@companyhelm/cli 0.0.2

package/dist/state/service/companyhelm_api_client.js

@@ -0,0 +1,316 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CompanyhelmApiClient = exports.CompanyhelmCommandChannel = void 0;
+exports.parseCompanyhelmApiUrl = parseCompanyhelmApiUrl;
+exports.createAgentRunnerControlServiceDefinition = createAgentRunnerControlServiceDefinition;
+const protobuf_1 = require("@bufbuild/protobuf");
+const protos_1 = require("@companyhelm/protos");
+const grpc = __importStar(require("@grpc/grpc-js"));
+const async_queue_js_1 = require("../utils/async_queue.js");
+function normalizePathPrefix(value) {
+    if (!value || value === "/") {
+        return "";
+    }
+    const withLeadingSlash = value.startsWith("/") ? value : `/${value}`;
+    const withoutTrailingSlash = withLeadingSlash.replace(/\/+$/g, "");
+    return withoutTrailingSlash === "/" ? "" : withoutTrailingSlash;
+}
+function buildRpcPath(methodName, pathPrefix) {
+    return `${normalizePathPrefix(pathPrefix)}/${protos_1.AgentRunnerControlService.typeName}/${methodName}`.replace(/\/{2,}/g, "/");
+}
+function extractTargetHost(target) {
+    const trimmed = target.trim().toLowerCase();
+    if (trimmed.startsWith("[")) {
+        const closingBracketIndex = trimmed.indexOf("]");
+        if (closingBracketIndex > 0) {
+            return trimmed.slice(1, closingBracketIndex);
+        }
+    }
+    const colonIndex = trimmed.indexOf(":");
+    return colonIndex >= 0 ? trimmed.slice(0, colonIndex) : trimmed;
+}
+function isLikelyLocalTarget(target) {
+    const host = extractTargetHost(target);
+    return host === "localhost" || host === "127.0.0.1" || host === "0.0.0.0" || host === "::1";
+}
+function parseCompanyhelmApiUrl(value) {
+    const trimmed = value.trim();
+    if (!trimmed) {
+        throw new Error("companyhelm_api_url cannot be empty.");
+    }
+    if (trimmed.includes("://")) {
+        const parsed = new URL(trimmed);
+        const host = parsed.hostname.includes(":") ? `[${parsed.hostname}]` : parsed.hostname;
+        const target = parsed.port ? `${host}:${parsed.port}` : host;
+        if (!target) {
+            throw new Error(`Invalid companyhelm_api_url '${value}'.`);
+        }
+        return {
+            target,
+            pathPrefix: normalizePathPrefix(parsed.pathname),
+            useTls: parsed.protocol !== "http:",
+        };
+    }
+    const firstSlash = trimmed.indexOf("/");
+    const target = firstSlash >= 0 ? trimmed.slice(0, firstSlash) : trimmed;
+    const pathPrefix = firstSlash >= 0 ? trimmed.slice(firstSlash) : "";
+    if (!target) {
+        throw new Error(`Invalid companyhelm_api_url '${value}'.`);
+    }
+    return {
+        target,
+        pathPrefix: normalizePathPrefix(pathPrefix),
+        useTls: !isLikelyLocalTarget(target),
+    };
+}
+function defaultCredentials(endpoint) {
+    return endpoint.useTls ? grpc.credentials.createSsl() : grpc.credentials.createInsecure();
+}
+function createAgentRunnerControlServiceDefinition(pathPrefix = "") {
+    const methods = protos_1.AgentRunnerControlService.method;
+    return {
+        registerRunner: {
+            path: buildRpcPath(methods.registerRunner.name, pathPrefix),
+            requestStream: false,
+            responseStream: false,
+            requestSerialize: (request) => Buffer.from((0, protobuf_1.toBinary)(protos_1.RegisterRunnerRequestSchema, request)),
+            requestDeserialize: (bytes) => (0, protobuf_1.fromBinary)(protos_1.RegisterRunnerRequestSchema, bytes),
+            responseSerialize: (response) => Buffer.from((0, protobuf_1.toBinary)(protos_1.RegisterRunnerResponseSchema, response)),
+            responseDeserialize: (bytes) => (0, protobuf_1.fromBinary)(protos_1.RegisterRunnerResponseSchema, bytes),
+        },
+        controlChannel: {
+            path: buildRpcPath(methods.controlChannel.name, pathPrefix),
+            requestStream: true,
+            responseStream: true,
+            requestSerialize: (request) => Buffer.from((0, protobuf_1.toBinary)(protos_1.ClientMessageSchema, request)),
+            requestDeserialize: (bytes) => (0, protobuf_1.fromBinary)(protos_1.ClientMessageSchema, bytes),
+            responseSerialize: (response) => Buffer.from((0, protobuf_1.toBinary)(protos_1.ServerMessageSchema, response)),
+            responseDeserialize: (bytes) => (0, protobuf_1.fromBinary)(protos_1.ServerMessageSchema, bytes),
