@agimon-ai/doompi-sandbox 0.0.1-alpha.101

package/dist/cockpitHarness.cjs

@@ -0,0 +1,298 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_harness = require("./harness-fK8CSaU1.cjs");
+let node_child_process = require("node:child_process");
+let _agimon_ai_doompi_core_sandboxHarness = require("@agimon-ai/doompi-core/sandboxHarness");
+//#region src/services/cockpitPlan/index.ts
+/**
+* Projects the cockpit into one detached engine run.
+*
+* The sandbox plan next door describes a disposable container wrapped around a
+* single interactive session. This one describes a long-lived container holding
+* the hub and every session it goes on to spawn, which changes four things:
+* it is detached rather than attached, it publishes a port rather than only
+* consuming them, its home volume is scoped to the cockpit rather than to one
+* repository, and it mounts a set of workspaces rather than a single repo.
+*/
+const CONTAINER_HOME = "/doompi-home";
+/**
+* One volume for the cockpit, not one per repository.
+*
+* A cockpit spans several workspaces, so there is no repository to key on. This
+* is also where `~/.doompi/web` lands, which is what makes paired passkeys and
+* the bundle signing key survive a container restart. A rotated signing key
+* would make every paired device refuse the cockpit, so the name must be
+* stable.
+*/
+const COCKPIT_HOME_VOLUME = "doompi-cockpit-home";
+const COCKPIT_LABEL = "doompi.cockpit";
+const COCKPIT_BINARY = "doompi-web";
+const LOOPBACK = "127.0.0.1";
+/**
+* The cockpit binds every interface inside the container.
+*
+* A published port reaches the container's external interface, never its
+* loopback, which is the same reason `oauthCallback.ts` sets its own bind
+* address. The host side of the publish is pinned to loopback, so this is not
+* exposed beyond the machine.
+*/
+const CONTAINER_BIND = "0.0.0.0";
+const LINUX_PLATFORM = "linux";
+const DISABLED = "0";
+/**
+* Git identity, passed as environment rather than by mounting a config.
+*
+* The agent can commit; it cannot push, because no key crosses the boundary.
+* Mounting `~/.gitconfig` would drag in whatever else it configures, and
+* forwarding an ssh agent would hand the container a live credential that
+* authenticates as the user everywhere their key reaches.
+*/
+function gitIdentityEnvironment(identity) {
+	if (identity === void 0) return {};
+	return {
+		GIT_AUTHOR_NAME: identity.name,
+		GIT_AUTHOR_EMAIL: identity.email,
+		GIT_COMMITTER_NAME: identity.name,
+		GIT_COMMITTER_EMAIL: identity.email
+	};
+}
+function buildCockpitPlan(input) {
+	const { engine, host, broker, imageTag, port } = input;
+	if (input.workspaces.length === 0) throw new Error("A cockpit container needs at least one workspace to mount.");
+	const environment = {
+		...require_harness.containerEnvironment(input.environment, broker),
+		...gitIdentityEnvironment(input.gitIdentity),
+		[require_harness.DEVCONTAINER_DISABLED_ENV]: DISABLED,
+		[_agimon_ai_doompi_core_sandboxHarness.DOOMPI_SANDBOX_ENV]: "1"
+	};
+	const environmentPairs = Object.entries(environment).sort(([left], [right]) => left.localeCompare(right));
+	return {
+		imageTag,
+		runArgs: [
+			"run",
+			"-d",
+			"--label",
+			`${COCKPIT_LABEL}=${String(port)}`,
+			"-p",
+			`${LOOPBACK}:${String(port)}:${String(port)}`,
+			...input.workspaces.flatMap((workspace) => ["-v", `${workspace.path}:${workspace.path}`]),
+			"-v",
+			`${COCKPIT_HOME_VOLUME}:${CONTAINER_HOME}`,
+			...broker?.endpoint.transport === "tcp" ? ["--add-host", `host.docker.internal:host-gateway`] : [],
+			...broker?.endpoint.transport === "unix" ? ["-v", `${broker.endpoint.socketDirectory}:/run/doompi`] : [],
+			"-w",
+			input.workspaces[0]?.path ?? CONTAINER_HOME,
+			"-e",
+			`HOME=${CONTAINER_HOME}`,
+			...environmentPairs.flatMap(([name, value]) => ["-e", `${name}=${value}`]),
+			...host.platform === LINUX_PLATFORM && host.userId !== void 0 ? [
+				"--user",
+				`${String(host.userId)}:${String(host.groupId ?? host.userId)}`,
+				...engine === "podman" ? ["--userns=keep-id"] : []
+			] : [],
+			...input.runFlags ?? [],
+			imageTag,
+			COCKPIT_BINARY,
+			"--host",
+			CONTAINER_BIND,
+			"--port",
+			String(port)
+		]
+	};
+}
+//#endregion
+//#region src/services/cockpitHarness/index.ts
+/**
+* Runs the cockpit itself in a container, detached, holding the hub and every
+* session it goes on to spawn.
+*
+* The interactive harness next door wraps one session and blocks until it
+* exits. This one returns a handle while the container keeps running, which is
+* why it is a separate entry rather than a flag on the other.
+*/
+const RUN_FLAGS_ENV = "DOOMPI_SANDBOX_RUN_FLAGS";
+const READY_TIMEOUT_MS = 6e4;
+const READY_POLL_MS = 250;
+const HUB_ROLE = "hub";
+/**
+* Reads the host's committer identity.
+*
+* Passed into the container as environment rather than by mounting the config,
+* so the agent can commit without any credential crossing the boundary. It
+* cannot push, and that is the intended limit.
+*/
+function readGitIdentity() {
+	const read = (key) => {
+		try {
+			const value = (0, node_child_process.execFileSync)("git", [
+				"config",
+				"--global",
+				"--get",
+				key
+			], { encoding: "utf8" }).trim();
+			return value === "" ? void 0 : value;
+		} catch {
+			return;
+		}
+	};
+	const name = read("user.name");
+	const email = read("user.email");
+	return name !== void 0 && email !== void 0 ? {
+		name,
+		email
+	} : void 0;
+}
+/** Answers whether the hub inside the container is serving yet. */
+async function defaultProbe(port) {
+	try {
+		const response = await fetch(`http://127.0.0.1:${String(port)}/api/health`);
+		if (!response.ok) return false;
+		return (await response.json()).role === HUB_ROLE;
+	} catch {
+		return false;
+	}
+}
+async function stopContainer(runner, engine, id) {
+	const stopped = await runner.capture(engine, ["stop", id]);
+	await runner.capture(engine, [
+		"rm",
+		"-f",
+		id
+	]);
+	return stopped?.exitCode === 0;
+}
+/**
+* Whether the engine still reports this container as running.
