@agimon-ai/doompi-sandbox 0.0.1-alpha.101

package/dist/harness-CEuhOTr2.mjs

@@ -0,0 +1,716 @@
+import { a as BROKER_HOST_GATEWAY, c as BROKER_SOCKET_CONTAINER_PATH, i as BROKER_CONTAINER_PORT, l as BROKER_SOCKET_ENV, n as BRIDGE_FILE_NAME, o as BROKER_PORT_ENV, r as BROKER_ADDRESS_ENV, s as BROKER_PROVIDERS_ENV, t as BRIDGE_CONTAINER_PATH, u as sandboxBridgeSource } from "./sandboxBridge-D6RAncmy.mjs";
+import { t as startBroker } from "./brokerHost-BeGtmnK8.mjs";
+import { createRequire } from "node:module";
+import { spawn } from "node:child_process";
+import { DOOMPI_SANDBOX_ENV } from "@agimon-ai/doompi-core/sandboxHarness";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import net from "node:net";
+//#region src/services/devcontainer/index.ts
+/**
+* Relative locations the Dev Containers spec looks for a configuration.
+*
+* Ordered as the spec resolves them, so the first hit on disk wins.
+*/
+const DEVCONTAINER_CONFIG_PATHS = [".devcontainer/devcontainer.json", ".devcontainer.json"];
+const DEVCONTAINER_DISABLED_ENV = "DOOMPI_SANDBOX_DEVCONTAINER";
+const DEVCONTAINER_CLI_PACKAGE = "@devcontainers/cli@0.80.0";
+/** Arguments for bringing the workspace's own dev container up. */
+function devcontainerUpArgs(options) {
+	return [
+		"up",
+		"--workspace-folder",
+		options.repoRoot,
+		"--log-format",
+		"json",
+		...options.socketDirectory && options.socketTarget ? ["--mount", `type=bind,source=${options.socketDirectory},target=${options.socketTarget}`] : []
+	];
+}
+/**
+* Reads the container id out of the CLI's JSON log stream.
+*
+* The stream carries progress records too, so the result is the last record
+* that reports an outcome rather than the first line parsed.
+*/
+function parseDevcontainerUp(stdout) {
+	let outcome;
+	for (const line of stdout.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed.startsWith("{")) continue;
+		let parsed;
+		try {
+			parsed = JSON.parse(trimmed);
+		} catch {
+			continue;
+		}
+		if (typeof parsed === "object" && parsed !== null && "outcome" in parsed) outcome = parsed;
+	}
+	if (!outcome) return { error: "The dev container CLI reported no outcome." };
+	if (outcome.outcome !== "success") return { error: outcome.description || outcome.message || `Dev container start reported ${outcome.outcome}.` };
+	if (!outcome.containerId) return { error: "The dev container started but reported no container id." };
+	return {
+		containerId: outcome.containerId,
+		remoteWorkspaceFolder: outcome.remoteWorkspaceFolder
+	};
+}
+/**
+* Maps a host path into the dev container's own workspace.
+*
+* A dev container mounts the workspace where its configuration says, commonly
+* /workspaces/<name>, so the host path the launch was given does not exist
+* inside and would fail the exec before the agent ever starts.
+*/
+function containerWorkspacePath(repoRoot, cwd, remoteWorkspaceFolder) {
+	const inside = path.relative(repoRoot, cwd);
+	const relative = inside === "" || inside.startsWith("..") || path.isAbsolute(inside) ? "" : inside;
+	return relative ? `${remoteWorkspaceFolder}/${relative.split("\\").join("/")}` : remoteWorkspaceFolder;
+}
+/**
+* Installs the distribution inside a dev container that lacks it.
+*
+* The container is the workspace's own, so it carries the project toolchain
+* rather than this layer's, and nothing guarantees DoomPi is present. `up`
+* reuses an existing container, so this is paid once for its lifetime.
+*/
+function bootstrapCommand(version) {
+	return [
+		"sh",
+		"-c",
+		`command -v doompi >/dev/null 2>&1 && exit 0; command -v npm >/dev/null 2>&1 || { echo "doompi-sandbox: this dev container has no npm to install DoomPi with" >&2; exit 127; }; npm install -g @agimon-ai/doompi@${version} >/dev/null`
+	];
+}
+/**
+* Rewrites forwarded host paths into the dev container's workspace.
