@companyhelm/runner 0.2.0 → 0.4.0

package/dist/service/thread_lifecycle.js

@@ -1,682 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ThreadContainerService = void 0;
-exports.parseHostDockerPath = parseHostDockerPath;
-exports.buildThreadContainerNames = buildThreadContainerNames;
-exports.resolveThreadsRootDirectory = resolveThreadsRootDirectory;
-exports.resolveThreadDirectory = resolveThreadDirectory;
-exports.buildSharedThreadMounts = buildSharedThreadMounts;
-exports.buildDindContainerOptions = buildDindContainerOptions;
-exports.buildRuntimeContainerOptions = buildRuntimeContainerOptions;
-const dockerode_1 = __importDefault(require("dockerode"));
-const node_child_process_1 = require("node:child_process");
-const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
-const script_renderer_js_1 = require("../provisioning/runtime_provisioning/script_renderer.js");
-const path_js_1 = require("../utils/path.js");
-const runtime_bashrc_js_1 = require("./runtime_bashrc.js");
-const runtime_shell_js_1 = require("./runtime_shell.js");
-const CONTAINER_START_TIMEOUT_MS = 30000;
-const CONTAINER_START_POLL_MS = 500;
-const DEFAULT_HOST_DOCKER_PATH = "unix:///var/run/docker.sock";
-const HOST_DOCKER_INTERNAL_GATEWAY = "host.docker.internal:host-gateway";
-function buildInvalidHostDockerPathError(value) {
-    return new Error(`Invalid host Docker path '${value}'. Expected 'unix:///<socket-path>' or 'tcp://localhost:<port>'.`);
-}
-function parseHostDockerPath(hostDockerPath) {
-    const value = (hostDockerPath ?? DEFAULT_HOST_DOCKER_PATH).trim();
-    if (value.startsWith("unix:///")) {
-        const socketPath = value.slice("unix://".length);
-        if (socketPath.length <= 1 || !socketPath.startsWith("/")) {
-            throw buildInvalidHostDockerPathError(value);
-        }
-        return {
-            mode: "unix",
-            socketPath,
-            dockerHost: `unix://${socketPath}`,
-        };
-    }
-    const tcpLocalhostMatch = /^tcp:\/\/localhost:(\d+)$/.exec(value);
-    if (tcpLocalhostMatch) {
-        const port = Number(tcpLocalhostMatch[1]);
-        if (!Number.isInteger(port) || port < 1 || port > 65535) {
-            throw buildInvalidHostDockerPathError(value);
-        }
-        return {
-            mode: "tcp",
-            dockerHost: `tcp://host.docker.internal:${port}`,
-        };
-    }
-    throw buildInvalidHostDockerPathError(value);
-}
-function resolveContainerPath(path, containerHome) {
-    if (path === "~") {
-        return containerHome;
-    }
-    if (path.startsWith("~/")) {
-        return `${containerHome}${path.slice(1)}`;
-    }
-    return path;
-}
-function buildThreadContainerNames(threadId) {
-    return {
-        dind: `companyhelm-dind-thread-${threadId}`,
-        runtime: `companyhelm-runtime-thread-${threadId}`,
-        home: `companyhelm-home-thread-${threadId}`,
-        tmp: `companyhelm-tmp-thread-${threadId}`,
-    };
-}
-function resolveThreadsRootDirectory(configDirectory, threadsDirectory) {
-    const expandedThreadsDirectory = (0, path_js_1.expandHome)(threadsDirectory);
-    if ((0, node_path_1.isAbsolute)(expandedThreadsDirectory)) {
-        return expandedThreadsDirectory;
-    }
-    return (0, node_path_1.join)((0, path_js_1.expandHome)(configDirectory), expandedThreadsDirectory);
-}
-function resolveThreadDirectory(configDirectory, threadsDirectory, threadId) {
-    return (0, node_path_1.join)(resolveThreadsRootDirectory(configDirectory, threadsDirectory), `thread-${threadId}`);
-}
-function buildSharedThreadMounts(options) {
-    const mounts = [
-        {
-            Type: "bind",
-            Source: options.threadDirectory,
-            Target: "/workspace",
-        },
-        {
-            Type: "volume",
-            Source: options.homeVolumeName,
-            Target: options.containerHomeDirectory,
-        },
-        {