+*
+* A removed container makes `inspect` fail rather than print `false`, so a
+* non-zero exit is read the same way: not running.
+*/
+async function isRunning(runner, engine, id) {
+	const probed = await runner.capture(engine, [
+		"inspect",
+		"-f",
+		"{{.State.Running}}",
+		id
+	]);
+	return probed?.exitCode === 0 && probed.stdout.trim() === "true";
+}
+function createCockpitHarness(dependencies = {}) {
+	const runner = dependencies.runner ?? new require_harness.SpawnEngineProcessRunner();
+	const probe = dependencies.probe ?? defaultProbe;
+	const readIdentity = dependencies.gitIdentity ?? readGitIdentity;
+	const now = dependencies.now ?? (() => Date.now());
+	return {
+		async startCockpitContainer(request) {
+			if (request.workspaces.length === 0) return {
+				ok: false,
+				error: "A cockpit container needs at least one workspace to mount."
+			};
+			let engine;
+			try {
+				engine = await require_harness.detectEngine(runner, request.environment);
+			} catch (error) {
+				return {
+					ok: false,
+					error: error instanceof Error ? error.message : String(error)
+				};
+			}
+			const runFlags = require_harness.parseRunFlags(request.environment[RUN_FLAGS_ENV]);
+			try {
+				require_harness.assertRunFlags(runFlags, RUN_FLAGS_ENV);
+			} catch (error) {
+				return {
+					ok: false,
+					error: error instanceof Error ? error.message : String(error)
+				};
+			}
+			request.onProgress?.(`using ${engine}${runFlags.length > 0 ? ` with ${runFlags.join(" ")}` : ""}`);
+			const version = dependencies.version ?? "0.0.0";
+			let imageTag;
+			try {
+				imageTag = await require_harness.ensureImage(runner, engine, version, request.onProgress, {
+					tag: require_harness.cockpitImageTag(version),
+					dockerfile: require_harness.cockpitDockerfile()
+				});
+			} catch (error) {
+				return {
+					ok: false,
+					error: error instanceof Error ? error.message : String(error)
+				};
+			}
+			const plan = buildCockpitPlan({
+				workspaces: request.workspaces,
+				port: request.port,
+				environment: request.environment,
+				engine,
+				host: {
+					hasTty: false,
+					platform: process.platform,
+					repoKey: "",
+					version
+				},
+				imageTag,
+				runFlags,
+				...readIdentity() === void 0 ? {} : { gitIdentity: readIdentity() }
+			});
+			const started = await runner.capture(engine, plan.runArgs);
+			const containerId = started?.stdout.trim().split("\n").pop() ?? "";
+			if (started?.exitCode !== 0 || containerId === "") return {
+				ok: false,
+				error: `The cockpit container did not start: ${started?.stdout.trim() ?? "no output"}`
+			};
+			request.onProgress?.("waiting for the cockpit to answer");
+			const deadline = now() + READY_TIMEOUT_MS;
+			for (;;) {
+				if (await probe(request.port)) break;
+				if (now() >= deadline) {
+					const logs = await runner.capture(engine, [
+						"logs",
+						"--tail",
+						"20",
+						containerId
+					]);
+					await stopContainer(runner, engine, containerId);
+					return {
+						ok: false,
+						error: `The cockpit did not answer within ${String(READY_TIMEOUT_MS / 1e3)}s.\n${logs?.stdout ?? ""}`.trim()
+					};
+				}
+				await new Promise((resolve) => setTimeout(resolve, READY_POLL_MS));
+			}
+			return {
+				ok: true,
+				handle: {
+					containerId,
+					stop: async () => {
+						await stopContainer(runner, engine, containerId);
+					},
+					alive: async () => await isRunning(runner, engine, containerId)
+				}
+			};
+		},
+		async reapCockpitContainer(containerId) {
+			for (const engine of [
+				"docker",
+				"podman",
+				"nerdctl",
+				"finch"
+			]) {
+				if ((await runner.capture(engine, ["--version"]))?.exitCode !== 0) continue;
+				return await stopContainer(runner, engine, containerId);
+			}
+			return false;
+		}
+	};
+}
+/** The module-shaped entry a host resolves from the composition. */
+async function startCockpitContainer(request) {
+	return await createCockpitHarness().startCockpitContainer(request);
+}
+async function reapCockpitContainer(containerId) {
+	return await createCockpitHarness().reapCockpitContainer(containerId);
+}
+//#endregion
+exports.createCockpitHarness = createCockpitHarness;
+exports.reapCockpitContainer = reapCockpitContainer;
+exports.startCockpitContainer = startCockpitContainer;
+
+//# sourceMappingURL=cockpitHarness.cjs.map

