Naresh

This commit **enhances the reliability of the CI/CD pipeline** by implementing a robust fallback mechanism for image retagging operations. Previously, transient registry errors during `crane copy` could cause entire builds to fail; now, a new `crane_copy_retry` script in `.github/crane-copy-retry.sh` provides retry logic with backoff. The **reusable build workflow** (`.github/workflows/reusable-build.yml`) is updated to utilize this script, making the retag step non-fatal and introducing a resolver to conditionally trigger a full Docker build if retagging ultimately fails. This **maintenance** change prevents unnecessary build failures, ensuring a more resilient and efficient build process.

This commit implements significant **CI/CD performance optimizations** and **corrects change detection logic** across the project's GitHub Actions workflows. It **widens path filters** in `.github/path-filters.yml` to align with Docker hash inputs, ensuring accurate E2E test triggering and preventing unnecessary skips. New content hashing for Docker and deploy artifacts is introduced in `.github/workflows/release.yml` to enable skipping redundant builds and deployments, while `.github/workflows/reusable-build.yml` now reports actual image changes via digest comparison. Additionally, **npm package caching** is refactored for explicit restore/save actions in `reusable-build.yml` and `reusable-e2e.yml`, and release concurrency is adjusted to prevent blocking. These **maintenance** and **optimization** changes drastically reduce CI run times and improve the reliability of automated releases.

This commit **reverts** three prior changes, effectively **undoing the configurability of the sandbox control plane port** and related WebSocket transport enhancements. Specifically, it **hardcodes the control plane port back to 3000** across the **`sandbox`** and **`sandbox-container`** modules, removing the ability to specify a custom port. This **rollback** impacts the server, security services, various client transports, and all associated tests, ensuring a fixed port for internal communication. Consequently, documentation and Docker build configurations are updated to reflect this non-configurable port, simplifying deployment but removing previous flexibility.

This commit **fixes a runtime error** within the **`@cloudflare/think` package** by updating its peer dependency on **`@cloudflare/shell`**. Previously, a wildcard dependency allowed incompatible older versions of `shell` to be resolved, leading to breaks because `Think` expects the `Workspace` constructor introduced in `shell` version `0.2.0`. The dependency is now explicitly set to `>=0.2.0 <1.0.0`, which **prevents these runtime failures** and ensures `Think` always operates with a compatible `shell` version.

This commit **resolves a critical CI/CD failure** within the **Release E2E workflow** by granting essential `actions:read` and `contents:read` permissions. Previously, the `e2e` job in `.github/workflows/release.yml` lacked these permissions, causing consistent `startup_failure` errors on pushes to the `main` branch due to a missing capacity guard requirement. This **maintenance fix** ensures the `reusable-e2e` workflow can execute correctly, thereby **restoring the stability and reliability of the automated release pipeline**.

This commit provides a **bug fix** and **refactoring** for the **`sandbox` module**, specifically addressing issues with **stale client references** in `CodeInterpreter` and `LocalMountSyncManager` after a legacy port fallback. It ensures that both HTTP and **WebSocket transports** consistently handle container startup by refactoring common logic into reusable methods within `sandbox.ts`. This significantly improves the **resilience of the sandbox environment**, preventing 500 errors and ensuring proper functionality of long-lived client components. Additionally, **error handling is enhanced** by redacting detailed error messages from client responses, improving security and user experience.

This commit **refactors the CI resource cleanup strategy** to address significant performance regressions, replacing per-run deletion with a **capacity-aware LRU eviction** triggered before deployment. It **restores the Docker cache and `deploy-skip` optimization** by ceasing per-run image deletion and allowing workers/containers to persist across runs, which **halves average CI build times** from 10.4 to 5.4 minutes. The **CI/CD pipeline** (`cleanup.yml`, `pr-privileged.yml`, `reusable-e2e.yml`) is updated to intelligently manage container app resources, only evicting least-recently-active PRs when approaching account limits, thereby **improving overall CI efficiency and stability**. This **maintenance and optimization** work also fixes several pre-existing cleanup issues and removes unnecessary nightly cache eviction.

This commit **fixes a bug** in the **versioning script** by excluding `CHANGELOG.md` from its find-and-replace operations. Previously, the `.github/changeset-version.ts` script was incorrectly overwriting Docker image versions within historical `CHANGELOG.md` entries, leading to inaccurate migration guides. This **maintenance** change prevents future corruption of release documentation and **restores correct Docker image tags** in affected changelogs, ensuring the integrity of past release information for users.

This commit **refactors** the management of **Docker image lists** within the CI/CD system to resolve a critical limitation. It moves the definition of Docker image names from being hardcoded in **GitHub Actions workflow YAMLs** to a new, centralized file, `docker-images.txt`, which is dynamically loaded by a new script, `load-docker-images.sh`. This change impacts several **CI workflows**, including `cleanup.yml`, `pr-privileged.yml`, `release.yml`, and `reusable-build.yml`, ensuring they all use the same source of truth. The primary benefit is **fixing a "chicken-and-egg" problem** that prevented pull requests from successfully building or pushing new Docker image variants, significantly **improving the maintainability and flexibility** of the build process.

This commit introduces a **documentation update** by adding a new changeset entry. It specifically records a **bug fix** related to the `sleepAfter` configuration, which previously failed to persist its value across sandbox restarts. This update ensures that users are informed about the improved **sandbox configuration persistence** and the reliable behavior of the `sleepAfter` setting. The change clarifies that the configuration now correctly retains its state, enhancing the predictability of **sandbox environment management**.

