From 272fd4da2360c8a81d81395c5037d09c9fa033b3 Mon Sep 17 00:00:00 2001 From: Robby Cochran Date: Sat, 13 Jun 2026 05:13:59 -0700 Subject: [PATCH 1/7] X-Smart-Branch-Parent: main From 05aa9f0b85e6b7b212d59f6baffa05b449e238db Mon Sep 17 00:00:00 2001 From: Robby Cochran Date: Sat, 13 Jun 2026 05:16:32 -0700 Subject: [PATCH 2/7] refactor: remove claude wrapper, run claude directly The wrapper script passed --bare and --dangerously-skip-permissions to claude, but both are already handled by config files: - settings.json: defaultMode=bypassPermissions, skipDangerousModePermissionPrompt=true - claude.json: hasCompletedOnboarding=true Remove the wrapper, stop moving the real binary to claude-real in the Dockerfile, and let the base image's claude run directly. --- cmd/helpers_test.go | 2 +- internal/agent/agent_test.go | 10 +++++----- sandbox/CLAUDE.md | 2 +- sandbox/Dockerfile | 9 +-------- sandbox/bin/claude | 3 --- test/test-flow.sh | 2 +- 6 files changed, 9 insertions(+), 19 deletions(-) delete mode 100755 sandbox/bin/claude diff --git a/cmd/helpers_test.go b/cmd/helpers_test.go index 7d8b6d3..f98c417 100644 --- a/cmd/helpers_test.go +++ b/cmd/helpers_test.go @@ -76,7 +76,7 @@ func setupTestAgent(t *testing.T) string { os.MkdirAll(filepath.Join(dir, "agents"), 0o755) os.WriteFile(filepath.Join(dir, "agents", "default.yaml"), []byte(`name: test-agent image: quay.io/test:latest -entrypoint: claude --bare +entrypoint: claude providers: - profile: github - profile: vertex-local diff --git a/internal/agent/agent_test.go b/internal/agent/agent_test.go index ae7635a..de662e2 100644 --- a/internal/agent/agent_test.go +++ b/internal/agent/agent_test.go @@ -17,7 +17,7 @@ providers: JIRA_URL: https://issues.redhat.com - profile: github task: tasks/daily-standup.md -entrypoint: claude --bare +entrypoint: claude `) cfg, err := Parse(data) if err != nil { @@ -179,7 +179,7 @@ func TestParseFile_AgentYAML(t *testing.T) { dir := t.TempDir() yamlContent := `name: test-agent image: ghcr.io/test:latest -entrypoint: claude --bare +entrypoint: claude tty: true providers: - profile: github @@ -268,7 +268,7 @@ func TestBuildEnvMap_Empty(t *testing.T) { func TestBuildRunSh(t *testing.T) { cfg := &AgentConfig{ - Entrypoint: "claude --bare", + Entrypoint: "claude", Task: "tasks/standup.md", } runSh := cfg.BuildRunSh() @@ -284,7 +284,7 @@ func TestBuildRunSh(t *testing.T) { if !strings.Contains(runSh, `command -v "claude"`) { t.Error("missing entrypoint validation") } - if !strings.Contains(runSh, `exec claude --bare -p "$(cat "$PAYLOAD_DIR/task.md")"`) { + if !strings.Contains(runSh, `exec claude -p "$(cat "$PAYLOAD_DIR/task.md")"`) { t.Errorf("missing task exec with -p in:\n%s", runSh) } } @@ -310,7 +310,7 @@ func TestRenderPayload(t *testing.T) { {Profile: "atlassian", Env: map[string]string{"JIRA_URL": "https://jira.example.com"}}, }, Task: "my-task.md", - Entrypoint: "claude --bare", + Entrypoint: "claude", } destDir := filepath.Join(t.TempDir(), "payload") diff --git a/sandbox/CLAUDE.md b/sandbox/CLAUDE.md index f24ebed..1829003 100644 --- a/sandbox/CLAUDE.md +++ b/sandbox/CLAUDE.md @@ -22,7 +22,7 @@ You are running inside an OpenShell sandbox. Credentials are injected via the Op - Use `gws schema ` to discover API parameters. ### AI Coding Agents -- `claude` — Claude Code (wrapper at `/usr/local/bin/claude`) +- `claude` — Claude Code - `opencode` — OpenCode (MCP config at `/sandbox/opencode.json`) ### General Tools diff --git a/sandbox/Dockerfile b/sandbox/Dockerfile index 1c30a28..e653436 100644 --- a/sandbox/Dockerfile +++ b/sandbox/Dockerfile @@ -75,17 +75,10 @@ COPY opencode.json /sandbox/opencode.json # Runtime script COPY startup.sh /sandbox/startup.sh -# Claude wrapper: move the real binary aside, install wrapper in its place. -# The base image puts claude at /usr/local/bin/claude; we move it to -# /usr/local/lib/claude-real so the wrapper can call it. -RUN mv /usr/local/bin/claude /usr/local/lib/claude-real -COPY bin/claude /usr/local/bin/claude - # Harness config directory (populated at runtime via upload) RUN mkdir -p /sandbox/.config/openshell && chown sandbox:sandbox /sandbox/.config/openshell -RUN chmod 755 /usr/local/bin/claude && \ - chmod +x /sandbox/startup.sh && \ +RUN chmod +x /sandbox/startup.sh && \ chown -R sandbox:sandbox /sandbox/.claude /sandbox/.claude.json /sandbox/.mcp.json /sandbox/opencode.json /sandbox/.config /sandbox/CLAUDE.md /sandbox/startup.sh USER sandbox diff --git a/sandbox/bin/claude b/sandbox/bin/claude deleted file mode 100755 index 3605a94..0000000 --- a/sandbox/bin/claude +++ /dev/null @@ -1,3 +0,0 @@ -#!/usr/bin/env bash -# Wrapper that sets sandbox defaults so Claude Code starts clean. -exec /usr/local/lib/claude-real --bare --dangerously-skip-permissions "$@" diff --git a/test/test-flow.sh b/test/test-flow.sh index c6de262..93a0618 100755 --- a/test/test-flow.sh +++ b/test/test-flow.sh @@ -158,7 +158,7 @@ sandbox_verify() { step "sandbox: gws token placeholder" "$CLI" sandbox exec --name "$name" -- bash -c 'echo "$GOOGLE_WORKSPACE_CLI_TOKEN" | grep -q "openshell:resolve:env"' step "sandbox: gws api call" "$CLI" sandbox exec --name "$name" -- bash -c 'for i in 1 2 3; do curl -sf https://gmail.googleapis.com/gmail/v1/users/me/profile -H "Authorization: Bearer $GOOGLE_WORKSPACE_CLI_TOKEN" -o /dev/null && exit 0; sleep 3; done; exit 1' step "sandbox: mcp config" "$CLI" sandbox exec --name "$name" -- test -f /sandbox/.mcp.json - step "sandbox: claude responds" "$CLI" sandbox exec --name "$name" -- bash -c 'echo "respond with ok" | claude --bare --print 2>&1 | head -1' + step "sandbox: claude responds" "$CLI" sandbox exec --name "$name" -- bash -c 'echo "respond with ok" | claude --print 2>&1 | head -1' } summary() { From 57e25d0ed52a5aa9be7bd78c3260070105abc175 Mon Sep 17 00:00:00 2001 From: Robby Cochran Date: Sat, 13 Jun 2026 05:26:16 -0700 Subject: [PATCH 3/7] refactor: move CLAUDE.md to ~/.claude/CLAUDE.md in sandbox Place the agent instructions at /sandbox/.claude/CLAUDE.md (the user's global CLAUDE.md path) instead of /sandbox/CLAUDE.md. Claude Code reads this automatically without needing it in the working directory. --- sandbox/Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sandbox/Dockerfile b/sandbox/Dockerfile index e653436..1c1a134 100644 --- a/sandbox/Dockerfile +++ b/sandbox/Dockerfile @@ -66,7 +66,7 @@ RUN npm install -g opencode-ai@latest COPY policy.yaml /etc/openshell/policy.yaml # Agent instructions + config (Claude Code + OpenCode) -COPY CLAUDE.md /sandbox/CLAUDE.md +COPY CLAUDE.md /sandbox/.claude/CLAUDE.md COPY settings.json /sandbox/.claude/settings.json