package/dist/cockpitHarness.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cockpitHarness.cjs","names":["containerEnvironment","DEVCONTAINER_DISABLED_ENV","DOOMPI_SANDBOX_ENV","execFileSync","SpawnEngineProcessRunner","detectEngine","parseRunFlags","ensureImage","cockpitImageTag","cockpitDockerfile"],"sources":["../src/services/cockpitPlan/index.ts","../src/services/cockpitHarness/index.ts"],"sourcesContent":["import type { CockpitWorkspace } from '@agimon-ai/doompi-core/cockpitContainer';\nimport { DOOMPI_SANDBOX_ENV } from '@agimon-ai/doompi-core/sandboxHarness';\n\nimport type { SandboxEngine, SandboxHostFacts } from '../../types/sandboxHarness';\nimport { DEVCONTAINER_DISABLED_ENV } from '../devcontainer';\nimport { containerEnvironment, type SandboxPlanBroker } from '../sandboxPlan';\n\n/**\n * Projects the cockpit into one detached engine run.\n *\n * The sandbox plan next door describes a disposable container wrapped around a\n * single interactive session. This one describes a long-lived container holding\n * the hub and every session it goes on to spawn, which changes four things:\n * it is detached rather than attached, it publishes a port rather than only\n * consuming them, its home volume is scoped to the cockpit rather than to one\n * repository, and it mounts a set of workspaces rather than a single repo.\n */\n\nconst CONTAINER_HOME = '/doompi-home';\n/**\n * One volume for the cockpit, not one per repository.\n *\n * A cockpit spans several workspaces, so there is no repository to key on. This\n * is also where `~/.doompi/web` lands, which is what makes paired passkeys and\n * the bundle signing key survive a container restart. A rotated signing key\n * would make every paired device refuse the cockpit, so the name must be\n * stable.\n */\nexport const COCKPIT_HOME_VOLUME = 'doompi-cockpit-home';\nexport const COCKPIT_LABEL = 'doompi.cockpit';\nconst COCKPIT_BINARY = 'doompi-web';\nconst LOOPBACK = '127.0.0.1';\n/**\n * The cockpit binds every interface inside the container.\n *\n * A published port reaches the container's external interface, never its\n * loopback, which is the same reason `oauthCallback.ts` sets its own bind\n * address. The host side of the publish is pinned to loopback, so this is not\n * exposed beyond the machine.\n */\nconst CONTAINER_BIND = '0.0.0.0';\nconst LINUX_PLATFORM = 'linux';\nconst DISABLED = '0';\n\n/** Git identity the agent commits under; no key crosses the boundary, so it cannot push. */\nexport interface CockpitGitIdentity {\n  name: string;\n  email: string;\n}\n\nexport interface CockpitPlanInput {\n  workspaces: readonly CockpitWorkspace[];\n  /** Published on the host loopback and bound inside the container. */\n  port: number;\n  environment: Readonly<Record<string, string | undefined>>;\n  engine: SandboxEngine;\n  host: SandboxHostFacts;\n  imageTag: string;\n  runFlags?: readonly string[];\n  broker?: SandboxPlanBroker;\n  gitIdentity?: CockpitGitIdentity;\n}\n\nexport interface CockpitPlan {\n  imageTag: string;\n  /** Full engine argv after the engine binary itself. */\n  runArgs: string[];\n}\n\n/**\n * Git identity, passed as environment rather than by mounting a config.\n *\n * The agent can commit; it cannot push, because no key crosses the boundary.\n * Mounting `~/.gitconfig` would drag in whatever else it configures, and\n * forwarding an ssh agent would hand the container a live credential that\n * authenticates as the user everywhere their key reaches.\n */\nfunction gitIdentityEnvironment(identity: CockpitGitIdentity | undefined): Record<string, string> {\n  if (identity === undefined) return {};\n  return {\n    GIT_AUTHOR_NAME: identity.name,\n    GIT_AUTHOR_EMAIL: identity.email,\n    GIT_COMMITTER_NAME: identity.name,\n    GIT_COMMITTER_EMAIL: identity.email,\n  };\n}\n\nexport function buildCockpitPlan(input: CockpitPlanInput): CockpitPlan {\n  const { engine, host, broker, imageTag, port } = input;\n  if (input.workspaces.length === 0) throw new Error('A cockpit container needs at least one workspace to mount.');\n\n  const environment: Record<string, string> = {\n    ...containerEnvironment(input.environment, broker),\n    ...gitIdentityEnvironment(input.gitIdentity),\n    // A workspace carrying a devcontainer config would otherwise replace the\n    // whole plan with an author-controlled one that can mount anything,\n    // including the docker socket. That would make the containment claim false.\n    [DEVCONTAINER_DISABLED_ENV]: DISABLED,\n    [DOOMPI_SANDBOX_ENV]: '1',\n  };\n  const environmentPairs = Object.entries(environment).sort(([left], [right]) => left.localeCompare(right));\n\n  const runArgs = [\n    'run',\n    // Detached, and deliberately not --rm: a container that exits on startup\n    // has to survive long enough for its logs to be read. The stop path and the\n    // reaper both remove it.\n    '-d',\n    '--label',\n    `${COCKPIT_LABEL}=${String(port)}`,\n    '-p',\n    `${LOOPBACK}:${String(port)}:${String(port)}`,\n    ...input.workspaces.flatMap((workspace) => ['-v', `${workspace.path}:${workspace.path}`]),\n    '-v',\n    `${COCKPIT_HOME_VOLUME}:${CONTAINER_HOME}`,\n    ...(broker?.endpoint.transport === 'tcp' ? ['--add-host', `host.docker.internal:host-gateway`] : []),\n    ...(broker?.endpoint.transport === 'unix' ? ['-v', `${broker.endpoint.socketDirectory}:/run/doompi`] : []),\n    '-w',\n    input.workspaces[0]?.path ?? CONTAINER_HOME,\n    '-e',\n    `HOME=${CONTAINER_HOME}`,\n    ...environmentPairs.flatMap(([name, value]) => ['-e', `${name}=${value}`]),\n    ...