@dharma-ai-labs/agent-fabric 0.2.134 → 0.2.136

package/README.md

@@ -27,6 +27,55 @@ Existing `--grant` integrations remain compatible. New portal instructions use
 private entry instead. After enrollment, use the exact supported grant-free
 `bootstrap --resume --complete` command; do not enter or replay the spent grant.
 
+## Owned Linux container lifecycle
+
+An unprivileged Linux container may use `relay container-entrypoint` as its
+actual non-root PID1 instead of a host systemd user service. Install the exact
+qualified CLI and supported Node runtime in the image, then exec Node with the
+absolute canonical `dist/bin.js` path and `relay container-entrypoint`. The
+command accepts no grant, policy, provider or task arguments. Inspect the
+credential-free plan with `relay container-entrypoint --dry-run` before image
+installation; it makes no local changes. Set an explicit
+private `DHARMA_HOME` before launch. An npm wrapper, shell that does not exec,
+`sleep` or an arbitrary init shim as PID1 does not qualify. A narrowly verified
+Docker `--init` route also supports the canonical CLI as the non-root direct
+child of Docker's root-owned, non-writable `/sbin/docker-init` executable. This
+route retains the existing official Node-image command
+`docker-entrypoint.sh sleep infinity`; an explicitly approved public entrypoint
+migration must exec the canonical Node/CLI command as that init's main child.
+The CLI checks the executable inode, UID, both process start times and the
+kernel's first init-child identity, retaining zombies rather than promoting
+adopted processes. The controller must also retain init's session and its own
+process group. The main-child and process identities are checked again before
+control is admitted; a foreground or orphaned `docker exec` or a fabricated
+marker cannot claim startup.
+
+The image/operator must provide its own protected Secret Service, private
+session bus and durable private home. Never mount a host bus or copy another
+client's credentials. Genuine provider login and private USER keyring unlock
+remain recipient actions. The entrypoint waits without enrollment or provider
+work until normal signed onboarding installs its canonical startup registration.
+It then launches the exact installed CLI supervisor, retaining all device,
+repository, policy and task checks. A locked or absent protected collection
+blocks launch; it does not select a plaintext store or request a model turn.
+
+The entrypoint owns one relay for that container OS user. It never creates a
+second host service or changes an existing systemd user unit. Owned start/stop
+controls use atomic private receipts; disable removes the registration. It
+reaps its child on normal shutdown and retries an exited child with a bounded
+delay. A new container boot renews only its own entrypoint lease while retaining its
+configuration and encrypted state. Runtime-version mismatch blocks restart;
+upgrade the reviewed image/runtime together through the normal release path.
+
+`relay autostart status` distinguishes saved configuration, blocked storage,
+paused work and a freshly observed live child with matching UID, parent and
+process start time. This is container-entrypoint restart coverage only. The
+CLI does not install Docker restart policy or prove host sign-in/reboot recovery.
+A real container restart, protected-store unlock, unchanged device/session
+identity, current signed relay polling and independent operator rehearsal must
+be observed before claiming readiness. Container creation, entrypoint changes
+and persistent startup installation remain explicit operator decisions.
+
 ## Recover a committed legacy bootstrap
 
 Older repositories may contain an unsigned installer marker committed for a

package/dist/containerDockerInit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=containerDockerInit.test.d.ts.map

package/dist/containerDockerInit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerDockerInit.test.d.ts","sourceRoot":"","sources":["../src/containerDockerInit.test.ts"],"names":[],"mappings":""}

