sandbox(es)")
+    .option("--all", "Remove all sandboxes")
+    .action((opts) => {
+    if (opts.all) {
+        try {
+            const names = (0, node_child_process_1.execSync)('docker ps -a --filter "label=docker/sandbox=true" --format "{{.Names}}"', { encoding: "utf8" }).trim();
+            if (names) {
+                for (const name of names.split("\n")) {
+                    const ws = (0, node_child_process_1.execFileSync)("docker", ["inspect", name, "--format", '{{index .Config.Labels "com.docker.sandbox.workingDirectory"}}'], { encoding: "utf8" }).trim();
+                    (0, node_child_process_1.execFileSync)("docker", ["rm", "-f", name], { stdio: "pipe" });
+                    if (ws && (0, node_fs_1.existsSync)((0, node_path_1.join)(ws, ".vibebox"))) {
+                        (0, node_fs_1.rmSync)((0, node_path_1.join)(ws, ".vibebox"), { recursive: true });
+                    }
+                }
+                console.log("Removed all sandboxes");
+            }
+            else {
+                console.log("No sandboxes");
+            }
+        }
+        catch {
+            console.log("No sandboxes");
+        }
+    }
+    else {
+        const name = getSandboxName(process.cwd());
+        if (!name) {
+            console.error("No sandbox");
+            process.exit(1);
+        }
+        const ws = process.cwd();
+        (0, node_child_process_1.execFileSync)("docker", ["rm", "-f", name], { stdio: "pipe" });
+        if ((0, node_fs_1.existsSync)((0, node_path_1.join)(ws, ".vibebox"))) {
+            (0, node_fs_1.rmSync)((0, node_path_1.join)(ws, ".vibebox"), { recursive: true });
+        }
+        console.log("Removed");
+    }
+});
+commander_1.program
+    .command("rebuild")
+    .description("Force rebuild image with current host config")
+    .action(async () => {
+    await ensureDocker();
+    await (0, update_1.checkForUpdates)();
+    console.log("Rebuilding vibebox image...");
+    try {
+        (0, node_child_process_1.execSync)("docker rmi vibebox", { stdio: "pipe" });
+    }
+    catch { }
+    buildImage();
+    console.log("Image rebuilt");
+});
+// ============ Ports Commands ============
+const DEFAULT_PORTS = ["5173", "3000", "3001", "4173", "8080"];
+const ports = commander_1.program.command("ports").description("Manage port mappings");
+ports
+    .command("ls")
+    .description("Show current port mappings")
+    .action(() => {
+    const name = getSandboxName(process.cwd());
+    if (!name) {
+        console.error("No sandbox");
+        process.exit(1);
+    }
+    try {
+        const mappings = getPortMappings(name);
+        // Get listening ports
+        const ssOut = (0, node_child_process_1.execFileSync)("docker", ["exec", name, "ss", "-tln"], { encoding: "utf8" });
+        const listening = new Set();
+        for (const line of ssOut.split("\n").slice(1)) {
+            const match = line.match(/:(\d+)\s*$/);
+            if (match)
+                listening.add(match[1]);
+        }
+        if (mappings.size === 0) {
+            console.log("No ports mapped");
+            return;
+        }
+        // Show mapped ports with listening status
+        console.log("Mapped ports:");
+        for (const [container, host] of mappings) {
+            const status = listening.has(container) ? "● listening" : "";
+            console.log(`  ${container} → http://localhost:${host}  ${status}`);
+        }
+        // Show unmapped listening ports
+        const unmapped = [...listening].filter((p) => !mappings.has(p) && parseInt(p) > 1024);
+        if (unmapped.length > 0) {
+            console.log("\nUnmapped listening:");
+            for (const p of unmapped) {
+                console.log(`  ${p}  (add with: vibebox ports add ${p})`);
+            }
+        }
+    }
+    catch {
+        console.log("No ports (container may not be running)");
+    }
+});
+ports
+    .command("add <ports...>")
+    .description("Add custom ports")
+    .action((add) => {
+    const ws = process.cwd();
+    const cfg = loadConfig(ws);
+    const current = new Set(cfg.ports ?? DEFAULT_PORTS);
+    add.forEach((p) => current.add(p));
+    cfg.ports = [...current];
+    saveConfig(ws, cfg);
+    console.log(`Ports: ${cfg.ports.join(", ")}`);
+    if (getSandboxName(ws))
+        console.log("Restart for changes: vibebox stop && vibebox claude");
+});
+ports
+    .command("rm <ports...>")
+    .description("Remove custom ports")
+    .action((rem) => {
+    const ws = process.cwd();
+    const cfg = loadConfig(ws);
+    const toRem = new Set(rem);
+    cfg.ports = (cfg.ports ?? DEFAULT_PORTS).filter((p) => !toRem.has(p));
+    saveConfig(ws, cfg);
+    console.log(`Ports: ${cfg.ports.join(", ")}`);
+    if (getSandboxName(ws))
+        console.log("Restart for changes: vibebox stop && vibebox claude");
+});
+// ============ Customize Command ============
+const TEMPLATES = {
+    setupGlobal: `#!/bin/bash
+# Runs once when a sandbox is created (all sandboxes)
+# Example: git clone https://github.com/YOU/dotfiles ~/.dotfiles && ~/.dotfiles/install.sh
+# Example: sudo apt-get update && sudo apt-get install -y ripgrep
+`,
+    setupLocal: `#!/bin/bash
+# Runs once when this project's sandbox is created
+# Example: pip install -r requirements.txt
+# Example: echo 'export DATABASE_URL=...' >> ~/.bashrc
+`,
+    imageGlobal: `# Baked into image, applies to ALL sandboxes. Run 'vibebox rebuild' after editing.
+FROM vibebox
+
+# Example: Install apt packages
+# RUN apt-get update && apt-get install -y ripgrep bat
+
+# Example: Install oh-my-zsh
+# RUN sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended
+`,
+    imageLocal: `# Baked into image for THIS project. Run 'vibebox rebuild' after editing.
+FROM vibebox:user
+# Or use 'FROM vibebox' to skip global customizations
+
+# Example: Copy config files
+# COPY some-config.json /home/user/.config/
+
+# Example: Install project tools
+# RUN pip install -r requirements.txt
+`,
+};
+function openInEditor({ file, template, isExecutable }) {
+    const dir = (0, node_path_1.dirname)(file);
+    if (!(0, node_fs_1.existsSync)(dir))
+        (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    if (!(0, node_fs_1.existsSync)(file)) {
+        (0, node_fs_1.writeFileSync)(file, template, isExecutable ? { mode: 0o755 } : undefined);
+        console.log(`Created ${file}`);
+    }
+    const editor = process.env.EDITOR || process.env.VISUAL || "vi";
+    const r = (0, node_child_process_1.spawnSync)(editor, [file], { stdio: "inherit" });
+    if (r.status !== 0)
+        console.error(`Failed to open editor. Edit manually: ${file}`);
+}
+const customize = commander_1.program.command("customize").description("Customize sandbox setup");
+customize
+    .command("image [scope]")
+    .description("Edit custom Dockerfile (global or local)")
+    .action(async (scope) => {
+    const targetScope = scope || await promptScope("Dockerfile", "~/.vibebox/Dockerfile", ".vibebox/Dockerfile");
+    if (targetScope !== "global" && targetScope !== "local") {
+        console.error("Usage: vibebox customize image <global|local>");
+        process.exit(1);
+    }
+    const isGlobal = targetScope === "global";