+        },
+        listGithubInstallationsForRunner: {
+            path: buildRpcPath(methods.listGithubInstallationsForRunner.name, pathPrefix),
+            requestStream: false,
+            responseStream: false,
+            requestSerialize: (request) => Buffer.from((0, protobuf_1.toBinary)(protos_1.ListGithubInstallationsForRunnerRequestSchema, request)),
+            requestDeserialize: (bytes) => (0, protobuf_1.fromBinary)(protos_1.ListGithubInstallationsForRunnerRequestSchema, bytes),
+            responseSerialize: (response) => Buffer.from((0, protobuf_1.toBinary)(protos_1.ListGithubInstallationsForRunnerResponseSchema, response)),
+            responseDeserialize: (bytes) => (0, protobuf_1.fromBinary)(protos_1.ListGithubInstallationsForRunnerResponseSchema, bytes),
+        },
+        getGithubInstallationAccessTokenForRunner: {
+            path: buildRpcPath(methods.getGithubInstallationAccessTokenForRunner.name, pathPrefix),
+            requestStream: false,
+            responseStream: false,
+            requestSerialize: (request) => Buffer.from((0, protobuf_1.toBinary)(protos_1.GetGithubInstallationAccessTokenForRunnerRequestSchema, request)),
+            requestDeserialize: (bytes) => (0, protobuf_1.fromBinary)(protos_1.GetGithubInstallationAccessTokenForRunnerRequestSchema, bytes),
+            responseSerialize: (response) => Buffer.from((0, protobuf_1.toBinary)(protos_1.GetGithubInstallationAccessTokenForRunnerResponseSchema, response)),
+            responseDeserialize: (bytes) => (0, protobuf_1.fromBinary)(protos_1.GetGithubInstallationAccessTokenForRunnerResponseSchema, bytes),
+        },
+    };
+}
+function createAgentRunnerControlClient(endpoint, credentials, channelOptions) {
+    const ClientCtor = grpc.makeGenericClientConstructor(createAgentRunnerControlServiceDefinition(endpoint.pathPrefix), "AgentRunnerControlService");
+    return new ClientCtor(endpoint.target, credentials, channelOptions);
+}
+function toError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}
+class CompanyhelmCommandChannel {
+    constructor(call) {
+        this.messages = new async_queue_js_1.AsyncQueue();
+        this.resolveOpened = null;
+        this.rejectOpened = null;
+        this.openState = "pending";
+        this.call = call;
+        this.opened = new Promise((resolve, reject) => {
+            this.resolveOpened = resolve;
+            this.rejectOpened = reject;
+        });
+        call.on("data", (message) => {
+            this.setOpened();
+            this.messages.push(message);
+        });
+        call.on("metadata", () => {
+            this.setOpened();
+        });
+        call.on("end", () => {
+            this.failOpen(new Error("command channel closed before becoming usable"));
+            this.messages.close();
+        });
+        call.on("error", (error) => {
+            const serviceError = error;
+            if (serviceError.code === grpc.status.CANCELLED) {
+                this.failOpen(new Error("command channel cancelled before becoming usable"));
+                this.messages.close();
+                return;
+            }
+            const channelError = toError(error);
+            this.failOpen(channelError);
+            this.messages.fail(channelError);
+        });
+        call.on("status", (status) => {
+            if (status.code === grpc.status.OK || status.code === grpc.status.CANCELLED) {
+                return;
+            }
+            const statusError = new Error(`command channel closed with status ${status.code}: ${status.details}`);
+            this.failOpen(statusError);
+            this.messages.fail(statusError);
+        });
+    }
+    setOpened() {
+        if (this.openState !== "pending") {
+            return;
+        }
+        this.openState = "opened";
+        this.resolveOpened?.();
+        this.resolveOpened = null;
+        this.rejectOpened = null;
+    }
+    failOpen(error) {
+        if (this.openState !== "pending") {
+            return;
+        }
+        this.openState = "failed";
+        this.rejectOpened?.(error);
+        this.resolveOpened = null;
+        this.rejectOpened = null;
+    }
+    send(message) {
+        return new Promise((resolve, reject) => {
+            this.call.write(message, (error) => {
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                resolve();
+            });
+        });