COPY claude.json /sandbox/.claude.json COPY mcp.json /sandbox/.mcp.json @@ -79,7 +79,7 @@ COPY startup.sh /sandbox/startup.sh RUN mkdir -p /sandbox/.config/openshell && chown sandbox:sandbox /sandbox/.config/openshell RUN chmod +x /sandbox/startup.sh && \ - chown -R sandbox:sandbox /sandbox/.claude /sandbox/.claude.json /sandbox/.mcp.json /sandbox/opencode.json /sandbox/.config /sandbox/CLAUDE.md /sandbox/startup.sh + chown -R sandbox:sandbox /sandbox/.claude /sandbox/.claude.json /sandbox/.mcp.json /sandbox/opencode.json /sandbox/.config /sandbox/startup.sh USER sandbox From feb54bca96c85f98056ebc58490fd34fd5e3cc15 Mon Sep 17 00:00:00 2001 From: Robby Cochran Date: Sat, 13 Jun 2026 05:32:28 -0700 Subject: [PATCH 4/7] refactor: make CLAUDE.md provider-aware via startup.sh Base CLAUDE.md is now generic (sandbox environment only). At startup, provider-specific tool docs are appended based on which credentials are available: - GitHub: appended when gh is authenticated - Jira/Confluence: appended when JIRA_URL is set - GWS: appended when GOOGLE_WORKSPACE_CLI_TOKEN is set This way the agent only sees docs for tools it can actually use. --- sandbox/CLAUDE.md | 43 +++++++------------------------------------ sandbox/startup.sh | 34 ++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 36 deletions(-) diff --git a/sandbox/CLAUDE.md b/sandbox/CLAUDE.md index 1829003..a19b33c 100644 --- a/sandbox/CLAUDE.md +++ b/sandbox/CLAUDE.md @@ -1,41 +1,12 @@ -# Sandbox Agent Instructions +# Sandbox Environment -You are running inside an OpenShell sandbox. Credentials are injected via the OpenShell provider system — they appear as environment variables automatically. +You are running inside an OpenShell sandbox. Credentials are injected via the OpenShell provider system and appear as environment variables automatically. -## Tools Available +## Environment -### GitHub — `gh` CLI -- Pre-authenticated. Use `gh` for all GitHub operations. -- Examples: `gh repo clone`, `gh pr create`, `gh issue list`, `gh api` - -### Jira & Confluence — mcp-atlassian MCP server -- Connected via the `atlassian` MCP server (credentials injected by provider). -- Use MCP tools for Jira searches, issue creation, comments, and Confluence page reads. - -### Google Workspace — `gws` CLI -- Pre-authenticated for Gmail, Calendar, Drive, Docs, Sheets. -- Path: `/usr/local/bin/gws` -- Examples: - - `gws gmail users messages list --params '{"userId": "me", "maxResults": 5}'` - - `gws calendar events list --params '{"calendarId": "primary", "maxResults": 5}'` - - `gws drive files list --params '{"pageSize": 10}'` -- Use `gws schema ` to discover API parameters. - -### AI Coding Agents -- `claude` — Claude Code -- `opencode` — OpenCode (MCP config at `/sandbox/opencode.json`) - -### General Tools -- `python3`, `pip`, `uv` — Python with a virtualenv at `/sandbox/.venv` -- `node`, `npm` — Node.js 22 -- `git`, `curl` — pre-installed - -## Configuration -- Inference routes through the gateway proxy at `inference.local`. -- Model and provider configuration are set by the harness during sandbox creation. - -## Conventions - Working directory: `/sandbox` - Writable paths: `/sandbox`, `/tmp` -- Network: Outbound allowed to Google APIs, GitHub, Atlassian, npm/pypi. -- Credentials are managed by the OpenShell