+    const file = (0, node_path_1.join)(isGlobal ? (0, node_os_1.homedir)() : process.cwd(), ".vibebox", "Dockerfile");
+    openInEditor({ file, template: isGlobal ? TEMPLATES.imageGlobal : TEMPLATES.imageLocal });
+    console.log(`\nDockerfile saved: ${file}`);
+    console.log("Run 'vibebox rebuild' to apply changes.");
+});
+customize
+    .command("setup [scope]")
+    .description("Edit setup script (global or local)")
+    .action(async (scope) => {
+    const targetScope = scope || await promptScope("setup script", "~/.vibebox/setup.sh", ".vibebox/setup.sh");
+    if (targetScope !== "global" && targetScope !== "local") {
+        console.error("Usage: vibebox customize setup <global|local>");
+        process.exit(1);
+    }
+    const isGlobal = targetScope === "global";
+    const file = (0, node_path_1.join)(isGlobal ? (0, node_os_1.homedir)() : process.cwd(), ".vibebox", "setup.sh");
+    openInEditor({ file, template: isGlobal ? TEMPLATES.setupGlobal : TEMPLATES.setupLocal, isExecutable: true });
+    console.log(`\nSetup script saved: ${file}`);
+    if (getSandboxName(process.cwd()))
+        console.log("Note: Runs on new sandboxes. To re-run: vibebox rm");
+});
+async function promptScope(type, globalPath, localPath) {
+    const rl = (0, node_readline_1.createInterface)({ input: process.stdin, output: process.stdout });
+    console.log(`\n  global  ${globalPath.padEnd(24)} All sandboxes`);
+    console.log(`  local   ${localPath.padEnd(24)} This project only\n`);
+    const answer = await new Promise((r) => rl.question(`Which ${type}? [global/local]: `, r));
+    rl.close();
+    return answer.trim().toLowerCase();
+}
+// ============ Help Display & Parse ============
+// Only parse CLI when run directly (not when imported)
+if (require.main === module) {
+    const isSubcommand = process.argv.length > 2 && !process.argv[2].startsWith("-");
+    if (process.argv.length === 2 ||
+        (!isSubcommand && (process.argv.includes("--help") || process.argv.includes("-h")))) {
+        console.log(exports.logo);
+    }
+    commander_1.program.parse();
+}
+// ============ Library code =========
+// ============ Constants ============
+const LOCKS_DIR = `${(0, node_os_1.homedir)()}/.vibebox/locks`;
+const DETACHED_LOCK = `${LOCKS_DIR}/detached.lock`;
+const WATCHER_SCRIPT = `${(0, node_os_1.homedir)()}/.local/bin/watcher.sh`;
+const IDLE_TIMEOUT = 300; // 5 minutes
+function loadConfig(ws) {
+    const p = (0, node_path_1.join)(ws, ".vibebox", "config.json");
+    if (!(0, node_fs_1.existsSync)(p))
+        return {};
+    try {
+        return JSON.parse((0, node_fs_1.readFileSync)(p, "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+function saveConfig(ws, cfg) {
+    const dir = (0, node_path_1.join)(ws, ".vibebox");
+    if (!(0, node_fs_1.existsSync)(dir))
+        (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, "config.json"), JSON.stringify(cfg, null, 2));
+}
+function setupInstalledAgents({ workspace }) {
+    const installedAgentNames = (0, agents_1.detectInstalledAgents)();
+    const installedAgents = installedAgentNames.map((n) => agents_1.agents[n]);
+    for (const agent of installedAgents) {
+        agent.setup?.({ workspace });
+    }
+    return installedAgents;
+}
+// ============ Helpers ============
+function getWorkspaceInode(workspace) {
+    const flag = process.platform === "darwin" ? "-f" : "-c";
+    return (0, node_child_process_1.execSync)(`stat ${flag} %i "${workspace}"`, { encoding: "utf8" }).trim();
+}
+function withSessionLock({ name, fn }) {
