feat(agent): sandbox conversation analysis

Dockerfile

@@ -18,6 +18,7 @@ RUN if [ -n "${UBUNTU_APT_MIRROR}" ]; then \
     apt-get update && apt-get install -y --no-install-recommends \
     curl \
     jq \
+    libseccomp2 \
     unzip \
     python3 \
     python3-venv && \
@@ -43,6 +44,8 @@ RUN if [ -n "${UBUNTU_APT_MIRROR}" ]; then \
     rich \
     ipython \
     pytest && \
+    (getent group 10001 >/dev/null || groupadd --gid 10001 tjwater-sandbox) && \
+    (getent passwd 10001 >/dev/null || useradd --uid 10001 --gid 10001 --no-create-home --shell /usr/sbin/nologin tjwater-sandbox) && \
     rm -rf /var/lib/apt/lists/*
 
 FROM base AS deps
@@ -59,9 +62,10 @@ WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY --from=deps /app/.opencode/node_modules ./.opencode/node_modules
 COPY package.json bun.lock ./
-COPY tsconfig.json opencode.json README.md .gitignore ./
+COPY tsconfig.json opencode.json README.md .gitignore Dockerfile ./
 COPY src ./src
 COPY cli ./cli
+COPY scripts ./scripts
 COPY .opencode ./.opencode
 RUN bun run check