+*
+* The launcher replays its resolved options, and several carry absolute host
+* paths: --cwd always, plugin and additional directories when set. Those
+* resolve in the built-in image, which mounts the repository at the path it
+* has on the host, but a dev container mounts it wherever its configuration
+* says, and the session would fail looking for a repository that is not there.
+*/
+function mapForwardArgs(args, repoRoot, remoteWorkspaceFolder) {
+	return args.map((argument) => argument === repoRoot || argument.startsWith(`${repoRoot}/`) ? containerWorkspacePath(repoRoot, argument, remoteWorkspaceFolder) : argument);
+}
+/**
+* Runs a command in the dev container through the engine rather than the CLI.
+*
+* `devcontainer exec` allocates no terminal, which a full screen TUI needs, so
+* the session is attached to the container the CLI already started.
+*/
+function devcontainerExecArgs(options) {
+	const environmentPairs = Object.entries(options.environment).sort(([left], [right]) => left.localeCompare(right));
+	return [
+		"exec",
+		"-i",
+		...options.hasTty ? ["-t"] : [],
+		"-w",
+		options.cwd,
+		...environmentPairs.flatMap(([name, value]) => ["-e", `${name}=${value}`]),
+		options.containerId,
+		...options.command
+	];
+}
+//#endregion
+//#region src/services/oauthCallback/index.ts
+/**
+* Fixed loopback ports Pi's OAuth flows listen on.
+*
+* A provider redirects the browser to `http://localhost:<port>`, so the host
+* port has to match exactly and cannot be remapped. Providers that bind an
+* ephemeral port instead, such as OpenRouter, cannot be published ahead of the
+* flow and are not covered.
+*/
+const OAUTH_CALLBACK_PORTS = [
+	1455,
+	1456,
+	53692
+];
+const OAUTH_CALLBACK_HOST_ENV = "PI_OAUTH_CALLBACK_HOST";
+/**
+* Address the in-container callback server binds.
+*
+* Pi binds loopback by default, which a published port cannot reach: the
+* engine forwards to the container's external interface, not its loopback.
+* Only the bind address changes; the redirect the provider sees stays
+* `localhost`.
+*/
+const OAUTH_CONTAINER_BIND = "0.0.0.0";
+/** Publishes each reachable callback port back onto the host's loopback. */
+function oauthPublishArgs(ports) {
+	return ports.flatMap((port) => ["-p", `127.0.0.1:${port}:${port}`]);
+}
+//#endregion
+//#region src/services/sandboxEnvironment/index.ts
+const EXACT_NAMES = /* @__PURE__ */ new Set([
+	"TERM",
+	"COLORTERM",
+	"LANG",
+	"TZ",
+	"DOOMPI_PRESET",
+	"ELICITATION_SESSION_ID",
+	"HTTP_PROXY",
+	"HTTPS_PROXY",
+	"NO_PROXY",
+	"http_proxy",
+	"https_proxy",
+	"no_proxy"
+]);
+const NAME_PREFIXES = ["LC_"];
+const NAME_SUFFIXES = [
+	"_API_KEY",
+	"_AUTH_TOKEN",
+	"_BASE_URL"
+];
+/** True for variables shaped like a provider credential or endpoint override. */
+function isCredentialEnvName(name) {
+	return NAME_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
+function allowed(name) {
+	return EXACT_NAMES.has(name) || NAME_PREFIXES.some((prefix) => name.startsWith(prefix)) || NAME_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
+/**
+* Projects the host environment down to what a sandboxed session may see.
+*
+* The list is an allowlist on purpose: everything a terminal accumulates
+* (agents, sockets, tokens, paths) stays on the host unless a rule names it.
+* Provider credentials pass through for now; the credential broker planned for
+* the client-server phase removes even those from the container.
