diff --git a/src/agents/sandbox/browser.ts b/src/agents/sandbox/browser.ts
index 4a6648c7f..827561d54 100644
--- a/src/agents/sandbox/browser.ts
+++ b/src/agents/sandbox/browser.ts
@@ -1,23 +1,32 @@
-import dns from "node:dns/promises";
-import { startBrowserBridgeServer, stopBrowserBridgeServer } from "../../browser/bridge-server.js";
-import { type ResolvedBrowserConfig, resolveProfile } from "../../browser/config.js";
+import dns from "node:dns/promises"
+import {
+  startBrowserBridgeServer,
+  stopBrowserBridgeServer,
+} from "../../browser/bridge-server.js"
+import {
+  type ResolvedBrowserConfig,
+  resolveProfile,
+} from "../../browser/config.js"
 import {
   DEFAULT_BROWSER_EVALUATE_ENABLED,
   DEFAULT_CLAWD_BROWSER_COLOR,
-} from "../../browser/constants.js";
-import { BROWSER_BRIDGES } from "./browser-bridges.js";
-import { DEFAULT_SANDBOX_BROWSER_IMAGE, SANDBOX_AGENT_WORKSPACE_MOUNT } from "./constants.js";
+} from "../../browser/constants.js"
+import { BROWSER_BRIDGES } from "./browser-bridges.js"
+import {
+  DEFAULT_SANDBOX_BROWSER_IMAGE,
+  SANDBOX_AGENT_WORKSPACE_MOUNT,
+} from "./constants.js"
 import {
   buildSandboxCreateArgs,
   dockerContainerState,
   execDocker,
   readDockerPort,
   remapPathForDinD,
-} from "./docker.js";
-import { updateBrowserRegistry } from "./registry.js";
-import { slugifySessionKey } from "./shared.js";
-import { isToolAllowed } from "./tool-policy.js";
-import type { SandboxBrowserContext, SandboxConfig } from "./types.js";
+} from "./docker.js"
+import { updateBrowserRegistry } from "./registry.js"
+import { slugifySessionKey } from "./shared.js"
+import { isToolAllowed } from "./tool-policy.js"
+import type { SandboxBrowserContext, SandboxConfig } from "./types.js"
 
 /**
  * Resolve a hostname to an IPv4 address for CDP connections.
@@ -27,57 +36,59 @@ import type { SandboxBrowserContext, SandboxConfig } from "./types.js";
 async function resolveHostToIp(host: string): Promise<string> {
   // If already an IP address (v4 or v6), return as-is
   if (/^(?:\d{1,3}\.){3}\d{1,3}$/.test(host) || host.includes(":")) {
-    return host;
+    return host
   }
   // localhost is special-cased by Chrome
   if (host === "localhost") {
-    return host;
+    return host
   }
   try {
-    const result = await dns.lookup(host, { family: 4 });
-    return result.address;
+    const result = await dns.lookup(host, { family: 4 })
+    return result.address
   } catch {
     // If DNS resolution fails, return original host and let caller handle the error
-    return host;
+    return host
   }
 }
 
 async function waitForSandboxCdp(params: {
-  cdpHost: string;
-  cdpPort: number;
-  timeoutMs: number;
+  cdpHost: string
+  cdpPort: number
+  timeoutMs: number
 }): Promise<boolean> {
-  const deadline = Date.now() + Math.max(0, params.timeoutMs);
+  const deadline = Date.now() + Math.max(0, params.timeoutMs)
   // Resolve hostname to IP for Chrome CDP compatibility
-  const resolvedHost = await resolveHostToIp(params.cdpHost);
-  const url = `http://${resolvedHost}:${params.cdpPort}/json/version`;
+  const resolvedHost = await resolveHostToIp(params.cdpHost)
+  const url = `http://${resolvedHost}:${params.cdpPort}/json/version`
   while (Date.now() < deadline) {
     try {
-      const ctrl = new AbortController();
-      const t = setTimeout(() => ctrl.abort(), 1000);
+      const ctrl = new AbortController()
+      const t = setTimeout(() => ctrl.abort(), 1000)
       try {
-        const res = await fetch(url, { signal: ctrl.signal });
-        if (res.ok) return true;
+        const res = await fetch(url, { signal: ctrl.signal })
+        if (res.ok) return true
       } finally {
-        clearTimeout(t);
+        clearTimeout(t)
       }
     } catch {
       // ignore
     }
-    await new Promise((r) => setTimeout(r, 150));
+    await new Promise((r) => setTimeout(r, 150))
   }
-  return false;
+  return false
 }
 
 function buildSandboxBrowserResolvedConfig(params: {
-  controlPort: number;
-  cdpHost: string;
-  cdpPort: number;
-  headless: boolean;
-  evaluateEnabled: boolean;
+  controlPort: number
+  cdpHost: string
+  cdpPort: number
+  headless: boolean
+  evaluateEnabled: boolean
 }): ResolvedBrowserConfig {
   const isLoopback =
-    params.cdpHost === "127.0.0.1" || params.cdpHost === "localhost" || params.cdpHost === "::1";
+    params.cdpHost === "127.0.0.1" ||
+    params.cdpHost === "localhost" ||
+    params.cdpHost === "::1"
   return {
     enabled: true,
     evaluateEnabled: params.evaluateEnabled,
@@ -96,120 +107,150 @@ function buildSandboxBrowserResolvedConfig(params: {
     profiles: {
       clawd: { cdpPort: params.cdpPort, color: DEFAULT_CLAWD_BROWSER_COLOR },
     },
-  };
+  }
 }
 