+    const sessionId = (0, node_crypto_1.randomBytes)(8).toString("hex");
+    const lockFile = `${LOCKS_DIR}/session-${sessionId}.lock`;
+    (0, node_child_process_1.execFileSync)("docker", ["exec", name, "mkdir", "-p", LOCKS_DIR], { stdio: "pipe" });
+    (0, node_child_process_1.execFileSync)("docker", ["exec", name, "touch", lockFile], { stdio: "pipe" });
+    try {
+        return fn();
+    }
+    finally {
+        // Remove this session's lock
+        try {
+            (0, node_child_process_1.execFileSync)("docker", ["exec", name, "rm", "-f", lockFile], { stdio: "pipe" });
+        }
+        catch { } // container stopped
+        // Check if other sessions exist, remove detached lock if none
+        let hasOthers = false;
+        try {
+            const out = (0, node_child_process_1.execFileSync)("docker", ["exec", name, "ls", LOCKS_DIR], { encoding: "utf8" });
+            const locks = out.split("\n").filter((f) => f.startsWith("session-") && f.endsWith(".lock"));
+            hasOthers = locks.filter((f) => f !== `session-${sessionId}.lock`).length > 0;
+        }
+        catch { } // container stopped
+        if (!hasOthers) {
+            try {
+                (0, node_child_process_1.execFileSync)("docker", ["exec", name, "rm", "-f", DETACHED_LOCK], { stdio: "pipe" });
+            }
+            catch { } // container stopped
+        }
+    }
+}
+function buildImage() {
+    const info = (0, node_os_1.userInfo)();
+    const nodeVersion = (0, node_child_process_1.execSync)("node --version", { encoding: "utf8" }).trim().replace(/^v/, "");
+    const npmVersion = (0, node_child_process_1.execSync)("npm --version", { encoding: "utf8" }).trim();
+    const contextDir = (0, node_path_1.dirname)((0, node_path_1.join)((0, node_path_1.dirname)(__dirname), "Dockerfile"));
+    // Hash all files that affect the Docker image
+    const buildFiles = [
+        "Dockerfile",
+        "container-scripts/startup.sh",
+        "container-scripts/port-monitor.sh",
+        "container-scripts/watcher.sh",
+    ];
+    const buildHash = (0, update_1.hashString)(buildFiles.map(f => (0, node_fs_1.readFileSync)((0, node_path_1.join)(contextDir, f), "utf8")).join("\n"));
+    const r = (0, node_child_process_1.spawnSync)("docker", [
+        "build", "-t", "vibebox",
+        "--build-arg", `NODE_VERSION=${nodeVersion}`,
+        "--build-arg", `NPM_VERSION=${npmVersion}`,
+        "--build-arg", `LOCAL_USER=${info.username}`,
+        "--build-arg", `LOCAL_UID=${info.uid ?? 1000}`,
+        "--build-arg", `LOCAL_GID=${info.gid ?? 1000}`,
+        "--build-arg", `LOCAL_HOME=${(0, node_os_1.homedir)()}`,
+        "--label", `vibebox.version.build=${buildHash}`,
+        contextDir,
+    ], { stdio: "inherit" });
+    if (r.status !== 0) {
+        console.error("Failed to build vibebox image");
+        process.exit(1);
+    }
+}
+function getImageHash(tag) {
+    try {
+        return (0, node_child_process_1.execFileSync)("docker", ["inspect", tag, "--format", '{{index .Config.Labels "vibebox.hash"}}'], { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+function buildCustomImage({ tag, contextDir, fromTag }) {
+    const dockerfilePath = (0, node_path_1.join)(contextDir, "Dockerfile");
+    if (!(0, node_fs_1.existsSync)(dockerfilePath))
+        return false;
+    const content = (0, node_fs_1.readFileSync)(dockerfilePath, "utf8");
+    const hash = (0, update_1.hashString)(content + fromTag);
+    if (getImageHash(tag) === hash)
+        return true; // Already up to date
+    console.log(`Building ${tag}...`);