provider system and cleaned up on sandbox exit. +- Inference routes through the gateway proxy at `inference.local` +- Credentials are managed by OpenShell and cleaned up on sandbox exit +- Pre-installed tools: `python3`, `uv`, `node`, `npm`, `git`, `curl` +- MCP servers are configured in `.mcp.json` and connected automatically diff --git a/sandbox/startup.sh b/sandbox/startup.sh index fcc7f68..a080227 100644 --- a/sandbox/startup.sh +++ b/sandbox/startup.sh @@ -12,4 +12,38 @@ fi # ── Git auth ────────────────────────────────────────────────────────── gh auth setup-git 2>/dev/null || true +# ── Append provider-specific docs to CLAUDE.md ──────────────────────── +CLAUDE_MD="/sandbox/.claude/CLAUDE.md" + +if command -v gh &>/dev/null && gh auth status &>/dev/null 2>&1; then + cat >> "$CLAUDE_MD" <<'DOCS' + +## GitHub — `gh` CLI +- Pre-authenticated. Use `gh` for all GitHub operations. +- Examples: `gh repo clone`, `gh pr create`, `gh issue list`, `gh api` +DOCS +fi + +if [[ -n "${JIRA_URL:-}" ]]; then + cat >> "$CLAUDE_MD" <<'DOCS' + +## Jira & Confluence — mcp-atlassian MCP server +- Connected via the `atlassian` MCP server (credentials injected by provider). +- Use MCP tools for Jira searches, issue creation, comments, and Confluence page reads. +DOCS +fi + +if [[ -n "${GOOGLE_WORKSPACE_CLI_TOKEN:-}" ]]; then + cat >> "$CLAUDE_MD" <<'DOCS' + +## Google Workspace — `gws` CLI +- Pre-authenticated for Gmail, Calendar, Drive, Docs, Sheets. +- Use `gws schema ` to discover API parameters. +- Examples: + - `gws gmail users messages list --params '{"userId": "me", "maxResults": 5}'` + - `gws calendar events list --params '{"calendarId": "primary", "maxResults": 5}'` + - `gws drive files list --params '{"pageSize": 10}'` +DOCS +fi + echo "Setup complete." From 8c999f5e31e4ebf9a1adfc94d8d0a1d2590938d9 Mon Sep 17 00:00:00 2001 From: Robby Cochran Date: Sat, 13 Jun 2026 05:34:08 -0700 Subject: [PATCH 5/7] Revert "refactor: make CLAUDE.md provider-aware via startup.sh" This reverts commit feb54bca96c85f98056ebc58490fd34fd5e3cc15. --- sandbox/CLAUDE.md | 43 ++++++++++++++++++++++++++++++++++++------- sandbox/startup.sh | 34 ---------------------------------- 2 files changed, 36 insertions(+), 41 deletions(-) diff --git a/sandbox/CLAUDE.md b/sandbox/CLAUDE.md index a19b33c..1829003 100644 --- a/sandbox/CLAUDE.md +++ b/sandbox/CLAUDE.md @@ -1,12 +1,41 @@ -# Sandbox Environment +# Sandbox Agent Instructions -You are running inside an OpenShell sandbox. Credentials are injected via the OpenShell provider system and appear as environment variables automatically. +You are running inside an OpenShell sandbox. Credentials are injected via the OpenShell provider system — they appear as environment variables automatically. -## Environment +## Tools Available +### GitHub — `gh` CLI +- Pre-authenticated. Use `gh` for all GitHub operations. +- Examples: `gh repo clone`, `gh pr create`, `gh issue list`, `gh api` + +### Jira & Confluence — mcp-atlassian MCP server +- Connected via the `atlassian` MCP server (credentials injected by provider). +- Use MCP tools for Jira searches, issue creation, comments, and Confluence page reads. + +### Google Workspace — `gws` CLI +- Pre-authenticated for Gmail, Calendar, Drive, Docs, Sheets. +- Path: `/usr/local/bin/gws` +- Examples: + - `gws