(host.platform === LINUX_PLATFORM && host.userId !== undefined\n      ? [\n          '--user',\n          `${String(host.userId)}:${String(host.groupId ?? host.userId)}`,\n          ...(engine === 'podman' ? ['--userns=keep-id'] : []),\n        ]\n      : []),\n    // Last before the image so a configured option wins over the defaults above\n    // it, and cannot be mistaken for the image or its command.\n    ...(input.runFlags ?? []),\n    imageTag,\n    COCKPIT_BINARY,\n    '--host',\n    CONTAINER_BIND,\n    '--port',\n    String(port),\n  ];\n\n  return { imageTag, runArgs };\n}\n","import { execFileSync } from 'node:child_process';\n\nimport type {\n  CockpitContainerHandle,\n  CockpitContainerHarnessModule,\n  CockpitContainerRequest,\n  CockpitContainerStart,\n} from '@agimon-ai/doompi-core/cockpitContainer';\n\nimport type { EngineProcessRunner, SandboxEngine } from '../../types/sandboxHarness';\nimport { buildCockpitPlan, type CockpitGitIdentity } from '../cockpitPlan';\nimport { SpawnEngineProcessRunner } from '../engineProcess';\nimport { detectEngine, ensureImage } from '../harness';\nimport { parseRunFlags, assertRunFlags } from '../runFlags';\nimport { cockpitDockerfile } from '../sandboxImage';\nimport { cockpitImageTag } from '../sandboxImageTag';\n\n/**\n * Runs the cockpit itself in a container, detached, holding the hub and every\n * session it goes on to spawn.\n *\n * The interactive harness next door wraps one session and blocks until it\n * exits. This one returns a handle while the container keeps running, which is\n * why it is a separate entry rather than a flag on the other.\n */\n\nconst RUN_FLAGS_ENV = 'DOOMPI_SANDBOX_RUN_FLAGS';\nconst READY_TIMEOUT_MS = 60_000;\nconst READY_POLL_MS = 250;\nconst HUB_ROLE = 'hub';\n\nexport interface CockpitHarnessDependencies {\n  runner?: EngineProcessRunner;\n  version?: string;\n  /** Test seam: reports whether the cockpit inside is answering yet. */\n  probe?: (port: number) => Promise<boolean>;\n  /** Test seam: the host's git identity, which is read from the real config by default. */\n  gitIdentity?: () => CockpitGitIdentity | undefined;\n  now?: () => number;\n}\n\n/**\n * Reads the host's committer identity.\n *\n * Passed into the container as environment rather than by mounting the config,\n * so the agent can commit without any credential crossing the boundary. It\n * cannot push, and that is the intended limit.\n */\nfunction readGitIdentity(): CockpitGitIdentity | undefined {\n  const read = (key: string): string | undefined => {\n    try {\n      const value = execFileSync('git', ['config', '--global', '--get', key], { encoding: 'utf8' }).trim();\n      return value === '' ? undefined : value;\n    } catch {\n      // No git, or no such key. An agent that cannot commit is a smaller\n      // problem than a launch that refuses to start.\n      return undefined;\n    }\n  };\n  const name = read('user.name');\n  const email = read('user.email');\n  return name !== undefined && email !== undefined ? { name, email } : undefined;\n}\n\n/** Answers whether the hub inside the container is serving yet. */\nasync function defaultProbe(port: number): Promise<boolean> {\n  try {\n    const response = await fetch(`http://127.0.0.1:${String(port)}/api/health`);\n    if (!response.ok) return false;\n    return ((await response.json()) as { role?: unknown }).role === HUB_ROLE;\n  } catch {\n    return false;\n  }\n}\n\nasync function stopContainer(runner: EngineProcessRunner, engine: SandboxEngine, id: string): Promise<boolean> {\n  const stopped = await runner.capture(engine, ['stop', id]);\n  // Removed explicitly because the run is not --rm: a container that dies on\n  // startup has to survive long enough for its logs to be read.\n  await runner.capture(engine, ['rm', '-f', id]);\n  return stopped?.exitCode === 0;\n}\n\n/**\n * Whether the engine still reports this container as running.\n *\n * A removed container makes `inspect` fail rather than print `false`, so a\n * non-zero exit is read the same way: not running.\n */\nasync function isRunning(runner: EngineProcessRunner, engine: SandboxEngine, id: string): Promise<boolean> {\n  const probed = await runner.capture(engine, ['inspect', '-f', '{{.State.Running}}', id]);\n  return probed?.exitCode === 0 && probed.stdout.trim() === 'true';\n}\n\nexport function createCockpitHarness(dependencies: CockpitHarnessDependencies = {}): CockpitContainerHarnessModule {\n  const runner = dependencies.runner ?? new SpawnEngineProcessRunner();\n  const probe = dependencies.probe ?? defaultProbe;\n  const readIdentity = dependencies.gitIdentity ?? readGitIdentity;\n  const now = dependencies.now ?? ((): number => Date.now());\n\n  return {\n    async startCockpitContainer(request: CockpitContainerRequest): Promise<CockpitContainerStart> {\n      if (request.workspaces.length === 0) {\n        return { ok: false, error: 'A cockpit container needs at least one workspace to mount.' };\n      }\n      let engine: SandboxEngine;\n      try {\n        engine = await detectEngine(runner, request.environment);\n      } catch (error) {\n        return { ok: false, error: error instanceof Error ? error.message : String(error) };\n      }\n      const runFlags = parseRunFlags(request.environment[RUN_FLAGS_ENV]);\n      try {\n        assertRunFlags(runFlags, RUN_FLAGS_ENV);\n      } catch (error) {\n        return { ok: false, error: error instanceof Error ? error.message : String(error) };\n      }\n      request.onProgress?.