+*/
+function filterSandboxEnvironment(environment) {
+	const filtered = {};
+	for (const [name, value] of Object.entries(environment)) if (value !== void 0 && allowed(name)) filtered[name] = value;
+	return filtered;
+}
+//#endregion
+//#region src/services/sandboxPlan/index.ts
+const CONTAINER_HOME = "/doompi-home";
+const REPOSITORY_LABEL = "doompi.sandbox.repo";
+const LAUNCHER_BINARY$1 = "doompi";
+const NODE_BINARY = "node";
+const LINUX_PLATFORM = "linux";
+const ENABLED = "1";
+const BROKER_MOUNT_DIRECTORY$1 = "/run/doompi";
+/**
+* Replaces every credential in the container with the broker's session token.
+*
+* Dropping all credential-shaped variables first is what makes the promise
+* hold for providers the broker does not carry: an unbrokered key would
+* otherwise stay readable inside the container.
+*/
+function brokeredEnvironment(filtered, broker) {
+	const environment = {};
+	for (const [name, value] of Object.entries(filtered)) if (!isCredentialEnvName(name)) environment[name] = value;
+	for (const name of broker.withheldEnv) environment[name] = broker.token;
+	if (broker.endpoint.transport === "unix") {
+		environment[BROKER_SOCKET_ENV] = BROKER_SOCKET_CONTAINER_PATH;
+		environment[BROKER_PORT_ENV] = String(BROKER_CONTAINER_PORT);
+	} else environment[BROKER_ADDRESS_ENV] = `${BROKER_HOST_GATEWAY}:${broker.endpoint.port}`;
+	environment[BROKER_PROVIDERS_ENV] = broker.providers.join(",");
+	return environment;
+}
+/**
+* Grants the container the one route it needs to reach the broker.
+*
+* A mounted socket needs no network at all. TCP needs the engine's host
+* gateway named explicitly, because it is not resolvable by default on every
+* engine.
+*/
+function brokerAccessArgs(broker) {
+	if (!broker) return [];
+	if (broker.endpoint.transport === "unix") return ["-v", `${broker.endpoint.socketDirectory}:${BROKER_MOUNT_DIRECTORY$1}`];
+	return ["--add-host", `${BROKER_HOST_GATEWAY}:host-gateway`];
+}
+/**
+* Projects one launch into a disposable engine run.
+*
+* The container is ephemeral; persistence lives in two named volumes: the
+* container home (Pi sessions, sync cache) and a shadow over the repository's
+* `.pi` store, which keeps Linux installs from corrupting the host's own
+* platform-specific packages on the shared workspace mount.
+*/
+/**
+* The environment a sandboxed session runs with, whichever container hosts it.
+*
+* Shared with the dev container path, which builds no run arguments of its own
+* but must apply the same allowlist and the same credential substitution.
+*/
+function containerEnvironment(environment, broker, loginPorts = []) {
+	const filtered = filterSandboxEnvironment(environment);
+	const resolved = broker ? brokeredEnvironment(filtered, broker) : filtered;
+	resolved[DOOMPI_SANDBOX_ENV] = ENABLED;
+	if (loginPorts.length > 0) resolved[OAUTH_CALLBACK_HOST_ENV] = OAUTH_CONTAINER_BIND;
+	return resolved;
+}
+function buildSandboxPlan(input) {
+	const { repoRoot, cwd, engine, host, broker, imageTag } = input;
+	const loginPorts = input.loginPorts ?? [];
+	const environmentPairs = Object.entries(containerEnvironment(input.environment, broker, loginPorts)).sort(([left], [right]) => left.localeCompare(right));
+	return {
+		imageTag,
+		runArgs: [
+			"run",
+			"--rm",
+			"-i",
+			...host.hasTty ? ["-t"] : [],
+			"--label",
+			`${REPOSITORY_LABEL}=${repoRoot}`,
+			"-v",
+			`${repoRoot}:${repoRoot}`,
+			"-v",
+			`${host.repoKey}-home:${CONTAINER_HOME}`,
+			"-v",
+			`${host.repoKey}-pi:${repoRoot}/.pi`,