package/dist/containerDockerInit.test.js

@@ -0,0 +1,187 @@
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import { mkdtemp, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import * as lifecycle from './containerRelayLifecycle.js';
+import { enableRelayAutostart, relayAutostartStatus } from './relayAutostart.js';
+const linux = { skip: process.platform !== 'linux' };
+async function fixture() {
+    const root = await mkdtemp(join(tmpdir(), 'dharma-docker-init-'));
+    const home = join(root, 'device');
+    const workspace = join(root, 'checkout');
+    await mkdir(join(home, 'relay'), { recursive: true, mode: 0o700 });
+    await mkdir(join(workspace, '.dharma'), { recursive: true, mode: 0o700 });
+    const uid = process.getuid();
+    const init = { pid: 1, parentPid: 0, processGroupId: 1, sessionId: 1, uid, startTicks: '123', argv: ['/sbin/docker-init', '--', 'docker-entrypoint.sh', 'sleep', 'infinity'] };
+    const controller = { pid: 42, parentPid: 1, processGroupId: 42, sessionId: 1, uid, startTicks: '124',
+        argv: ['/usr/local/bin/node', '/fixture/cli/dist/bin.js', 'relay', 'container-entrypoint'] };
+    const marker = { schema: 'dharma.container-entrypoint/v2', home, pid: controller.pid, uid,
+        startTicks: controller.startTicks, initStartTicks: init.startTicks };
+    await writeFile(join(home, 'relay', 'container-entrypoint.json'), JSON.stringify(marker), { mode: 0o600 });
+    let verifiedInit = true;
+    let verifiedNode = true;
+    let mainChild = controller.pid;
+    const runtime = { identity: async () => init, canonicalEntrypoint: controller.argv[1], runtimeVersion: '0.2.135',
+        controllerIdentity: async (pid) => { assert.equal(pid, controller.pid); return controller; },
+        dockerInitVerified: async () => verifiedInit,
+        dockerInitMainChild: async () => mainChild,
+        controllerExecutableVerified: async () => verifiedNode,
+        childIdentity: async (pid) => ({ ...await lifecycle.readContainerChildIdentity(pid), parentPid: controller.pid }) };
+    const options = { platform: 'linux', home, uid, userHome: root, workspace,
+        launcher: join(workspace, '.dharma', 'bin', 'dharma'), policy: join(workspace, '.dharma', 'approved-policy.json'),
+        version: '0.2.135', containerRuntime: runtime,
+        run: async () => { throw new Error('must never use systemd for the owned init child'); } };
+    return { root, home, init, controller, marker, runtime, options,
+        untrustInit: () => { verifiedInit = false; }, untrustNode: () => { verifiedNode = false; },
+        setMainChild: (pid) => { mainChild = pid; } };
+}
+async function until(check) {
+    const deadline = Date.now() + 3000;
+    while (!check()) {
+        if (Date.now() > deadline)
+            throw new Error('fixture did not progress');
+        await new Promise(r => setTimeout(r, 10));
+    }
+}
+test('canonical direct child of verified Docker init can own persistent container startup', linux, async () => {
+    const f = await fixture();
+    assert.equal((await enableRelayAutostart(f.options)).backend, 'container-entrypoint');
+    assert.equal((await relayAutostartStatus(f.options)).state, 'enabled');
+});
+test('adopted canonical exec child cannot replace the Docker init main startup child', linux, async () => {
+    for (const kind of ['different-main-child', 'foreign-session', 'foreign-process-group', 'missing-main-child']) {
+        const f = await fixture();
+        if (kind === 'different-main-child')
+            f.setMainChild(7);
+        if (kind === 'missing-main-child')
+            f.setMainChild(0);
+        if (kind === 'foreign-session')
+            f.controller.sessionId = 99;
+        if (kind === 'foreign-process-group')
+            f.controller.processGroupId = 99;
+        await assert.rejects(enableRelayAutostart(f.options), /container_startup_unavailable/, kind);
+    }
+});
+test('Docker init main-child identity is checked again before control is admitted', linux, async () => {
+    const f = await fixture();
+    let reads = 0;
+    f.runtime.dockerInitMainChild = async () => ++reads === 1 ? f.controller.pid : 7;
+    await assert.rejects(enableRelayAutostart(f.options), /container_startup_unavailable/);
+});
+test('Docker init session and controller process group cannot change during attribution', linux, async () => {
+    for (const kind of ['init-session', 'init-group', 'controller-session', 'controller-group']) {
+        const f = await fixture();
+        let reads = 0;
+        if (kind.startsWith('init-'))
+            f.runtime.identity = async () => {
+                reads++;
+                return { ...f.init, ...(reads > 1 ? kind === 'init-session' ? { sessionId: 99 } : { processGroupId: 99 } : {}) };
+            };
+        else
+            f.runtime.controllerIdentity = async () => {
+                reads++;
+                return { ...f.controller, ...(reads > 1 ? kind === 'controller-session' ? { sessionId: 99 } : { processGroupId: 99 } : {}) };
+            };
+        await assert.rejects(enableRelayAutostart(f.options), /container_startup_unavailable/, kind);
+    }
+});
