The images resolve the whole workspace graph before cargo fetch, so
every member manifest has to be in the build context by then, and
the copied list had fallen six crates behind the workspace: the
backend split added sandbox-local, sandbox-lxd, and sandbox-server,
and the cloud frontends added cloud-agent, cloudflare-code, and
vercel-agent. rhema-code path-depends on the sandbox backends, so
the claw image was the first to break — the fetch died reading the
lxd manifest.
privacy.rs bound the opened handle in a name only the unix build
used, so `-D warnings` failed the wasm target; the bind is now
`_file` and the unix branch uses it.
The docker images resolve the whole workspace manifest graph before
`cargo fetch`, so they now copy the tools contract with its workspace
root plus the sandbox manifests rhema-code path-depends on, and the
stub loop covers tools/*/ too.
The seam crate carried every backend behind features — local, client,
server — so a wasm worker linked the axum daemon and a host daemon
linked reqwest it never dialed. The family mirrors the provider family
now, as the design always said it would: rhema-sandbox keeps the
contract, the ShellSandbox adapter, the wire protocol, the seeding
helper, the scripted mock, and — behind the new `spawn` feature — the
process family's shared machinery (exec_util, fsroot); the backends
are sibling crates, rhema-sandbox-local, -docker, -ssh, each dependent
only on the seam; the HTTPS client is rhema-sandbox-http (reqwest
behind its `native` feature, off on wasm, whose worker brings its own
HttpTransport over host fetch); the daemon is rhema-sandbox-server,
and the rhema-sandboxd binary moves with it.
Consumers rewire, semantics don't: rhema-code names its backends
directly; rhema-cloud-agent keeps its transitional re-exports;
rhema-cloudflare-code and rhema-vercel-agent take the HTTP client
reqwest-free and native respectively; the sandboxd image builds
-p rhema-sandbox-server. Cargo paths only — no behavior, no protocol,
no spec change.
A multi-stage build shipping the daemon: bash, git, and a CA store in
the runtime so git and tarball seeds work; the base directory is a
volume, the token is a flag with no env default, the port must be
passed because the binary defaults to an OS pick. Smoke-tested against
a real daemon: healthz auth, exec, put/get, session dirs under the
mounted base.
vhaudiquet