 async function ensureSandboxBrowserImage(image: string) {
   const result = await execDocker(["image", "inspect", image], {
     allowFailure: true,
-  });
-  if (result.code === 0) return;
+  })
+  if (result.code === 0) return
   throw new Error(
     `Sandbox browser image not found: ${image}. Build it with scripts/sandbox-browser-setup.sh.`,
-  );
+  )
 }
 
 export async function ensureSandboxBrowser(params: {
-  scopeKey: string;
-  workspaceDir: string;
-  agentWorkspaceDir: string;
-  cfg: SandboxConfig;
-  evaluateEnabled?: boolean;
+  scopeKey: string
+  workspaceDir: string
+  agentWorkspaceDir: string
+  cfg: SandboxConfig
+  evaluateEnabled?: boolean
 }): Promise<SandboxBrowserContext | null> {
-  if (!params.cfg.browser.enabled) return null;
-  if (!isToolAllowed(params.cfg.tools, "browser")) return null;
+  if (!params.cfg.browser.enabled) return null
+  if (!isToolAllowed(params.cfg.tools, "browser")) return null
 
-  const slug = params.cfg.scope === "shared" ? "shared" : slugifySessionKey(params.scopeKey);
-  const name = `${params.cfg.browser.containerPrefix}${slug}`;
-  const containerName = name.slice(0, 63);
-  const state = await dockerContainerState(containerName);
+  const slug =
+    params.cfg.scope === "shared"
+      ? "shared"
+      : slugifySessionKey(params.scopeKey)
+  const name = `${params.cfg.browser.containerPrefix}${slug}`
+  const containerName = name.slice(0, 63)
+  const state = await dockerContainerState(containerName)
   if (!state.exists) {
-    await ensureSandboxBrowserImage(params.cfg.browser.image ?? DEFAULT_SANDBOX_BROWSER_IMAGE);
+    await ensureSandboxBrowserImage(
+      params.cfg.browser.image ?? DEFAULT_SANDBOX_BROWSER_IMAGE,
+    )
     const args = buildSandboxCreateArgs({
       name: containerName,
       cfg: params.cfg.docker,
       scopeKey: params.scopeKey,
       labels: { "moltbot.sandboxBrowser": "1" },
-    });
+    })
     const mainMountSuffix =
-      params.cfg.workspaceAccess === "ro" && params.workspaceDir === params.agentWorkspaceDir
+      params.cfg.workspaceAccess === "ro" &&
+      params.workspaceDir === params.agentWorkspaceDir
         ? ":ro"
-        : "";
+        : ""
     // Remap paths for Docker-in-Docker scenarios
-    const hostWorkspaceDir = remapPathForDinD(params.workspaceDir);
-    args.push("-v", `${hostWorkspaceDir}:${params.cfg.docker.workdir}${mainMountSuffix}`);
-    if (params.cfg.workspaceAccess !== "none" && params.workspaceDir !== params.agentWorkspaceDir) {
-      const agentMountSuffix = params.cfg.workspaceAccess === "ro" ? ":ro" : "";
-      const hostAgentWorkspaceDir = remapPathForDinD(params.agentWorkspaceDir);
+    const hostWorkspaceDir = remapPathForDinD(params.workspaceDir)
+    args.push(
+      "-v",
+      `${hostWorkspaceDir}:${params.cfg.docker.workdir}${mainMountSuffix}`,
+    )
+    if (
+      params.cfg.workspaceAccess !== "none" &&
+      params.workspaceDir !== params.agentWorkspaceDir
+    ) {
+      const agentMountSuffix = params.cfg.workspaceAccess === "ro" ? ":ro" : ""
+      const hostAgentWorkspaceDir = remapPathForDinD(params.agentWorkspaceDir)
       args.push(
         "-v",
         `${hostAgentWorkspaceDir}:${SANDBOX_AGENT_WORKSPACE_MOUNT}${agentMountSuffix}`,
-      );
+      )
     }
-    args.push("-p", `127.0.0.1::${params.cfg.browser.cdpPort}`);
+    args.push("-p", `127.0.0.1::${params.cfg.browser.cdpPort}`)
     if (params.cfg.browser.enableNoVnc && !params.cfg.browser.headless) {
-      args.push("-p", `127.0.0.1::${params.cfg.browser.noVncPort}`);
+      args.push("-p", `127.0.0.1::${params.cfg.browser.noVncPort}`)
     }
-    args.push("-e", `CLAWDBOT_BROWSER_HEADLESS=${params.cfg.browser.headless ? "1" : "0"}`);
-    args.push("-e", `CLAWDBOT_BROWSER_ENABLE_NOVNC=${params.cfg.browser.enableNoVnc ? "1" : "0"}`);
-    args.push("-e", `CLAWDBOT_BROWSER_CDP_PORT=${params.cfg.browser.cdpPort}`);
-    args.push("-e", `CLAWDBOT_BROWSER_VNC_PORT=${params.cfg.browser.vncPort}`);
-    args.push("-e", `CLAWDBOT_BROWSER_NOVNC_PORT=${params.cfg.browser.noVncPort}`);
-    args.push(params.cfg.browser.image);
-    await execDocker(args);
-    await execDocker(["start", containerName]);
+    args.push(
+      "-e",
+      `CLAWDBOT_BROWSER_HEADLESS=${params.cfg.browser.headless ? "1" : "0"}`,
+    )
+    args.push(
+      "-e",
+      `CLAWDBOT_BROWSER_ENABLE_NOVNC=${
+        params.cfg.browser.enableNoVnc ? "1" : "0"
+      }`,
+    )
+    args.push("-e", `CLAWDBOT_BROWSER_CDP_PORT=${params.cfg.browser.cdpPort}`)
+    args.push("-e", `CLAWDBOT_BROWSER_VNC_PORT=${params.cfg.browser.vncPort}`)
+    args.push(
+      "-e",
+      `CLAWDBOT_BROWSER_NOVNC_PORT=${params.cfg.browser.noVncPort}`,
+    )
+    args.push(params.cfg.browser.image)
+    await execDocker(args)
+    await execDocker(["start", containerName])
   } else if (!state.running) {
-    await execDocker(["start", containerName]);
+    await execDocker(["start", containerName])
   }
 
