@agentshouse/kit 0.1.0-alpha.4 → 0.1.0-alpha.41

package/bin/connect-windows.ps1

@@ -0,0 +1,440 @@
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+
+$Image = 'ghcr.io/agentshouse/kit@sha256:__IMAGE_DIGEST__'
+$Name = 'house-kit'
+$KitHome = 'house-kit-home'
+$KitHomeMount = "type=volume,src=$KitHome,dst=/kit-home"
+$BootstrapArguments = @($args | ForEach-Object { [string]$_ })
+$MinimumBuild = 22631
+$MinimumWsl = [version]'2.1.5'
+$DesktopInstaller = 'https://desktop.docker.com/win/main/amd64/Docker%20Desktop%20Installer.exe'
+$DesktopWaitSeconds = 300
+
+function Stop-Bootstrap([string] $Cause) {
+  throw "kit_bootstrap_refused: $Cause"
+}
+
+function Exit-Bootstrap([int] $Status) {
+  throw "kit_bootstrap_exit: $Status"
+}
+
+function Invoke-Native([string] $Command, [string[]] $NativeArguments) {
+  $ErrorActionPreference = 'Continue'
+  $output = @(& $Command @NativeArguments 2>&1 | ForEach-Object { "$_" })
+  [pscustomobject]@{ Status = $LASTEXITCODE; Output = $output }
+}
+
+function ConvertTo-NativeArgument([string] $Value) {
+  if ((Get-Variable -Name PSNativeCommandArgumentPassing -ValueOnly -ErrorAction SilentlyContinue) -in @('Windows', 'Standard')) { return $Value }
+  if ($Value -eq '') { return '""' }
+  $escaped = $Value -replace '(\\*)"', '$1$1\"'
+  if ($PSVersionTable.PSEdition -eq 'Desktop' -and $Value -match '\s') { $escaped = $escaped -replace '(\\+)$', '$1$1' }
+  $escaped
+}
+
+function Invoke-Docker {
+  & docker @args
+  if ($LASTEXITCODE -ne 0) { Exit-Bootstrap $LASTEXITCODE }
+}
+
+function Read-Docker {
+  $read = [pscustomobject]@{ Answers = $false; Platform = ''; System = ''; Kernel = ''; Cause = 'the docker command is not installed' }
+  if (-not (Get-Command docker -CommandType Application -ErrorAction SilentlyContinue)) { return $read }
+  $result = Invoke-Native docker @('info', '--format', '{{.OSType}}/{{.Architecture}}|{{.OperatingSystem}}|{{.KernelVersion}}')
+  $line = @($result.Output | Where-Object { $_ -match '^[a-z]+/[a-z0-9_]+\|' })
+  if ($result.Status -ne 0 -or $line.Count -eq 0) {
+    $read.Cause = @($result.Output | Where-Object { $_ })[-1]
+    return $read
+  }
+  $fields = $line[0].Split('|')
+  $read.Answers = $true
+  $read.Platform = $fields[0]
+  $read.System = $fields[1]
+  $read.Kernel = $fields[2]
+  $read
+}
+
+function Invoke-Elevated([string] $FilePath, [string[]] $ElevatedArguments, [string] $Failure, [int[]] $Accepted = @(0)) {
+  try {
+    $process = Start-Process -FilePath $FilePath -ArgumentList $ElevatedArguments -Verb RunAs -Wait -PassThru
+  } catch {
+    Stop-Bootstrap "$Failure; Windows did not grant administrator rights: $($_.Exception.Message); rerun this bootstrap and approve the prompt"
+  }
+  if ($Accepted -notcontains $process.ExitCode) {
+    Stop-Bootstrap "$Failure (exit $($process.ExitCode)); rerun this bootstrap"
+  }
+}
+
+function Get-WslVersion {
+  if (-not (Get-Command wsl.exe -CommandType Application -ErrorAction SilentlyContinue)) { return $null }
+  $result = Invoke-Native wsl.exe @('--version')
+  if ($result.Status -ne 0) { return $null }
+  if ((($result.Output -join "`n") -replace "`0", '') -match '(\d+)\.(\d+)\.(\d+)') {
+    return [version]"$($Matches[1]).$($Matches[2]).$($Matches[3])"
+  }
+  $null
+}
+
+function Initialize-Wsl {
+  $version = Get-WslVersion
+  if ($null -eq $version) {
+    Write-Host 'Installing WSL through wsl --install --no-distribution; Windows asks you to approve administrator rights.'