+test('Docker init route rejects foreign parent owner argv executable boot and controller ticks', linux, async () => {
+    for (const kind of ['parent', 'uid', 'argv', 'executable', 'node-executable', 'init-parent', 'init-argv', 'init-boot', 'controller-boot', 'extra-argument']) {
+        const f = await fixture();
+        if (kind === 'parent')
+            f.controller.parentPid = 9;
+        if (kind === 'uid')
+            f.controller.uid++;
+        if (kind === 'argv')
+            f.controller.argv[1] = '/foreign/cli/dist/bin.js';
+        if (kind === 'executable')
+            f.untrustInit();
+        if (kind === 'node-executable')
+            f.untrustNode();
+        if (kind === 'init-parent')
+            f.init.parentPid = 3;
+        if (kind === 'init-argv')
+            f.init.argv[3] = 'foreign-command';
+        if (kind === 'init-boot')
+            f.init.startTicks = '999';
+        if (kind === 'controller-boot')
+            f.controller.startTicks = '999';
+        if (kind === 'extra-argument')
+            f.controller.argv.push('--grant');
+        await assert.rejects(enableRelayAutostart(f.options), /container_startup_unavailable/, kind);
+    }
+});
+test('init marker cannot omit the Docker boot identity or promote an ordinary exec child to the entrypoint', linux, async () => {
+    const f = await fixture();
+    await writeFile(join(f.home, 'relay', 'container-entrypoint.json'), JSON.stringify({ ...f.marker, initStartTicks: undefined }));
+    await assert.rejects(enableRelayAutostart(f.options), /container_startup_unavailable/);
+});
+test('controller identity changes during executable verification are rejected before startup control', linux, async () => {
+    const f = await fixture();
+    let reads = 0;
+    f.runtime.controllerIdentity = async (pid) => {
+        assert.equal(pid, f.controller.pid);
+        reads++;
+        return { ...f.controller, startTicks: reads > 1 ? 'CANARY_REUSED_PROCESS' : f.controller.startTicks };
+    };
+    await assert.rejects(enableRelayAutostart(f.options), error => {
+        assert.match(String(error), /container_startup_unavailable/);
+        assert.doesNotMatch(String(error), /CANARY_REUSED_PROCESS/);
+        return true;
+    });
+});
+test('same Docker-init boot cannot take over another controller lease', linux, async () => {
+    const f = await fixture();
+    await writeFile(join(f.home, 'relay', 'container-entrypoint.lock'), JSON.stringify({ ...f.marker, pid: 77, startTicks: '99' }), { mode: 0o600 });
+    const abort = new AbortController();
+    await assert.rejects(lifecycle.runOwnedContainerEntrypoint({ home: f.home, uid: f.options.uid, signal: abort.signal,
+        containerRuntime: { ...f.runtime, currentControllerPid: f.controller.pid } }), /container_entrypoint_busy/);
+});
+test('different verified Docker-init boot renews only its own previous lifecycle metadata', linux, async () => {
+    const f = await fixture();
+    await writeFile(join(f.home, 'relay', 'container-entrypoint.lock'), JSON.stringify(f.marker), { mode: 0o600 });
+    f.init.startTicks = '223';
+    f.controller.startTicks = '224';
+    const abort = new AbortController();
+    const result = lifecycle.runOwnedContainerEntrypoint({ home: f.home, uid: f.options.uid, signal: abort.signal,
+        containerRuntime: { ...f.runtime, currentControllerPid: f.controller.pid }, pollMs: 10,
+        spawnRelay: () => { throw new Error('unconfigured controller cannot launch'); } });
+    try {
+        await new Promise(resolve => setTimeout(resolve, 50));
+        const marker = JSON.parse(await readFile(join(f.home, 'relay', 'container-entrypoint.json'), 'utf8'));
+        assert.equal(marker.initStartTicks, '223');
+        assert.equal(marker.startTicks, '224');
+    }
+    finally {
+        abort.abort();
+    }
+    await result;
+});
+test('Docker init controller fences its own supervisor and remains blocked while the consumer is locked', linux, async () => {
+    const f = await fixture();
+    await enableRelayAutostart(f.options);
+    const abort = new AbortController();
+    let ready = false;
+    const children = [];
+    const result = lifecycle.runOwnedContainerEntrypoint({ home: f.home, uid: f.options.uid, signal: abort.signal,
+        containerRuntime: { ...f.runtime, currentControllerPid: f.controller.pid }, pollMs: 10,
+        consumerStoreReady: async () => ready,
+        spawnRelay: () => { const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' }); children.push(child); return child; } });
+    try {
+        await new Promise(resolve => setTimeout(resolve, 50));
+        const heartbeat = JSON.parse(await readFile(join(f.home, 'relay', 'container-heartbeat.json'), 'utf8'));
+        assert.equal(heartbeat.lifecycle, 'blocked');
+        assert.equal(children.length, 0);
+        ready = true;
+        await until(() => children.length === 1);
+        assert.equal((await relayAutostartStatus(f.options)).lifecycle, 'running');
+    }
+    finally {
+        abort.abort();
+    }
+    await result;
+    assert.equal(children.every(child => child.exitCode !== null || child.signalCode !== null), true);
+});
+//# sourceMappingURL=containerDockerInit.test.js.map