+			...brokerAccessArgs(broker),
+			...oauthPublishArgs(loginPorts),
+			"-w",
+			cwd,
+			"-e",
+			`HOME=${CONTAINER_HOME}`,
+			...environmentPairs.flatMap(([name, value]) => ["-e", `${name}=${value}`]),
+			...host.platform === LINUX_PLATFORM && host.userId !== void 0 ? [
+				"--user",
+				`${host.userId}:${host.groupId ?? host.userId}`,
+				...engine === "podman" ? ["--userns=keep-id"] : []
+			] : [],
+			...input.runFlags ?? [],
+			imageTag,
+			...broker?.endpoint.transport === "unix" ? [NODE_BINARY, BRIDGE_CONTAINER_PATH] : [],
+			LAUNCHER_BINARY$1,
+			...input.forwardArgs
+		]
+	};
+}
+//#endregion
+//#region src/services/engineProcess/index.ts
+const INHERIT = "inherit";
+const PIPE = "pipe";
+const IGNORE = "ignore";
+const FORWARDED_SIGNALS = [
+	"SIGINT",
+	"SIGTERM",
+	"SIGHUP"
+];
+/** Spawns the container engine, keeping the session's terminal attached. */
+var SpawnEngineProcessRunner = class {
+	run(command, args, options = {}) {
+		return new Promise((resolve, reject) => {
+			const child = spawn(command, args, { stdio: options.input === void 0 ? INHERIT : [
+				PIPE,
+				INHERIT,
+				INHERIT
+			] });
+			if (options.input !== void 0) child.stdin?.end(options.input);
+			const forwarders = FORWARDED_SIGNALS.map((signal) => {
+				const forward = () => {
+					child.kill(signal);
+				};
+				process.on(signal, forward);
+				return {
+					signal,
+					forward
+				};
+			});
+			const cleanup = () => {
+				for (const { signal, forward } of forwarders) process.off(signal, forward);
+			};
+			child.once("error", (error) => {
+				cleanup();
+				reject(error);
+			});
+			child.once("exit", (code, signal) => {
+				cleanup();
+				resolve(code ?? (signal ? 1 : 0));
+			});
+		});
+	}
+	capture(command, args) {
+		return new Promise((resolve) => {
+			const child = spawn(command, args, { stdio: [
+				IGNORE,
+				PIPE,
+				IGNORE
+			] });
+			let stdout = "";
+			child.stdout?.on("data", (chunk) => {
+				stdout += chunk.toString();
+			});
+			child.once("error", () => {
+				resolve(void 0);
+			});
+			child.once("exit", (code) => {
+				resolve({
+					exitCode: code ?? 1,
+					stdout
+				});
+			});
+		});
+	}
+};
+//#endregion
+//#region src/services/devcontainer/runtime.ts
+const DEVCONTAINER_BINARY = "devcontainer";
+const NPX_BINARY = "npx";
+const LAUNCHER_BINARY = "doompi";
+const BROKER_MOUNT_DIRECTORY = "/run/doompi";
+/** Locates the workspace's own dev container configuration, if it has one. */
+function findDevcontainerConfig(repoRoot) {
+	for (const relative of DEVCONTAINER_CONFIG_PATHS) {
+		const candidate = path.join(repoRoot, relative);
+		if (fs.existsSync(candidate)) return candidate;
+	}
+}
+/**
+* Resolves how to invoke the Dev Containers CLI.
+*
+* A local install is preferred so a launch does not depend on the network;
+* npx is the fallback, pinned so the tool cannot change underneath a session.
+*/
+async function resolveDevcontainerCli(runner) {
+	if ((await runner.capture(DEVCONTAINER_BINARY, ["--version"]))?.exitCode === 0) return {
+		command: DEVCONTAINER_BINARY,
+		prefix: []
+	};
+	return {
+		command: NPX_BINARY,
+		prefix: ["-y", DEVCONTAINER_CLI_PACKAGE]
+	};
+}
+/**
+* Runs the session inside the workspace's own dev container.
+*
+* The container is brought up by the Dev Containers CLI, so the file decides
+* the image, features, mounts and lifecycle hooks: the session gets the
+* project's real toolchain, and this layer's isolation guarantees do not
+* apply beyond the environment it passes in.