-  const mappedCdp = await readDockerPort(containerName, params.cfg.browser.cdpPort);
+  const mappedCdp = await readDockerPort(
+    containerName,
+    params.cfg.browser.cdpPort,
+  )
   if (!mappedCdp) {
-    throw new Error(`Failed to resolve CDP port mapping for ${containerName}.`);
+    throw new Error(`Failed to resolve CDP port mapping for ${containerName}.`)
   }
 
   const mappedNoVnc =
     params.cfg.browser.enableNoVnc && !params.cfg.browser.headless
       ? await readDockerPort(containerName, params.cfg.browser.noVncPort)
-      : null;
+      : null
 
-  const existing = BROWSER_BRIDGES.get(params.scopeKey);
-  const existingProfile = existing ? resolveProfile(existing.bridge.state.resolved, "clawd") : null;
+  const existing = BROWSER_BRIDGES.get(params.scopeKey)
+  const existingProfile = existing
+    ? resolveProfile(existing.bridge.state.resolved, "clawd")
+    : null
   const shouldReuse =
-    existing && existing.containerName === containerName && existingProfile?.cdpPort === mappedCdp;
+    existing &&
+    existing.containerName === containerName &&
+    existingProfile?.cdpPort === mappedCdp
   if (existing && !shouldReuse) {
-    await stopBrowserBridgeServer(existing.bridge.server).catch(() => undefined);
-    BROWSER_BRIDGES.delete(params.scopeKey);
+    await stopBrowserBridgeServer(existing.bridge.server).catch(() => undefined)
+    BROWSER_BRIDGES.delete(params.scopeKey)
   }
 
   const bridge = (() => {
-    if (shouldReuse && existing) return existing.bridge;
-    return null;
-  })();
+    if (shouldReuse && existing) return existing.bridge
+    return null
+  })()
 
   const ensureBridge = async () => {
-    if (bridge) return bridge;
+    if (bridge) return bridge
 
     // Resolve hostname to IP for Chrome CDP compatibility
-    const resolvedCdpHost = await resolveHostToIp(params.cfg.browser.cdpHost);
+    const resolvedCdpHost = await resolveHostToIp(params.cfg.browser.cdpHost)
 
     const onEnsureAttachTarget = params.cfg.browser.autoStart
       ? async () => {
-          const state = await dockerContainerState(containerName);
+          const state = await dockerContainerState(containerName)
           if (state.exists && !state.running) {
-            await execDocker(["start", containerName]);
+            await execDocker(["start", containerName])
           }
           const ok = await waitForSandboxCdp({
             cdpHost: resolvedCdpHost,
             cdpPort: mappedCdp,
             timeoutMs: params.cfg.browser.autoStartTimeoutMs,
-          });
+          })
           if (!ok) {
             throw new Error(
               `Sandbox browser CDP did not become reachable on ${resolvedCdpHost}:${mappedCdp} within ${params.cfg.browser.autoStartTimeoutMs}ms.`,
-            );
+            )
           }
         }
-      : undefined;
+      : undefined
 
     return await startBrowserBridgeServer({
       resolved: buildSandboxBrowserResolvedConfig({
@@ -217,21 +258,22 @@ export async function ensureSandboxBrowser(params: {
         cdpHost: resolvedCdpHost,
         cdpPort: mappedCdp,
         headless: params.cfg.browser.headless,
-        evaluateEnabled: params.evaluateEnabled ?? DEFAULT_BROWSER_EVALUATE_ENABLED,
+        evaluateEnabled:
+          params.evaluateEnabled ?? DEFAULT_BROWSER_EVALUATE_ENABLED,
       }),
       onEnsureAttachTarget,
-    });
-  };
+    })
+  }
 