package/dist/containerDockerInit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerDockerInit.test.js","sourceRoot":"","sources":["../src/containerDockerInit.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,SAAS,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;AACrD,KAAK,UAAU,OAAO;IACpB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAAC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC5E,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,MAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,mBAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;IAC/K,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK;QAClG,IAAI,EAAE,CAAC,qBAAqB,EAAE,0BAA0B,EAAE,OAAO,EAAE,sBAAsB,CAAC,EAAE,CAAC;IAC/F,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,gCAAgC,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG;QACvF,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACvE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3G,IAAI,YAAY,GAAG,IAAI,CAAC;IAAC,IAAI,YAAY,GAAG,IAAI,CAAC;IAAC,IAAI,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC;IACjF,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS;QAC9G,kBAAkB,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;QACpG,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY;QAC5C,mBAAmB,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;QAC1C,4BAA4B,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY;QACtD,aAAa,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,SAAS,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;IAC9H,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,OAAgB,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS;QAChF,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,sBAAsB,CAAC;QACjH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO;QAC7C,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;QAC7D,WAAW,EAAE,GAAG,EAAE,GAAG,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC;QAC1F,YAAY,EAAE,CAAC,GAAW,EAAE,EAAE,GAAG,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AACD,KAAK,UAAU,KAAK,CAAC,KAAoB;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACnC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;AACzI,CAAC;AAED,IAAI,CAAC,qFAAqF,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAC5G,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACtF,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gFAAgF,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACvG,KAAK,MAAM,IAAI,IAAI,CAAC,sBAAsB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAC9G,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,IAAI,IAAI,KAAK,sBAAsB;YAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,oBAAoB;YAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,IAAI,KAAK,iBAAiB;YAAE,CAAC,CAAC,UAAU,CAAC,SAAS,GAAG,EAAE,CAAC;QAC5D,IAAI,IAAI,KAAK,uBAAuB;YAAE,CAAC,CAAC,UAAU,CAAC,cAAc,GAAG,EAAE,CAAC;QACvE,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,+BAA+B,EAAE,IAAI,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6EAA6E,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACpG,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,OAAO,CAAC,mBAAmB,GAAG,KAAK,IAAI,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,+BAA+B,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mFAAmF,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAC1G,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,YAAY,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC5F,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,GAAG,KAAK,IAAI,EAAE;gBAC5D,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACnH,CAAC,CAAC;;YACG,CAAC,CAAC,OAAO,CAAC,kBAAkB,GAAG,KAAK,IAAI,EAAE;gBAC7C,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/H,CAAC,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,+BAA+B,EAAE,IAAI,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0FAA0F,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACjH,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC5J,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,IAAI,IAAI,KAAK,QAAQ;YAAE,CAAC,CAAC,UAAU,CAAC,SAAS,GAAG,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,KAAK;YAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;QACvC,IAAI,IAAI,KAAK,MAAM;YAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,0BAA0B,CAAC;QACvE,IAAI,IAAI,KAAK,YAAY;YAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,IAAI,KAAK,iBAAiB;YAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,IAAI,IAAI,KAAK,aAAa;YAAE,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,WAAW;YAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC;QAC7D,IAAI,IAAI,KAAK,WAAW;YAAE,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QACpD,IAAI,IAAI,KAAK,iBAAiB;YAAE,CAAC,CAAC,UAAU,CAAC,UAAU,GAAG,KAAK,CAAC;QAChE,IAAI,IAAI,KAAK,gBAAgB;YAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,+BAA+B,EAAE,IAAI,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sGAAsG,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAC7H,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAChI,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,+BAA+B,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gGAAgG,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACvH,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,OAAO,CAAC,kBAAkB,GAAG,KAAK,EAAC,GAAG,EAAC,EAAE;QACzC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAAC,KAAK,EAAE,CAAC;QAC7C,OAAO,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;IACxG,CAAC,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE;QAC5D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAC7D,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,uBAAuB,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACxF,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjJ,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;QACjH,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,2BAA2B,CAAC,CAAC;AAChH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAC5G,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/G,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;IAAC,CAAC,CAAC,UAAU,CAAC,UAAU,GAAG,KAAK,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;QAC3G,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE;QACtF,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACtG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrF,CAAC;YAAS,CAAC;QAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IAC5B,MAAM,MAAM,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mGAAmG,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAC1H,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IAAC,IAAI,KAAK,GAAG,KAAK,CAAC;IAAC,MAAM,QAAQ,GAA+B,EAAE,CAAC;IACxG,MAAM,MAAM,GAAG,SAAS,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;QAC3G,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE;QACtF,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;QACrC,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,6BAA6B,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAiE,CAAC,CAAC;IACjO,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,0BAA0B,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACxG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/E,KAAK,GAAG,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC7E,CAAC;YAAS,CAAC;QAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IAC5B,MAAM,MAAM,CAAC;IACb,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AACpG,CAAC,CAAC,CAAC"}