-            Type: "volume",
-            Source: options.tmpVolumeName,
-            Target: "/tmp",
-        },
-    ];
-    if (options.codexAuthMode === "dedicated") {
-        mounts.push({
-            Type: "bind",
-            Source: (0, node_path_1.join)((0, path_js_1.expandHome)(options.configDirectory), options.codexAuthFilePath),
-            Target: resolveContainerPath(options.codexAuthPath, options.containerHomeDirectory),
-        });
-        return mounts;
-    }
-    const hostAuthPath = (0, path_js_1.expandHome)(options.codexAuthPath);
-    mounts.push({
-        Type: "bind",
-        Source: hostAuthPath,
-        Target: resolveContainerPath(options.codexAuthPath, options.containerHomeDirectory),
-    });
-    return mounts;
-}
-function buildCommonContainerEnv(user) {
-    return [
-        `HOME=${user.agentHomeDirectory}`,
-        `USER=${user.agentUser}`,
-    ];
-}
-function shellQuote(value) {
-    return `'${value.replace(/'/g, `'"'"'`)}'`;
-}
-function buildRuntimeIdentityProvisionScript(user) {
-    return [
-        "set -euo pipefail",
-        `AGENT_USER=${shellQuote(user.agentUser)}`,
-        `AGENT_HOME=${shellQuote(user.agentHomeDirectory)}`,
-        `AGENT_UID=${shellQuote(String(user.uid))}`,
-        `AGENT_GID=${shellQuote(String(user.gid))}`,
-        "",
-        'AGENT_GROUP="$AGENT_USER"',
-        'EXISTING_GID_GROUP="$(getent group "$AGENT_GID" | cut -d: -f1 || true)"',
-        'if [ -n "$EXISTING_GID_GROUP" ] && [ "$EXISTING_GID_GROUP" != "$AGENT_USER" ] && ! getent group "$AGENT_USER" >/dev/null 2>&1; then',
-        '  groupmod -n "$AGENT_USER" "$EXISTING_GID_GROUP"',
-        "fi",
-        'if getent group "$AGENT_USER" >/dev/null 2>&1; then',
-        '  if [ "$(getent group "$AGENT_USER" | cut -d: -f3)" != "$AGENT_GID" ]; then',
-        '    groupmod -g "$AGENT_GID" "$AGENT_USER"',
-        "  fi",
-        "else",
-        '  groupadd -g "$AGENT_GID" "$AGENT_USER"',
-        "fi",
-        "",
-        'EXISTING_UID_USER="$(getent passwd "$AGENT_UID" | cut -d: -f1 || true)"',
-        'if [ -n "$EXISTING_UID_USER" ] && [ "$EXISTING_UID_USER" != "$AGENT_USER" ] && ! id -u "$AGENT_USER" >/dev/null 2>&1; then',
-        '  usermod -l "$AGENT_USER" -d "$AGENT_HOME" -g "$AGENT_GROUP" -s /bin/bash "$EXISTING_UID_USER"',
-        'elif id -u "$AGENT_USER" >/dev/null 2>&1; then',
-        '  usermod -u "$AGENT_UID" -g "$AGENT_GROUP" -d "$AGENT_HOME" -s /bin/bash "$AGENT_USER"',
-        "else",
-        '  useradd -m -d "$AGENT_HOME" -u "$AGENT_UID" -g "$AGENT_GROUP" -s /bin/bash "$AGENT_USER"',
-        "fi",
-        "",
-        'install -d -m 0755 -o "$AGENT_UID" -g "$AGENT_GID" "$AGENT_HOME"',
-        "",
-        'SUDOERS_FILE="/etc/sudoers.d/90-companyhelm-agent"',
-        'if command -v sudo >/dev/null 2>&1; then',
-        '  install -d -m 0750 /etc/sudoers.d',
-        '  printf \'%s\\n\' "$AGENT_USER ALL=(ALL) NOPASSWD:ALL" > "$SUDOERS_FILE"',
-        '  chmod 0440 "$SUDOERS_FILE"',
-        '  if command -v visudo >/dev/null 2>&1; then',
-        '    visudo -cf "$SUDOERS_FILE" >/dev/null',
-        "  fi",
-        "fi",
-        "",
-        'install -d -m 0755 -o "$AGENT_UID" -g "$AGENT_GID" "$AGENT_HOME/.codex"',
-        'install -d -m 0755 -o "$AGENT_UID" -g "$AGENT_GID" "$AGENT_HOME/.cache"',
-        'if [ -e "$AGENT_HOME/.codex/auth.json" ]; then',
-        '  chown "$AGENT_UID:$AGENT_GID" "$AGENT_HOME/.codex/auth.json" || true',
-        "fi",
-        "",
-        'PLAYWRIGHT_SHARED_CACHE="/ms-playwright"',
-        'PLAYWRIGHT_DEFAULT_CACHE="$AGENT_HOME/.cache/ms-playwright"',
-        'install -d -m 0755 "$PLAYWRIGHT_SHARED_CACHE"',
-        'if [ "$(stat -c \'%u:%g\' "$PLAYWRIGHT_SHARED_CACHE" 2>/dev/null || true)" != "$AGENT_UID:$AGENT_GID" ]; then',
-        '  chown -R "$AGENT_UID:$AGENT_GID" "$PLAYWRIGHT_SHARED_CACHE" || true',
-        "fi",
