Fix #18834: use docker inspect exit code instead of stdout parsing

[LifeJiggy]

Summary

Fix sandbox imageExists returning false negatives when Docker outputs image names to stderr (e.g. with DOCKER_BUILDKIT). Switch from parsing docker images -q stdout to using docker inspect --type=image exit code.

Details
docker images -q may write the image name to stderr when DOCKER_BUILDKIT=1 is set, causing the old stdout-based parsing to return a false negative. The sandbox would then attempt to pull the image unnecessarily. The fix uses docker inspect --type=image and checks the exit code, which is reliable regardless of output channel.

Related Issues
Fixes #18834

How to Validate

1. cd packages/cli
2. npx vitest run src/utils/sandbox.test.ts — all 8 tests pass
3. If Docker is available: set DOCKER_BUILDKIT=1, run sandbox operation — no spurious pull

Pre-Merge Checklist

• Updated relevant documentation and README (if needed)
• Added/updated tests (if needed)
• Noted breaking changes (if any)
• Validated on required platforms/methods:
• MacOS
• Windows
• Linux (via CI)

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request improves the reliability of the sandbox image existence check by switching from parsing command output to checking the exit code of the Docker inspection command. This ensures that the system correctly identifies image presence even when environment variables like DOCKER_BUILDKIT are enabled, which previously caused output to be redirected to stderr and triggered unnecessary image pulls.

Highlights

• Improved Docker image existence check: Replaced the unreliable stdout parsing of 'docker images -q' with 'docker inspect --type=image', which uses the command's exit code to determine if an image exists.
• Enhanced reliability with DOCKER_BUILDKIT: The change prevents false negatives that occurred when DOCKER_BUILDKIT=1 caused image names to be output to stderr instead of stdout.
• Test suite updates: Updated all relevant unit tests in sandbox.test.ts to reflect the new inspection logic and simplified the mocking of the spawn process.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request updates the imageExists utility in packages/cli to use docker inspect --type=image instead of docker images -q for checking the existence of a sandbox image. The implementation now relies on the process exit code rather than parsing stdout, and includes stdio: 'ignore' to suppress output. Corresponding test mocks and assertions in sandbox.test.ts have been updated to reflect these changes. I have no feedback to provide as there were no review comments to evaluate.

[LifeJiggy]

@scidomino, @abhipatel12 , @bbiggs PTAL

[scidomino]

Please do not ping individual maintainers. Our inboxes are overfull and many of us have been assigned to other project. I appreciate that it's frustrating but this will be reviewed by the normal process or not at all.

[LifeJiggy]

@scidomino

Understood. I apologize for pinging multiple maintainers.

I won't ping individuals again and will respect the normal review process going forward.

Thank you.