// Generated by abox {{ abox_version }} for project "{{ project }}".
//
// CONVENIENCE ARTIFACT — abox does not read this file.
//
// abox builds and runs the agent container through the Docker CLI directly, from
// runspec.json in its own state directory. That is what keeps the host free of
// npm: there is no @devcontainers/cli dependency anywhere in abox.
//
// This file exists so an editor (VS Code, Cursor) can open the same image with
// roughly the same shape. Opening the folder in an editor gives you a *developer*
// container, not the sandbox: your editor will not apply the firewall, the mask
// overlays, or the single-MCP-endpoint restriction. Use `abox shell` for that.
{
  "name": "abox-{{ project }}",
  "image": "{{ image }}",
  "runArgs": [
    "--network={{ network }}",
    "--cap-add=NET_ADMIN",
    "--cap-add=NET_RAW"
  ],
  "workspaceFolder": "/workspace",
  "workspaceMount": "source={{ workspace }},target=/workspace,type=bind,consistency=cached",
  "mounts": [
    "source={{ claude_volume }},target=/home/{{ remote_user }}/.claude,type=volume",
    "source={{ artifacts_dir }},target=/opt/abox,type=bind,readonly",
    "source={{ run_log_dir }},target=/var/log/abox,type=bind"
{%- for mount in extra_mounts %},
    "{{ mount }}"
{%- endfor %}
  ],
  "containerEnv": {
    "ABOX_PROJECT": "{{ project }}",
    "ABOX_PROFILE": "{{ profile }}",
    "ABOX_GATEWAY_URL": "{{ gateway_url }}",
    "CLAUDE_CONFIG_DIR": "/home/{{ remote_user }}/.claude"
  },
  "remoteUser": "{{ remote_user }}",
  "overrideCommand": true,
  "customizations": {
    "abox": {
      "authoritative": "runspec.json (in the abox state dir, not this file)",
      "manifestDigest": "{{ manifest_digest }}",
      "renderedAt": "{{ rendered_at }}",
      "toolchains": [
{%- for toolchain in toolchains %}
        "{{ toolchain }}"{{ "," if not loop.last }}
{%- endfor %}
      ],
      "maskedPaths": [
{%- for path in masked_paths %}
        "{{ path }}"{{ "," if not loop.last }}
{%- endfor %}
      ]
    }
  }
}