+*/
+async function runDevcontainerSession(options) {
+	const cli = await resolveDevcontainerCli(options.runner);
+	options.onProgress?.("starting the workspace dev container");
+	const upArgs = devcontainerUpArgs({
+		repoRoot: options.repoRoot,
+		socketDirectory: options.socketDirectory,
+		socketTarget: options.socketDirectory ? BROKER_MOUNT_DIRECTORY : void 0
+	});
+	const up = await options.runner.capture(cli.command, [...cli.prefix, ...upArgs]);
+	if (!up) throw new Error("The Dev Containers CLI could not be started. Install @devcontainers/cli, or make npx available.");
+	const { containerId, remoteWorkspaceFolder, error } = parseDevcontainerUp(up.stdout);
+	if (!containerId) throw new Error(`The dev container did not start: ${error ?? `exit ${up.exitCode}`}`);
+	const bootstrap = await options.runner.run(options.engine, [
+		"exec",
+		containerId,
+		...bootstrapCommand(options.version)
+	]);
+	if (bootstrap !== 0) throw new Error(`DoomPi could not be installed in the dev container (exit ${bootstrap}). Add it to the dev container, or unset the dev container preference to use the built-in image.`);
+	options.onProgress?.(`attaching to dev container ${containerId.slice(0, 12)}`);
+	return options.runner.run(options.engine, devcontainerExecArgs({
+		containerId,
+		cwd: remoteWorkspaceFolder ? containerWorkspacePath(options.repoRoot, options.cwd, remoteWorkspaceFolder) : options.cwd,
+		environment: options.environment,
+		hasTty: options.hasTty,
+		command: [LAUNCHER_BINARY, ...remoteWorkspaceFolder ? mapForwardArgs(options.forwardArgs, options.repoRoot, remoteWorkspaceFolder) : options.forwardArgs]
+	}));
+}
+//#endregion
+//#region src/services/loginPorts/index.ts
+const LOOPBACK = "127.0.0.1";
+function portIsFree(port) {
+	return new Promise((resolve) => {
+		const probe = net.createServer();
+		probe.once("error", () => resolve(false));
+		probe.listen(port, LOOPBACK, () => {
+			probe.close(() => resolve(true));
+		});
+	});
+}
+/**
+* Reports which OAuth callback ports this launch may publish.
+*
+* A taken port means another sandbox already holds it, so publishing would
+* fail the whole launch over a login the session may never attempt. Skipping
+* it costs only the ability to log in from inside this particular container.
+*/
+async function availableLoginPorts(ports = OAUTH_CALLBACK_PORTS) {
+	const free = [];
+	for (const port of ports) if (await portIsFree(port)) free.push(port);
+	return free;
+}
+//#endregion
+//#region src/services/runFlags/index.ts
+/**
+* Splits configured engine options into argv entries.
+*
+* Whitespace separated rather than shell parsed: the engine is spawned without
+* a shell, so quoting rules would only invent a syntax the caller does not
+* actually get.
+*/
+function parseRunFlags(configured) {
+	return (configured ?? "").split(/\s+/).filter((flag) => flag.length > 0);
+}
+const OPTION_FORM = /^--?[^\s=]+(=.*)?$/s;
+/**
+* Requires every configured entry to be a self-contained option.
+*
+* Separated values cannot be told from positional arguments without knowing
+* each option's arity, and a stray positional would silently replace the image
+* or its command. Demanding `--flag=value` removes the ambiguity instead of
+* guessing at it.
+*/
+function assertRunFlags(flags, optionName) {
+	const invalid = flags.find((flag) => !OPTION_FORM.test(flag));
+	if (invalid !== void 0) throw new Error(`${optionName} accepts engine options in --flag or --flag=value form; "${invalid}" is neither. Write a value as part of its option, for example --runtime=runsc.`);
+}
+//#endregion
+//#region src/services/sandboxImage/index.ts
+const IMAGE_REPOSITORY = "doompi-sandbox";
+const TAG_SAFE = /[^A-Za-z0-9_.-]/g;
+/**
+* Names one image build: a distribution version plus its image definition.