gmail users messages list --params '{"userId": "me", "maxResults": 5}'` + - `gws calendar events list --params '{"calendarId": "primary", "maxResults": 5}'` + - `gws drive files list --params '{"pageSize": 10}'` +- Use `gws schema ` to discover API parameters. + +### AI Coding Agents +- `claude` — Claude Code +- `opencode` — OpenCode (MCP config at `/sandbox/opencode.json`) + +### General Tools +- `python3`, `pip`, `uv` — Python with a virtualenv at `/sandbox/.venv` +- `node`, `npm` — Node.js 22 +- `git`, `curl` — pre-installed + +## Configuration +- Inference routes through the gateway proxy at `inference.local`. +- Model and provider configuration are set by the harness during sandbox creation. + +## Conventions - Working directory: `/sandbox` - Writable paths: `/sandbox`, `/tmp` -- Inference routes through the gateway proxy at `inference.local` -- Credentials are managed by OpenShell and cleaned up on sandbox exit -- Pre-installed tools: `python3`, `uv`, `node`, `npm`, `git`, `curl` -- MCP servers are configured in `.mcp.json` and connected automatically +- Network: Outbound allowed to Google APIs, GitHub, Atlassian, npm/pypi. +- Credentials are managed by the OpenShell provider system and cleaned up on sandbox exit. diff --git a/sandbox/startup.sh b/sandbox/startup.sh index a080227..fcc7f68 100644 --- a/sandbox/startup.sh +++ b/sandbox/startup.sh @@ -12,38 +12,4 @@ fi # ── Git auth ────────────────────────────────────────────────────────── gh auth setup-git 2>/dev/null || true -# ── Append provider-specific docs to CLAUDE.md ──────────────────────── -CLAUDE_MD="/sandbox/.claude/CLAUDE.md" - -if command -v gh &>/dev/null && gh auth status &>/dev/null 2>&1; then - cat >> "$CLAUDE_MD" <<'DOCS' - -## GitHub — `gh` CLI -- Pre-authenticated. Use `gh` for all GitHub operations. -- Examples: `gh repo clone`, `gh pr create`, `gh issue list`, `gh api` -DOCS -fi - -if [[ -n "${JIRA_URL:-}" ]]; then - cat >> "$CLAUDE_MD" <<'DOCS' - -## Jira & Confluence — mcp-atlassian MCP server -- Connected via the `atlassian` MCP server (credentials injected by provider). -- Use MCP tools for Jira searches, issue creation, comments, and Confluence page reads. -DOCS -fi - -if [[ -n "${GOOGLE_WORKSPACE_CLI_TOKEN:-}" ]]; then - cat >> "$CLAUDE_MD" <<'DOCS' - -## Google Workspace — `gws` CLI -- Pre-authenticated for Gmail, Calendar, Drive, Docs, Sheets. -- Use `gws schema ` to discover API parameters. -- Examples: - - `gws gmail users messages list --params '{"userId": "me", "maxResults": 5}'` - - `gws calendar events list --params '{"calendarId": "primary", "maxResults": 5}'` - - `gws drive files list --params '{"pageSize": 10}'` -DOCS -fi - echo "Setup complete." From 2463e00c13274b4567ae1c4738024cc3e119904b Mon Sep 17 00:00:00 2001 From: Robby Cochran Date: Sat, 13 Jun 2026 06:07:56 -0700 Subject: [PATCH 6/7] refactor: simplify sandbox CLAUDE.md to environment basics --- sandbox/CLAUDE.md | 48 ++++++++++++----------------------------------- 1 file changed, 12 insertions(+), 36 deletions(-) diff --git a/sandbox/CLAUDE.md b/sandbox/CLAUDE.md index 1829003..298d151 100644 --- a/sandbox/CLAUDE.md +++ b/sandbox/CLAUDE.md @@ -1,41 +1,17 @@ -# Sandbox Agent Instructions +# Sandbox Environment -You are running inside an OpenShell sandbox. Credentials are injected via the OpenShell