-  const resolvedBridge = await ensureBridge();
+  const resolvedBridge = await ensureBridge()
   if (!shouldReuse) {
     BROWSER_BRIDGES.set(params.scopeKey, {
       bridge: resolvedBridge,
       containerName,
-    });
+    })
   }
 
-  const now = Date.now();
+  const now = Date.now()
   await updateBrowserRegistry({
     containerName,
     sessionKey: params.scopeKey,
@@ -240,16 +282,18 @@ export async function ensureSandboxBrowser(params: {
     image: params.cfg.browser.image,
     cdpPort: mappedCdp,
     noVncPort: mappedNoVnc ?? undefined,
-  });
+  })
 
   const noVncUrl =
-    mappedNoVnc && params.cfg.browser.enableNoVnc && !params.cfg.browser.headless
+    mappedNoVnc &&
+    params.cfg.browser.enableNoVnc &&
+    !params.cfg.browser.headless
       ? `http://${params.cfg.browser.cdpHost}:${mappedNoVnc}/vnc.html?autoconnect=1&resize=remote`
-      : undefined;
+      : undefined
 
   return {
     bridgeUrl: resolvedBridge.baseUrl,
     noVncUrl,
     containerName,
-  };
+  }
 }
diff --git a/src/agents/sandbox/docker.ts b/src/agents/sandbox/docker.ts
index 596b6ccc1..84738fede 100644
--- a/src/agents/sandbox/docker.ts
+++ b/src/agents/sandbox/docker.ts
@@ -1,13 +1,24 @@
-import os from "node:os";
-import { spawn } from "node:child_process";
+import os from "node:os"
+import { spawn } from "node:child_process"
 
-import { defaultRuntime } from "../../runtime.js";
-import { formatCliCommand } from "../../cli/command-format.js";
-import { DEFAULT_SANDBOX_IMAGE, SANDBOX_AGENT_WORKSPACE_MOUNT } from "./constants.js";
-import { readRegistry, updateRegistry } from "./registry.js";
-import { computeSandboxConfigHash } from "./config-hash.js";
-import { resolveSandboxAgentId, resolveSandboxScopeKey, slugifySessionKey } from "./shared.js";
-import type { SandboxConfig, SandboxDockerConfig, SandboxWorkspaceAccess } from "./types.js";
+import { defaultRuntime } from "../../runtime.js"
+import { formatCliCommand } from "../../cli/command-format.js"
+import {
+  DEFAULT_SANDBOX_IMAGE,
+  SANDBOX_AGENT_WORKSPACE_MOUNT,
+} from "./constants.js"
+import { readRegistry, updateRegistry } from "./registry.js"
+import { computeSandboxConfigHash } from "./config-hash.js"
+import {
+  resolveSandboxAgentId,
+  resolveSandboxScopeKey,
+  slugifySessionKey,
+} from "./shared.js"
+import type {
+  SandboxConfig,
+  SandboxDockerConfig,
+  SandboxWorkspaceAccess,
+} from "./types.js"
 
 /**
  * For Docker-in-Docker scenarios, remap container paths to host paths.
@@ -19,305 +30,334 @@ import type { SandboxConfig, SandboxDockerConfig, SandboxWorkspaceAccess } from
  * - CLAWDBOT_SANDBOX_HOST_WORKSPACE_DIR: host path for ~/clawd
  */
 export function remapPathForDinD(containerPath: string): string {
-  const hostConfigDir = process.env.CLAWDBOT_SANDBOX_HOST_CONFIG_DIR;
-  const hostWorkspaceDir = process.env.CLAWDBOT_SANDBOX_HOST_WORKSPACE_DIR;
+  const hostConfigDir = process.env.CLAWDBOT_SANDBOX_HOST_CONFIG_DIR
+  const hostWorkspaceDir = process.env.CLAWDBOT_SANDBOX_HOST_WORKSPACE_DIR
 
   // Both must be set for DinD mode, or neither (partial config is invalid)
   if (!hostConfigDir || !hostWorkspaceDir) {
-    return containerPath;
+    return containerPath
   }
 
-  const home = os.homedir();
-  const containerConfigDir = `${home}/.clawdbot`;
-  const containerWorkspaceDir = `${home}/clawd`;
+  const home = os.homedir()
+  const containerConfigDir = `${home}/.clawdbot`
+  const containerWorkspaceDir = `${home}/clawd`
 
   // Remap config directory paths
   if (hostConfigDir && containerPath.startsWith(containerConfigDir)) {
-    return containerPath.replace(containerConfigDir, hostConfigDir);
+    return containerPath.replace(containerConfigDir, hostConfigDir)
   }
 
   // Remap workspace directory paths
   if (hostWorkspaceDir && containerPath.startsWith(containerWorkspaceDir)) {
-    return containerPath.replace(containerWorkspaceDir, hostWorkspaceDir);
+    return containerPath.replace(containerWorkspaceDir, hostWorkspaceDir)
   }
 
