@ai-projector/ide 0.0.0-stage → 0.11.1

package/packages/server/modules/browser/rewrite.js

@@ -0,0 +1,82 @@
+import { proxyUrl } from "../../../core/modules/browser/index.js";
+const ABSOLUTE = /^(?:https?:)?\/\//i;
+/**
+ * Относительные ссылки (`/a.png`, `b.css`) работают сами: документ и так на origin сайта.
+ * Переписываются только абсолютные ссылки на другие хосты.
+ */
+function remap(value, context) {
+    const text = value.trim();
+    if (!ABSOLUTE.test(text))
+        return;
+    try {
+        return proxyUrl(new URL(text, context.page), context.suffix);
+    }
+    catch {
+        return;
+    }
+}
+export function rewriteCss(css, context) {
+    return css
+        .replace(/url\(\s*(["']?)([^"')]*?)\1\s*\)/gi, (whole, quote, value) => {
+        const target = remap(value, context);
+        return target ? `url(${quote}${target}${quote})` : whole;
+    })
+        .replace(/@import\s+(["'])([^"']+)\1/gi, (whole, quote, value) => {
+        const target = remap(value, context);
+        return target ? `@import ${quote}${target}${quote}` : whole;
+    });
+}
+const URL_ATTRIBUTES = /(\s(?:src|href|action|formaction|poster|data|background)\s*=\s*)(?:"([^"]*)"|'([^']*)')/gi;
+const SRCSET = /(\ssrcset\s*=\s*)(?:"([^"]*)"|'([^']*)')/gi;
+const STYLE_ATTRIBUTE = /(\sstyle\s*=\s*)(?:"([^"]*)"|'([^']*)')/gi;
+const STYLE_BLOCK = /(<style\b[^>]*>)([\s\S]*?)(<\/style>)/gi;
+const INTEGRITY = /\sintegrity(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+))?(?=[\s>/])/gi;
+const META_BLOCKED = /<meta\b[^>]*http-equiv\s*=\s*["']?(?:content-security-policy|set-cookie)[^>]*>/gi;
+function quoted(prefix, double, single, map) {
+    const quote = double !== undefined ? '"' : "'";
+    return `${prefix}${quote}${map(double ?? single ?? "")}${quote}`;
+}
+/**
+ * Скрипт страницы: направляет в прокси абсолютные адреса из JavaScript (fetch, XHR, sendBeacon,
+ * window.open) и сообщает родителю настоящий адрес и заголовок для адресной строки.
+ */
+export function pageShim(context) {
+    const origin = JSON.stringify(context.page.origin);
+    const suffix = JSON.stringify(context.suffix);
+    const source = `(function(){
+var T=${origin},S=${suffix},A=/^(?:https?:)?\\/\\//i;
+function map(u){try{var s=typeof u==="string"?u:u instanceof URL?u.href:"";if(!A.test(s))return u;
+var x=new URL(s,location.href);if(x.hostname.indexOf(":")>=0||x.host.slice(-S.length)===S)return u;
+return"http://"+x.hostname+"."+(x.protocol==="https:"?"s":"h")+x.port+"."+S+x.pathname+x.search+x.hash}catch(e){return u}}
+var f=window.fetch;if(f)window.fetch=function(i,n){try{if(typeof i==="string"||i instanceof URL)i=map(i);else if(i&&i.url){var m=map(i.url);if(m!==i.url)i=new Request(m,i)}}catch(e){}return f.call(this,i,n)};
+var o=XMLHttpRequest.prototype.open;XMLHttpRequest.prototype.open=function(m,u){arguments[1]=map(u);return o.apply(this,arguments)};
+if(navigator.sendBeacon){var b=navigator.sendBeacon;navigator.sendBeacon=function(u,d){return b.call(this,map(u),d)}}
+var w=window.open;window.open=function(u){arguments[0]=map(u);return w.apply(this,arguments)};
+var last="";function report(){var u=T+location.pathname+location.search+location.hash,t=document.title,k=u+"\\n"+t;
+if(k===last)return;last=k;try{parent.postMessage({projectorBrowser:true,url:u,title:t},"*")}catch(e){}}
+addEventListener("load",report);addEventListener("popstate",report);addEventListener("hashchange",report);setInterval(report,500);report();
+})();`;
+    return `<script>${source.replace(/<\/script/gi, "<\\/script")}</script>`;
+}
+/** Переписывает абсолютные ссылки HTML на origin прокси и добавляет скрипт страницы. */
+export function rewriteHtml(html, context) {
+    const rewritten = html
+        .replace(META_BLOCKED, "")
+        .replace(INTEGRITY, "")
+        .replace(STYLE_BLOCK, (_, open, css, close) => open + rewriteCss(css, context) + close)
+        .replace(STYLE_ATTRIBUTE, (_whole, prefix, d, s) => quoted(prefix, d, s, (value) => rewriteCss(value, context)))
+        .replace(SRCSET, (_whole, prefix, d, s) => quoted(prefix, d, s, (value) => value
+        .split(",")
+        .map((part) => {
+        const [link, ...rest] = part.trim().split(/\s+/);
+        return [(link && remap(link, context)) || link, ...rest].join(" ");
+    })
+        .join(", ")))
+        .replace(URL_ATTRIBUTES, (_whole, prefix, d, s) => quoted(prefix, d, s, (value) => remap(value, context) ?? value));
+    const shim = pageShim(context);
+    const head = rewritten.match(/<head\b[^>]*>/i);
+    if (head)
+        return rewritten.replace(head[0], () => head[0] + shim);
+    const root = rewritten.match(/<html\b[^>]*>/i);
+    return root ? rewritten.replace(root[0], () => root[0] + shim) : shim + rewritten;
+}