This commit **enhances sandbox configuration management** by **persisting the `sleepAfter` value to storage**, resolving an issue where this setting would revert to its default after sandbox eviction. The `packages/sandbox` module now ensures that `sleepAfter` is written to storage when `setSleepAfter` is called and restored during the `init` process. This **bug fix and feature enhancement** guarantees that sandbox `sleepAfter` configurations are reliably maintained across lifecycle events, preventing unexpected behavior. New test cases have been added to verify the correct persistence and restoration of this critical setting.

This commit **fixes** a critical issue in the **CI/CD pipeline** where **Docker images built for Pull Requests (PRs)** were incorrectly using the `main` branch's code instead of the PR's specific changes. The problem stemmed from `docker/bake-action@v6` defaulting to the workflow ref, which for `pull_request_target` workflows is always the base branch. This **bug fix** involves modifying `.github/workflows/reusable-build.yml` to explicitly add `source: .` to the Docker bake action. This ensures the build process now correctly utilizes the locally checked-out PR code, preventing outdated or incorrect Docker images from being produced for PRs.

This commit introduces a **significant enhancement to the CI/CD workflow** by ensuring that **all pull requests now receive a preview comment**, not just those involving Docker image rebuilds. Previously, SDK-only PRs lacked this crucial feedback, but now the `.github/workflows/pr-privileged.yml` workflow dynamically selects between the existing Docker template and a **new SDK-only template** (`.github/templates/pr-preview-main-comment.md`) that provides `npm install` instructions. This **improves developer experience** by offering consistent and relevant preview information across all types of PRs, streamlining testing and review processes.

This commit **fixes a critical authentication issue** within the **`bonk` workflow** by explicitly granting `id-token: write` permission in `.github/workflows/bonk.yml`. Previously, an oversight during workflow permission hardening caused the **OIDC token exchange** to fail, preventing the `bonk` workflow from authenticating with its backend. This **maintenance fix** ensures that the `bonk` workflow can now successfully perform OIDC authentication, resolving all related failures during its orchestration step.

This commit **updates the project's code ownership configuration** by adding Archie (`@scuffi`) and Aron (`@aron-cf`) to the `.github/CODEOWNERS` file. This **maintenance** change ensures that these individuals are automatically requested for reviews on relevant pull requests, thereby **streamlining the review process** and enhancing code quality oversight. It primarily affects the **developer workflow** and **review assignments** across the repository.

This commit implements a series of **bug fixes** and **robustness improvements** across the `sandbox` and `sandbox-container` modules to resolve **E2E test flakiness**. It refines **container startup error classification** in `sandbox.ts` to distinguish between permanent (500) and transient (503) failures, preventing unnecessary retries and improving diagnostics. Additionally, it adds **timeouts and credential sanitization to git clone operations** in `git-manager.ts` and `git-service.ts`, fixes a **debounce deadlock in `waitForLogPattern`**, and prevents **event listener leaks in process streaming** within `process-handler.ts`. These changes collectively enhance the stability, reliability, and diagnostic capabilities of the platform, particularly for E2E testing.

This commit **resolves a permission issue** within the **GitHub Actions workflow** (`pr-privileged.yml`) that prevented labels from being removed on fork PR `synchronize` events. The `GITHUB_TOKEN` lacked the necessary organization-level write access for this operation, so the workflow now generates and uses an **app token** (`sandy-bonk`) which has the required permissions. This **maintenance fix** ensures that label management functions correctly for fork PRs. As a beneficial side effect, the commit also **removes the now-unnecessary `issues: write` permission** from the policy job, enhancing security by adhering to the principle of least privilege.

This commit **enhances CI/CD security and reliability** by tightening permissions and ensuring Docker image availability for end-to-end tests. The `policy` job in `.github/workflows/pr-privileged.yml` now operates with **read-only pull request access**, aligning with its actual needs and improving security posture. Furthermore, the **CI pipeline** for **e2e tests** is **refactored** to reliably provide Docker images by splitting the signal into `needs-docker` and `docker-changed`, utilizing a content-addressed cache for efficient retagging. This work also includes disabling credential persistence for checkout actions across `lint`, `test`, and `build` jobs in `.github/workflows/reusable-quality.yml`, further bolstering overall workflow security.

This commit **refactors** the **GitHub Actions workflow** defined in `.github/workflows/pr-privileged.yml` to **fix a skip cascade issue** within the CI/CD pipeline. It integrates the `remove-label` functionality directly into the `policy` job as a conditional step, removing the `policy` job's external dependencies. This ensures the `policy` job always executes, thereby eliminating the source of unintended skips that previously affected downstream jobs like `detect-changes`. The change significantly improves **CI/CD pipeline reliability** by guaranteeing consistent execution of critical checks.

This commit **fixes critical bugs** in the **GitHub Actions CI workflows** that were preventing proper execution for all pull requests. It addresses a missing `packages:write` permission in the **`pr.yml`** workflow, which previously caused GitHub to reject runs calling permission-scoped reusable workflows. Additionally, the **`pr-privileged.yml`** workflow's `policy` job is corrected by adding `always()` to its `if` condition, preventing it from being silently skipped due to cascaded dependency failures. These **CI pipeline fixes** restore full functionality, ensuring all pull requests correctly trigger and complete their required build and policy checks.