(`using ${engine}${runFlags.length > 0 ? ` with ${runFlags.join(' ')}` : ''}`);\n\n      const version = dependencies.version ?? '0.0.0';\n      let imageTag: string;\n      try {\n        // Before the tunnel is reported ready, never inside a session spawn:\n        // a cold build is minutes and the hub gives a spawning session ten\n        // seconds to register.\n        imageTag = await ensureImage(runner, engine, version, request.onProgress, {\n          tag: cockpitImageTag(version),\n          dockerfile: cockpitDockerfile(),\n        });\n      } catch (error) {\n        return { ok: false, error: error instanceof Error ? error.message : String(error) };\n      }\n\n      const plan = buildCockpitPlan({\n        workspaces: request.workspaces,\n        port: request.port,\n        environment: request.environment,\n        engine,\n        host: { hasTty: false, platform: process.platform, repoKey: '', version },\n        imageTag,\n        runFlags,\n        ...(readIdentity() === undefined ? {} : { gitIdentity: readIdentity() as CockpitGitIdentity }),\n      });\n\n      const started = await runner.capture(engine, plan.runArgs);\n      const containerId = started?.stdout.trim().split('\\n').pop() ?? '';\n      if (started?.exitCode !== 0 || containerId === '') {\n        return { ok: false, error: `The cockpit container did not start: ${started?.stdout.trim() ?? 'no output'}` };\n      }\n      request.onProgress?.('waiting for the cockpit to answer');\n\n      const deadline = now() + READY_TIMEOUT_MS;\n      for (;;) {\n        if (await probe(request.port)) break;\n        if (now() >= deadline) {\n          const logs = await runner.capture(engine, ['logs', '--tail', '20', containerId]);\n          await stopContainer(runner, engine, containerId);\n          return {\n            ok: false,\n            error:\n              `The cockpit did not answer within ${String(READY_TIMEOUT_MS / 1000)}s.\\n${logs?.stdout ?? ''}`.trim(),\n          };\n        }\n        await new Promise((resolve) => setTimeout(resolve, READY_POLL_MS));\n      }\n\n      const handle: CockpitContainerHandle = {\n        containerId,\n        stop: async () => {\n          await stopContainer(runner, engine, containerId);\n        },\n        alive: async () => await isRunning(runner, engine, containerId),\n      };\n      return { ok: true, handle };\n    },\n\n    async reapCockpitContainer(containerId: string): Promise<boolean> {\n      // Named by id rather than searched for, because the caller recorded it\n      // before the process that owned it went away.\n      for (const engine of ['docker', 'podman', 'nerdctl', 'finch'] as const) {\n        const probed = await runner.capture(engine, ['--version']);\n        if (probed?.exitCode !== 0) continue;\n        return await stopContainer(runner, engine, containerId);\n      }\n      return false;\n    },\n  };\n}\n\n/** The module-shaped entry a host resolves from the composition. */\nexport async function startCockpitContainer(request: CockpitContainerRequest): Promise<CockpitContainerStart> {\n  return await createCockpitHarness().startCockpitContainer(request);\n}\n\nexport async function reapCockpitContainer(containerId: string): Promise<boolean> {\n  return await createCockpitHarness().reapCockpitContainer(containerId);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAkBA,MAAM,iBAAiB;;;;;;;;;;AAUvB,MAAa,sBAAsB;AACnC,MAAa,gBAAgB;AAC7B,MAAM,iBAAiB;AACvB,MAAM,WAAW;;;;;;;;;AASjB,MAAM,iBAAiB;AACvB,MAAM,iBAAiB;AACvB,MAAM,WAAW;;;;;;;;;AAmCjB,SAAS,uBAAuB,UAAkE;CAChG,IAAI,aAAa,KAAA,GAAW,OAAO,CAAC;CACpC,OAAO;EACL,iBAAiB,SAAS;EAC1B,kBAAkB,SAAS;EAC3B,oBAAoB,SAAS;EAC7B,qBAAqB,SAAS;CAChC;AACF;AAEA,SAAgB,iBAAiB,OAAsC;CACrE,MAAM,EAAE,QAAQ,MAAM,QAAQ,UAAU,SAAS;CACjD,IAAI,MAAM,WAAW,WAAW,GAAG,MAAM,IAAI,MAAM,4DAA4D;CAE/G,MAAM,cAAsC;EAC1C,GAAGA,gBAAAA,qBAAqB,MAAM,aAAa,MAAM;EACjD,GAAG,uBAAuB,MAAM,WAAW;GAI1CC,gBAAAA,4BAA4B;GAC5BC,sCAAAA,qBAAqB;CACxB;CACA,MAAM,mBAAmB,OAAO,QAAQ,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,cAAc,KAAK,CAAC;CAwCxG,OAAO;EAAE;EAAU,SAAA;GArCjB;GAIA;GACA;GACA,GAAG,cAAc,GAAG,OAAO,IAAI;GAC/B;GACA,GAAG,SAAS,GAAG,OAAO,IAAI,EAAE,GAAG,OAAO,IAAI;GAC1C,GAAG,MAAM,WAAW,SAAS,cAAc,CAAC,MAAM,GAAG,UAAU,KAAK,GAAG,UAAU,MAAM,CAAC;GACxF;GACA,GAAG,oBAAoB,GAAG;GAC1B,GAAI,QAAQ,SAAS,cAAc,QAAQ,CAAC,cAAc,mCAAmC,IAAI,CAAC;GAClG,GAAI,QAAQ,SAAS,cAAc,SAAS,CAAC,MAAM,GAAG,OAAO,SAAS,gBAAgB,aAAa,IAAI,CAAC;GACxG;GACA,MAAM,WAAW,EAAE,EAAE,QAAQ;GAC7B;GACA,QAAQ;GACR,GAAG,iBAAiB,SAAS,CAAC,MAAM,WAAW,CAAC,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;GACzE,GAAI,KAAK,aAAa,kBAAkB,KAAK,WAAW,KAAA,IACpD;IACE;IACA,GAAG,OAAO,KAAK,MAAM,EAAE,GAAG,OAAO,KAAK,WAAW,KAAK,MAAM;IAC5D,GAAI,WAAW,WAAW,CAAC,kBAAkB,IAAI,CAAC;GACpD,IACA,CAAC;GAGL,GAAI,MAAM,YAAY,CAAC;GACvB;GACA;GACA;GACA;GACA;GACA,OAAO,IAAI;EAGY;CAAE;AAC7B;;;;;;;;;;;ACnHA,MAAM,gBAAgB;AACtB,MAAM,mBAAmB;AACzB,MAAM,gBAAgB;AACtB,MAAM,WAAW;;;;;;;;AAmBjB,SAAS,kBAAkD;CACzD,MAAM,QAAQ,QAAoC;EAChD,IAAI;GACF,MAAM,SAAA,GAAQC,mBAAAA,aAAAA,CAAa,OAAO;IAAC;IAAU;IAAY;IAAS;GAAG,GAAG,EAAE,UAAU,OAAO,CAAC,CAAC,CAAC,KAAK;GACnG,OAAO,UAAU,KAAK,KAAA,IAAY;EACpC,QAAQ;GAGN;EACF;CACF;CACA,MAAM,OAAO,KAAK,WAAW;CAC7B,MAAM,QAAQ,KAAK,YAAY;CAC/B,OAAO,SAAS,KAAA,KAAa,UAAU,KAAA,IAAY;EAAE;EAAM;CAAM,IAAI,KAAA;AACvE;;AAGA,eAAe,aAAa,MAAgC;CAC1D,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,oBAAoB,OAAO,IAAI,EAAE,YAAY;EAC1E,IAAI,CAAC,SAAS,IAAI,OAAO;EACzB,QAAS,MAAM,SAAS,KAAK,EAAA,CAA0B,SAAS;CAClE,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAe,cAAc,QAA6B,QAAuB,IAA8B;CAC7G,MAAM,UAAU,MAAM,OAAO,QAAQ,QAAQ,CAAC,QAAQ,EAAE,CAAC;CAGzD,MAAM,OAAO,QAAQ,QAAQ;EAAC;EAAM;EAAM;CAAE,CAAC;CAC7C,OAAO,SAAS,aAAa;AAC/B;;;;;;;AAQA,eAAe,UAAU,QAA6B,QAAuB,IAA8B;CACzG,MAAM,SAAS,MAAM,OAAO,QAAQ,QAAQ;EAAC;EAAW;EAAM;EAAsB;CAAE,CAAC;CACvF,OAAO,QAAQ,aAAa,KAAK,OAAO,OAAO,KAAK,MAAM;AAC5D;AAEA,SAAgB,qBAAqB,eAA2C,CAAC,GAAkC;CACjH,MAAM,SAAS,aAAa,UAAU,IAAIC,gBAAAA,yBAAyB;CACnE,MAAM,QAAQ,aAAa,SAAS;CACpC,MAAM,eAAe,aAAa,eAAe;CACjD,MAAM,MAAM,aAAa,cAAsB,KAAK,IAAI;CAExD,OAAO;EACL,MAAM,sBAAsB,SAAkE;GAC5F,IAAI,QAAQ,WAAW,WAAW,GAChC,OAAO;IAAE,IAAI;IAAO,OAAO;GAA6D;GAE1F,IAAI;GACJ,IAAI;IACF,SAAS,MAAMC,gBAAAA,aAAa,QAAQ,QAAQ,WAAW;GACzD,SAAS,OAAO;IACd,OAAO;KAAE,IAAI;KAAO,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAAE;GACpF;GACA,MAAM,WAAWC,gBAAAA,cAAc,QAAQ,YAAY,cAAc;GACjE,IAAI;IACF,gBAAA,eAAe,UAAU,aAAa;GACxC,SAAS,OAAO;IACd,OAAO;KAAE,IAAI;KAAO,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAAE;GACpF;GACA,QAAQ,aAAa,SAAS,SAAS,SAAS,SAAS,IAAI,SAAS,SAAS,KAAK,GAAG,MAAM,IAAI;GAEjG,MAAM,UAAU,aAAa,WAAW;GACxC,IAAI;GACJ,IAAI;IAIF,WAAW,MAAMC,gBAAAA,YAAY,QAAQ,QAAQ,SAAS,QAAQ,YAAY;KACxE,KAAKC,gBAAAA,gBAAgB,OAAO;KAC5B,YAAYC,gBAAAA,kBAAkB;IAChC,CAAC;GACH,SAAS,OAAO;IACd,OAAO;KAAE,IAAI;KAAO,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAAE;GACpF;GAEA,MAAM,OAAO,iBAAiB;IAC5B,YAAY,QAAQ;IACpB,MAAM,QAAQ;IACd,aAAa,QAAQ;IACrB;IACA,MAAM;KAAE,QAAQ;KAAO,UAAU,QAAQ;KAAU,SAAS;KAAI;IAAQ;IACxE;IACA;IACA,GAAI,aAAa,MAAM,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,aAAa,EAAwB;GAC9F,CAAC;GAED,MAAM,UAAU,MAAM,OAAO,QAAQ,QAAQ,KAAK,OAAO;GACzD,MAAM,cAAc,SAAS,OAAO,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK;GAChE,IAAI,SAAS,aAAa,KAAK,gBAAgB,IAC7C,OAAO;IAAE,IAAI;IAAO,OAAO,wCAAwC,SAAS,OAAO,KAAK,KAAK;GAAc;GAE7G,QAAQ,aAAa,mCAAmC;GAExD,MAAM,WAAW,IAAI,IAAI;GACzB,SAAS;IACP,IAAI,MAAM,MAAM,QAAQ,IAAI,GAAG;IAC/B,IAAI,IAAI,KAAK,UAAU;KACrB,MAAM,OAAO,MAAM,OAAO,QAAQ,QAAQ;MAAC;MAAQ;MAAU;MAAM;KAAW,CAAC;KAC/E,MAAM,cAAc,QAAQ,QAAQ,WAAW;KAC/C,OAAO;MACL,IAAI;MACJ,OACE,qCAAqC,OAAO,mBAAmB,GAAI,EAAE,MAAM,MAAM,UAAU,KAAK,KAAK;KACzG;IACF;IACA,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,aAAa,CAAC;GACnE;GASA,OAAO;IAAE,IAAI;IAAM,QAAA;KANjB;KACA,MAAM,YAAY;MAChB,MAAM,cAAc,QAAQ,QAAQ,WAAW;KACjD;KACA,OAAO,YAAY,MAAM,UAAU,QAAQ,QAAQ,WAAW;IAExC;GAAE;EAC5B;EAEA,MAAM,qBAAqB,aAAuC;GAGhE,KAAK,MAAM,UAAU;IAAC;IAAU;IAAU;IAAW;GAAO,GAAY;IAEtE,KAAI,MADiB,OAAO,QAAQ,QAAQ,CAAC,WAAW,CAAC,EAAA,EAC7C,aAAa,GAAG;IAC5B,OAAO,MAAM,cAAc,QAAQ,QAAQ,WAAW;GACxD;GACA,OAAO;EACT;CACF;AACF;;AAGA,eAAsB,sBAAsB,SAAkE;CAC5G,OAAO,MAAM,qBAAqB,CAAC,CAAC,sBAAsB,OAAO;AACnE;AAEA,eAAsB,qBAAqB,aAAuC;CAChF,OAAO,MAAM,qBAAqB,CAAC,CAAC,qBAAqB,WAAW;AACtE"}

package/dist/cockpitHarness.d.mts

@@ -0,0 +1,26 @@
+import { n as EngineProcessRunner } from "./sandboxHarness-BIvuRMio.mjs";
+import { CockpitContainerHarnessModule, CockpitContainerRequest, CockpitContainerStart } from "@agimon-ai/doompi-core/cockpitContainer";
+//#region src/services/cockpitPlan/index.d.ts
+/** Git identity the agent commits under; no key crosses the boundary, so it cannot push. */
+interface CockpitGitIdentity {
+  name: string;
+  email: string;
+}
+//#endregion
+//#region src/services/cockpitHarness/index.d.ts
+interface CockpitHarnessDependencies {
+  runner?: EngineProcessRunner;
+  version?: string;
+  /** Test seam: reports whether the cockpit inside is answering yet. */
+  probe?: (port: number) => Promise<boolean>;
+  /** Test seam: the host's git identity, which is read from the real config by default. */
+  gitIdentity?: () => CockpitGitIdentity | undefined;
+  now?: () => number;
+}
+export declare function createCockpitHarness(dependencies?: CockpitHarnessDependencies): CockpitContainerHarnessModule;
+/** The module-shaped entry a host resolves from the composition. */
+export declare function startCockpitContainer(request: CockpitContainerRequest): Promise<CockpitContainerStart>;
