feat(doctor): repair sandbox images

src/commands/doctor.ts

@@ -1,8 +1,14 @@
+import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
 import { confirm, intro, note, outro } from "@clack/prompts";
 
+import {
+  DEFAULT_SANDBOX_BROWSER_IMAGE,
+  DEFAULT_SANDBOX_COMMON_IMAGE,
+  DEFAULT_SANDBOX_IMAGE,
+} from "../agents/sandbox.js";
 import { buildWorkspaceSkillStatus } from "../agents/skills-status.js";
 import type { ClawdbotConfig } from "../config/config.js";
 import {
@@ -20,6 +26,7 @@ import {
 } from "../daemon/legacy.js";
 import { resolveGatewayProgramArguments } from "../daemon/program-args.js";
 import { resolveGatewayService } from "../daemon/service.js";
+import { runCommandWithTimeout, runExec } from "../process/exec.js";
 import type { RuntimeEnv } from "../runtime.js";
 import { defaultRuntime } from "../runtime.js";
 import { resolveUserPath, sleep } from "../utils.js";
@@ -58,6 +65,249 @@ function replaceLegacyName(value: string | undefined): string | undefined {
   return replacedClawdis.replace(/clawd(?!bot)/g, "clawdbot");
 }
 
+function replaceModernName(value: string | undefined): string | undefined {
+  if (!value) return value;
+  if (!value.includes("clawdbot")) return value;
+  return value.replace(/clawdbot/g, "clawdis");
+}
+
+type SandboxScriptInfo = {
+  scriptPath: string;
+  cwd: string;
+};
+
+function resolveSandboxScript(scriptRel: string): SandboxScriptInfo | null {
+  const candidates = new Set<string>();
+  candidates.add(process.cwd());
+  const argv1 = process.argv[1];
+  if (argv1) {
+    const normalized = path.resolve(argv1);
+    candidates.add(path.resolve(path.dirname(normalized), ".."));
+    candidates.add(path.resolve(path.dirname(normalized)));
+  }
+
+  for (const root of candidates) {
+    const scriptPath = path.join(root, scriptRel);
+    if (fs.existsSync(scriptPath)) {
+      return { scriptPath, cwd: root };
+    }
+  }
+
+  return null;
+}
+
+async function runSandboxScript(
+  scriptRel: string,
+  runtime: RuntimeEnv,
+): Promise<boolean> {
+  const script = resolveSandboxScript(scriptRel);
+  if (!script) {
+    note(
+      `Unable to locate ${scriptRel}. Run it from the repo root.`,
+      "Sandbox",
+    );
+    return false;
+  }
+
+  runtime.log(`Running ${scriptRel}...`);
+  const result = await runCommandWithTimeout(["bash", script.scriptPath], {
+    timeoutMs: 20 * 60 * 1000,
+    cwd: script.cwd,
+  });
+  if (result.code !== 0) {
+    runtime.error(
+      `Failed running ${scriptRel}: ${
+        result.stderr.trim() || result.stdout.trim() || "unknown error"
+      }`,
+    );
+    return false;
+  }
+
+  runtime.log(`Completed ${scriptRel}.`);
+  return true;
+}
+
+async function isDockerAvailable(): Promise<boolean> {
+  try {
+    await runExec("docker", ["version", "--format", "{{.Server.Version}}"], {
+      timeoutMs: 5_000,
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function dockerImageExists(image: string): Promise<boolean> {
+  try {
+    await runExec("docker", ["image", "inspect", image], { timeoutMs: 5_000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function resolveSandboxDockerImage(cfg: ClawdbotConfig): string {
+  const image = cfg.agent?.sandbox?.docker?.image?.trim();
+  return image ? image : DEFAULT_SANDBOX_IMAGE;
+}
+
+function resolveSandboxBrowserImage(cfg: ClawdbotConfig): string {
+  const image = cfg.agent?.sandbox?.browser?.image?.trim();
+  return image ? image : DEFAULT_SANDBOX_BROWSER_IMAGE;
+}
+
+function updateSandboxDockerImage(
+  cfg: ClawdbotConfig,
+  image: string,
+): ClawdbotConfig {
+  return {
+    ...cfg,
+    agent: {
+      ...cfg.agent,
+      sandbox: {
+        ...cfg.agent?.sandbox,
+        docker: {
+          ...cfg.agent?.sandbox?.docker,