-        'if [ -L "$PLAYWRIGHT_DEFAULT_CACHE" ]; then',
-        '  if [ "$(readlink "$PLAYWRIGHT_DEFAULT_CACHE" 2>/dev/null || true)" != "$PLAYWRIGHT_SHARED_CACHE" ]; then',
-        '    rm -f "$PLAYWRIGHT_DEFAULT_CACHE"',
-        '    ln -s "$PLAYWRIGHT_SHARED_CACHE" "$PLAYWRIGHT_DEFAULT_CACHE"',
-        "  fi",
-        'elif [ ! -e "$PLAYWRIGHT_DEFAULT_CACHE" ]; then',
-        '  ln -s "$PLAYWRIGHT_SHARED_CACHE" "$PLAYWRIGHT_DEFAULT_CACHE"',
-        "else",
-        '  chown -R "$AGENT_UID:$AGENT_GID" "$PLAYWRIGHT_DEFAULT_CACHE" || true',
-        "fi",
-        'chown -R "$AGENT_UID:$AGENT_GID" "$AGENT_HOME" || true',
-    ].join("\n");
-}
-function buildRuntimeToolingValidationScript(user) {
-    const bootstrap = (0, runtime_shell_js_1.buildNvmCodexBootstrapScript)(user.agentHomeDirectory);
-    return [
-        bootstrap,
-        "",
-        'if ! command -v aws >/dev/null 2>&1; then',
-        '  echo "aws CLI is not available in runtime PATH." >&2',
-        '  echo "Fix: install awscli in the runtime image." >&2',
-        "  exit 1",
-        "fi",
-        "",
-        'if ! command -v playwright >/dev/null 2>&1; then',
-        '  echo "playwright CLI is not available after sourcing nvm." >&2',
-        '  echo "Fix: install playwright in the runtime image (for example: npm install --global playwright)." >&2',
-        "  exit 1",
-        "fi",
-        "",
-        'PLAYWRIGHT_CACHE_DIR="${PLAYWRIGHT_BROWSERS_PATH:-$HOME/.cache/ms-playwright}"',
-        'if [ ! -d "$PLAYWRIGHT_CACHE_DIR" ]; then',
-        '  echo "Playwright browser cache directory is missing: $PLAYWRIGHT_CACHE_DIR" >&2',
-        '  echo "Fix: set PLAYWRIGHT_BROWSERS_PATH and run npx playwright install chromium during runtime image build." >&2',
-        "  exit 1",
-        "fi",
-        "",
-        'CHROMIUM_BIN="$(find "$PLAYWRIGHT_CACHE_DIR" -type f -path "*/chrome-linux/chrome" -print -quit 2>/dev/null || true)"',
-        'if [ -z "$CHROMIUM_BIN" ]; then',
-        '  echo "Playwright chromium binary is missing under $PLAYWRIGHT_CACHE_DIR." >&2',
-        '  echo "Fix: run npx playwright install chromium while building the runtime image." >&2',
-        "  exit 1",
-        "fi",
-        "",
-        'if [ ! -x "$CHROMIUM_BIN" ]; then',
-        '  echo "Playwright chromium binary exists but is not executable: $CHROMIUM_BIN" >&2',
-        "  exit 1",
-        "fi",
-    ].join("\n");
-}
-function buildRuntimeBashrcProvisionScript(user) {
-    const bashrcContent = (0, runtime_bashrc_js_1.renderRuntimeBashrc)(user.agentHomeDirectory);
-    return [
-        "set -euo pipefail",
-        `AGENT_HOME=${shellQuote(user.agentHomeDirectory)}`,
-        `BASHRC_CONTENT=${shellQuote(bashrcContent)}`,
-        "",
-        'install -d -m 0755 "$AGENT_HOME"',
-        'printf \'%s\' "$BASHRC_CONTENT" > "$AGENT_HOME/.bashrc"',
-        'chmod 0644 "$AGENT_HOME/.bashrc"',
-    ].join("\n");
-}
-function buildRuntimeGitConfigScript(gitUserName, gitUserEmail) {
-    return [
-        "set -euo pipefail",
-        `DEFAULT_GIT_USER_NAME=${shellQuote(gitUserName)}`,
-        `DEFAULT_GIT_USER_EMAIL=${shellQuote(gitUserEmail)}`,
-        "",
-        "if ! command -v git >/dev/null 2>&1; then",
-        "  exit 0",
-        "fi",
-        "",
-        "if ! git config --global --get user.name >/dev/null 2>&1; then",
-        '  git config --global user.name "$DEFAULT_GIT_USER_NAME"',
-        "fi",
-        "if ! git config --global --get user.email >/dev/null 2>&1; then",
-        '  git config --global user.email "$DEFAULT_GIT_USER_EMAIL"',
-        "fi",
-        "",
-        "if [ ! -d /workspace ]; then",
-        "  exit 0",
-        "fi",
-        "",
-        "while IFS= read -r -d '' git_dir; do",
-        '  repo_root="$(dirname "$git_dir")"',
-        '  if ! git -C "$repo_root" config --local --get user.name >/dev/null 2>&1; then',