+*
+* The digest matters as much as the version. Editing the Dockerfile or the
+* bridge without it would silently reuse a cached image that predates the
+* change.
+*/
+function formatImageTag(version, digest) {
+	return `${IMAGE_REPOSITORY}:v${version.replaceAll(TAG_SAFE, "-")}-${digest}`;
+}
+/**
+* Self-contained Linux image for sandboxed sessions.
+*
+* nano is present because Pi falls back to it for the external editor when
+* VISUAL and EDITOR are unset, which is always the case here: a host editor
+* variable naming a desktop application would resolve to a binary the
+* container does not have, so it is deliberately not forwarded.
+*
+* The distribution installs from the registry rather than mounting host
+* modules: host installs carry platform-specific binaries a Linux container
+* cannot run. DOOMPI_SANDBOX is baked in so nothing that reaches a shell in
+* the container can present itself as an unsandboxed session.
+*/
+function sandboxDockerfile() {
+	return [
+		"FROM node:22-bookworm-slim",
+		"RUN apt-get update \\",
+		"  && apt-get install -y --no-install-recommends ca-certificates curl git nano openssh-client ripgrep \\",
+		"  && rm -rf /var/lib/apt/lists/*",
+		"ARG DOOMPI_VERSION",
+		"RUN npm install -g @agimon-ai/doompi@${DOOMPI_VERSION}",
+		`COPY ${BRIDGE_FILE_NAME} ${BRIDGE_CONTAINER_PATH}`,
+		"# World-writable so the launch can map any host user id onto it.",
+		"RUN mkdir -m 0777 /doompi-home",
+		"ENV DOOMPI_SANDBOX=1 HOME=/doompi-home",
+		""
+	].join("\n");
+}
+/**
+* Image for the cockpit container, which holds the hub rather than one session.
+*
+* Kept separate from the sandbox image rather than folded into it. The cockpit
+* needs the web package and a tunnel client, and making every interactive
+* `--sandbox` launch pay for an extra apt repository and a larger download to
+* get them would be a poor trade.
+*
+* Installing `@agimon-ai/doompi-web` is enough for all three programs: its
+* `@agimon-ai/doompi` dependency owns both the session server executable and
+* the agent runtime.
+*/
+function cockpitDockerfile() {
+	return [
+		"FROM node:22-bookworm-slim",
+		"RUN apt-get update \\",
+		"  && apt-get install -y --no-install-recommends ca-certificates curl git gnupg nano openssh-client ripgrep \\",
+		"  && rm -rf /var/lib/apt/lists/*",
+		"RUN curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg \\",
+		"  -o /usr/share/keyrings/cloudflare-main.gpg \\",
+		" && echo \"deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared bookworm main\" \\",
+		"  > /etc/apt/sources.list.d/cloudflared.list \\",
+		" && apt-get update && apt-get install -y --no-install-recommends cloudflared \\",
+		" && rm -rf /var/lib/apt/lists/*",
+		"ARG DOOMPI_VERSION",
+		"RUN npm install -g @agimon-ai/doompi-web@${DOOMPI_VERSION}",
+		"# World-writable so the launch can map any host user id onto it.",
+		"RUN mkdir -m 0777 /doompi-home",
+		"ENV DOOMPI_SANDBOX=1 HOME=/doompi-home",
+		""
+	].join("\n");
+}
+//#endregion
+//#region src/services/sandboxImageTag/index.ts
+const DIGEST_LENGTH = 8;
+/** Tags the image with the distribution version and a digest of its definition. */
+function sandboxImageTag(version) {
+	return formatImageTag(version, createHash("sha256").update(sandboxDockerfile()).update(sandboxBridgeSource()).digest("hex").slice(0, DIGEST_LENGTH));
+}
+/**
+* Tags the cockpit image separately from the sandbox one.
+*
+* Same digest scheme, different definition, so editing either Dockerfile
+* invalidates only its own image.