-  return containerPath;
+  return containerPath
 }
 
-const HOT_CONTAINER_WINDOW_MS = 5 * 60 * 1000;
+const HOT_CONTAINER_WINDOW_MS = 5 * 60 * 1000
 
 export function execDocker(args: string[], opts?: { allowFailure?: boolean }) {
-  return new Promise<{ stdout: string; stderr: string; code: number }>((resolve, reject) => {
-    const child = spawn("docker", args, {
-      stdio: ["ignore", "pipe", "pipe"],
-    });
-    let stdout = "";
-    let stderr = "";
-    child.stdout?.on("data", (chunk) => {
-      stdout += chunk.toString();
-    });
-    child.stderr?.on("data", (chunk) => {
-      stderr += chunk.toString();
-    });
-    child.on("close", (code) => {
-      const exitCode = code ?? 0;
-      if (exitCode !== 0 && !opts?.allowFailure) {
-        reject(new Error(stderr.trim() || `docker ${args.join(" ")} failed`));
-        return;
-      }
-      resolve({ stdout, stderr, code: exitCode });
-    });
-  });
+  return new Promise<{ stdout: string stderr: string code: number }>(
+    (resolve, reject) => {
+      const child = spawn("docker", args, {
+        stdio: ["ignore", "pipe", "pipe"],
+      })
+      let stdout = ""
+      let stderr = ""
+      child.stdout?.on("data", (chunk) => {
+        stdout += chunk.toString()
+      })
+      child.stderr?.on("data", (chunk) => {
+        stderr += chunk.toString()
+      })
+      child.on("close", (code) => {
+        const exitCode = code ?? 0
+        if (exitCode !== 0 && !opts?.allowFailure) {
+          reject(new Error(stderr.trim() || `docker ${args.join(" ")} failed`))
+          return
+        }
+        resolve({ stdout, stderr, code: exitCode })
+      })
+    },
+  )
 }
 
 export async function readDockerPort(containerName: string, port: number) {
   const result = await execDocker(["port", containerName, `${port}/tcp`], {
     allowFailure: true,
-  });
-  if (result.code !== 0) return null;
-  const line = result.stdout.trim().split(/\r?\n/)[0] ?? "";
-  const match = line.match(/:(\d+)\s*$/);
-  if (!match) return null;
-  const mapped = Number.parseInt(match[1] ?? "", 10);
-  return Number.isFinite(mapped) ? mapped : null;
+  })
+  if (result.code !== 0) return null
+  const line = result.stdout.trim().split(/\r?\n/)[0] ?? ""
+  const match = line.match(/:(\d+)\s*$/)
+  if (!match) return null
+  const mapped = Number.parseInt(match[1] ?? "", 10)
+  return Number.isFinite(mapped) ? mapped : null
 }
 
 async function dockerImageExists(image: string) {
   const result = await execDocker(["image", "inspect", image], {
     allowFailure: true,
-  });
-  if (result.code === 0) return true;
-  const stderr = result.stderr.trim();
+  })
+  if (result.code === 0) return true
+  const stderr = result.stderr.trim()
   if (stderr.includes("No such image")) {
-    return false;
+    return false
   }
-  throw new Error(`Failed to inspect sandbox image: ${stderr}`);
+  throw new Error(`Failed to inspect sandbox image: ${stderr}`)
 }
 
 export async function ensureDockerImage(image: string) {
-  const exists = await dockerImageExists(image);
-  if (exists) return;
+  const exists = await dockerImageExists(image)
+  if (exists) return
   if (image === DEFAULT_SANDBOX_IMAGE) {
-    await execDocker(["pull", "debian:bookworm-slim"]);
-    await execDocker(["tag", "debian:bookworm-slim", DEFAULT_SANDBOX_IMAGE]);
-    return;
+    await execDocker(["pull", "debian:bookworm-slim"])
+    await execDocker(["tag", "debian:bookworm-slim", DEFAULT_SANDBOX_IMAGE])
+    return
   }
-  throw new Error(`Sandbox image not found: ${image}. Build or pull it first.`);
+  throw new Error(`Sandbox image not found: ${image}. Build or pull it first.`)
 }
 
 export async function dockerContainerState(name: string) {
-  const result = await execDocker(["inspect", "-f", "{{.State.Running}}", name], {
-    allowFailure: true,
-  });
-  if (result.code !== 0) return { exists: false, running: false };
-  return { exists: true, running: result.stdout.trim() === "true" };
+  const result = await execDocker(
+    ["inspect", "-f", "{{.State.Running}}", name],
+    {
+      allowFailure: true,
+    },
+  )
+  if (result.code !== 0) return { exists: false, running: false }
+  return { exists: true, running: result.stdout.trim() === "true" }
 }
 
 function normalizeDockerLimit(value?: string | number) {
-  if (value === undefined || value === null) return undefined;
+  if (value === undefined || value === null) return undefined
   if (typeof value === "number") {
-    return Number.isFinite(value) ? String(value) : undefined;
+    return Number.isFinite(value) ? String(value) : undefined
   }
-  const trimmed = value.trim();
-  return trimmed ? trimmed : undefined;
+  const trimmed = value.trim()
+  return trimmed ? trimmed : undefined
 }
 