+          image,
+        },
+      },
+    },
+  };
+}
+
+function updateSandboxBrowserImage(
+  cfg: ClawdbotConfig,
+  image: string,
+): ClawdbotConfig {
+  return {
+    ...cfg,
+    agent: {
+      ...cfg.agent,
+      sandbox: {
+        ...cfg.agent?.sandbox,
+        browser: {
+          ...cfg.agent?.sandbox?.browser,
+          image,
+        },
+      },
+    },
+  };
+}
+
+type SandboxImageCheck = {
+  label: string;
+  image: string;
+  buildScript?: string;
+  updateConfig: (image: string) => void;
+};
+
+async function handleMissingSandboxImage(
+  params: SandboxImageCheck,
+  runtime: RuntimeEnv,
+) {
+  const exists = await dockerImageExists(params.image);
+  if (exists) return;
+
+  const buildHint = params.buildScript
+    ? `Build it with ${params.buildScript}.`
+    : "Build or pull it first.";
+  note(
+    `Sandbox ${params.label} image missing: ${params.image}. ${buildHint}`,
+    "Sandbox",
+  );
+
+  let built = false;
+  if (params.buildScript) {
+    const build = guardCancel(
+      await confirm({
+        message: `Build ${params.label} sandbox image now?`,
+        initialValue: true,
+      }),
+      runtime,
+    );
+    if (build) {
+      built = await runSandboxScript(params.buildScript, runtime);
+    }
+  }
+
+  if (built) return;
+
+  const legacyImage = replaceModernName(params.image);
+  if (!legacyImage || legacyImage === params.image) return;
+  const legacyExists = await dockerImageExists(legacyImage);
+  if (!legacyExists) return;
+
+  const fallback = guardCancel(
+    await confirm({
+      message: `Switch config to legacy image ${legacyImage}?`,
+      initialValue: false,
+    }),
+    runtime,
+  );
+  if (!fallback) return;
+
+  params.updateConfig(legacyImage);
+}
+
+async function maybeRepairSandboxImages(
+  cfg: ClawdbotConfig,
+  runtime: RuntimeEnv,
+): Promise<ClawdbotConfig> {
+  const sandbox = cfg.agent?.sandbox;
+  const mode = sandbox?.mode ?? "off";
+  if (!sandbox || mode === "off") return cfg;
+
+  const dockerAvailable = await isDockerAvailable();
+  if (!dockerAvailable) {
+    note("Docker not available; skipping sandbox image checks.", "Sandbox");
+    return cfg;
+  }
+
+  let next = cfg;
+  const changes: string[] = [];
+
+  const dockerImage = resolveSandboxDockerImage(cfg);
+  await handleMissingSandboxImage(
+    {
+      label: "base",
+      image: dockerImage,
+      buildScript:
+        dockerImage === DEFAULT_SANDBOX_COMMON_IMAGE
+          ? "scripts/sandbox-common-setup.sh"
+          : dockerImage === DEFAULT_SANDBOX_IMAGE
+            ? "scripts/sandbox-setup.sh"
+            : undefined,
+      updateConfig: (image) => {
+        next = updateSandboxDockerImage(next, image);
+        changes.push(`Updated agent.sandbox.docker.image → ${image}`);
+      },
+    },
+    runtime,
+  );
+
+  if (sandbox.browser?.enabled) {
+    await handleMissingSandboxImage(
+      {
+        label: "browser",
+        image: resolveSandboxBrowserImage(cfg),
+        buildScript: "scripts/sandbox-browser-setup.sh",
+        updateConfig: (image) => {
+          next = updateSandboxBrowserImage(next, image);
+          changes.push(`Updated agent.sandbox.browser.image → ${image}`);
+        },
+      },
+      runtime,
+    );
+  }
+
+  if (changes.length > 0) {
+    note(changes.join("\n"), "Doctor changes");
+  }
+
+  return next;
+}
+
 function normalizeLegacyConfigValues(cfg: ClawdbotConfig): {
   config: ClawdbotConfig;
   changes: string[];
@@ -345,6 +595,8 @@ export async function doctorCommand(runtime: RuntimeEnv = defaultRuntime) {
     cfg = normalized.config;
   }
 
+  cfg = await maybeRepairSandboxImages(cfg, runtime);
+
   await maybeMigrateLegacyGatewayService(cfg, runtime);
 
   const workspaceDir = resolveUserPath(