src/lib/onboard.ts (1)

5171-5451: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Reduce this hunk to satisfy the onboard entrypoint growth gate.

CI is currently failing because src/lib/onboard.ts grew by net +6 lines. Please trim this change (behavior can stay the same) so the budget check passes.

Possible line-neutral rewrite (same behavior)

-  let usingAgentDockerfile = false;
   if (fromDockerfile) {
@@
   } else if (agent) {
     const agentBuild = agentOnboard.createAgentSandbox(agent);
     buildCtx = agentBuild.buildCtx;
     stagedDockerfile = agentBuild.stagedDockerfile;
-    usingAgentDockerfile = true;
   } else {
     ({ buildCtx, stagedDockerfile } = stageOptimizedSandboxBuildContext(ROOT));
   }
@@
-  const resolved = usingAgentDockerfile
+  const resolved = agent && !fromDockerfile
     ? null
     : pullAndResolveBaseImageDigest({
         requireOpenshellSandboxAbi: isLinuxDockerDriverGatewayEnabled(),
       });
-  if (!usingAgentDockerfile) {
-    if (resolved?.digest) {
-      console.log(`  Pinning base image to ${resolved.digest.slice(0, 19)}...`);
-    } else if (resolved) {
-      console.log(`  Using sandbox base image ${resolved.ref}`);
-    } else {
+  if (resolved?.digest) {
+    console.log(`  Pinning base image to ${resolved.digest.slice(0, 19)}...`);
+  } else if (resolved) {
+    console.log(`  Using sandbox base image ${resolved.ref}`);
+  } else if (!(agent && !fromDockerfile)) {
       // Check if the image exists locally before falling back to unpinned :latest.
       // On a first-time install behind a firewall with no cached image, warn early
       // so the user knows the build will likely fail.
       const localCheck = dockerImageInspect(`${SANDBOX_BASE_IMAGE}:${SANDBOX_BASE_TAG}`, {
         ignoreError: true,
         suppressOutput: true,
       });
       if (localCheck.status === 0) {
         console.warn("  Warning: could not pull base image from registry; using cached :latest.");
       } else {
         console.warn(
           `  Warning: base image ${SANDBOX_BASE_IMAGE}:${SANDBOX_BASE_TAG} is not available locally.`,
         );
         console.warn("  The build will fail unless Docker can pull the image during build.");
         console.warn("  If offline, pull the image manually first:");
         console.warn(`    docker pull ${SANDBOX_BASE_IMAGE}:${SANDBOX_BASE_TAG}`);
       }
-    }
   }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard.ts` around lines 5171 - 5451, The file grew by a few lines in
the custom-Dockerfile and cleanup logic — shrink the hunk without changing
behavior by collapsing multi-line console logs and small helpers and removing
redundant whitespace/comments: inside the fromDockerfile branch compress the
three separate console.error/console.warn calls into single concise messages
where safe (e.g. the permission/blocking messages and the "move Dockerfile"
suggestions), inline the small cleanupCustomBuildCtx arrow into the catch
handler (making it a one-liner try/finally usage), and remove extra blank lines
around the usingAgentDockerfile assignment and the resolved/pull fallback block;
target symbols to change: the fromDockerfile branch
(fromResolved/buildContextDir/stagedDockerfile), cleanupCustomBuildCtx,
cleanupBuildCtx, usingAgentDockerfile, and the resolved = usingAgentDockerfile ?
null : pullAndResolveBaseImageDigest(...) section. Ensure behavior and exit
codes remain identical.