+    }
+    closeWrite() {
+        this.call.end();
+    }
+    cancel() {
+        this.call.cancel();
+    }
+    async waitForOpen(timeoutMs = 5000) {
+        let timeoutHandle;
+        try {
+            await Promise.race([
+                this.opened,
+                new Promise((_, reject) => {
+                    timeoutHandle = setTimeout(() => {
+                        reject(new Error(`command channel did not open within ${timeoutMs}ms`));
+                    }, timeoutMs);
+                }),
+            ]);
+        }
+        finally {
+            if (timeoutHandle) {
+                clearTimeout(timeoutHandle);
+            }
+        }
+    }
+    nextMessage() {
+        return this.messages.pop();
+    }
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            const message = await this.nextMessage();
+            if (message === null) {
+                return;
+            }
+            yield message;
+        }
+    }
+}
+exports.CompanyhelmCommandChannel = CompanyhelmCommandChannel;
+class CompanyhelmApiClient {
+    constructor(options) {
+        this.endpoint = parseCompanyhelmApiUrl(options.apiUrl);
+        this.client = createAgentRunnerControlClient(this.endpoint, options.credentials ?? defaultCredentials(this.endpoint), options.channelOptions);
+    }
+    registerRunner(request, options) {
+        const metadata = options?.metadata ?? new grpc.Metadata();
+        const callOptions = options?.callOptions ?? {};
+        return new Promise((resolve, reject) => {
+            this.client.registerRunner(request, metadata, callOptions, (error, response) => {
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                resolve(response ?? (0, protobuf_1.create)(protos_1.RegisterRunnerResponseSchema));
+            });
+        });
+    }
+    async connect(registerRequest, options) {
+        await this.registerRunner(registerRequest, options);
+        const stream = this.client.controlChannel(options?.metadata, options?.callOptions);
+        return new CompanyhelmCommandChannel(stream);
+    }
+    listGithubInstallationsForRunner(options) {
+        const metadata = options?.metadata ?? new grpc.Metadata();
+        const callOptions = options?.callOptions ?? {};
+        const request = (0, protobuf_1.create)(protos_1.ListGithubInstallationsForRunnerRequestSchema, {});
+        return new Promise((resolve, reject) => {
+            this.client.listGithubInstallationsForRunner(request, metadata, callOptions, (error, response) => {
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                resolve(response ?? (0, protobuf_1.create)(protos_1.ListGithubInstallationsForRunnerResponseSchema, {}));
+            });
+        });
+    }
+    getGithubInstallationAccessTokenForRunner(installationId, options) {
+        const metadata = options?.metadata ?? new grpc.Metadata();
+        const callOptions = options?.callOptions ?? {};
+        const request = (0, protobuf_1.create)(protos_1.GetGithubInstallationAccessTokenForRunnerRequestSchema, {
+            installationId,
+        });
+        return new Promise((resolve, reject) => {
+            this.client.getGithubInstallationAccessTokenForRunner(request, metadata, callOptions, (error, response) => {
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                resolve(response ?? (0, protobuf_1.create)(protos_1.GetGithubInstallationAccessTokenForRunnerResponseSchema, {}));
+            });
+        });
+    }
+    close() {
+        this.client.close();
+    }
+}
+exports.CompanyhelmApiClient = CompanyhelmApiClient;

package/dist/state/service/docker/app_server_container.js

@@ -0,0 +1,165 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppServerContainerService = void 0;
+const node_fs_1 = require("node:fs");
+const node_child_process_1 = require("node:child_process");
+const node_path_1 = require("node:path");
+const drizzle_orm_1 = require("drizzle-orm");
+const config_js_1 = require("../../config.js");
+const db_js_1 = require("../../state/db.js");
+const schema_js_1 = require("../../state/schema.js");
+const async_queue_js_1 = require("../../utils/async_queue.js");
+const path_js_1 = require("../../utils/path.js");
+const runtime_shell_js_1 = require("../runtime_shell.js");
+const host_js_1 = require("../host.js");
+const DEFAULT_APP_SERVER_COMMAND = (0, runtime_shell_js_1.buildCodexAppServerCommand)();