 function formatUlimitValue(
   name: string,
-  value: string | number | { soft?: number; hard?: number },
+  value: string | number | { soft?: number hard?: number },
 ) {
-  if (!name.trim()) return null;
+  if (!name.trim()) return null
   if (typeof value === "number" || typeof value === "string") {
-    const raw = String(value).trim();
-    return raw ? `${name}=${raw}` : null;
+    const raw = String(value).trim()
+    return raw ? `${name}=${raw}` : null
   }
-  const soft = typeof value.soft === "number" ? Math.max(0, value.soft) : undefined;
-  const hard = typeof value.hard === "number" ? Math.max(0, value.hard) : undefined;
-  if (soft === undefined && hard === undefined) return null;
-  if (soft === undefined) return `${name}=${hard}`;
-  if (hard === undefined) return `${name}=${soft}`;
-  return `${name}=${soft}:${hard}`;
+  const soft =
+    typeof value.soft === "number" ? Math.max(0, value.soft) : undefined
+  const hard =
+    typeof value.hard === "number" ? Math.max(0, value.hard) : undefined
+  if (soft === undefined && hard === undefined) return null
+  if (soft === undefined) return `${name}=${hard}`
+  if (hard === undefined) return `${name}=${soft}`
+  return `${name}=${soft}:${hard}`
 }
 
 export function buildSandboxCreateArgs(params: {
-  name: string;
-  cfg: SandboxDockerConfig;
-  scopeKey: string;
-  createdAtMs?: number;
-  labels?: Record<string, string>;
-  configHash?: string;
+  name: string
+  cfg: SandboxDockerConfig
+  scopeKey: string
+  createdAtMs?: number
+  labels?: Record<string, string>
+  configHash?: string
 }) {
-  const createdAtMs = params.createdAtMs ?? Date.now();
-  const args = ["create", "--name", params.name];
-  args.push("--label", "moltbot.sandbox=1");
-  args.push("--label", `moltbot.sessionKey=${params.scopeKey}`);
-  args.push("--label", `moltbot.createdAtMs=${createdAtMs}`);
+  const createdAtMs = params.createdAtMs ?? Date.now()
+  const args = ["create", "--name", params.name]
+  args.push("--label", "moltbot.sandbox=1")
+  args.push("--label", `moltbot.sessionKey=${params.scopeKey}`)
+  args.push("--label", `moltbot.createdAtMs=${createdAtMs}`)
   if (params.configHash) {
-    args.push("--label", `moltbot.configHash=${params.configHash}`);
+    args.push("--label", `moltbot.configHash=${params.configHash}`)
   }
   for (const [key, value] of Object.entries(params.labels ?? {})) {
-    if (key && value) args.push("--label", `${key}=${value}`);
+    if (key && value) args.push("--label", `${key}=${value}`)
   }
-  if (params.cfg.readOnlyRoot) args.push("--read-only");
+  if (params.cfg.readOnlyRoot) args.push("--read-only")
   for (const entry of params.cfg.tmpfs) {
-    args.push("--tmpfs", entry);
+    args.push("--tmpfs", entry)
   }
-  if (params.cfg.network) args.push("--network", params.cfg.network);
-  if (params.cfg.user) args.push("--user", params.cfg.user);
+  if (params.cfg.network) args.push("--network", params.cfg.network)
+  if (params.cfg.user) args.push("--user", params.cfg.user)
   for (const cap of params.cfg.capDrop) {
-    args.push("--cap-drop", cap);
+    args.push("--cap-drop", cap)
   }
-  args.push("--security-opt", "no-new-privileges");
+  args.push("--security-opt", "no-new-privileges")
   if (params.cfg.seccompProfile) {
-    args.push("--security-opt", `seccomp=${params.cfg.seccompProfile}`);
+    args.push("--security-opt", `seccomp=${params.cfg.seccompProfile}`)
   }
   if (params.cfg.apparmorProfile) {
-    args.push("--security-opt", `apparmor=${params.cfg.apparmorProfile}`);
+    args.push("--security-opt", `apparmor=${params.cfg.apparmorProfile}`)
   }
   for (const entry of params.cfg.dns ?? []) {
-    if (entry.trim()) args.push("--dns", entry);
+    if (entry.trim()) args.push("--dns", entry)
   }
   for (const entry of params.cfg.extraHosts ?? []) {
-    if (entry.trim()) args.push("--add-host", entry);
+    if (entry.trim()) args.push("--add-host", entry)
   }
   if (typeof params.cfg.pidsLimit === "number" && params.cfg.pidsLimit > 0) {
-    args.push("--pids-limit", String(params.cfg.pidsLimit));
+    args.push("--pids-limit", String(params.cfg.pidsLimit))
   }
-  const memory = normalizeDockerLimit(params.cfg.memory);
-  if (memory) args.push("--memory", memory);
-  const memorySwap = normalizeDockerLimit(params.cfg.memorySwap);
-  if (memorySwap) args.push("--memory-swap", memorySwap);
+  const memory = normalizeDockerLimit(params.cfg.memory)
+  if (memory) args.push("--memory", memory)
+  const memorySwap = normalizeDockerLimit(params.cfg.memorySwap)
+  if (memorySwap) args.push("--memory-swap", memorySwap)
   if (typeof params.cfg.cpus === "number" && params.cfg.cpus > 0) {
-    args.push("--cpus", String(params.cfg.cpus));
+    args.push("--cpus", String(params.cfg.cpus))
   }
-  for (const [name, value] of Object.entries(params.cfg.ulimits ?? {}) as Array<
-    [string, string | number | { soft?: number; hard?: number }]
-  >) {
-    const formatted = formatUlimitValue(name, value);
-    if (formatted) args.push("--ulimit", formatted);
+  for (const [name, value] of Object.entries(
+    params.cfg.ulimits ?? {},
+  ) as Array<[string, string | number | { soft?: number hard?: number }]>) {
+    const formatted = formatUlimitValue(name, value)
+    if (formatted) args.push("--ulimit", formatted)
   }
   if (params.cfg.binds?.length) {
     for (const bind of params.cfg.binds) {
-      args.push("-v", bind);
+      args.push("-v", bind)
     }
   }
-  return args;
+  return args
 }
 