+    const r = (0, node_child_process_1.spawnSync)("docker", ["build", "-t", tag, "--label", `vibebox.hash=${hash}`, contextDir], { stdio: "inherit" });
+    return r.status === 0;
+}
+function getImageTag({ workspace }) {
+    const globalDir = (0, node_path_1.join)((0, node_os_1.homedir)(), ".vibebox");
+    const localDir = (0, node_path_1.join)(workspace, ".vibebox");
+    const hasGlobal = (0, node_fs_1.existsSync)((0, node_path_1.join)(globalDir, "Dockerfile"));
+    const hasLocal = (0, node_fs_1.existsSync)((0, node_path_1.join)(localDir, "Dockerfile"));
+    const wsHash = (0, update_1.hashString)(workspace).slice(0, 8);
+    if (hasGlobal)
+        buildCustomImage({ tag: "vibebox:user", contextDir: globalDir, fromTag: "vibebox" });
+    if (hasLocal)
+        buildCustomImage({ tag: `vibebox:${wsHash}`, contextDir: localDir, fromTag: hasGlobal ? "vibebox:user" : "vibebox" });
+    if (hasLocal)
+        return `vibebox:${wsHash}`;
+    if (hasGlobal)
+        return "vibebox:user";
+    return "vibebox";
+}
+function ensureImage() {
+    try {
+        (0, node_child_process_1.execSync)("docker image inspect vibebox", { stdio: "pipe" });
+    }
+    catch {
+        console.log("Building vibebox image...");
+        buildImage();
+    }
+}
+function getSandboxName(workspace) {
+    try {
+        const out = (0, node_child_process_1.execFileSync)("docker", ["ps", "-a", "--filter", `label=com.docker.sandbox.workingDirectory=${workspace}`, "--format", "{{.Names}}"], { encoding: "utf8" }).trim();
+        return out || null;
+    }
+    catch {
+        return null;
+    }
+}
+function isContainerRunning(name) {
+    try {
+        const state = (0, node_child_process_1.execFileSync)("docker", ["inspect", name, "--format={{.State.Running}}"], {
+            encoding: "utf8",
+            stdio: ["pipe", "pipe", "pipe"],
+        }).trim();
+        return state === "true";
+    }
+    catch {
+        return false;
+    }
+}
+function getPortMappings(name) {
+    const mappings = new Map();
+    try {
+        const out = (0, node_child_process_1.execFileSync)("docker", ["port", name], { encoding: "utf8" }).trim();
+        for (const line of out.split("\n")) {
+            const m = line.match(/^(\d+)\/tcp -> 0\.0\.0\.0:(\d+)$/);
+            if (m)
+                mappings.set(m[1], m[2]);
+        }
+    }
+    catch { } // container not running
+    return mappings;
+}
+function writePortMappings(workspace, name) {
+    const mappings = getPortMappings(name);
+    if (mappings.size === 0)
+        return;
+    const vibeboxDir = (0, node_path_1.join)(workspace, ".vibebox");
+    if (!(0, node_fs_1.existsSync)(vibeboxDir))
+        (0, node_fs_1.mkdirSync)(vibeboxDir, { recursive: true });
+    const parsed = [...mappings].map(([c, h]) => `${c}:${h}`).join("\n");
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(vibeboxDir, "port-mappings.txt"), parsed);
+}
+function ensureSandbox({ workspace, agents: requestedAgents = [], containerOnly = false, }) {
+    const existing = getSandboxName(workspace);
+    if (existing) {
+        try {
+            const state = (0, node_child_process_1.execFileSync)("docker", ["inspect", existing, "--format={{.State.Running}}"], {
+                encoding: "utf8",
+            }).trim();
+            if (state !== "true") {
+                (0, node_child_process_1.execFileSync)("docker", ["start", existing], { stdio: "pipe" });
+                writePortMappings(workspace, existing);
+            }
+            // Verify container is now running
+            const newState = (0, node_child_process_1.execFileSync)("docker", ["inspect", existing, "--format={{.State.Running}}"], {
