fix: ESC key, .config, workspace permissions, terminal race condition

apps/api/src/services/manifest_compiler.py

@@ -118,6 +118,11 @@ def compile_dockerfile(manifest: dict) -> str:
 
     # System packages (apt)
     apt_packages = manifest.get("packages", {}).get("apt", [])
+    if manifest.get("user"):
+        # Ensure sudo is available for permission-fixing startup scripts
+        apt_packages = list(apt_packages)
+        if "sudo" not in apt_packages:
+            apt_packages.append("sudo")
     if apt_packages:
         lines.append("RUN apt-get update && apt-get install -y \\")
         for pkg in apt_packages[:-1]:
@@ -168,10 +173,18 @@ def compile_dockerfile(manifest: dict) -> str:
         lines.append(f"ENV USER={name}")
         lines.append("")
         # Ensure home directory exists and is writable by the user
-        lines.append(f"RUN mkdir -p {home} && chown {name}:{name} {home} && chmod 755 {home}")
+        lines.append(
+            f"RUN mkdir -p {home} && chown {name}:{name} {home} && chmod 755 {home}"
+        )
         lines.append("")
 
-        # Build scripts
+        # Configure passwordless sudo so startup scripts can fix permissions
+        lines.append(
+            f'RUN echo "{name} ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/{name} && chmod 0440 /etc/sudoers.d/{name}'
+        )
+        lines.append("")
+
+    # Build scripts
     build_scripts = manifest.get("scripts", {}).get("build", [])
     for script in build_scripts:
         # Normalize multi-line scripts into single RUN command
@@ -184,6 +197,11 @@ def compile_dockerfile(manifest: dict) -> str:
     if build_scripts:
         lines.append("")
 
+    # After build scripts, ensure everything in home is owned by the user
+    if user and build_scripts:
+        lines.append(f"RUN chown -R {name}:{name} {home}")
+        lines.append("")
+
     # Create mount target directories
     mounts = manifest.get("mounts", [])
     if mounts: