feat: add sandbox environment checks and user confirmation dialogs

- Introduced a new endpoint to check if the application is running in a containerized environment, allowing the UI to display appropriate risk warnings.
- Added a confirmation dialog for users when running outside a sandbox, requiring acknowledgment of potential risks before proceeding.
- Implemented a rejection screen for users who deny sandbox risk confirmation, providing options to restart in a container or reload the application.
- Updated the main application logic to handle sandbox status checks and user responses effectively, enhancing security and user experience.

apps/server/src/routes/health/index.ts

@@ -1,12 +1,13 @@
 /**
  * Health check routes
  *
- * NOTE: Only the basic health check (/) is unauthenticated.
+ * NOTE: Only the basic health check (/) and environment check are unauthenticated.
  * The /detailed endpoint requires authentication.
  */
 
 import { Router } from 'express';
 import { createIndexHandler } from './routes/index.js';
+import { createEnvironmentHandler } from './routes/environment.js';
 
 /**
  * Create unauthenticated health routes (basic check only)
@@ -18,6 +19,10 @@ export function createHealthRoutes(): Router {
   // Basic health check - no sensitive info
   router.get('/', createIndexHandler());
 
+  // Environment info including containerization status
+  // This is unauthenticated so the UI can check on startup
+  router.get('/environment', createEnvironmentHandler());
+
   return router;
 }
 

apps/server/src/routes/health/routes/environment.ts

@@ -0,0 +1,20 @@
+/**
+ * GET /environment endpoint - Environment information including containerization status
+ *
+ * This endpoint is unauthenticated so the UI can check it on startup
+ * before login to determine if sandbox risk warnings should be shown.
+ */
+
+import type { Request, Response } from 'express';
+
+export interface EnvironmentResponse {
+  isContainerized: boolean;
+}
+
+export function createEnvironmentHandler() {
+  return (_req: Request, res: Response): void => {
+    res.json({
+      isContainerized: process.env.IS_CONTAINERIZED === 'true',
+    } satisfies EnvironmentResponse);
+  };
+}