-        '    git -C "$repo_root" config --local user.name "$DEFAULT_GIT_USER_NAME"',
-        "  fi",
-        '  if ! git -C "$repo_root" config --local --get user.email >/dev/null 2>&1; then',
-        '    git -C "$repo_root" config --local user.email "$DEFAULT_GIT_USER_EMAIL"',
-        "  fi",
-        "done < <(find /workspace -type d -name .git -print0 2>/dev/null || true)",
-    ].join("\n");
-}
-function resolveThreadGitSkillsCloneRootDirectory(options) {
-    return options.cloneRootDirectory.trim().length > 0
-        ? options.cloneRootDirectory.trim()
-        : "/skills";
-}
-function buildRuntimeThreadGitSkillsCloneScript(options) {
-    const cloneRootDirectory = resolveThreadGitSkillsCloneRootDirectory(options);
-    const scriptLines = [
-        "set -euo pipefail",
-        `SKILLS_ROOT=${shellQuote(cloneRootDirectory)}`,
-        "",
-        'install -d -m 0755 "$SKILLS_ROOT"',
-        "",
-        "if ! command -v git >/dev/null 2>&1; then",
-        '  echo "git is not available in the runtime container." >&2',
-        "  exit 1",
-        "fi",
-    ];
-    for (const pkg of options.packages) {
-        const checkoutPath = (0, node_path_1.join)(cloneRootDirectory, pkg.checkoutDirectoryName);
-        const sourceMarkerPath = (0, node_path_1.join)(checkoutPath, ".companyhelm-source");
-        scriptLines.push("", `PACKAGE_DIR=${shellQuote(checkoutPath)}`, `PACKAGE_SOURCE_MARKER=${shellQuote(sourceMarkerPath)}`, `PACKAGE_REPO_URL=${shellQuote(pkg.repositoryUrl)}`, `PACKAGE_COMMIT_REF=${shellQuote(pkg.commitReference)}`, 'if [ ! -d "$PACKAGE_DIR/.git" ] || [ ! -f "$PACKAGE_SOURCE_MARKER" ] || [ "$(cat "$PACKAGE_SOURCE_MARKER")" != "$PACKAGE_REPO_URL#$PACKAGE_COMMIT_REF" ]; then', '  rm -rf "$PACKAGE_DIR"', '  if ! git clone --depth 1 --branch "$PACKAGE_COMMIT_REF" "$PACKAGE_REPO_URL" "$PACKAGE_DIR"; then', '    rm -rf "$PACKAGE_DIR"', '    git clone --depth 1 "$PACKAGE_REPO_URL" "$PACKAGE_DIR"', '    git -C "$PACKAGE_DIR" fetch --depth 1 origin "$PACKAGE_COMMIT_REF"', '    git -C "$PACKAGE_DIR" checkout --detach FETCH_HEAD', "  fi", '  printf \'%s\' "$PACKAGE_REPO_URL#$PACKAGE_COMMIT_REF" > "$PACKAGE_SOURCE_MARKER"', "fi", 'chmod -R a+rX "$PACKAGE_DIR" || true');
-    }
-    return scriptLines.join("\n");
-}
-function buildRuntimeThreadGitSkillsLinkScript(user, options) {
-    const cloneRootDirectory = resolveThreadGitSkillsCloneRootDirectory(options);
-    const codexSkillsDirectory = (0, node_path_1.join)(user.agentHomeDirectory, ".codex", "skills");
-    const scriptLines = [
-        "set -euo pipefail",
-        `SKILLS_ROOT=${shellQuote(cloneRootDirectory)}`,
-        `CODEX_SKILLS_ROOT=${shellQuote(codexSkillsDirectory)}`,
-        "",
-        'install -d -m 0755 "$CODEX_SKILLS_ROOT"',
-    ];
-    for (const pkg of options.packages) {
-        const checkoutPath = (0, node_path_1.join)(cloneRootDirectory, pkg.checkoutDirectoryName);
-        for (const skill of pkg.skills) {
-            scriptLines.push("", `SKILL_SOURCE=${shellQuote((0, node_path_1.join)(checkoutPath, skill.directoryPath))}`, `SKILL_LINK=${shellQuote((0, node_path_1.join)(codexSkillsDirectory, skill.linkName))}`, 'if [ ! -d "$SKILL_SOURCE" ]; then', '  echo "Thread git skill directory not found: $SKILL_SOURCE" >&2', "  exit 1", "fi", 'if [ ! -f "$SKILL_SOURCE/SKILL.md" ]; then', '  echo "Thread git skill directory is missing SKILL.md: $SKILL_SOURCE" >&2', "  exit 1", "fi", 'rm -rf "$SKILL_LINK"', 'ln -s "$SKILL_SOURCE" "$SKILL_LINK"');
-        }
-    }
-    return scriptLines.join("\n");
-}
-function buildDindContainerOptions(options) {
-    return {
-        name: options.names.dind,
-        Image: options.dindImage,
-        WorkingDir: "/workspace",
-        Env: [
-            "DOCKER_TLS_CERTDIR=",
-        ],
-        HostConfig: {
-            Privileged: true,
-            Mounts: options.mounts,
-        },
-    };
-}
