feat(cloud): custom sandbox base images

[tatoalo]

Problem

Backend support for custom sandbox base images is landing in PostHog/posthog#68620, PostHog/posthog#68621, and PostHog/posthog#68622. The desktop app needs the UI: manage images, watch builds, and pick an image per environment or per run.

Changes

• Cloud settings gains a "Custom images" section: create an image (opens its interactive builder session), edit the spec, save and build, delete, and a live-tailing build log pane. Environments get a "Base image" select.
• Task composer can pick a custom base image per run; image-builder sessions get their own sidebar group and a build button in the session footer.
• Polling that matches build lifetimes: detail/list queries poll only while scanning/building, the list keeps polling in the background, and a component-independent watcher fires an OS notification when a build finishes (polling the light list endpoint, not the 200 KB build log). All image mutations seed the react-query detail cache through one helper, so panes never sit on stale terminal state.
• ELECTRON_RUN_AS_NODE is now only injected into Claude session env when actually spawning from Electron. In cloud sandboxes the agent-server runs under plain node, and the leaked variable broke any Electron app the agent tried to launch in its workspace.

Everything is hidden unless the backend reports custom images enabled (typed 403 detection on the list endpoint).

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[tatoalo]

• feat(cloud): custom sandbox base images #3175 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Comments Outside Diff (1)

1. packages/ui/src/features/settings/sections/environments/imageBuildWatcher.ts, line 1408-1413 (link)

   Watcher fetches the entire image list to track one image, and duplicates the React Query poll

   watchImageBuild calls listSandboxCustomImages() every 5 s to track a single imageId, but useSandboxCustomImages already has a refetchInterval of 5 000 ms that fires whenever any image is in a building/scanning state. Once a build is triggered, both mechanisms poll the same endpoint in parallel, doubling the request rate. It would be more efficient to poll getSandboxCustomImage(imageId) (targets one resource) and have the watcher's onTerminal callback remain the sole trigger for the notification — or, alternatively, drive the notification entirely from a React Query onSuccess side-effect in the list query rather than an imperative background interval.

_{Reviews (1): Last reviewed commit: "feat(cloud): custom sandbox base images" | Re-trigger Greptile}

[github-actions]

React Doctor found 1 issue in 1 file · 1 warning.

1 warning

src/features/settings/sections/environments/CloudEnvironmentsSettings.tsx

• ⚠️ src/features/settings/sections/environments/CloudEnvironmentsSettings.tsx:341 Many related useState calls prefer-useReducer

_{Reviewed by React Doctor for commit dedd747.}

[stamphog]

This PR exceeds the auto-review size ceiling (1384 lines, 21 files) and introduces a substantial new feature touching API contracts, domain types, and UI across many packages. There are no human reviews — only resolved bot comments and author self-replies. A feature of this scope needs a human reviewer.

[greptile-apps]

_{Reviews (2): Last reviewed commit: "feat(cloud): custom sandbox base images" | Re-trigger Greptile}