provider system — they appear as environment variables automatically. +You are running inside an OpenShell sandbox. Credentials are injected via the OpenShell provider system and appear as environment variables automatically. -## Tools Available +## Environment -### GitHub — `gh` CLI -- Pre-authenticated. Use `gh` for all GitHub operations. -- Examples: `gh repo clone`, `gh pr create`, `gh issue list`, `gh api` - -### Jira & Confluence — mcp-atlassian MCP server -- Connected via the `atlassian` MCP server (credentials injected by provider). -- Use MCP tools for Jira searches, issue creation, comments, and Confluence page reads. - -### Google Workspace — `gws` CLI -- Pre-authenticated for Gmail, Calendar, Drive, Docs, Sheets. -- Path: `/usr/local/bin/gws` -- Examples: - - `gws gmail users messages list --params '{"userId": "me", "maxResults": 5}'` - - `gws calendar events list --params '{"calendarId": "primary", "maxResults": 5}'` - - `gws drive files list --params '{"pageSize": 10}'` -- Use `gws schema ` to discover API parameters. - -### AI Coding Agents -- `claude` — Claude Code -- `opencode` — OpenCode (MCP config at `/sandbox/opencode.json`) - -### General Tools -- `python3`, `pip`, `uv` — Python with a virtualenv at `/sandbox/.venv` -- `node`, `npm` — Node.js 22 -- `git`, `curl` — pre-installed - -## Configuration -- Inference routes through the gateway proxy at `inference.local`. -- Model and provider configuration are set by the harness during sandbox creation. - -## Conventions - Working directory: `/sandbox` - Writable paths: `/sandbox`, `/tmp` -- Network: Outbound allowed to Google APIs, GitHub, Atlassian, npm/pypi. -- Credentials are managed by the OpenShell provider system and cleaned up on sandbox exit. +- Inference routes through the gateway proxy at `inference.local` +- Credentials are managed by OpenShell and cleaned up on sandbox exit + +## Tools + +- `gh` — GitHub CLI (pre-authenticated) +- `gws` — Google Workspace CLI (when available). Use `gws schema ` to discover API parameters. +- MCP servers (Jira, Confluence) are configured in `.mcp.json` and connected automatically. +- `python3`, `uv`, `node`, `npm`, `git`, `curl` From f18363d3ef3ee087514a9333cfa8edb184b2ccc0 Mon Sep 17 00:00:00 2001 From: Robby Cochran Date: Sat, 13 Jun 2026 06:18:24 -0700 Subject: [PATCH 7/7] refactor: remove startup.sh, move gh auth to CLAUDE.md instructions startup.sh was sourcing a sandbox.env file that nothing generates and running gh auth setup-git which was duplicated in run.sh. Remove both. Agent now runs gh auth setup-git on demand when it needs git auth, guided by CLAUDE.md instructions. Env vars are injected via --env on sandbox create, no env file needed. --- internal/agent/agent.go | 2 -- internal/agent/agent_test.go | 3 --- sandbox/CLAUDE.md | 2 +- sandbox/Dockerfile | 10 +--------- sandbox/startup.sh | 15 --------------- 5 files changed, 2 insertions(+), 30 deletions(-) delete mode 100644 sandbox/startup.sh diff --git a/internal/agent/agent.go b/internal/agent/agent.go index a62dcc0..c446829 100644 --- a/internal/agent/agent.go +++ b/internal/agent/agent.go @@ -104,8 +104,6 @@ func (c *AgentConfig) BuildRunSh() string { b.WriteString("PAYLOAD_DIR=\"$(cd \"$(dirname \"$0\")\" && pwd)\"\n\n") b.WriteString("# Prepend payload bin to