-function buildRuntimeContainerOptions(options) {
-    const hostDocker = options.useHostDockerRuntime ? parseHostDockerPath(options.hostDockerPath) : null;
-    const runtimeMounts = hostDocker?.mode === "unix"
-        ? [
-            ...options.mounts,
-            {
-                Type: "bind",
-                Source: hostDocker.socketPath,
-                Target: hostDocker.socketPath,
-            },
-        ]
-        : options.mounts;
-    const runtimeEnv = [
-        ...buildCommonContainerEnv(options.user),
-        hostDocker ? `DOCKER_HOST=${hostDocker.dockerHost}` : "DOCKER_HOST=tcp://localhost:2375",
-    ];
-    return {
-        name: options.names.runtime,
-        Image: options.runtimeImage,
-        User: `${options.user.uid}:${options.user.gid}`,
-        WorkingDir: "/workspace",
-        Env: runtimeEnv,
-        Cmd: ["sleep", "infinity"],
-        HostConfig: {
-            NetworkMode: options.useHostDockerRuntime ? undefined : `container:${options.names.dind}`,
-            Mounts: runtimeMounts,
-            ...(hostDocker?.mode === "tcp" ? { ExtraHosts: [HOST_DOCKER_INTERNAL_GATEWAY] } : {}),
-        },
-    };
-}
-function isContainerNotFound(error) {
-    if (typeof error !== "object" || error === null) {
-        return false;
-    }
-    const statusCode = "statusCode" in error ? error.statusCode : undefined;
-    if (statusCode === 404) {
-        return true;
-    }
-    const message = error instanceof Error ? error.message : String(error);
-    return /No such container/i.test(message);
-}
-function isVolumeNotFound(error) {
-    if (typeof error !== "object" || error === null) {
-        return false;
-    }
-    const statusCode = "statusCode" in error ? error.statusCode : undefined;
-    if (statusCode === 404) {
-        return true;
-    }
-    const message = error instanceof Error ? error.message : String(error);
-    return /No such volume/i.test(message);
-}
-function isContainerAlreadyStarted(error) {
-    if (typeof error !== "object" || error === null) {
-        return false;
-    }
-    const statusCode = "statusCode" in error ? error.statusCode : undefined;
-    if (statusCode === 304) {
-        return true;
-    }
-    const message = error instanceof Error ? error.message : String(error);
-    return /already started/i.test(message);
-}
-function isContainerNotRunning(error) {
-    if (typeof error !== "object" || error === null) {
-        return false;
-    }
-    const statusCode = "statusCode" in error ? error.statusCode : undefined;
-    if (statusCode === 304) {
-        return true;
-    }
-    const message = error instanceof Error ? error.message : String(error);
-    return /is not running/i.test(message);
-}
-function isImageNotFound(error) {
-    if (typeof error !== "object" || error === null) {
-        return false;
-    }
-    const statusCode = "statusCode" in error ? error.statusCode : undefined;
-    if (statusCode === 404) {
-        return true;
-    }
-    const message = error instanceof Error ? error.message : String(error);
-    return /No such image/i.test(message);
-}
-function toErrorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null;
-}
-class ThreadContainerService {
-    constructor(docker, runCommand = node_child_process_1.spawnSync) {
-        this.docker = docker ?? new dockerode_1.default();
-        this.runCommand = runCommand;
-        this.scriptRenderer = new script_renderer_js_1.RuntimeProvisioningScriptRenderer();
-    }
-    runDockerExecScript(args, contextMessage) {
-        const result = this.runCommand("docker", args, {
-            encoding: "utf8",
-        });
-        if (result.status === 0 && !result.error) {
-            return;
-        }
-        const detail = [result.error?.message, result.stderr, result.stdout]
-            .filter((value) => typeof value === "string" && value.trim().length > 0)