package/packages/server/modules/devcontainer/discovery.js

@@ -0,0 +1,85 @@
+import { createHash } from "node:crypto";
+import { readFileSync, realpathSync, statSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { parse } from "jsonc-parser";
+const CANDIDATES = [".devcontainer/devcontainer.json", ".devcontainer.json"];
+const MAX_BYTES = 256 * 1024;
+const inside = (root, path) => {
+    const rel = relative(root, path);
+    return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+};
+// Small files, read synchronously so the trust check can run inside synchronous terminal launches.
+function readLimited(path) {
+    if (statSync(path).size > MAX_BYTES)
+        throw new Error("файл конфигурации слишком большой");
+    return readFileSync(path);
+}
+function referencedFiles(config, directory) {
+    const build = config.build;
+    const compose = config.dockerComposeFile;
+    const names = [
+        ...(typeof config.dockerFile === "string" ? [config.dockerFile] : []),
+        ...(typeof build?.dockerfile === "string" ? [build.dockerfile] : []),
+        ...(typeof compose === "string" ? [compose] : Array.isArray(compose) ? compose : []),
+    ].filter((name) => typeof name === "string");
+    return names.map((name) => resolve(directory, name));
+}
+/**
+ * Finds the project's devcontainer.json. The hash covers the config plus the
+ * Dockerfile and Compose files it builds from, so any of them changing
+ * invalidates a previous trust decision.
+ */
+export function findDevcontainer(root) {
+    const base = realpathSync(root);
+    for (const candidate of CANDIDATES) {
+        let file;
+        try {
+            file = realpathSync(join(base, candidate));
+        }
+        catch {
+            continue;
+        }
+        // A symlink pointing out of the project is never read or trusted.
+        if (!inside(base, file))
+            continue;
+        let bytes;
+        try {
+            bytes = readLimited(file);
+        }
+        catch {
+            continue;
+        }
+        const errors = [];
+        const parsed = parse(bytes.toString("utf8"), errors, { allowTrailingComma: true });
+        const config = parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : {};
+        const hash = createHash("sha256");
+        hash.update(`${relative(base, file)}\0`).update(bytes);
+        for (const extra of referencedFiles(config, dirname(file)).sort()) {
+            hash.update(`\0${relative(base, extra)}\0`);
+            let real;
+            try {
+                real = realpathSync(extra);
+            }
+            catch {
+                /* Missing files still count: creating one later changes the hash. */
+            }
+            if (!real || !inside(base, real))
+                hash.update(real ? "outside" : "missing");
+            else
+                try {
+                    hash.update(readLimited(real));
+                }
+                catch {
+                    hash.update("unreadable");
+                }
+        }
+        return {
+            file,
+            relativePath: relative(base, file),
+            config: errors.length ? {} : config,
+            hash: hash.digest("hex"),
+        };
+    }
+}

package/packages/server/modules/devcontainer/exec.js

@@ -0,0 +1,81 @@
+import { createRequire } from "node:module";
+import { realpathSync } from "node:fs";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { os } from "../../../core/modules/os/index.js";
+import { loadProjects } from "../projects/index.js";
+import { trustedDevcontainer } from "./state.js";
+const UP_TTL = 120_000;
+const UP_TIMEOUT = 10 * 60_000;
+const cliPath = () => createRequire(import.meta.url).resolve("@devcontainers/cli/devcontainer.js");
+const ready = new Map();
+function target(project) {
+    const config = trustedDevcontainer(project);
+    if (!config)
+        return undefined;
+    const root = realpathSync(project.path);
+    const flags = ["--workspace-folder", root, "--config", config.file];
+    return { flags, key: `${root}\0${config.hash}` };
+}
+/** Builds/starts the container once for a while; concurrent callers share the same `up`. */
+function ensureUp(key, flags, signal) {
+    const cached = ready.get(key);
+    if (cached && Date.now() - cached.at < UP_TTL)
+        return cached.pending;
+    const pending = os.tools
+        .runNodeScript(cliPath(), ["up", ...flags], { timeout: UP_TIMEOUT, signal })
+        .then(() => undefined);
+    const entry = { at: Date.now(), pending };
+    ready.set(key, entry);
+    pending.catch(() => {
+        if (ready.get(key) === entry)
+            ready.delete(key);
+    });
+    return pending;
+}
+/** True when commands for this project must run in its trusted Dev Container. */
+export const usesDevcontainer = (project) => !!target(project);
+/** Runs a command inside the trusted Dev Container; rejects like `execFile` on a non-zero exit. */
+export async function runDevcontainerCommand(project, command, timeout = 30_000, signal, onOutput) {
+    const resolved = target(project);
+    if (!resolved)
+        throw new Error("Проект не использует доверенный Dev Container");
+    await ensureUp(resolved.key, resolved.flags, signal);
+    try {
+        return await os.tools.runNodeScript(cliPath(), ["exec", ...resolved.flags, ...command], {
+            timeout,
+            signal,
+            onOutput,
+        });
+    }
+    catch (error) {
+        // A container removed behind our back: forget it so the next call rebuilds.
+        if (/not found|is not running/i.test(String(error.stderr)))
+            ready.delete(resolved.key);
+        throw error;
+    }
+}
+/** The project containing `path` whose commands run in a trusted Dev Container. */
+export async function devcontainerForPath(path) {
+    const root = resolve(path);
+    return (await loadProjects(true)).find((project) => {
+        const rel = relative(project.path, root);
+        return (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel) && usesDevcontainer(project));
+    });
+}
+/** Removes the project's dev container(s); files in the project are untouched. */
+export async function stopDevcontainer(project) {
+    const root = realpathSync(project.path);
+    const { stdout } = await os.tools.runDocker([
+        "ps",
+        "-aq",
+        "--filter",
+        `label=devcontainer.local_folder=${root}`,
+    ]);
+    const ids = stdout.split("\n").filter((id) => /^[a-f0-9]{12,64}$/.test(id));
+    if (ids.length)
+        await os.tools.runDocker(["rm", "--force", ...ids], { timeout: 60_000 });
+    for (const key of ready.keys())
+        if (key.startsWith(`${root}\0`))
+            ready.delete(key);
+    return { removed: ids.length };
+}

package/packages/server/modules/devcontainer/index.js

@@ -0,0 +1,4 @@
+export { devcontainerState, decideDevcontainer, trustedDevcontainer } from "./state.js";
+export { devcontainerLaunch } from "./launch.js";
+export { findDevcontainer } from "./discovery.js";
+export { runDevcontainerCommand, usesDevcontainer, devcontainerForPath, stopDevcontainer, } from "./exec.js";

package/packages/server/modules/devcontainer/launch.js

@@ -0,0 +1,51 @@
+import { createRequire } from "node:module";
+import { realpathSync } from "node:fs";
+import { basename } from "node:path";
+import { os, bashShellLaunch } from "../../../core/modules/os/index.js";
+import { trustedDevcontainer } from "./state.js";
+const SCRIPT = `
+const { spawnSync } = require("node:child_process");
+const [cli, workspace, config, ...command] = process.argv.slice(1);
+const options = ["--workspace-folder", workspace, "--config", config];
+const up = spawnSync(process.execPath, [cli, "up", ...options], { stdio: ["inherit", "ignore", "inherit"] });
+if (up.error || up.status !== 0) {
+  console.error(up.error?.message || "devcontainer up завершился с ошибкой");
+  process.exit(up.status || 1);
+}
+const result = spawnSync(process.execPath, [cli, "exec", ...options, ...command], { stdio: "inherit" });
+if (result.error) console.error(result.error.message);
+process.exit(result.status ?? 1);
+`;
+/**
+ * Runs `command` inside the project's dev container, building it first when needed.
+ * Only for configs the user trusted in their current form; undefined otherwise.
+ */
+/** Where the CLI mounts the project: `workspaceFolder`, else `/workspaces/<folder name>`. */
+export function containerWorkspace(config, root) {
+    const name = basename(root);
+    const custom = config.workspaceFolder;
+    if (typeof custom === "string" && custom.startsWith("/"))
+        return custom.replaceAll("${localWorkspaceFolderBasename}", name).replace(/\/+$/, "");
+    return `/workspaces/${name}`;
+}
+export function devcontainerLaunch(project, shell) {
+    const config = trustedDevcontainer(project);
+    if (!config)
+        return undefined;
+    const cli = createRequire(import.meta.url).resolve("@devcontainers/cli/devcontainer.js");
+    const command = bashShellLaunch(shell);
+    return {
+        ...os.tools.ptyCommand(process.execPath, [
+            "--input-type=commonjs",
+            "-e",
+            SCRIPT,
+            cli,
+            realpathSync(project.path),
+            config.file,
+            command.file,
+            ...command.args,
+        ]),
+        title: `Dev Container · ${project.name}`,
+        workspace: containerWorkspace(config.config, realpathSync(project.path)),
+    };
+}

package/packages/server/modules/devcontainer/state.js

@@ -0,0 +1,68 @@
+import { realpathSync } from "node:fs";
+import { classifyDevcontainer } from "../../../core/modules/devcontainer/index.js";
+import { HttpError } from "../http/index.js";
+import { findDevcontainer } from "./discovery.js";
+import { saveTrust, trustEntry } from "./trust.js";
+function resolved(project) {
+    const root = realpathSync(project.path);
+    const found = findDevcontainer(root);
+    const entry = trustEntry(root);
+    return { root, found, entry };
+}
+/** Trust applies only while the decision was made for the config as it is now. */
+const current = (entry, hash) => !!entry && entry.hash === hash;
+export function devcontainerState(project) {
+    const { found, entry } = resolved(project);
+    if (!found)
+        return {
+            found: false,
+            findings: [],
+            decision: null,
+            stale: false,
+            needsDecision: false,
+            active: false,
+        };
+    const findings = classifyDevcontainer(found.config);
+    const valid = current(entry, found.hash);
+    const decision = valid ? entry.decision : null;
+    return {
+        found: true,
+        configPath: found.relativePath,
+        name: typeof found.config.name === "string" ? found.config.name : undefined,
+        hash: found.hash,
+        findings,
+        decision,
+        stale: !!entry && !valid,
+        needsDecision: findings.length > 0 && !decision,
+        active: decision === "trusted",
+    };
+}
+/** `hash` is what the user saw; a config edited since then cannot be trusted by accident. */
+export async function decideDevcontainer(project, decision, hash) {
+    const { root, found } = resolved(project);
+    if (!found)
+        throw new HttpError(404, "В проекте нет devcontainer.json");
+    if (decision === "forget")
+        await saveTrust(root, null);
+    else {
+        if (hash !== found.hash)
+            throw new HttpError(409, "Конфигурация изменилась после показа. Проверьте её ещё раз");
+        await saveTrust(root, {
+            decision,
+            configPath: found.relativePath,
+            hash: found.hash,
+            decidedAt: new Date().toISOString(),
+        });
+    }
+    return devcontainerState(project);
+}
+/** The config to run with, or undefined when the project must keep the restricted model. */
+export function trustedDevcontainer(project) {
+    try {
+        const { found, entry } = resolved(project);
+        return found && entry?.decision === "trusted" && current(entry, found.hash) ? found : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/packages/server/modules/devcontainer/trust.js

@@ -0,0 +1,41 @@
+import { mkdir, rename, writeFile } from "node:fs/promises";
+import { os } from "../../../core/modules/os/index.js";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { dataDir } from "../../../core/modules/app-paths/index.js";
+export const trustPath = () => join(dataDir(), "devcontainer-trust.json");
+let queue = Promise.resolve();
+function read() {
+    try {
+        const parsed = JSON.parse(readFileSync(trustPath(), "utf8"));
+        if (parsed.version !== 1 || typeof parsed.projects !== "object" || !parsed.projects)
+            throw new Error("Некорректный файл доверия");
+        return parsed;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return { version: 1, projects: {} };
+        throw error;
+    }
+}
+/** Decisions are keyed by the project's real path, not by the (renameable) project id. */
+export function trustEntry(root) {
+    return read().projects[root];
+}
+export async function saveTrust(root, entry) {
+    const operation = queue.then(async () => {
+        const file = read();
+        if (entry)
+            file.projects[root] = entry;
+        else
+            delete file.projects[root];
+        await mkdir(dataDir(), { recursive: true });
+        const tmp = `${trustPath()}.${randomUUID()}.tmp`;
+        await writeFile(tmp, JSON.stringify(file, null, 2) + "\n", { mode: 0o600 });
+        await rename(tmp, trustPath());
+        await os.tools.restrictToOwner(trustPath());
+    });
+    queue = operation.catch(() => { });
+    await operation;
+}

package/packages/server/modules/directories/directories.js

@@ -0,0 +1,34 @@
+import { readdir, stat } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join } from "node:path";
+import { expandPath } from "../projects/index.js";
+import { HttpError } from "../http/index.js";
+export async function listDirectories(input, complete = false) {
+    if (!input ||
+        input.includes("\0") ||
+        (!isAbsolute(input) && input !== "~" && !input.startsWith("~/")))
+        throw new HttpError(400, "Укажите абсолютный путь или ~/…");
+    const expanded = expandPath(input);
+    const contents = !complete || input.endsWith("/") || input === "~";
+    const path = contents ? expanded : dirname(expanded);
+    const prefix = contents ? "" : basename(expanded);
+    try {
+        const rows = (await readdir(path, { withFileTypes: true }))
+            .filter((row) => row.name.startsWith(prefix))
+            .sort((a, b) => a.name.localeCompare(b.name));
+        const entries = [];
+        // Resolve directory symlinks as well; broken links simply aren't suggestions.
+        for (const row of rows) {
+            if (row.isDirectory() ||
+                (row.isSymbolicLink() &&
+                    (await stat(join(path, row.name)).then((info) => info.isDirectory(), () => false))))
+                entries.push({ name: row.name, path: join(path, row.name) });
+            if (entries.length > 1000)
+                break;
+        }
+        return { path, entries: entries.slice(0, 1000), truncated: entries.length > 1000 };
+    }
+    catch (error) {
+        const code = error.code;
+        throw new HttpError(code === "EACCES" || code === "EPERM" ? 403 : 400, code === "EACCES" || code === "EPERM" ? "Нет доступа к папке" : "Папка не найдена");
+    }
+}

package/packages/server/modules/directories/index.js

@@ -0,0 +1 @@
+export { listDirectories } from "./directories.js";