+export declare function reapCockpitContainer(containerId: string): Promise<boolean>;
+//#endregion
+export type { CockpitHarnessDependencies };
+//# sourceMappingURL=cockpitHarness.d.mts.map

package/dist/cockpitHarness.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cockpitHarness.d.mts","names":[],"sources":["../src/services/cockpitPlan/index.ts","../src/services/cockpitHarness/index.ts"],"mappings":";;;;UA6CiB;EACf;EACA;;;;UChBe;EACf,SAAS;EACT;;EAEA,SAAS,iBAAiB;;EAE1B,oBAAoB;EACpB;;wBAwDc,qBAAqB,eAAc,6BAAkC;;wBAgG/D,sBAAsB,SAAS,0BAA0B,QAAQ;wBAIjE,qBAAqB,sBAAsB"}

package/dist/cockpitHarness.mjs

@@ -0,0 +1,295 @@
+import { a as cockpitImageTag, c as parseRunFlags, d as DEVCONTAINER_DISABLED_ENV, l as SpawnEngineProcessRunner, n as detectEngine, o as cockpitDockerfile, r as ensureImage, s as assertRunFlags, u as containerEnvironment } from "./harness-CEuhOTr2.mjs";
+import { execFileSync } from "node:child_process";
+import { DOOMPI_SANDBOX_ENV } from "@agimon-ai/doompi-core/sandboxHarness";
+//#region src/services/cockpitPlan/index.ts
+/**
+* Projects the cockpit into one detached engine run.
+*
+* The sandbox plan next door describes a disposable container wrapped around a
+* single interactive session. This one describes a long-lived container holding
+* the hub and every session it goes on to spawn, which changes four things:
+* it is detached rather than attached, it publishes a port rather than only
+* consuming them, its home volume is scoped to the cockpit rather than to one
+* repository, and it mounts a set of workspaces rather than a single repo.
+*/
+const CONTAINER_HOME = "/doompi-home";
+/**
+* One volume for the cockpit, not one per repository.
+*
+* A cockpit spans several workspaces, so there is no repository to key on. This
+* is also where `~/.doompi/web` lands, which is what makes paired passkeys and
+* the bundle signing key survive a container restart. A rotated signing key
+* would make every paired device refuse the cockpit, so the name must be
+* stable.
+*/
+const COCKPIT_HOME_VOLUME = "doompi-cockpit-home";
+const COCKPIT_LABEL = "doompi.cockpit";
+const COCKPIT_BINARY = "doompi-web";
+const LOOPBACK = "127.0.0.1";
+/**
+* The cockpit binds every interface inside the container.
+*
+* A published port reaches the container's external interface, never its
+* loopback, which is the same reason `oauthCallback.ts` sets its own bind
+* address. The host side of the publish is pinned to loopback, so this is not
+* exposed beyond the machine.
+*/
+const CONTAINER_BIND = "0.0.0.0";
+const LINUX_PLATFORM = "linux";
+const DISABLED = "0";
+/**
+* Git identity, passed as environment rather than by mounting a config.
+*
+* The agent can commit; it cannot push, because no key crosses the boundary.
+* Mounting `~/.gitconfig` would drag in whatever else it configures, and
+* forwarding an ssh agent would hand the container a live credential that
+* authenticates as the user everywhere their key reaches.
+*/
+function gitIdentityEnvironment(identity) {
+	if (identity === void 0) return {};
+	return {
+		GIT_AUTHOR_NAME: identity.name,
+		GIT_AUTHOR_EMAIL: identity.email,
+		GIT_COMMITTER_NAME: identity.name,
+		GIT_COMMITTER_EMAIL: identity.email
+	};
+}
+function buildCockpitPlan(input) {
+	const { engine, host, broker, imageTag, port } = input;
+	if (input.workspaces.length === 0) throw new Error("A cockpit container needs at least one workspace to mount.");
+	const environment = {
+		...containerEnvironment(input.environment, broker),
+		...gitIdentityEnvironment(input.gitIdentity),
+		[DEVCONTAINER_DISABLED_ENV]: DISABLED,
+		[DOOMPI_SANDBOX_ENV]: "1"
+	};
+	const environmentPairs = Object.entries(environment).sort(([left], [right]) => left.localeCompare(right));
+	return {
+		imageTag,
+		runArgs: [
+			"run",
+			"-d",
+			"--label",
+			`${COCKPIT_LABEL}=${String(port)}`,
+			"-p",
+			`${LOOPBACK}:${String(port)}:${String(port)}`,
+			...input.workspaces.flatMap((workspace) => ["-v", `${workspace.path}:${workspace.path}`]),
+			"-v",
+			`${COCKPIT_HOME_VOLUME}:${CONTAINER_HOME}`,
+			...broker?.endpoint.transport === "tcp" ? ["--add-host", `host.docker.internal:host-gateway`] : [],
+			...broker?.endpoint.transport === "unix" ? ["-v", `${broker.endpoint.socketDirectory}:/run/doompi`] : [],
+			"-w",
+			input.workspaces[0]?.path ?? CONTAINER_HOME,
+			"-e",
+			`HOME=${CONTAINER_HOME}`,
+			...environmentPairs.flatMap(([name, value]) => ["-e", `${name}=${value}`]),
+			...host.platform === LINUX_PLATFORM && host.userId !== void 0 ? [
+				"--user",
+				`${String(host.userId)}:${String(host.groupId ?? host.userId)}`,
+				...engine === "podman" ? ["--userns=keep-id"] : []
+			] : [],
+			...input.runFlags ?? [],
+			imageTag,
+			COCKPIT_BINARY,
+			"--host",
+			CONTAINER_BIND,
+			"--port",
+			String(port)
+		]
+	};
+}
+//#endregion
+//#region src/services/cockpitHarness/index.ts
+/**
+* Runs the cockpit itself in a container, detached, holding the hub and every
+* session it goes on to spawn.
