feat: full herm-style container mode with TUI status bar

- Container boots async on launch with --container flag
- Status bar shows container lifecycle: checking → starting → <id>
- "Docker is not running" error shown like herm when Docker unavailable
- BashTool routes through ContainerExecutor when container is active
- DevEnvTool lets agent read/write/build Dockerfiles for hot-swap
- ContainerSandbox exposes ContainerID() for status display
- No permission prompts in container mode (full isolation)

Author: Patel230

cmd/chat_model.go

@@ -16,6 +16,7 @@ import (
 	hawkconfig "github.com/GrayCodeAI/hawk/config"
 	"github.com/GrayCodeAI/hawk/engine"
 	"github.com/GrayCodeAI/hawk/plugin"
+	"github.com/GrayCodeAI/hawk/sandbox"
 	"github.com/GrayCodeAI/hawk/session"
 	"github.com/GrayCodeAI/hawk/tool"
 )
@@ -138,6 +139,13 @@ type chatModel struct {
 	welcomeCache   string
 	viewDirty      bool
 	activeSkills   map[string]plugin.SmartSkill // per-session activated skills
+
+	// Container mode (herm-style hermetic execution)
+	containerEnabled    bool
+	containerStatus     string // "checking docker…", "pulling image…", "starting…", "<id>", "docker not running"
+	containerReady      bool
+	containerErr        error
+	containerSandbox    *sandbox.ContainerSandbox
 }
 
 func blinkTickCmd() tea.Cmd {

cmd/chat_view.go

@@ -349,6 +349,9 @@ func (m chatModel) View() string {
 		leftBold := permissionModeLabel(m.session)
 		leftDim := permissionModeHint(m.session)
 		rightStatus := fmt.Sprintf("%s %s", m.session.Provider(), m.session.Model())
+		if m.containerEnabled && m.containerStatus != "" {
+			rightStatus = fmt.Sprintf("container: %s  %s", m.containerStatus, rightStatus)
+		}
 		leftVisLen := len(leftBold) + len(leftDim)
 		gap := totalW - leftVisLen - len(rightStatus)
 		if gap < 1 {

cmd/container_boot.go

@@ -0,0 +1,56 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+
+	"github.com/GrayCodeAI/hawk/sandbox"
+)
+
+// containerStatusMsg carries container lifecycle updates to the TUI.
+type containerStatusMsg struct {
+	status  string
+	ready   bool
+	err     error
+	sandbox *sandbox.ContainerSandbox
+}
+
+// bootContainerCmd starts the container in the background and sends status
+// updates to the TUI (herm-style async boot with progress feedback).
+func bootContainerCmd(projectDir string) tea.Cmd {
+	return func() tea.Msg {
+		cs := sandbox.NewContainerSandbox(projectDir)
+
+		if !sandbox.DockerAvailable() {
+			return containerStatusMsg{
+				status: "docker not running",
+				err:    fmt.Errorf("Docker is not running. Start Docker and try again."),
+			}
+		}
+
+		ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+		defer cancel()
+
+		if err := cs.Start(ctx); err != nil {
+			return containerStatusMsg{
+				status: "start failed",
+				err:    fmt.Errorf("container start failed: %w", err),
+			}
+		}
+
+		cid := cs.ContainerID()
+		shortID := cid
+		if len(shortID) > 12 {
+			shortID = shortID[:12]
+		}
+
+		return containerStatusMsg{
+			status:  shortID,
+			ready:   true,
+			sandbox: cs,
+		}
+	}
+}

sandbox/container.go

@@ -118,6 +118,13 @@ func (c *ContainerSandbox) Running() bool {
 	return c.running
 }
 
+// ContainerID returns the full container ID (empty if not running).
+func (c *ContainerSandbox) ContainerID() string {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.containerID
+}
+
 // BuildFromDockerfile builds a new image from a Dockerfile in the project.
 // Returns the image tag that can be used for subsequent Start calls.
 func (c *ContainerSandbox) BuildFromDockerfile(ctx context.Context, dockerfile string) (string, error) {