+    Invoke-Elevated 'wsl.exe' @('--install', '--no-distribution') 'WSL could not be installed' @(0, 3010)
+    Stop-Bootstrap 'WSL is installed and needs a Windows restart; restart Windows, then rerun this bootstrap'
+  }
+  if ($version -lt $MinimumWsl) {
+    Write-Host "Updating WSL $version through wsl --update; Windows asks you to approve administrator rights."
+    Invoke-Elevated 'wsl.exe' @('--update') 'WSL could not be updated'
+  }
+}
+
+function Find-DockerDesktop {
+  foreach ($location in @((Join-Path $env:ProgramFiles 'Docker\Docker'), (Join-Path $env:LOCALAPPDATA 'Programs\DockerDesktop'))) {
+    if (Test-Path -LiteralPath (Join-Path $location 'Docker Desktop.exe') -PathType Leaf) { return $location }
+  }
+  $null
+}
+
+function Add-DockerPath([string] $Location) {
+  if (-not (Get-Command docker -CommandType Application -ErrorAction SilentlyContinue)) {
+    $env:PATH = "$env:PATH;$(Join-Path $Location 'resources\bin')"
+  }
+}
+
+function Install-DockerDesktop {
+  $download = Join-Path ([IO.Path]::GetTempPath()) ([IO.Path]::GetRandomFileName())
+  [void][IO.Directory]::CreateDirectory($download)
+  try {
+    $installer = Join-Path $download 'Docker Desktop Installer.exe'
+    Write-Host 'Downloading Docker Desktop for Windows from docker.com.'
+    try {
+      Invoke-WebRequest -UseBasicParsing -Uri $DesktopInstaller -OutFile $installer
+    } catch {
+      Stop-Bootstrap "Docker Desktop could not be downloaded: $($_.Exception.Message)"
+    }
+    Write-Host 'Installing Docker Desktop for this Windows account.'
+    try {
+      $process = Start-Process -FilePath $installer -ArgumentList @('install', '--user', '--quiet') -Wait -PassThru
+    } catch {
+      Stop-Bootstrap "the Docker Desktop installer could not be started: $($_.Exception.Message)"
+    }
+    if ($process.ExitCode -ne 0) { Stop-Bootstrap "the Docker Desktop installer did not finish (exit $($process.ExitCode))" }
+  } finally {
+    Remove-Item -LiteralPath $download -Recurse -Force -ErrorAction SilentlyContinue
+  }
+}
+
+function Initialize-DockerDesktop {
+  $location = Find-DockerDesktop
+  if ($location) { Add-DockerPath $location }
+  $docker = Read-Docker
+  if ($docker.Answers) { return $docker }
+  if ($Forwarding) {
+    if (-not $location) { Stop-Bootstrap 'House Kit is not installed; run this bootstrap without arguments first' }
+    Stop-Bootstrap "Docker Desktop does not answer: $($docker.Cause); start Docker Desktop, then rerun this command"
+  }
+  Initialize-Wsl
+  if (-not $location) {
+    Install-DockerDesktop
+    $location = Find-DockerDesktop
+    if (-not $location) { Stop-Bootstrap 'Docker Desktop is not where its installer puts it; rerun this bootstrap' }
+    Add-DockerPath $location
+  }
+  Write-Host 'Starting Docker Desktop; accept its terms or finish its setup if its window asks.'