PATH\n") b.WriteString("export PATH=\"$PAYLOAD_DIR/bin:$PATH\"\n\n") - b.WriteString("# Git auth\n") - b.WriteString("gh auth setup-git 2>/dev/null || true\n\n") b.WriteString("# Validate entrypoint\n") entrypoint := c.EffectiveEntrypoint() epBin := strings.Fields(entrypoint)[0] diff --git a/internal/agent/agent_test.go b/internal/agent/agent_test.go index de662e2..0c068db 100644 --- a/internal/agent/agent_test.go +++ b/internal/agent/agent_test.go @@ -278,9 +278,6 @@ func TestBuildRunSh(t *testing.T) { if strings.Contains(runSh, "env.sh") { t.Error("run.sh should not source env.sh — env vars are injected via --env") } - if !strings.Contains(runSh, "gh auth setup-git") { - t.Error("missing gh auth setup-git") - } if !strings.Contains(runSh, `command -v "claude"`) { t.Error("missing entrypoint validation") } diff --git a/sandbox/CLAUDE.md b/sandbox/CLAUDE.md index 298d151..1755813 100644 --- a/sandbox/CLAUDE.md +++ b/sandbox/CLAUDE.md @@ -11,7 +11,7 @@ You are running inside an OpenShell sandbox. Credentials are injected via the Op ## Tools -- `gh` — GitHub CLI (pre-authenticated) +- `gh` — GitHub CLI (pre-authenticated). Run `gh auth setup-git` before any git clone/push/pull to configure git credential helper. - `gws` — Google Workspace CLI (when available). Use `gws schema ` to discover API parameters. - MCP servers (Jira, Confluence) are configured in `.mcp.json` and connected automatically. - `python3`, `uv`, `node`, `npm`, `git`, `curl` diff --git a/sandbox/Dockerfile b/sandbox/Dockerfile index 1c1a134..8404274 100644 --- a/sandbox/Dockerfile +++ b/sandbox/Dockerfile @@ -38,10 +38,6 @@ # GWS config could be provider-managed and the CLI could move to a # community sandbox. # -# startup.sh: Baked into the image to wire runtime credentials (Atlassian -# MCP config, GWS file placement). See sandbox.sh for the specific -# workarounds and their upstream tracking issues. - ARG BASE_IMAGE=ghcr.io/nvidia/openshell-community/sandboxes/base:latest FROM ${BASE_IMAGE} @@ -72,14 +68,10 @@ COPY claude.json /sandbox/.claude.json COPY mcp.json /sandbox/.mcp.json COPY opencode.json /sandbox/opencode.json -# Runtime script -COPY startup.sh /sandbox/startup.sh - # Harness config directory (populated at runtime via upload) RUN mkdir -p /sandbox/.config/openshell && chown sandbox:sandbox /sandbox/.config/openshell -RUN chmod +x /sandbox/startup.sh && \ - chown -R sandbox:sandbox /sandbox/.claude /sandbox/.claude.json /sandbox/.mcp.json /sandbox/opencode.json /sandbox/.config /sandbox/startup.sh +RUN chown -R sandbox:sandbox /sandbox/.claude /sandbox/.claude.json /sandbox/.mcp.json /sandbox/opencode.json /sandbox/.config USER sandbox diff --git a/sandbox/startup.sh b/sandbox/startup.sh deleted file mode 100644 index fcc7f68..0000000 --- a/sandbox/startup.sh +++ /dev/null @@ -1,15 +0,0 @@ -#!/usr/bin/env bash -# Runtime setup for the sandbox. Runs once at sandbox creation. -set -euo pipefail - -# ── Source env vars from agent config ───────────────────────────────── -OPENSHELL_DIR="/sandbox/.config/openshell" -if [[ -f "$OPENSHELL_DIR/sandbox.env" ]]; then - . "$OPENSHELL_DIR/sandbox.env" - cat "$OPENSHELL_DIR/sandbox.env" >> /sandbox/.bashrc -fi - -# ── Git auth ────────────────────────────────────────────────────────── -gh auth setup-git 2>/dev/null || true - -echo "Setup complete."