diff --git a/packages/cli/src/gemini.ts b/packages/cli/src/gemini.ts
index 14e5db82..7e329dd6 100644
--- a/packages/cli/src/gemini.ts
+++ b/packages/cli/src/gemini.ts
@@ -57,16 +57,6 @@ function start_sandbox(sandbox: string) {
   // determine full path for gemini-code to distinguish linked vs installed setting
   const gcPath = execSync(`realpath $(which gemini-code)`).toString().trim();
 
-  // stop if image is missing
-  const image = 'gemini-code-sandbox';
-  if (!execSync(`${sandbox} images -q ${image}`).toString().trim()) {
-    const remedy = gcPath.includes('gemini-code/packages/')
-      ? 'Try `scripts/build_sandbox.sh` under gemini-code repo.'
-      : 'Please notify gemini-code-dev@google.com.';
-    console.error(`ERROR: ${image} is missing. ${remedy}`);
-    process.exit(1);
-  }
-
   // stop if debugging in sandbox using linked/installed gemini-code
   // note this is because it does not work (unclear why, parent process interferes somehow)
   // note `npm run debug` runs sandbox directly and avoids any interference from parent process
@@ -78,15 +68,29 @@ function start_sandbox(sandbox: string) {
     process.exit(1);
   }
 
-  // if project is gemini-code, then run sandboxed CLI from ${workdir}/packages/cli
-  // otherwise refuse debug mode (see comments in launch.json around remoteRoot)
+  // if project is gemini-code, then switch to -dev image & run CLI from ${workdir}/packages/cli
+  let image = 'gemini-code-sandbox';
   const project = path.basename(process.cwd());
   const workdir = `/sandbox/${project}`;
   let cliPath = '/usr/local/share/npm-global/lib/node_modules/@gemini-code/cli';
   if (project === 'gemini-code') {
+    image += '-dev';
     cliPath = `${workdir}/packages/cli`;
-  } else if (process.env.DEBUG) {
-    console.error('ERROR: cannot debug in sandbox outside gemini-code repo');
+  } else {
+    // refuse to debug using global installation for now (can be added later)
+    // (requires a separate attach config, see comments in launch.json around remoteRoot)
+    if (process.env.DEBUG) {
+      console.error('ERROR: cannot debug in sandbox outside gemini-code repo');
+      process.exit(1);
+    }
+  }
+
+  // stop if image is missing
+  if (!execSync(`${sandbox} images -q ${image}`).toString().trim()) {
+    const remedy = gcPath.includes('gemini-code/packages/')
+      ? 'Try `scripts/build_sandbox.sh` under gemini-code repo.'
+      : 'Please notify gemini-code-dev@google.com.';
+    console.error(`ERROR: ${image} is missing. ${remedy}`);
     process.exit(1);
   }
 
diff --git a/packages/server/src/tools/shell.ts b/packages/server/src/tools/shell.ts
index 8066044f..aca8677d 100644
--- a/packages/server/src/tools/shell.ts
+++ b/packages/server/src/tools/shell.ts
@@ -24,6 +24,7 @@ export interface ShellToolParams {
 import { spawn } from 'child_process';
 
 export class ShellTool extends BaseTool<ShellToolParams, ToolResult> {
+  // name should match TerminalTool.Name used in prompts.ts for now
   static Name: string = 'execute_bash_command';
   private readonly config: Config;
   private whitelist: Set<string> = new Set();
diff --git a/scripts/build_sandbox.sh b/scripts/build_sandbox.sh
index 24291e7c..f14a3d4b 100755
--- a/scripts/build_sandbox.sh
+++ b/scripts/build_sandbox.sh
@@ -30,11 +30,14 @@ SKIP_NPM_INSTALL_BUILD=false
 while getopts "sd" opt; do
     case ${opt} in
     s) SKIP_NPM_INSTALL_BUILD=true ;;
-    d) DOCKERFILE=Dockerfile-dev ;;
+    d)
+        DOCKERFILE=Dockerfile-dev
+        IMAGE+="-dev"
+        ;;
     \?)
         echo "usage: $(basename "$0") [-s] [-d]"
         echo "  -s: skip npm install + npm run build"
-        echo "  -d: use Dockerfile-dev"
+        echo "  -d: build dev image (using Dockerfile-dev)"
         exit 1
         ;;
     esac
diff --git a/scripts/start_sandbox.sh b/scripts/start_sandbox.sh
index 18e81bde..89046fbe 100755
--- a/scripts/start_sandbox.sh
+++ b/scripts/start_sandbox.sh
@@ -23,28 +23,27 @@ fi
 CMD=$(scripts/sandbox_command.sh)
 IMAGE=gemini-code-sandbox
 DEBUG_PORT=9229
-
-# stop if image is missing
-if ! $CMD images -q "$IMAGE" | grep -q .; then
-    echo "ERROR: $IMAGE is missing. Try \`npm run build\` with sandboxing enabled."
-    exit 1
-fi
-
 PROJECT=$(basename "$PWD")
 WORKDIR=/sandbox/$PROJECT
 CLI_PATH=/usr/local/share/npm-global/lib/node_modules/\@gemini-code/cli
 
-# if project is gemini-code, then run CLI from $WORKDIR/packages/cli
-# note this means the global installation is not required in this case
+# if project is gemini-code, then switch to -dev image & run CLI from $WORKDIR/packages/cli
 if [[ "$PROJECT" == "gemini-code" ]]; then
+    IMAGE+="-dev"
     CLI_PATH="$WORKDIR/packages/cli"
 elif [ -n "${DEBUG:-}" ]; then
-    # refuse to debug using global installation
-    # (requires a separate attach config in launch.json, see comments there around remoteRoot)
+    # refuse to debug using global installation for now (can be added later)
+    # (requires a separate attach config, see comments in launch.json around remoteRoot)
     echo "ERROR: debugging is sandbox is not supported when target/root is not gemini-code"
     exit 1
 fi
 
+# stop if image is missing
+if ! $CMD images -q "$IMAGE" | grep -q .; then
+    echo "ERROR: $IMAGE is missing. Try \`npm run build\` with sandboxing enabled."
+    exit 1
+fi
+
 # use interactive tty mode and auto-remove container on exit
 run_args=(-it --rm)