+                encoding: "utf8",
+            }).trim();
+            if (newState === "true")
+                return existing;
+            // Container failed to start, remove it and create fresh
+            (0, node_child_process_1.execFileSync)("docker", ["rm", "-f", existing], { stdio: "pipe" });
+        }
+        catch {
+            // Container might not exist anymore or is in bad state, try to remove and fall through
+            try {
+                (0, node_child_process_1.execFileSync)("docker", ["rm", "-f", existing], { stdio: "pipe" });
+            }
+            catch { }
+        }
+    }
+    ensureImage();
+    const imageTag = getImageTag({ workspace });
+    // ---- Placeholders ----
+    // Create placeholders for mount overlays (agents may need these)
+    const emptyDir = (0, node_path_1.join)(workspace, ".vibebox", "empty");
+    const emptyFile = (0, node_path_1.join)(workspace, ".vibebox", "empty-file");
+    if (!(0, node_fs_1.existsSync)(emptyDir))
+        (0, node_fs_1.mkdirSync)(emptyDir, { recursive: true });
+    if (!(0, node_fs_1.existsSync)(emptyFile))
+        (0, node_fs_1.writeFileSync)(emptyFile, "");
+    const home = (0, node_os_1.homedir)();
+    const inode = getWorkspaceInode(workspace);
+    const ports = loadConfig(workspace).ports ?? DEFAULT_PORTS;
+    // ---- Agent args ----
+    const agentArgs = requestedAgents.flatMap((agent) => agent.dockerArgs({ workspace, home, containerOnly }));
+    // ---- Symlinks ----
+    const symlinkMounts = new Set();
+    const scanForSymlinks = (dir) => {
+        try {
+            for (const entry of (0, node_fs_1.readdirSync)(dir)) {
+                if (entry.startsWith("."))
+                    continue;
+                const entryPath = (0, node_path_1.join)(dir, entry);
+                try {
+                    const stat = (0, node_fs_1.lstatSync)(entryPath);
+                    if (stat.isSymbolicLink()) {
+                        symlinkMounts.add((0, node_fs_1.realpathSync)(entryPath));
+                    }
+                    else if (stat.isDirectory()) {
+                        scanForSymlinks(entryPath);
+                    }
+                }
+                catch { } // permission denied or inaccessible
+            }
+        }
+        catch { } // dir unreadable
+    };
+    for (let i = 0; i < agentArgs.length; i++) {
+        if (agentArgs[i] === "-v" && agentArgs[i + 1]) {
+            const hostPath = agentArgs[i + 1].split(":")[0];
+            if ((0, node_fs_1.existsSync)(hostPath) && (0, node_fs_1.lstatSync)(hostPath).isDirectory()) {
+                scanForSymlinks(hostPath);
+            }
+        }
+    }
+    // Agent names for label
+    const agentNames = requestedAgents.map((a) => a.name).join(",") || "none";
+    // Generate sandbox name
+    const now = new Date();
+    const name = `vibebox-${now.toISOString().slice(0, 10)}-${String(now.getHours()).padStart(2, "0")}${String(now.getMinutes()).padStart(2, "0")}${String(now.getSeconds()).padStart(2, "0")}`;
+    // ---- SSH ----
+    // Windows named pipes (\\.\pipe\...) can't be mounted with Docker -v
+    const sshAuthSock = process.env.SSH_AUTH_SOCK;
+    const sshArgs = sshAuthSock && process.platform !== "win32" && (0, node_fs_1.existsSync)(sshAuthSock)
+        ? ["-v", `${sshAuthSock}:/ssh-agent`, "-e", "SSH_AUTH_SOCK=/ssh-agent"]
+        : [];
+    // Global vibebox config dir (for setup.sh)
+    const vibeboxGlobalDir = (0, node_path_1.join)(home, ".vibebox");
+    const vibeboxGlobalArgs = (0, node_fs_1.existsSync)(vibeboxGlobalDir)
+        ? ["-v", `${vibeboxGlobalDir}:${vibeboxGlobalDir}:ro`]
+        : [];
+    // ---- GitHub CLI ----
+    const ghConfigDir = process.platform === "win32" && process.env.APPDATA
+        ? (0, node_path_1.join)(process.env.APPDATA, "GitHub CLI")
+        : (0, node_path_1.join)(home, ".config", "gh");
+    const ghArgs = (0, node_fs_1.existsSync)((0, node_path_1.join)(ghConfigDir, "hosts.yml"))
+        ? ["-v", `${ghConfigDir}:${(0, node_path_1.join)(home, ".config", "gh")}:ro`]
+        : [];
+    // ---- Git config ----
+    // Read effective git config from workspace context (respects includeIf)
+    // Uses execFileSync to avoid shell injection
+    const gitEnvArgs = [];
+    const safeGitConfigs = ["user.name", "user.email", "init.defaultBranch", "push.autoSetupRemote", "pull.rebase", "help.autocorrect"];
+    for (const key of safeGitConfigs) {
+        try {
+            // Try workspace context first (respects includeIf), fall back to global
+            let val = "";
+            try {
+                val = (0, node_child_process_1.execFileSync)("git", ["-C", workspace, "config", key], { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+            }
+            catch {
+                val = (0, node_child_process_1.execFileSync)("git", ["config", "--global", key], { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+            }
+            if (val)
+                gitEnvArgs.push("-e", `VIBEBOX_GIT_${key.replace(/\./g, "_").toUpperCase()}=${val}`);
+        }
+        catch { } // config not set
+    }
+    // Git aliases (pass as single JSON env var)
+    try {
+        const aliasOut = (0, node_child_process_1.execFileSync)("git", ["config", "--global", "--get-regexp", "^alias\\."], { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+        if (aliasOut) {
+            const aliases = {};
+            for (const line of aliasOut.split("\n")) {
+                const match = line.match(/^alias\.(\S+)\s+(.+)$/);
+                if (match)
+                    aliases[match[1]] = match[2];
+            }
+            gitEnvArgs.push("-e", `VIBEBOX_GIT_ALIASES=${JSON.stringify(aliases)}`);
+        }
+    }
+    catch { } // no aliases
+    // ---- Docker run ----
+    const args = [
+        "run", "-d",
+        "--name", name,
+        // Labels for container lookup
+        "--label", "docker/sandbox=true",
+        "--label", `com.docker.sandbox.agent=${agentNames}`,
+        "--label", `com.docker.sandbox.workingDirectory=${workspace}`,
+        "--label", `com.docker.sandbox.workingDirectoryInode=${inode}`,
+        // Port mappings (dynamic allocation)
+        ...ports.flatMap((p) => ["-p", p]),
+        // SSH agent forwarding
+        ...sshArgs,
+        // Global vibebox config
+        ...vibeboxGlobalArgs,
+        // GitHub CLI config
+        ...ghArgs,
+        // Environment
+        "-e", `TZ=${process.env.TZ || Intl.DateTimeFormat().resolvedOptions().timeZone}`,
+        "-e", `VIBEBOX_PROJECT_ROOT=${workspace}`,
+        // Git config env vars
+        ...gitEnvArgs,
+        // Agent-specific mounts
+        ...agentArgs,
+        // Symlink targets from mounted directories
+        ...[...symlinkMounts].flatMap((p) => ["-v", `${p}:${p}`]),
+        // Mount workspace at same path
+        "-v", `${workspace}:${workspace}`,
+        "-w", workspace,
+        imageTag,
+        // Run startup script with watcher
+        `${home}/.local/bin/startup.sh`, "bash", "-c", `mkdir -p ${LOCKS_DIR} && touch ${DETACHED_LOCK} && ${WATCHER_SCRIPT} ${IDLE_TIMEOUT}`,
+    ];
+    const result = (0, node_child_process_1.spawnSync)("docker", args, { stdio: "pipe", encoding: "utf-8" });
+    if (result.status !== 0) {
+        console.error("Failed to create sandbox:", result.stderr || result.stdout);
+        process.exit(1);
+    }
+    const created = getSandboxName(workspace);
+    if (!created) {
+        console.error("Failed to create sandbox");
+        process.exit(1);
+    }
+    writePortMappings(workspace, created);
+    return created;
+}
+async function ensureDocker() {
+    try {
+        (0, node_child_process_1.execSync)("docker --version", { stdio: "pipe" });
+    }
+    catch {
+        console.error("Docker not installed.\nDownload: https://www.docker.com/products/docker-desktop/");
+        process.exit(1);
+    }
+    try {
+        (0, node_child_process_1.execSync)("docker info", { stdio: "pipe" });
+        return;
+    }
+    catch { } // not running, try to start
+    const cmds = { darwin: "open -gj -a Docker", win32: 'start /min "" "Docker Desktop"' };
+    const launchCmd = cmds[process.platform];
+    if (!launchCmd) {
+        console.error("Docker not running.");
+        process.exit(1);
+    }
+    console.log("Starting Docker...");
+    try {
+        (0, node_child_process_1.spawnSync)(launchCmd, { stdio: "pipe", shell: true });
+    }
+    catch {
+        console.error("Could not start Docker.");
+        process.exit(1);
+    }
+    for (let i = 0; i < 60; i++) {
+        try {
+            (0, node_child_process_1.execSync)("docker info", { stdio: "pipe" });
+            return;
+        }
+        catch { } // still starting
+        await new Promise((r) => setTimeout(r, 1000));
+    }
+    console.error("Docker failed to start.");
+    process.exit(1);
+}
+async function promptKeep(dir) {
+    const rl = (0, node_readline_1.createInterface)({ input: process.stdin, output: process.stdout });
+    const ask = (q) => new Promise((r) => rl.question(q, r));
+    const now = new Date();
+    const day = String(now.getDate()).padStart(2, "0");
+    const month = now.toLocaleString("en-US", { month: "short" });
+    const year = now.getFullYear();
+    const hour = String(now.getHours()).padStart(2, "0");
+    const minute = String(now.getMinutes()).padStart(2, "0");
+    const defaultName = `claude-session-${day}${month}${year}${hour}${minute}`;
+    const defaultPath = `~/${defaultName}`;
+    const keep = await ask("\nKeep workspace? [y/N]: ");
+    if (keep.toLowerCase() === "y") {
+        const dest = await ask(`Copy to [${defaultPath}]: `);
+        const finalDest = dest.trim() || defaultPath;
+        const resolvedDest = finalDest.startsWith("~/") ? (0, node_path_1.join)((0, node_os_1.homedir)(), finalDest.slice(2)) : finalDest;
+        if (resolvedDest.startsWith("/") && !(0, node_fs_1.existsSync)(resolvedDest)) {
+            (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(resolvedDest), { recursive: true });
+            (0, node_fs_1.cpSync)(dir, resolvedDest, { recursive: true });
+            (0, node_fs_1.rmSync)(dir, { recursive: true });
+            console.log(`Saved to ${resolvedDest}`);
+        }
+        else if ((0, node_fs_1.existsSync)(resolvedDest)) {
+            console.error(`Path already exists: ${resolvedDest}`);
+            (0, node_fs_1.rmSync)(dir, { recursive: true });
+        }
+        else {
+            console.error("Invalid path (must be absolute)");
+            (0, node_fs_1.rmSync)(dir, { recursive: true });
+        }
+    }
+    else {
+        (0, node_fs_1.rmSync)(dir, { recursive: true });
+        console.log("Deleted");
+    }
+    rl.close();
+}