 async function createSandboxContainer(params: {
-  name: string;
-  cfg: SandboxDockerConfig;
-  workspaceDir: string;
-  workspaceAccess: SandboxWorkspaceAccess;
-  agentWorkspaceDir: string;
-  scopeKey: string;
-  configHash?: string;
+  name: string
+  cfg: SandboxDockerConfig
+  workspaceDir: string
+  workspaceAccess: SandboxWorkspaceAccess
+  agentWorkspaceDir: string
+  scopeKey: string
+  configHash?: string
 }) {
-  const { name, cfg, workspaceDir, scopeKey } = params;
-  await ensureDockerImage(cfg.image);
+  const { name, cfg, workspaceDir, scopeKey } = params
+  await ensureDockerImage(cfg.image)
 
   const args = buildSandboxCreateArgs({
     name,
     cfg,
     scopeKey,
     configHash: params.configHash,
-  });
-  args.push("--workdir", cfg.workdir);
+  })
+  args.push("--workdir", cfg.workdir)
   const mainMountSuffix =
-    params.workspaceAccess === "ro" && workspaceDir === params.agentWorkspaceDir ? ":ro" : "";
+    params.workspaceAccess === "ro" && workspaceDir === params.agentWorkspaceDir
+      ? ":ro"
+      : ""
   // Remap paths for Docker-in-Docker scenarios
-  const hostWorkspaceDir = remapPathForDinD(workspaceDir);
-  args.push("-v", `${hostWorkspaceDir}:${cfg.workdir}${mainMountSuffix}`);
-  if (params.workspaceAccess !== "none" && workspaceDir !== params.agentWorkspaceDir) {
-    const agentMountSuffix = params.workspaceAccess === "ro" ? ":ro" : "";
-    const hostAgentWorkspaceDir = remapPathForDinD(params.agentWorkspaceDir);
+  const hostWorkspaceDir = remapPathForDinD(workspaceDir)
+  args.push("-v", `${hostWorkspaceDir}:${cfg.workdir}${mainMountSuffix}`)
+  if (
+    params.workspaceAccess !== "none" &&
+    workspaceDir !== params.agentWorkspaceDir
+  ) {
+    const agentMountSuffix = params.workspaceAccess === "ro" ? ":ro" : ""
+    const hostAgentWorkspaceDir = remapPathForDinD(params.agentWorkspaceDir)
     args.push(
       "-v",
       `${hostAgentWorkspaceDir}:${SANDBOX_AGENT_WORKSPACE_MOUNT}${agentMountSuffix}`,
-    );
+    )
   }
-  args.push(cfg.image, "sleep", "infinity");
+  args.push(cfg.image, "sleep", "infinity")
 
-  await execDocker(args);
-  await execDocker(["start", name]);
+  await execDocker(args)
+  await execDocker(["start", name])
 
   if (cfg.setupCommand?.trim()) {
-    await execDocker(["exec", "-i", name, "sh", "-lc", cfg.setupCommand]);
+    await execDocker(["exec", "-i", name, "sh", "-lc", cfg.setupCommand])
   }
 }
 
-async function readContainerConfigHash(containerName: string): Promise<string | null> {
+async function readContainerConfigHash(
+  containerName: string,
+): Promise<string | null> {
   const result = await execDocker(
-    ["inspect", "-f", '{{ index .Config.Labels "moltbot.configHash" }}', containerName],
+    [
+      "inspect",
+      "-f",
+      '{{ index .Config.Labels "moltbot.configHash" }}',
+      containerName,
+    ],
     { allowFailure: true },
-  );
-  if (result.code !== 0) return null;
-  const raw = result.stdout.trim();
-  if (!raw || raw === "<no value>") return null;
-  return raw;
+  )
+  if (result.code !== 0) return null
+  const raw = result.stdout.trim()
+  if (!raw || raw === "<no value>") return null
+  return raw
 }
 
