From 25c14c804d8da18fa29f71d60bec8bfccd409839 Mon Sep 17 00:00:00 2001
From: Guillaume Tardif <guillaume.tardif@gmail.com>
Date: Wed, 18 Mar 2026 08:31:13 +0100
Subject: [PATCH] Fix --sandbox when running cli plugin mode

Signed-off-by: Guillaume Tardif <guillaume.tardif@gmail.com>
---
 pkg/sandbox/args.go         |  7 +++++++
 pkg/sandbox/sandbox_test.go | 19 +++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/pkg/sandbox/args.go b/pkg/sandbox/args.go
index 8c79f47f6..e025daf7a 100644
--- a/pkg/sandbox/args.go
+++ b/pkg/sandbox/args.go
@@ -6,6 +6,8 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/docker/cli/cli-plugins/plugin"
+
 	"github.com/docker/docker-agent/pkg/userconfig"
 )
 
@@ -42,6 +44,7 @@ var (
 func BuildCagentArgs(argv []string) []string {
 	out := make([]string, 0, len(argv))
 	runStripped := false
+	agentStripped := false
 	agentResolved := false
 	hasYolo := false
 	skipNext := false
@@ -67,6 +70,10 @@ func BuildCagentArgs(argv []string) []string {
 			runStripped = true
 			continue
 		}
+		if !plugin.RunningStandalone() && !agentStripped && a == "agent" {
+			agentStripped = true
+			continue
+		}
 		// The first positional arg after "run" is the agent reference.
 		// Resolve it if it's a user-defined alias.
 		if runStripped && !agentResolved && !strings.HasPrefix(a, "-") {
diff --git a/pkg/sandbox/sandbox_test.go b/pkg/sandbox/sandbox_test.go
index 413ee184e..f32571c9d 100644
--- a/pkg/sandbox/sandbox_test.go
+++ b/pkg/sandbox/sandbox_test.go
@@ -6,6 +6,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/docker/cli/cli-plugins/metadata"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -120,9 +121,22 @@ func TestExisting_HasWorkspace(t *testing.T) {
 func TestBuildCagentArgs(t *testing.T) {
 	tests := []struct {
 		name string
+		env  map[string]string
 		argv []string
 		want []string
 	}{
+		{
+			name: "using cli plugin, strips run and --sandbox and --debug, adds --yolo",
+			env:  map[string]string{metadata.ReexecEnvvar: "docker"}, // env var set by cli plugin execution
+			argv: []string{"docker", "agent", "run", "./agent.yaml", "--sandbox", "--debug"},
+			want: []string{"./agent.yaml", "--yolo"},
+		},
+		{
+			name: "using cli plugin, strips -d shorthand",
+			env:  map[string]string{metadata.ReexecEnvvar: "docker"}, // env var set by cli plugin execution
+			argv: []string{"docker", "agent", "-d", "run", "./agent.yaml"},
+			want: []string{"./agent.yaml", "--yolo"},
+		},
 		{
 			name: "strips run and --sandbox and --debug, adds --yolo",
 			argv: []string{"cagent", "run", "./agent.yaml", "--sandbox", "--debug"},
@@ -204,6 +218,11 @@ func TestBuildCagentArgs(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			// Use an empty HOME so no real user aliases interfere.
 			t.Setenv("HOME", t.TempDir())
+			if tt.env != nil {
+				for k, v := range tt.env {
+					t.Setenv(k, v)
+				}
+			}
 
 			got := sandbox.BuildCagentArgs(tt.argv)
 			assert.Equal(t, tt.want, got)