+  try {
+    Start-Process -FilePath (Join-Path $location 'Docker Desktop.exe')
+  } catch {
+    Stop-Bootstrap "Docker Desktop could not be started: $($_.Exception.Message)"
+  }
+  $waited = 0
+  while (-not ($docker = Read-Docker).Answers) {
+    if ($waited -ge $DesktopWaitSeconds) {
+      Stop-Bootstrap "Docker Desktop is not ready: $($docker.Cause); finish what its window asks, then rerun this bootstrap"
+    }
+    Start-Sleep -Seconds 2
+    $waited += 2
+  }
+  $docker
+}
+
+function Protect-Directory([string] $Path) {
+  if ($Path.Contains(',')) { Stop-Bootstrap "$Path contains a comma, which this bootstrap cannot pass to a Docker mount from Windows PowerShell" }
+  $item = Get-Item -LiteralPath $Path -Force -ErrorAction SilentlyContinue
+  if ($item -and ($item.Attributes -band [IO.FileAttributes]::ReparsePoint)) { Stop-Bootstrap "$Path is a symbolic link" }
+  $created = -not $item
+  if ($created) {
+    try { [void][IO.Directory]::CreateDirectory($Path) } catch { Stop-Bootstrap "$Path could not be created" }
+    $item = Get-Item -LiteralPath $Path -Force
+  }
+  if (-not $item.PSIsContainer) { Stop-Bootstrap "$Path is not a directory" }
+  $owner = (Get-Acl -LiteralPath $Path).GetOwner([Security.Principal.SecurityIdentifier]).Value
+  if (-not $created -and $owner -ne $User.Value) { Stop-Bootstrap "$Path is not owned by this User" }
+  try {
+    $security = New-Object Security.AccessControl.DirectorySecurity
+    if ($owner -ne $User.Value) { $security.SetOwner($User) }
+    $security.SetAccessRuleProtection($true, $false)
+    $security.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($User, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow')))
+    $item.SetAccessControl($security)
+  } catch {
+    Stop-Bootstrap "$Path could not be owner-protected"
+  }
+  $item.FullName.TrimEnd('\')
+}
+
+function Invoke-KitHome([string] $Failure, [string] $Script) {
+  $ErrorActionPreference = 'Continue'
+  $output = @($input | & docker run -i --rm --network none --mount $KitHomeMount --entrypoint sh $Image -c $Script 2>&1 | ForEach-Object { "$_" })
+  if ($LASTEXITCODE -ne 0) { Stop-Bootstrap "${Failure}: $(@($output | Where-Object { $_ })[-1])" }
+  $output
+}
+
+function Read-KitHome {
+  $files = @{}
+  $listed = Invoke-KitHome 'the Kit home could not be read' 'cd /kit-home && for name in environment house kit.json; do if [ -f $name ]; then echo $name $(base64 -w 0 $name); fi; done && if [ -f credential ]; then echo credential; fi'
+  foreach ($line in @($listed | Where-Object { $_ -match '^(credential|environment|house|kit\.json)( [A-Za-z0-9+/=]+)?$' })) {
+    $file, $encoded = $line -split ' ', 2
+    $files[$file] = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("$encoded"))
+  }
+  $files
+}
+
+function Write-KitHome([string] $File, [string] $Text) {
+  [void]([Convert]::ToBase64String((New-Object Text.UTF8Encoding($false)).GetBytes($Text)) | Invoke-KitHome "$File could not be updated" "umask 077 && base64 -di > /kit-home/$File")
+}
+
+function Read-Inspect([string] $Format) {
+  $value = & docker inspect --format $Format $Name
+  if ($LASTEXITCODE -ne 0) { Exit-Bootstrap $LASTEXITCODE }
+  "$value"
+}
+
+function Read-Source([string] $Destination) {
+  $source = Read-Inspect ('{{range .Mounts}}{{if eq .Destination `' + $Destination + '`}}{{.Source}}{{end}}{{end}}')
+  if ($source -match '^/run/desktop/mnt/host/([a-z])(/.*)?$') { $source = "$($Matches[1].ToUpper()):$($Matches[2] -replace '/', '\')" }
+  $source
+}
+
+function Test-Container {
+  (Invoke-Native docker @('container', 'inspect', $Name)).Status -eq 0
+}
+
+function Invoke-Login([string[]] $LoginArguments) {
+  if ($LoginArguments -contains '--manual') {
+    Invoke-Docker run -i --rm @Network @Common login @LoginArguments
+    return
+  }
+  & docker run @Published --rm @Network @Common login @LoginArguments --host-browser | ForEach-Object {
+    if ($_ -like 'Open *') {
+      Write-Host 'Opening House Login in the host browser.'