package/packages/server/modules/docker/actions.js

@@ -0,0 +1,121 @@
+import { os } from "../../../core/modules/os/index.js";
+import { createTerminalSession, listTerminalSessions } from "../terminal/index.js";
+import { HttpError } from "../http/index.js";
+import { requireContext, readBinding, projectFile } from "./settings.js";
+const host = globalThis;
+const locks = (host.projectorDockerActions ??= new Set());
+const containerActions = new Set(["start", "stop", "restart", "remove", "logs", "shell"]);
+const composeActions = {
+    up: ["up", "-d"],
+    composeStop: ["stop"],
+    composeRestart: ["restart"],
+    down: ["down"],
+    build: ["build"],
+    pull: ["pull"],
+};
+export async function dockerAction(project, input) {
+    const action = input.action;
+    if (!containerActions.has(action) && !composeActions[action])
+        throw new HttpError(400, "Неизвестное Docker-действие");
+    if (typeof input.context !== "string")
+        throw new HttpError(400, "Укажите Docker context");
+    const prefix = await requireContext(input.context);
+    if ((action === "remove" || action === "down") && input.confirm !== true)
+        throw new HttpError(409, "Подтвердите удаление контейнеров и сетей; volumes сохраняются");
+    const key = input.context;
+    if (locks.has(key))
+        throw new HttpError(409, "Дождитесь текущей Docker-операции");
+    locks.add(key);
+    try {
+        let args;
+        let containerId;
+        let composeProject;
+        let title;
+        if (containerActions.has(action)) {
+            if (typeof input.containerId !== "string" || !/^[a-f0-9]{64}$/.test(input.containerId))
+                throw new HttpError(400, "Укажите полный containerId");
+            const inspected = JSON.parse((await os.tools.runDocker([...prefix, "inspect", "--type", "container", input.containerId]))
+                .stdout)[0];
+            if (!inspected || inspected.Id !== input.containerId)
+                throw new HttpError(404, "Контейнер не найден");
+            containerId = inspected.Id;
+            if (!["logs", "shell"].includes(action) &&
+                listTerminalSessions().some((session) => session.status === "running" &&
+                    session.docker?.context === input.context &&
+                    session.docker?.containerId === containerId &&
+                    !["logs", "shell"].includes(session.docker?.kind ?? "")))
+                throw new HttpError(409, "Дождитесь операции над этим контейнером");
+            if (action === "shell" && !inspected.State?.Running)
+                throw new HttpError(409, "Контейнер должен работать");
+            if (action === "remove" && inspected.State?.Running)
+                throw new HttpError(409, "Сначала остановите контейнер");
+            if (action === "shell" &&
+                input.shell !== undefined &&
+                input.shell !== "sh" &&
+                input.shell !== "bash")
+                throw new HttpError(400, "shell: sh или bash");
+            args =
+                action === "logs"
+                    ? ["logs", "--follow", "--tail", "200", "--timestamps", containerId]
+                    : action === "shell"
+                        ? ["exec", "-it", containerId, input.shell || "sh"]
+                        : [
+                            action === "remove" ? "rm" : action,
+                            ...(action === "stop" || action === "restart" ? ["--time", "10"] : []),
+                            containerId,
+                        ];
+            title = `Docker ${action} · ${String(inspected.Name).replace(/^\//, "")}`;
+        }
+        else {
+            const binding = await readBinding(project.id);
+            if (!binding || binding.context !== input.context)
+                throw new HttpError(409, "Привяжите Compose к проекту и выбранному context");
+            composeProject = binding.name;
+            args = ["compose", "--project-directory", project.path, "--project-name", binding.name];
+            for (const file of binding.files)
+                args.push("-f", await projectFile(project.path, file));
+            for (const file of binding.envFiles)
+                args.push("--env-file", await projectFile(project.path, file));
+            for (const profile of binding.profiles)
+                args.push("--profile", profile);
+            if (listTerminalSessions().some((session) => session.status === "running" &&
+                session.docker?.context === input.context &&
+                session.docker?.composeProject === binding.name))
+                throw new HttpError(409, "Дождитесь текущей Compose-операции");
+            args.push(...composeActions[action]);
+            if (input.service !== undefined) {
+                if (typeof input.service !== "string" ||
+                    !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(input.service) ||
+                    action === "down")
+                    throw new HttpError(400, "Некорректный Compose service");
+                args.push(input.service);
+            }
+            title = `Compose ${action} · ${binding.name}`;
+        }
+        // Reuse PTY flow control, reconnect snapshots, exit status and dock tabs.
+        const session = createTerminalSession(project, { program: "shell" }, undefined, undefined, {
+            file: "docker",
+            args: [...prefix, ...args],
+            title,
+            docker: { context: input.context, kind: action, containerId, composeProject },
+        });
+        return { session };
+    }
+    finally {
+        locks.delete(key);
+    }
+}
+export async function dockerLogs(context, containerId) {
+    const prefix = await requireContext(context);
+    if (!/^[a-f0-9]{64}$/.test(containerId))
+        throw new HttpError(400, "Укажите полный containerId");
+    const result = await os.tools.runDocker([
+        ...prefix,
+        "logs",
+        "--tail",
+        "200",
+        "--timestamps",
+        containerId,
+    ]);
+    return { text: result.stdout + result.stderr };
+}