-            .map((value) => value.trim())
-            .join(" | ");
-        const status = result.status === null ? "unknown" : String(result.status);
-        throw new Error(`${contextMessage} (exit ${status})${detail ? `: ${detail}` : "."}`);
-    }
-    async pullImage(image, imageStatusReporter) {
-        let lastReportedProgressBucket = -1;
-        const layerProgress = new Map();
-        let lastReportedStatus = "";
-        const reportPullProgress = (event) => {
-            if (!isRecord(event)) {
-                return;
-            }
-            const status = typeof event.status === "string" ? event.status.trim() : "";
-            const id = typeof event.id === "string" ? event.id.trim() : "";
-            const progressDetail = isRecord(event.progressDetail) ? event.progressDetail : null;
-            const current = progressDetail && typeof progressDetail.current === "number"
-                ? progressDetail.current
-                : undefined;
-            const total = progressDetail && typeof progressDetail.total === "number"
-                ? progressDetail.total
-                : undefined;
-            if (id && current !== undefined && total !== undefined && total > 0) {
-                layerProgress.set(id, { current: Math.min(current, total), total });
-                let totalCurrent = 0;
-                let totalSize = 0;
-                for (const progress of layerProgress.values()) {
-                    totalCurrent += progress.current;
-                    totalSize += progress.total;
-                }
-                if (totalSize > 0) {
-                    const percent = Math.floor((totalCurrent / totalSize) * 100);
-                    const bucket = Math.floor(percent / 5) * 5;
-                    if (bucket > lastReportedProgressBucket) {
-                        lastReportedProgressBucket = bucket;
-                        imageStatusReporter?.(`Pulling Docker image '${image}': ${bucket}%`);
-                    }
-                }
-                return;
-            }
-            if (status && status !== lastReportedStatus) {
-                lastReportedStatus = status;
-                imageStatusReporter?.(`Pulling Docker image '${image}': ${status}`);
-            }
-        };
-        await new Promise((resolve, reject) => {
-            this.docker.pull(image, (error, stream) => {
-                if (error) {
-                    reject(error);
-                    return;
-                }
-                if (!stream) {
-                    reject(new Error(`Docker returned an empty stream while pulling image '${image}'.`));
-                    return;
-                }
-                const modem = this.docker.modem;
-                if (!modem?.followProgress) {
-                    resolve();
-                    return;
-                }
-                modem.followProgress(stream, (pullError) => {
-                    if (pullError) {
-                        reject(pullError);
-                        return;
-                    }
-                    resolve();
-                }, reportPullProgress);
-            });
-        });
-    }
-    async ensureImageAvailable(image, imageStatusReporter) {
-        try {
-            await this.docker.getImage(image).inspect();
-            return;
-        }
-        catch (error) {
-            if (!isImageNotFound(error)) {
-                throw error;
-            }
-        }
-        imageStatusReporter?.(`Docker image '${image}' not found locally. Pulling remotely.`);
-        await this.pullImage(image, imageStatusReporter);
-        imageStatusReporter?.(`Docker image '${image}' is ready.`);
-    }
-    async createThreadContainers(options) {
-        if (options.useHostDockerRuntime) {
-            const hostDocker = parseHostDockerPath(options.hostDockerPath);