+      try { Start-Process -FilePath $_.Substring(5) } catch { Stop-Bootstrap 'host browser did not open; rerun with --manual' }
+    } else {
+      Write-Host $_
+    }
+  }
+  if ($LASTEXITCODE -ne 0) { Exit-Bootstrap $LASTEXITCODE }
+}
+
+function Start-Resident {
+  $resident = @()
+  if (-not $House.StartsWith('https://')) { $resident = @('--network', 'host') }
+  Invoke-Docker run -d --name $Name --restart unless-stopped @resident --mount $KitHomeMount --mount $WorkspaceMount --label "agentshouse.house=$House" --env HOME=/kit-home --env HOUSE_KIT_HOME=/kit-home --env HOUSE_KIT_CONTAINER=1 $Image resident | Out-Null
+}
+
+function Connect-Kit {
+  $House = 'https://agents.house'
+  $Workspace = $null
+  $Manual = $false
+  $Skills = 'true'
+  $WorkspaceSelected = $false
+  $HouseSelected = $false
+  $Forwarding = $false
+  $Forwarded = 'kit'
+  $Forward = @()
+  $Arguments = $BootstrapArguments
+  if ($Arguments.Count -gt 0 -and ($Arguments[0] -ceq 'kit' -or $Arguments[0] -ceq 'house')) {
+    $Forwarding = $true
+    $Forwarded = $Arguments[0]
+    $Forward = @($Arguments | Select-Object -Skip 1 | ForEach-Object { ConvertTo-NativeArgument $_ })
+    $Arguments = @()
+  }
+  for ($index = 0; $index -lt $Arguments.Count; $index++) {
+    $argument = $Arguments[$index]
+    if ($argument -ceq '--workspace' -or $argument -ceq '--house') {
+      if ($index + 1 -ge $Arguments.Count) { Stop-Bootstrap "$argument requires one value" }
+      $index++
+      if ($argument -ceq '--workspace') {
+        if ($WorkspaceSelected) { Stop-Bootstrap 'supply exactly one workspace root' }
+        $Workspace = $Arguments[$index]
+        $WorkspaceSelected = $true
+      } else {
+        if ($HouseSelected) { Stop-Bootstrap 'supply exactly one House origin' }
+        $House = $Arguments[$index]
+        $HouseSelected = $true
+      }
+    } elseif ($argument -ceq '--manual') {
+      $Manual = $true
+    } elseif ($argument -ceq '--no-skills') {
+      $Skills = 'false'
+    } else {
+      Stop-Bootstrap "unknown argument $argument"
+    }
+  }
+
+  if ($Image -notmatch '^ghcr\.io/agentshouse/kit@sha256:[0-9a-f]{64}$') { Stop-Bootstrap 'this bootstrap has not been published with an immutable image digest' }
+  if ($env:OS -ne 'Windows_NT') { Stop-Bootstrap 'this bootstrap is for Windows 11; run connect-linux.sh on Linux and macOS' }
+  if (-not [Environment]::Is64BitProcess) { Stop-Bootstrap 'this is a 32-bit PowerShell; run this bootstrap from the 64-bit Windows PowerShell' }
+  $system = Get-CimInstance -ClassName Win32_OperatingSystem
+  if ([int]$system.ProductType -ne 1) { Stop-Bootstrap "$($system.Caption) is a Windows Server edition; this bootstrap supports Windows 11 on amd64" }
+  if ([int]$system.BuildNumber -lt 22000) { Stop-Bootstrap "$($system.Caption) is not Windows 11; this bootstrap supports Windows 11 on amd64" }
+  if ([int]$system.BuildNumber -lt $MinimumBuild) { Stop-Bootstrap "Docker Desktop needs Windows 11 23H2 (build $MinimumBuild) or later, not build $($system.BuildNumber); update Windows, then rerun this bootstrap" }
+  $processor = [int]@(Get-CimInstance -ClassName Win32_Processor)[0].Architecture
+  if ($processor -ne 9) {
+    $described = @{ 0 = 'x86'; 5 = 'ARM'; 12 = 'ARM64' }[$processor]
+    if (-not $described) { $described = "architecture $processor" }
+    Stop-Bootstrap "Windows on $described is not supported; this bootstrap supports Windows 11 on amd64"
+  }
+  if ($WorkspaceSelected -and $Workspace -notmatch '^[A-Za-z]:\\') { Stop-Bootstrap 'workspace root must be an absolute path' }
+
+  $docker = Initialize-DockerDesktop
+  if (-not $docker.Platform.StartsWith('linux/')) { Stop-Bootstrap "Docker runs $($docker.Platform.Split('/')[0]) containers; switch Docker Desktop to Linux containers, then rerun this bootstrap" }
+  if ($docker.System -ne 'Docker Desktop') { Stop-Bootstrap "Docker answers from $($docker.System), not Docker Desktop; stop that engine or switch Docker to Docker Desktop, then rerun this bootstrap" }