package/packages/server/modules/docker/daemon.js

@@ -0,0 +1,72 @@
+import { spawn } from "node:child_process";
+import { os } from "../../../core/modules/os/index.js";
+import { HttpError } from "../http/index.js";
+import { requireContext } from "./settings.js";
+const STOPPED = /cannot connect to (?:the )?docker daemon|daemon (?:is )?not running|is the docker daemon running|error during connect|dial unix|pipe\/docker|system cannot find the file|connection refused/i;
+const WAIT_MS = 90_000;
+const host = globalThis;
+/** Tells a missing CLI from a daemon that is down; anything else stays a plain error. */
+export function daemonState(error) {
+    const text = error instanceof Error ? error.message : String(error);
+    const missing = error?.code === "ENOENT" || /not found/i.test(text);
+    if (!missing && !STOPPED.test(text))
+        return undefined;
+    const plan = os.tools.dockerStartPlan();
+    return {
+        state: missing ? "missing" : "stopped",
+        start: { label: plan.label, auto: !!plan.command, manual: plan.manual },
+    };
+}
+function reachable(context) {
+    return (os.tools
+        // `docker info` exits 0 even with no daemon; `ps` really needs one.
+        .runDocker(["--context", context, "ps", "-q"], { timeout: 5000 })
+        .then(() => true, () => false));
+}
+function launch(command, args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, { stdio: "ignore", detached: true, windowsHide: true });
+        child.once("error", reject);
+        // systemctl/pkexec report the outcome by exit code; GUI launchers return at once or never.
+        const waits = /systemctl$|pkexec$|colima$/.test(command);
+        child.once("exit", (code) => !waits || code === 0 ? resolve() : reject(new Error(`${command} завершился с кодом ${code}`)));
+        if (!waits) {
+            child.unref();
+            resolve();
+        }
+    });
+}
+/** Brings the local Docker daemon up the way this OS does it, then waits until it answers. */
+export async function startDockerDaemon(context) {
+    await requireContext(context);
+    if (host.projectorDockerStart)
+        throw new HttpError(409, "Docker уже запускается");
+    const plan = os.tools.dockerStartPlan();
+    if (!plan.command)
+        throw new HttpError(409, plan.manual ?? "Запустить Docker автоматически не получится");
+    if (await reachable(context))
+        return { started: true };
+    const run = (async () => {
+        try {
+            await launch(plan.command, plan.args ?? []);
+        }
+        catch (error) {
+            throw new HttpError(500, `Не удалось выполнить «${plan.label}»: ${error instanceof Error ? error.message : error}`);
+        }
+        const deadline = Date.now() + WAIT_MS;
+        while (Date.now() < deadline) {
+            if (await reachable(context))
+                return;
+            await new Promise((resolve) => setTimeout(resolve, 2000));
+        }
+        throw new HttpError(504, "Docker запущен, но daemon не ответил за 90 секунд");
+    })();
+    host.projectorDockerStart = run;
+    try {
+        await run;
+    }
+    finally {
+        host.projectorDockerStart = undefined;
+    }
+    return { started: true };
+}

package/packages/server/modules/docker/index.js

@@ -0,0 +1,4 @@
+export { dockerSnapshot } from "./snapshot.js";
+export { configureDocker, bindDocker, dockerIntegrationStatus } from "./settings.js";
+export { startDockerDaemon } from "./daemon.js";
+export { dockerAction, dockerLogs } from "./actions.js";