+const BOOTSTRAP_TEMPLATE_PATH = "templates/app_server_bootstrap.sh.j2";
+function resolveContainerPath(path, containerHome) {
+    if (path === "~") {
+        return containerHome;
+    }
+    if (path.startsWith("~/")) {
+        return `${containerHome}${path.slice(1)}`;
+    }
+    return path;
+}
+function resolveTemplatePath() {
+    const distRelativePath = (0, node_path_1.join)(__dirname, "..", "..", BOOTSTRAP_TEMPLATE_PATH);
+    if ((0, node_fs_1.existsSync)(distRelativePath)) {
+        return distRelativePath;
+    }
+    const sourceRelativePath = (0, node_path_1.join)(__dirname, "..", "..", "..", "src", BOOTSTRAP_TEMPLATE_PATH);
+    if ((0, node_fs_1.existsSync)(sourceRelativePath)) {
+        return sourceRelativePath;
+    }
+    throw new Error(`Bootstrap template was not found at ${distRelativePath} or ${sourceRelativePath}`);
+}
+function renderJinjaTemplate(template, context) {
+    return template.replace(/{{\s*([a-zA-Z0-9_]+)\s*}}/g, (_match, key) => {
+        const value = context[key];
+        if (value === undefined) {
+            throw new Error(`Missing template value for key '${key}'`);
+        }
+        return value;
+    });
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+class AppServerContainerService {
+    constructor() {
+        this.messageQueue = new async_queue_js_1.AsyncQueue();
+        this.child = null;
+        this.containerName = null;
+        this.running = false;
+    }
+    async start() {
+        if (this.running) {
+            throw new Error("App server container is already running");
+        }
+        const cfg = config_js_1.config.parse({});
+        const { db, client } = await (0, db_js_1.initDb)(cfg.state_db_path);
+        let codexAuthMode;
+        try {
+            const sdk = await db.select().from(schema_js_1.agentSdks).where((0, drizzle_orm_1.eq)(schema_js_1.agentSdks.name, "codex")).get();
+            if (!sdk) {
+                throw new Error("Codex SDK is not configured.");
+            }
+            if (!sdk.authentication || sdk.authentication === "unauthenticated") {
+                throw new Error("Codex SDK authentication is not configured.");
+            }
+            codexAuthMode = sdk.authentication;
+        }
+        finally {
+            client.close();
+        }
+        const hostInfo = (0, host_js_1.getHostInfo)(cfg.codex.codex_auth_path);
+        const containerHome = cfg.agent_home_directory;
+        const containerAuthPath = resolveContainerPath(cfg.codex.codex_auth_path, containerHome);
+        const hostDedicatedAuthPath = `${(0, path_js_1.expandHome)(cfg.config_directory)}/${cfg.codex.codex_auth_file_path}`;
+        const mountArgs = [];
+        if (codexAuthMode === "dedicated") {
+            if (!(0, host_js_1.getHostInfo)(hostDedicatedAuthPath).codexAuthExists) {
+                throw new Error(`Dedicated Codex auth file was not found at ${hostDedicatedAuthPath}`);
+            }
+            mountArgs.push("--mount", `type=bind,src=${hostDedicatedAuthPath},dst=${containerAuthPath}`);
+        }
+        this.containerName = `companyhelm-codex-app-server-${Date.now()}`;
+        const bootstrapTemplate = (0, node_fs_1.readFileSync)(resolveTemplatePath(), "utf8");
+        const bootstrapScript = renderJinjaTemplate(bootstrapTemplate, {
+            agent_user: shellQuote(cfg.agent_user),
+            agent_home: shellQuote(containerHome),
+            agent_uid: shellQuote(String(hostInfo.uid)),
+            agent_gid: shellQuote(String(hostInfo.gid)),
+            codex_auth_path: shellQuote(containerAuthPath),
+            app_server_command: shellQuote(DEFAULT_APP_SERVER_COMMAND),
+        });
+        const args = [
+            "run",
+            "--rm",
+            "-i",
+            "--name",
+            this.containerName,
+            "--entrypoint",
+            "bash",
+            ...mountArgs,
+            cfg.runtime_image,
+            "-lc",
+            bootstrapScript,
+        ];
+        const child = (0, node_child_process_1.spawn)("docker", args, {
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        child.stdout.on("data", (chunk) => {
+            this.messageQueue.push({ type: "stdout", payload: chunk });
+        });
+        child.stderr.on("data", (chunk) => {
+            this.messageQueue.push({ type: "stderr", payload: chunk.toString("utf8") });
+        });
+        child.on("error", (err) => {