+*/
+function cockpitImageTag(version) {
+	const digest = createHash("sha256").update(cockpitDockerfile()).digest("hex").slice(0, DIGEST_LENGTH);
+	return formatImageTag(`${version}-cockpit`, digest);
+}
+//#endregion
+//#region src/services/harness/index.ts
+const ENGINE_ENV = "DOOMPI_SANDBOX_ENGINE";
+const BROKER_DISABLED_ENV = "DOOMPI_SANDBOX_BROKER";
+const RUN_FLAGS_ENV = "DOOMPI_SANDBOX_RUN_FLAGS";
+const DISABLED_VALUE = "0";
+const ENGINES = [
+	"docker",
+	"podman",
+	"nerdctl",
+	"finch"
+];
+const DOCKERFILE_NAME = "Dockerfile";
+const MODES_FILE = path.join(".doom", "modes.yaml");
+const LOCAL_PACKAGE_PATTERN = /^\s*(?:-|name:)\s*["']?\.{1,2}\//m;
+const REPO_KEY_LENGTH = 12;
+const require = createRequire(import.meta.url);
+const SELF_MANIFEST = "@agimon-ai/doompi-sandbox/package.json";
+function distributionVersion() {
+	return require(SELF_MANIFEST).version;
+}
+/** Fixed per-repository directory a reused dev container can keep mounted. */
+function brokerDirectory(repoRoot) {
+	return path.join(os.tmpdir(), `${repoKey(repoRoot)}-broker`);
+}
+function repoKey(repoRoot) {
+	return `doompi-sandbox-${createHash("sha256").update(repoRoot).digest("hex").slice(0, REPO_KEY_LENGTH)}`;
+}
+async function detectEngine(runner, environment) {
+	const configured = environment[ENGINE_ENV]?.trim();
+	if (configured) {
+		if (ENGINES.includes(configured)) return configured;
+		throw new Error(`${ENGINE_ENV} must be one of: ${ENGINES.join(", ")}.`);
+	}
+	for (const engine of ENGINES) if ((await runner.capture(engine, ["--version"]))?.exitCode === 0) return engine;
+	throw new Error(`No container engine found. Install one of ${ENGINES.join(", ")}, or set ${ENGINE_ENV}.`);
+}
+/**
+* Builds the image if the engine does not already have it.
+*
+* Takes its definition rather than assuming one, because the interactive
+* sandbox and the cockpit container are two different images built the same
+* way. The tag already carries a digest of the definition, so a changed
+* Dockerfile misses the inspect and rebuilds.
+*/
+async function ensureImage(runner, engine, version, onProgress, definition) {
+	const tag = definition.tag;
+	if ((await runner.capture(engine, [
+		"image",
+		"inspect",
+		tag
+	]))?.exitCode === 0) return tag;
+	onProgress?.(`building ${tag} (first run for this DoomPi version)`);
+	const context = fs.mkdtempSync(path.join(os.tmpdir(), "doompi-sandbox-build-"));
+	try {
+		fs.writeFileSync(path.join(context, DOCKERFILE_NAME), definition.dockerfile);
+		for (const [name, contents] of Object.entries(definition.files ?? {})) fs.writeFileSync(path.join(context, name), contents);
+		const exitCode = await runner.run(engine, [
+			"build",
+			"-t",
+			tag,
+			"--build-arg",
+			`DOOMPI_VERSION=${version}`,
+			context
+		]);
+		if (exitCode !== 0) throw new Error(`Building the ${tag} image failed with exit code ${exitCode}.`);
+	} finally {
+		fs.rmSync(context, {
+			recursive: true,
+			force: true
+		});
+	}
+	return tag;
+}
+function warnAboutLocalPackages(repoRoot, onProgress) {
+	let modes;
+	try {
+		modes = fs.readFileSync(path.join(repoRoot, MODES_FILE), "utf8");
+	} catch {
+		return;
+	}
+	if (LOCAL_PACKAGE_PATTERN.test(modes)) onProgress?.("modes.yaml declares local workspace packages; their platform-specific dependencies must be installed inside the container before they can load");
+}
+/** Builds the launcher with injectable seams for tests. */
+function createSandboxLauncher(dependencies = {}) {
+	const runner = dependencies.runner ?? new SpawnEngineProcessRunner();
+	const beginBroker = dependencies.startBroker ?? startBroker;