-function formatSandboxRecreateHint(params: { scope: SandboxConfig["scope"]; sessionKey: string }) {
+function formatSandboxRecreateHint(params: {
+  scope: SandboxConfig["scope"]
+  sessionKey: string
+}) {
   if (params.scope === "session") {
-    return formatCliCommand(`moltbot sandbox recreate --session ${params.sessionKey}`);
+    return formatCliCommand(
+      `moltbot sandbox recreate --session ${params.sessionKey}`,
+    )
   }
   if (params.scope === "agent") {
-    const agentId = resolveSandboxAgentId(params.sessionKey) ?? "main";
-    return formatCliCommand(`moltbot sandbox recreate --agent ${agentId}`);
+    const agentId = resolveSandboxAgentId(params.sessionKey) ?? "main"
+    return formatCliCommand(`moltbot sandbox recreate --agent ${agentId}`)
   }
-  return formatCliCommand("moltbot sandbox recreate --all");
+  return formatCliCommand("moltbot sandbox recreate --all")
 }
 
 export async function ensureSandboxContainer(params: {
-  sessionKey: string;
-  workspaceDir: string;
-  agentWorkspaceDir: string;
-  cfg: SandboxConfig;
+  sessionKey: string
+  workspaceDir: string
+  agentWorkspaceDir: string
+  cfg: SandboxConfig
 }) {
-  const scopeKey = resolveSandboxScopeKey(params.cfg.scope, params.sessionKey);
-  const slug = params.cfg.scope === "shared" ? "shared" : slugifySessionKey(scopeKey);
-  const name = `${params.cfg.docker.containerPrefix}${slug}`;
-  const containerName = name.slice(0, 63);
+  const scopeKey = resolveSandboxScopeKey(params.cfg.scope, params.sessionKey)
+  const slug =
+    params.cfg.scope === "shared" ? "shared" : slugifySessionKey(scopeKey)
+  const name = `${params.cfg.docker.containerPrefix}${slug}`
+  const containerName = name.slice(0, 63)
   const expectedHash = computeSandboxConfigHash({
     docker: params.cfg.docker,
     workspaceAccess: params.cfg.workspaceAccess,
     workspaceDir: params.workspaceDir,
     agentWorkspaceDir: params.agentWorkspaceDir,
-  });
-  const now = Date.now();
-  const state = await dockerContainerState(containerName);
-  let hasContainer = state.exists;
-  let running = state.running;
-  let currentHash: string | null = null;
-  let hashMismatch = false;
-  let registryEntry:
-    | {
-        lastUsedAtMs: number;
-        configHash?: string;
-      }
-    | undefined;
+  })
+  const now = Date.now()
+  const state = await dockerContainerState(containerName)
+  let hasContainer = state.exists
+  let running = state.running
+  let currentHash: string | null = null
+  let hashMismatch = false
+  let registryEntry: {
+    lastUsedAtMs: number
+    configHash?: string
+  } | undefined
   if (hasContainer) {
-    const registry = await readRegistry();
-    registryEntry = registry.entries.find((entry) => entry.containerName === containerName);
-    currentHash = await readContainerConfigHash(containerName);
+    const registry = await readRegistry()
+    registryEntry = registry.entries.find(
+      (entry) => entry.containerName === containerName,
+    )
+    currentHash = await readContainerConfigHash(containerName)
     if (!currentHash) {
-      currentHash = registryEntry?.configHash ?? null;
+      currentHash = registryEntry?.configHash ?? null
     }
-    hashMismatch = !currentHash || currentHash !== expectedHash;
+    hashMismatch = !currentHash || currentHash !== expectedHash
     if (hashMismatch) {
-      const lastUsedAtMs = registryEntry?.lastUsedAtMs;
+      const lastUsedAtMs = registryEntry?.lastUsedAtMs
       const isHot =
         running &&
-        (typeof lastUsedAtMs !== "number" || now - lastUsedAtMs < HOT_CONTAINER_WINDOW_MS);
+        (typeof lastUsedAtMs !== "number" ||
+          now - lastUsedAtMs < HOT_CONTAINER_WINDOW_MS)
       if (isHot) {
-        const hint = formatSandboxRecreateHint({ scope: params.cfg.scope, sessionKey: scopeKey });
+        const hint = formatSandboxRecreateHint({
+          scope: params.cfg.scope,
+          sessionKey: scopeKey,
+        })
         defaultRuntime.log(
           `Sandbox config changed for ${containerName} (recently used). Recreate to apply: ${hint}`,
-        );
+        )
       } else {
-        await execDocker(["rm", "-f", containerName], { allowFailure: true });
-        hasContainer = false;
-        running = false;
+        await execDocker(["rm", "-f", containerName], { allowFailure: true })
+        hasContainer = false
+        running = false
       }
     }
   }
@@ -330,9 +370,9 @@ export async function ensureSandboxContainer(params: {
       agentWorkspaceDir: params.agentWorkspaceDir,
       scopeKey,
       configHash: expectedHash,
-    });
+    })
   } else if (!running) {
-    await execDocker(["start", containerName]);
+    await execDocker(["start", containerName])
   }
   await updateRegistry({
     containerName,
@@ -340,7 +380,8 @@ export async function ensureSandboxContainer(params: {
     createdAtMs: now,
     lastUsedAtMs: now,
     image: params.cfg.docker.image,
-    configHash: hashMismatch && running ? (currentHash ?? undefined) : expectedHash,
-  });
-  return containerName;
+    configHash:
+      hashMismatch && running ? (currentHash ?? undefined) : expectedHash,
+  })
+  return containerName
 }