+  if ($docker.Kernel -notlike '*WSL2*') { Stop-Bootstrap "Docker Desktop does not use its WSL 2 engine; turn on Use the WSL 2 based engine in its settings, then rerun this bootstrap" }
+  if ($docker.Platform -ne 'linux/x86_64' -and $docker.Platform -ne 'linux/amd64') { Stop-Bootstrap "host linux/amd64 does not match Docker Desktop $($docker.Platform)" }
+  if ($Forwarding) {
+    if (-not (Test-Container)) { Stop-Bootstrap 'House Kit is not installed; run this bootstrap without arguments first' }
+    if ((Read-Inspect '{{.Config.Image}}') -cne $Image) { Stop-Bootstrap 'an installed Kit uses a different image; rerun this bootstrap without arguments to update it' }
+    $Workspace = Read-Source '/agents/house'
+    if ($Workspace -notmatch '^[A-Za-z]:\\' -or -not (Test-Path -LiteralPath $Workspace -PathType Container)) {
+      Stop-Bootstrap "the installed Kit's workspace root $Workspace is not a directory on this computer; rerun this bootstrap without arguments"
+    }
+  } else {
+    Invoke-Docker volume create $KitHome | Out-Null
+    if ((Invoke-Native docker @('image', 'inspect', '--format', '{{.Id}}', $Image)).Status -ne 0) { Invoke-Docker pull --quiet --platform linux/amd64 $Image | Out-Null }
+  }
+  if (-not $Workspace) { $Workspace = Join-Path $env:USERPROFILE 'AgentsHouse' }
+
+  $User = [Security.Principal.WindowsIdentity]::GetCurrent().User
+  $Workspace = Protect-Directory $Workspace
+  $WorkspaceMount = "type=bind,src=$Workspace,dst=/agents/house"
+  $stored = Read-KitHome
+  if (($stored.ContainsKey('credential') -or $stored.ContainsKey('environment')) -and -not $stored.ContainsKey('house')) {
+    Stop-Bootstrap 'stored House origin is missing for an enrolled Environment'
+  }
+  if ($stored.ContainsKey('house')) {
+    $boundHouse = @($stored['house'] -split '\r?\n')[0]
+    if (-not $boundHouse) { Stop-Bootstrap 'stored House origin is unreadable' }
+    if ($HouseSelected -and $House -cne $boundHouse) { Stop-Bootstrap 'this Environment is bound to another House origin' }
+    $House = $boundHouse
+  }
+  if ($House -notmatch '^(https://|http://127\.0\.0\.1:|http://localhost:)') { Stop-Bootstrap 'House origin must use HTTPS or local loopback HTTP' }
+  if (-not $Forwarding) {
+    $text = "{`"availability`":`"intermittent`",`"execution_authority`":`"allow`",`"migrators`":[],`"instances`":[],`"clients`":[],`"host`":null,`"skills`":$Skills}`n"
+    if ($stored.ContainsKey('kit.json')) {
+      $text = $stored['kit.json']
+      if ($text -match '"skills"\s*:') {
+        $text = $text -replace '("skills"\s*:\s*)(true|false)', "`${1}$Skills"
+      } else {
+        $text = $text -replace '^(\s*)\{', "`${1}{`"skills`":$Skills,"
+      }
+    }
+    if ($text -notmatch "`"skills`"\s*:\s*$Skills") { Stop-Bootstrap 'kit.json could not be updated' }
+    Write-KitHome 'kit.json' $text
+  }
+  $Network = @('--network', 'host')
+  $Published = @()
+  if ($House.StartsWith('https://')) {
+    $Network = @()
+    $port = Get-Random -Minimum 49152 -Maximum 65536
+    $Published = @('--publish', "127.0.0.1:${port}:$port", '--env', "HOUSE_KIT_LOGIN_PORT=$port")
+  }
+  $Common = @('--mount', $KitHomeMount, '--mount', $WorkspaceMount, '--env', 'HOME=/kit-home', '--env', 'HOUSE_KIT_HOME=/kit-home', '--env', 'HOUSE_KIT_CONTAINER=1', '--env', "HOUSE_KIT_HOSTNAME=$([Net.Dns]::GetHostName())", $Image)
+
+  if (Test-Container) {
+    $installed = Read-Inspect '{{.Config.Image}}'
+    if ((Read-Inspect '{{.HostConfig.RestartPolicy.Name}}') -cne 'unless-stopped') { Stop-Bootstrap 'the installed Kit has a different lifecycle' }
+    if ((Read-Inspect '{{len .Mounts}}') -cne '2') { Stop-Bootstrap 'the installed Kit has unexpected mounts' }
+    if ((Read-Inspect '{{range .Mounts}}{{if eq .Destination `/kit-home`}}{{.Name}}{{end}}{{end}}') -cne $KitHome) { Stop-Bootstrap 'the installed Kit uses another Kit home' }