+	const resolveLoginPorts = dependencies.loginPorts ?? availableLoginPorts;
+	return { async launchSandbox(request) {
+		const engine = await detectEngine(runner, request.environment);
+		const runFlags = parseRunFlags(request.environment[RUN_FLAGS_ENV]);
+		assertRunFlags(runFlags, RUN_FLAGS_ENV);
+		request.onProgress?.(`using ${engine}${runFlags.length > 0 ? ` with ${runFlags.join(" ")}` : ""}`);
+		const version = dependencies.version ?? distributionVersion();
+		const devcontainer = request.environment["DOOMPI_SANDBOX_DEVCONTAINER"] === DISABLED_VALUE ? void 0 : findDevcontainerConfig(request.repoRoot);
+		const imageTag = devcontainer ? void 0 : await ensureImage(runner, engine, version, request.onProgress, {
+			tag: sandboxImageTag(version),
+			dockerfile: sandboxDockerfile(),
+			files: { [BRIDGE_FILE_NAME]: sandboxBridgeSource() }
+		});
+		if (devcontainer) {
+			request.onProgress?.(`using the workspace dev container from ${path.relative(request.repoRoot, devcontainer)}`);
+			request.onProgress?.("its configuration owns the mounts and run arguments, so this is not an isolation boundary");
+		} else warnAboutLocalPackages(request.repoRoot, request.onProgress);
+		const broker = request.environment[BROKER_DISABLED_ENV] === DISABLED_VALUE ? void 0 : await beginBroker({
+			environment: request.environment,
+			onDenied: (reason) => request.onProgress?.(`broker refused a call: ${reason}`),
+			...devcontainer ? { socketDirectory: brokerDirectory(request.repoRoot) } : {}
+		});
+		if (broker) request.onProgress?.(`brokering ${broker.providers.join(", ")}; provider keys stay on the host`);
+		const loginPorts = devcontainer ? [] : await resolveLoginPorts();
+		if (!devcontainer && loginPorts.length < OAUTH_CALLBACK_PORTS.length) request.onProgress?.("some OAuth callback ports are already taken; /login inside this sandbox may not complete");
+		try {
+			const hasTty = process.stdin.isTTY === true && process.stdout.isTTY === true;
+			if (devcontainer) return await runDevcontainerSession({
+				repoRoot: request.repoRoot,
+				cwd: request.cwd,
+				forwardArgs: request.forwardArgs,
+				environment: containerEnvironment(request.environment, broker),
+				engine,
+				runner,
+				version,
+				hasTty,
+				...broker?.endpoint.transport === "unix" ? { socketDirectory: broker.endpoint.socketDirectory } : {},
+				...request.onProgress ? { onProgress: request.onProgress } : {}
+			});
+			const host = {
+				hasTty,
+				platform: process.platform,
+				userId: process.getuid?.(),
+				groupId: process.getgid?.(),
+				repoKey: repoKey(request.repoRoot),
+				version,
+				...dependencies.hostFacts
+			};
+			const plan = buildSandboxPlan({
+				repoRoot: request.repoRoot,
+				cwd: request.cwd,
+				forwardArgs: request.forwardArgs,
+				environment: request.environment,
+				engine,
+				host,
+				imageTag,
+				runFlags,
+				loginPorts,
+				broker
+			});
+			request.onProgress?.(`starting contained session in ${imageTag}`);
+			return await runner.run(engine, plan.runArgs);
+		} finally {
+			await broker?.stop();
+		}
+	} };
+}
+/** Contract entry the DoomPi harness resolves for `--sandbox`. */
+function launchSandbox(request) {
+	return createSandboxLauncher().launchSandbox(request);
+}
+//#endregion
+export { cockpitImageTag as a, parseRunFlags as c, DEVCONTAINER_DISABLED_ENV as d, launchSandbox as i, SpawnEngineProcessRunner as l, detectEngine as n, cockpitDockerfile as o, ensureImage as r, assertRunFlags as s, createSandboxLauncher as t, containerEnvironment as u };
+
+//# sourceMappingURL=harness-CEuhOTr2.mjs.map