Rebuild compose images on startup to keep services up to date

sandbox/egg_lib/cli.py

@@ -108,7 +108,8 @@ def main() -> int | None:
     parser.add_argument(
         "--build",
         action="store_true",
-        help="Rebuild compose images before starting (use with --compose)",
+        help="Rebuild compose images before starting (use with --compose). "
+        "Note: the default egg startup path already rebuilds automatically.",
     )
 
     # Multi-agent execution options

sandbox/egg_lib/compose.py

@@ -523,23 +523,29 @@ def _get_mtime(path: Path) -> float:
         return 0.0
 
 
-def ensure_compose_services(build: bool = False) -> bool:
+def ensure_compose_services(build: bool = True) -> bool:
     """Start gateway + orchestrator via Docker Compose.
 
     This is the primary entry point used by the default ``egg`` CLI path.
     It:
     1. Locates docker-compose.yml
     2. Generates .env dynamically from the same config sources as
        ``start_gateway_container()`` (secrets.env, repositories.yaml, etc.)
-    3. Runs ``docker compose up -d``
+    3. Runs ``docker compose up -d --build``
     4. Waits for gateway health check
     5. Waits for orchestrator health check (non-blocking on failure)
 
+    Passing ``--build`` ensures compose service images (gateway,
+    orchestrator) are rebuilt when their build context changes, keeping
+    them up to date the same way ``build_image()`` keeps the sandbox
+    image up to date.  Docker's layer cache makes this fast when
+    nothing has changed.
+
     Falls back to ``start_gateway_container()`` if docker compose is
     unavailable.
 
     Args:
-        build: Force rebuild of compose images
+        build: Rebuild compose images if build context changed (default True)
 
     Returns:
         True if gateway is healthy (orchestrator failure is a warning only)
@@ -583,8 +589,8 @@ def ensure_compose_services(build: bool = False) -> bool:
         or _get_mtime(override_path) != override_mtime_before
     )
 
-    # Fast path: services healthy, config unchanged, no explicit rebuild
-    if already_healthy and not config_changed and not build:
+    # Fast path: services healthy, config unchanged — skip compose_up entirely
+    if already_healthy and not config_changed:
         success("Gateway is healthy")
         # Quick orchestrator check — gateway confirmed healthy but orchestrator
         # was not directly probed, so allow a couple of attempts.
@@ -701,14 +707,14 @@ def get_compose_gateway_ip(compose_file: Path) -> str:
     return "172.32.0.2"
 
 
-def run_compose_mode(down: bool = False, build: bool = False) -> int:
+def run_compose_mode(down: bool = False, build: bool = True) -> int:
     """Run egg in explicit compose control mode.
 
     Used by ``egg --compose --down`` and ``egg --compose --build``.
 
     Args:
         down: If True, stop the stack and exit
-        build: If True, rebuild images before starting
+        build: Rebuild images before starting (default True)
 
     Returns:
         Exit code (0 for success)