-            if (hostDocker.mode === "unix" && !(0, node_fs_1.existsSync)(hostDocker.socketPath)) {
-                throw new Error(`Host Docker socket path '${hostDocker.socketPath}' does not exist.`);
-            }
-            await this.ensureImageAvailable(options.runtimeImage, options.imageStatusReporter);
-            try {
-                options.imageStatusReporter?.(`Creating Docker container '${options.names.runtime}' from image '${options.runtimeImage}'.`);
-                await this.docker.createContainer(buildRuntimeContainerOptions(options));
-            }
-            catch (error) {
-                await this.forceRemoveVolume(options.names.home).catch(() => undefined);
-                await this.forceRemoveVolume(options.names.tmp).catch(() => undefined);
-                throw new Error(toErrorMessage(error));
-            }
-            return;
-        }
-        await this.ensureImageAvailable(options.dindImage, options.imageStatusReporter);
-        if (options.runtimeImage !== options.dindImage) {
-            await this.ensureImageAvailable(options.runtimeImage, options.imageStatusReporter);
-        }
-        options.imageStatusReporter?.(`Creating Docker container '${options.names.dind}' from image '${options.dindImage}'.`);
-        await this.docker.createContainer(buildDindContainerOptions(options));
-        try {
-            options.imageStatusReporter?.(`Creating Docker container '${options.names.runtime}' from image '${options.runtimeImage}'.`);
-            await this.docker.createContainer(buildRuntimeContainerOptions(options));
-        }
-        catch (error) {
-            await this.forceRemoveContainer(options.names.dind);
-            await this.forceRemoveVolume(options.names.home).catch(() => undefined);
-            await this.forceRemoveVolume(options.names.tmp).catch(() => undefined);
-            throw new Error(toErrorMessage(error));
-        }
-    }
-    async startContainer(name) {
-        const container = this.docker.getContainer(name);
-        try {
-            await container.start();
-        }
-        catch (error) {
-            if (isContainerAlreadyStarted(error)) {
-                return;
-            }
-            throw error;
-        }
-    }
-    async waitForContainerRunning(name, timeoutMs = CONTAINER_START_TIMEOUT_MS) {
-        const container = this.docker.getContainer(name);
-        const deadline = Date.now() + timeoutMs;
-        while (Date.now() < deadline) {
-            const details = await container.inspect();
-            const state = details.State;
-            if (state?.Running) {
-                return;
-            }
-            if (state?.Status === "exited" || state?.Status === "dead") {
-                throw new Error(`Container '${name}' is not running (status=${state.Status}, exitCode=${state.ExitCode ?? "unknown"}).`);
-            }
-            await new Promise((resolve) => setTimeout(resolve, CONTAINER_START_POLL_MS));
-        }
-        throw new Error(`Container '${name}' did not reach running state within ${timeoutMs}ms.`);
-    }
-    async ensureContainerRunning(name, timeoutMs = CONTAINER_START_TIMEOUT_MS) {
-        await this.startContainer(name);
-        await this.waitForContainerRunning(name, timeoutMs);
-    }
-    async isContainerRunning(name) {
-        try {
-            const details = await this.docker.getContainer(name).inspect();
-            return details.State?.Running === true;
-        }
-        catch (error) {
-            if (isContainerNotFound(error)) {
-                return false;
-            }
-            throw error;
-        }
-    }
-    async ensureRuntimeContainerIdentity(name, user) {
-        const script = this.scriptRenderer.renderIdentityScript(user);
-        this.runDockerExecScript(["exec", "-u", "0", name, "bash", "-lc", script], `Failed to provision runtime user '${user.agentUser}' in container '${name}'`);