+            this.messageQueue.push({ type: "error", reason: `docker process error: ${err.message}` });
+            this.running = false;
+            this.messageQueue.close();
+        });
+        child.on("exit", () => {
+            this.running = false;
+            this.messageQueue.close();
+        });
+        this.child = child;
+        this.running = true;
+    }
+    async stop() {
+        this.running = false;
+        this.messageQueue.close();
+        const child = this.child;
+        this.child = null;
+        if (child) {
+            if (!child.killed) {
+                child.kill("SIGTERM");
+            }
+            await new Promise((resolve) => {
+                child.once("exit", () => resolve());
+            });
+        }
+        if (this.containerName) {
+            (0, node_child_process_1.spawnSync)("docker", ["rm", "-f", this.containerName], { stdio: "ignore" });
+            this.containerName = null;
+        }
+    }
+    async sendRaw(payload) {
+        if (!this.running || !this.child || !this.child.stdin) {
+            throw new Error("App server container is not running");
+        }
+        this.child.stdin.write(payload);
+    }
+    async *receiveOutput() {
+        while (true) {
+            const item = await this.messageQueue.pop();
+            if (!item) {
+                return;
+            }
+            yield item;
+        }
+    }
+}
+exports.AppServerContainerService = AppServerContainerService;

package/dist/state/service/docker/dind.js

@@ -0,0 +1,114 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DinDService = void 0;
+const dockerode_1 = __importDefault(require("dockerode"));
+const DIND_IMAGE = "docker:dind-rootless";
+const DIND_PORT = 2375;
+const READY_TIMEOUT_MS = 30000;
+const READY_POLL_MS = 500;
+class DinDService {
+    constructor(docker) {
+        this.container = null;
+        this._endpoint = null;
+        this.docker = docker ?? new dockerode_1.default();
+    }
+    async start() {
+        if (this.container) {
+            throw new Error("DinD service is already running");
+        }
+        const uid = process.getuid?.();
+        if (uid === undefined) {
+            throw new Error("Cannot determine current UID (not supported on this platform)");
+        }
+        await this.pullImage();
+        const container = await this.docker.createContainer({
+            Image: DIND_IMAGE,
+            User: String(uid),
+            Env: [
+                // Disable TLS so the inner daemon listens on plain 2375.
+                "DOCKER_TLS_CERTDIR=",
+            ],
+            ExposedPorts: { [`${DIND_PORT}/tcp`]: {} },
+            HostConfig: {
+                Privileged: true,
+                PublishAllPorts: true,
+            },
+        });
+        await container.start();
+        this.container = container;
+        const info = await container.inspect();
+        const bindings = info.NetworkSettings.Ports[`${DIND_PORT}/tcp`];
+        if (!bindings?.[0]) {
+            await this.stop();
+            throw new Error("DinD container started but port was not bound");
+        }
+        this._endpoint = {
+            host: "127.0.0.1",
+            port: parseInt(bindings[0].HostPort, 10),
+        };
+        await this.waitForReady();
+    }
+    async stop() {
+        if (!this.container)
+            return;
+        const c = this.container;
+        this.container = null;
+        this._endpoint = null;
+        try {
+            await c.stop();
+        }
+        catch {
+            // already stopped
+        }
+        try {
+            await c.remove({ force: true });
+        }
+        catch {
+            // already removed
+        }
+    }
+    getEndpoint() {
+        if (!this._endpoint) {
+            throw new Error("DinD service is not running");
+        }
+        return this._endpoint;
+    }
+    getContainer() {
+        if (!this.container) {
+            throw new Error("DinD service is not running");
+        }
+        return this.container;
+    }
+    async pullImage() {
+        try {
+            await this.docker.getImage(DIND_IMAGE).inspect();
+            return; // already present
+        }
+        catch {
+            // not found – pull it
+        }
+        const stream = await this.docker.pull(DIND_IMAGE);
+        await new Promise((resolve, reject) => {