+*
+* The interactive harness next door wraps one session and blocks until it
+* exits. This one returns a handle while the container keeps running, which is
+* why it is a separate entry rather than a flag on the other.
+*/
+const RUN_FLAGS_ENV = "DOOMPI_SANDBOX_RUN_FLAGS";
+const READY_TIMEOUT_MS = 6e4;
+const READY_POLL_MS = 250;
+const HUB_ROLE = "hub";
+/**
+* Reads the host's committer identity.
+*
+* Passed into the container as environment rather than by mounting the config,
+* so the agent can commit without any credential crossing the boundary. It
+* cannot push, and that is the intended limit.
+*/
+function readGitIdentity() {
+	const read = (key) => {
+		try {
+			const value = execFileSync("git", [
+				"config",
+				"--global",
+				"--get",
+				key
+			], { encoding: "utf8" }).trim();
+			return value === "" ? void 0 : value;
+		} catch {
+			return;
+		}
+	};
+	const name = read("user.name");
+	const email = read("user.email");
+	return name !== void 0 && email !== void 0 ? {
+		name,
+		email
+	} : void 0;
+}
+/** Answers whether the hub inside the container is serving yet. */
+async function defaultProbe(port) {
+	try {
+		const response = await fetch(`http://127.0.0.1:${String(port)}/api/health`);
+		if (!response.ok) return false;
+		return (await response.json()).role === HUB_ROLE;
+	} catch {
+		return false;
+	}
+}
+async function stopContainer(runner, engine, id) {
+	const stopped = await runner.capture(engine, ["stop", id]);
+	await runner.capture(engine, [
+		"rm",
+		"-f",
+		id
+	]);
+	return stopped?.exitCode === 0;
+}
+/**
+* Whether the engine still reports this container as running.
+*
+* A removed container makes `inspect` fail rather than print `false`, so a
+* non-zero exit is read the same way: not running.
+*/
+async function isRunning(runner, engine, id) {
+	const probed = await runner.capture(engine, [
+		"inspect",
+		"-f",
+		"{{.State.Running}}",
+		id
+	]);
+	return probed?.exitCode === 0 && probed.stdout.trim() === "true";
+}
+function createCockpitHarness(dependencies = {}) {
+	const runner = dependencies.runner ?? new SpawnEngineProcessRunner();
+	const probe = dependencies.probe ?? defaultProbe;
+	const readIdentity = dependencies.gitIdentity ?? readGitIdentity;
+	const now = dependencies.now ?? (() => Date.now());
+	return {
+		async startCockpitContainer(request) {
+			if (request.workspaces.length === 0) return {
+				ok: false,
+				error: "A cockpit container needs at least one workspace to mount."
+			};
+			let engine;
+			try {
+				engine = await detectEngine(runner, request.environment);
+			} catch (error) {
+				return {
+					ok: false,
+					error: error instanceof Error ? error.message : String(error)
+				};
+			}
+			const runFlags = parseRunFlags(request.environment[RUN_FLAGS_ENV]);
+			try {
+				assertRunFlags(runFlags, RUN_FLAGS_ENV);
+			} catch (error) {
+				return {
+					ok: false,
+					error: error instanceof Error ? error.message : String(error)
+				};
+			}
+			request.onProgress?.(`using ${engine}${runFlags.length > 0 ? ` with ${runFlags.join(" ")}` : ""}`);
+			const version = dependencies.version ?? "0.0.0";
+			let imageTag;
+			try {
+				imageTag = await ensureImage(runner, engine, version, request.onProgress, {
+					tag: cockpitImageTag(version),
+					dockerfile: cockpitDockerfile()
+				});
+			} catch (error) {
+				return {
+					ok: false,
+					error: error instanceof Error ? error.message : String(error)
+				};
+			}
+			const plan = buildCockpitPlan({
+				workspaces: request.workspaces,
+				port: request.port,
+				environment: request.environment,
+				engine,
+				host: {
+					hasTty: false,
+					platform: process.platform,
+					repoKey: "",
+					version
+				},
+				imageTag,
+				runFlags,
+				...readIdentity() === void 0 ? {} : { gitIdentity: readIdentity() }
+			});
+			const started = await runner.capture(engine, plan.runArgs);
+			const containerId = started?.stdout.trim().split("\n").pop() ?? "";
+			if (started?.exitCode !== 0 || containerId === "") return {
+				ok: false,
+				error: `The cockpit container did not start: ${started?.stdout.trim() ?? "no output"}`
+			};
+			request.onProgress?.("waiting for the cockpit to answer");
+			const deadline = now() + READY_TIMEOUT_MS;
+			for (;;) {
+				if (await probe(request.port)) break;
+				if (now() >= deadline) {
+					const logs = await runner.capture(engine, [
+						"logs",
+						"--tail",
+						"20",
+						containerId
+					]);
+					await stopContainer(runner, engine, containerId);
+					return {
+						ok: false,
+						error: `The cockpit did not answer within ${String(READY_TIMEOUT_MS / 1e3)}s.\n${logs?.stdout ?? ""}`.trim()
+					};
+				}
+				await new Promise((resolve) => setTimeout(resolve, READY_POLL_MS));
+			}
+			return {
+				ok: true,
+				handle: {
+					containerId,
+					stop: async () => {
+						await stopContainer(runner, engine, containerId);
+					},
+					alive: async () => await isRunning(runner, engine, containerId)
+				}
+			};
+		},
+		async reapCockpitContainer(containerId) {
+			for (const engine of [
+				"docker",
+				"podman",
+				"nerdctl",
+				"finch"
+			]) {
+				if ((await runner.capture(engine, ["--version"]))?.exitCode !== 0) continue;
+				return await stopContainer(runner, engine, containerId);
+			}
+			return false;
+		}
+	};
+}
+/** The module-shaped entry a host resolves from the composition. */
+async function startCockpitContainer(request) {
+	return await createCockpitHarness().startCockpitContainer(request);
+}
+async function reapCockpitContainer(containerId) {
+	return await createCockpitHarness().reapCockpitContainer(containerId);
+}
+//#endregion
+export { createCockpitHarness, reapCockpitContainer, startCockpitContainer };
+
+//# sourceMappingURL=cockpitHarness.mjs.map