-    }
-    async ensureRuntimeContainerTooling(name, user) {
-        const script = this.scriptRenderer.renderToolingValidationScript(user);
-        this.runDockerExecScript(["exec", "-u", user.agentUser, name, "bash", "-lc", script], `Failed to validate runtime tooling (nvm/codex/aws/playwright) in container '${name}'`);
-    }
-    async ensureRuntimeContainerBashrc(name, user) {
-        const script = this.scriptRenderer.renderBashrcScript(user);
-        this.runDockerExecScript(["exec", "-u", user.agentUser, name, "bash", "-lc", script], `Failed to provision runtime .bashrc in container '${name}'`);
-    }
-    async ensureRuntimeContainerCodexConfig(name, user, configToml) {
-        const script = this.scriptRenderer.renderCodexConfigScript(user, configToml);
-        this.runDockerExecScript(["exec", "-u", user.agentUser, name, "bash", "-lc", script], `Failed to write runtime Codex config.toml in container '${name}'`);
-    }
-    async ensureRuntimeContainerGitConfig(name, user, gitUserName, gitUserEmail) {
-        const script = this.scriptRenderer.renderGitConfigScript(gitUserName, gitUserEmail);
-        this.runDockerExecScript(["exec", "-u", user.agentUser, name, "bash", "-lc", script], `Failed to configure git author defaults in runtime container '${name}'`);
-    }
-    async ensureRuntimeContainerThreadGitSkills(name, user, options) {
-        if (options.packages.length === 0) {
-            return;
-        }
-        const cloneScript = this.scriptRenderer.renderThreadGitSkillsCloneScript(options);
-        this.runDockerExecScript(["exec", "-u", "0", name, "bash", "-lc", cloneScript], `Failed to provision thread git skills in runtime container '${name}'`);
-        const linkScript = this.scriptRenderer.renderThreadGitSkillsLinkScript(user, options);
-        this.runDockerExecScript(["exec", "-u", user.agentUser, name, "bash", "-lc", linkScript], `Failed to provision thread git skills in runtime container '${name}'`);
-    }
-    async ensureRuntimeContainerAgentMetadataFiles(name, user, files, contextMessage) {
-        if (files.length === 0) {
-            return;
-        }
-        const script = this.scriptRenderer.renderAgentMetadataScript(user, files);
-        this.runDockerExecScript(["exec", "-u", user.agentUser, name, "bash", "-lc", script], contextMessage);
-    }
-    async ensureRuntimeContainerThreadMetadata(name, user, payload) {
-        const files = [
-            {
-                filename: "thread-mcp.json",
-                content: `${JSON.stringify({ servers: payload.mcpServers }, null, 2)}\n`,
-            },
-            {
-                filename: "thread-git-skills.json",
-                content: `${JSON.stringify({ packages: payload.gitSkillPackages }, null, 2)}\n`,
-            },
-        ];
-        await this.ensureRuntimeContainerAgentMetadataFiles(name, user, files, `Failed to write runtime thread metadata in container '${name}'`);
-    }
-    async stopContainer(name) {
-        try {
-            await this.docker.getContainer(name).stop({ t: 10 });
-        }
-        catch (error) {
-            if (isContainerNotFound(error) || isContainerNotRunning(error)) {
-                return;
-            }
-            throw error;
-        }
-    }
-    async forceRemoveContainer(name) {
-        try {
-            await this.docker.getContainer(name).remove({ force: true });
-        }
-        catch (error) {
-            if (isContainerNotFound(error)) {
-                return;
-            }
-            throw error;
-        }
-    }
-    async forceRemoveVolume(name) {
-        try {
-            await this.docker.getVolume(name).remove();
-        }
-        catch (error) {
-            if (isVolumeNotFound(error)) {
-                return;
-            }
-            throw error;
-        }
-    }
-}
-exports.ThreadContainerService = ThreadContainerService;