+    if ((Read-Inspect '{{range .Mounts}}{{if eq .Destination `/kit-home`}}{{.Type}}/{{.RW}}{{end}}{{end}}') -cne 'volume/true') { Stop-Bootstrap 'the installed Kit home is not a writable volume' }
+    if ((Read-Source '/agents/house') -ine $Workspace) { Stop-Bootstrap 'the installed Kit uses another workspace root' }
+    if ((Read-Inspect '{{range .Mounts}}{{if eq .Destination `/agents/house`}}{{.Type}}/{{.RW}}{{end}}{{end}}') -cne 'bind/true') { Stop-Bootstrap 'the installed workspace is not a writable bind mount' }
+    if ((Read-Inspect '{{index .Config.Labels `agentshouse.house`}}') -cne $House) { Stop-Bootstrap 'the installed Kit uses another House origin' }
+    if (-not ($stored.ContainsKey('credential') -and $stored.ContainsKey('environment') -and $stored.ContainsKey('house'))) { Stop-Bootstrap 'the installed Kit has no enrolled authority' }
+    if ($Forwarding) {
+      if ($Forwarded -ceq 'kit' -and $Forward.Count -gt 0 -and $Forward[0] -ceq 'login') {
+        Invoke-Login @($Forward | Select-Object -Skip 1)
+        return
+      }
+      $placed = @()
+      $entry = @()
+      if ($Forwarded -ceq 'house') {
+        $here = (Get-Location).ProviderPath.TrimEnd('\')
+        if ($here -ine $Workspace -and -not $here.StartsWith("$Workspace\", [StringComparison]::OrdinalIgnoreCase)) {
+          Stop-Bootstrap "the current directory is outside the workspace $Workspace"
+        }
+        $placed = @('--workdir', "/agents/house$($here.Substring($Workspace.Length).Replace('\', '/'))")
+        $entry = @('--entrypoint', 'house')
+      }
+      $terminal = @()
+      if (-not [Console]::IsInputRedirected) { $terminal = @('-t') }
+      if ((Read-Inspect '{{.State.Running}}') -ceq 'true') {
+        & docker exec -i @terminal @placed $Name $Forwarded @Forward
+      } else {
+        & docker run -i @terminal @placed @entry --rm @Network @Common @Forward
+      }
+      Exit-Bootstrap $LASTEXITCODE
+    }
+    if ($installed -cne $Image) {
+      if ((Read-Inspect '{{.State.Running}}') -ceq 'true') { Invoke-Docker exec $Name kit resident drain }
+      Invoke-Docker rm -f $Name | Out-Null
+      [void](Invoke-KitHome 'the Kit home could not be updated' 'rm -f /kit-home/state/update-drain')
+      Start-Resident
+      Write-Host "House Kit updated for Environment $($stored['environment'].Trim())."
+      return
+    }
+    Invoke-Docker run --rm @Network @Common credential check
+    if ((Read-Inspect '{{.State.Running}}') -ceq 'true') {
+      Write-Host "House Kit is already running for Environment $($stored['environment'].Trim())."
+    } else {
+      Invoke-Docker start $Name | Out-Null
+      Write-Host "House Kit restarted for Environment $($stored['environment'].Trim())."
+    }
+    return
+  }
+
+  if ($stored.ContainsKey('credential')) {
+    Invoke-Docker run --rm @Network @Common credential check
+  } else {
+    $login = @()
+    if ($HouseSelected) { $login += @('--house', $House) }
+    if ($Manual) { $login += '--manual' }
+    Invoke-Login $login
+  }
+  Invoke-Docker run --rm @Network @Common apply
+  Start-Resident
+  Write-Host "House Kit connected for Environment $((Read-KitHome)['environment'].Trim())."
+}
+
+$consoleEncoding = [Console]::OutputEncoding
+try {
+  try {
+    [Console]::OutputEncoding = New-Object Text.UTF8Encoding($false)
+  } catch {
+    Stop-Bootstrap 'this PowerShell has no console; run this bootstrap from a Windows PowerShell console window'
+  }
+  Connect-Kit
+  $global:LASTEXITCODE = 0
+} catch {
+  $message = "$($_.Exception.Message)"
+  if ($message -match '^kit_bootstrap_exit: (\d+)$') {
+    $global:LASTEXITCODE = [int]$Matches[1]
+  } elseif ($message.StartsWith('kit_bootstrap_refused: ')) {
+    [Console]::Error.WriteLine($message)
+    $global:LASTEXITCODE = 1
+  } else {
+    $global:LASTEXITCODE = 1
+    throw
+  }
+} finally {
+  try { [Console]::OutputEncoding = $consoleEncoding } catch { }
+}