+            this.docker.modem.followProgress(stream, (err) => (err ? reject(err) : resolve()));
+        });
+    }
+    async waitForReady() {
+        const { host, port } = this.getEndpoint();
+        const inner = new dockerode_1.default({ host, port });
+        const deadline = Date.now() + READY_TIMEOUT_MS;
+        while (Date.now() < deadline) {
+            try {
+                await inner.ping();
+                return;
+            }
+            catch {
+                await new Promise((r) => setTimeout(r, READY_POLL_MS));
+            }
+        }
+        throw new Error(`DinD daemon did not become ready within ${READY_TIMEOUT_MS}ms`);
+    }
+}
+exports.DinDService = DinDService;

package/dist/state/service/docker/runtime_app_server_exec.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuntimeContainerAppServerTransport = void 0;
+const node_child_process_1 = require("node:child_process");
+const async_queue_js_1 = require("../../utils/async_queue.js");
+const runtime_shell_js_1 = require("../runtime_shell.js");
+const DEFAULT_APP_SERVER_COMMAND = (0, runtime_shell_js_1.buildCodexAppServerCommand)();
+const PROCESS_EXIT_TIMEOUT_MS = 5000;
+class RuntimeContainerAppServerTransport {
+    constructor(runtimeContainerName, appServerCommand = DEFAULT_APP_SERVER_COMMAND) {
+        this.runtimeContainerName = runtimeContainerName;
+        this.appServerCommand = appServerCommand;
+        this.messageQueue = new async_queue_js_1.AsyncQueue();
+        this.child = null;
+        this.running = false;
+    }
+    async start() {
+        if (this.running) {
+            throw new Error("Runtime app-server transport is already running.");
+        }
+        const child = (0, node_child_process_1.spawn)("docker", ["exec", "-i", this.runtimeContainerName, "bash", "-lc", this.appServerCommand], { stdio: ["pipe", "pipe", "pipe"] });
+        child.stdout.on("data", (chunk) => {
+            this.messageQueue.push({ type: "stdout", payload: chunk });
+        });
+        child.stderr.on("data", (chunk) => {
+            this.messageQueue.push({ type: "stderr", payload: chunk.toString("utf8") });
+        });
+        child.on("error", (error) => {
+            this.messageQueue.push({ type: "error", reason: `docker exec error: ${error.message}` });
+            this.running = false;
+            this.messageQueue.close();
+        });
+        child.on("exit", (code, signal) => {
+            this.running = false;
+            this.messageQueue.push({
+                type: "error",
+                reason: `docker exec exited (${code !== null ? `code ${code}` : `signal ${signal ?? "unknown"}`})`,
+            });
+            this.messageQueue.close();
+        });
+        this.child = child;
+        this.running = true;
+    }
+    async stop() {
+        this.running = false;
+        this.messageQueue.close();
+        const child = this.child;
+        this.child = null;
+        if (!child) {
+            return;
+        }
+        const waitForExit = (timeoutMs) => Promise.race([
+            new Promise((resolveExit) => {
+                child.once("exit", () => resolveExit(true));
+            }),
+            new Promise((resolveExit) => {
+                setTimeout(() => resolveExit(false), timeoutMs);
+            }),
+        ]);
+        // Close stdin first so app-server can flush and exit cleanly.
+        if (child.stdin && !child.stdin.destroyed && child.stdin.writable) {
+            child.stdin.end();
+        }
+        let exited = await waitForExit(PROCESS_EXIT_TIMEOUT_MS);
+        if (exited) {
+            return;
+        }
+        if (!child.killed) {
+            child.kill("SIGTERM");
+        }
+        exited = await waitForExit(PROCESS_EXIT_TIMEOUT_MS);
+        if (exited) {
+            return;
+        }
+        if (!exited && !child.killed) {
+            child.kill("SIGKILL");
+        }
+    }
+    async sendRaw(payload) {
+        if (!this.running || !this.child || !this.child.stdin) {
+            throw new Error("Runtime app-server transport is not running.");
+        }
+        this.child.stdin.write(payload);
+    }
+    async *receiveOutput() {
+        while (true) {
+            const event = await this.messageQueue.pop();
+            if (!event) {
+                return;
+            }
+            yield event;
+        }
+    }
+}
+exports.RuntimeContainerAppServerTransport = RuntimeContainerAppServerTransport;