package/dist/containerRelayLifecycle.d.ts

@@ -0,0 +1,68 @@
+import { type ChildProcess } from 'node:child_process';
+export interface ContainerProcessIdentity {
+    pid: number;
+    uid: number;
+    startTicks: string;
+    argv: string[];
+    parentPid?: number;
+    processGroupId?: number;
+    sessionId?: number;
+}
+export interface ContainerChildIdentity {
+    pid: number;
+    uid: number;
+    parentPid: number;
+    startTicks: string;
+}
+export interface ContainerRuntime {
+    identity?: () => Promise<ContainerProcessIdentity>;
+    childIdentity?: (pid: number) => Promise<ContainerChildIdentity>;
+    canonicalEntrypoint?: string;
+    runtimeVersion?: string;
+    controllerIdentity?: (pid: number) => Promise<ContainerProcessIdentity>;
+    dockerInitVerified?: () => Promise<boolean>;
+    dockerInitMainChild?: () => Promise<number>;
+    controllerExecutableVerified?: (identity: ContainerProcessIdentity) => Promise<boolean>;
+    currentControllerPid?: number;
+}
+export interface ContainerLifecycleOptions {
+    home: string;
+    uid?: number;
+    containerRuntime?: ContainerRuntime;
+}
+export interface ContainerRelayRegistration {
+    schema: 'dharma.relay-autostart/v3';
+    backend: 'container-entrypoint';
+    launcher: string;
+    workspace: string;
+    policy: string;
+    version: string;
+    taskName: null;
+}
+export declare function readContainerPid1Identity(): Promise<ContainerProcessIdentity>;
+export declare function readContainerProcessIdentity(pid: number): Promise<ContainerProcessIdentity>;
+export declare function readContainerChildIdentity(pid: number): Promise<ContainerChildIdentity>;
+export declare function containerEntrypointAvailable(options: ContainerLifecycleOptions): Promise<boolean>;
+export declare function containerStartupControl(options: ContainerLifecycleOptions, registration: ContainerRelayRegistration, running: boolean): Promise<void>;
+export declare function containerStartupState(options: ContainerLifecycleOptions, registration: ContainerRelayRegistration): Promise<{
+    state: "enabled";
+    backend: "container-entrypoint";
+    version: string;
+    lifecycle: "unconfigured" | "paused" | "blocked" | "starting" | "running" | "configured";
+    restartCoverage: "container-entrypoint-only";
+}>;
+export declare function ownsContainerStartup(options: ContainerLifecycleOptions, registration: ContainerRelayRegistration): Promise<boolean>;
+export declare function writeContainerRegistration(options: ContainerLifecycleOptions, registration: ContainerRelayRegistration): Promise<void>;
+export declare function readContainerRegistration(options: ContainerLifecycleOptions): Promise<ContainerRelayRegistration | null>;
+export declare function containerConsumerStoreReady(): Promise<boolean>;
+export declare function runOwnedContainerEntrypoint(options: ContainerLifecycleOptions & {
+    signal: AbortSignal;
+    spawnRelay?: (registration: ContainerRelayRegistration) => ChildProcess;
+    consumerStoreReady?: () => Promise<boolean>;
+    pollMs?: number;
+    restartDelayMs?: number;
+}): Promise<{
+    stopped: boolean;
+    restarts: number;
+}>;
+//# sourceMappingURL=containerRelayLifecycle.d.ts.map

package/dist/containerRelayLifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerRelayLifecycle.d.ts","sourceRoot":"","sources":["../src/containerRelayLifecycle.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAOxE,MAAM,WAAW,wBAAwB;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AAC3K,MAAM,WAAW,sBAAsB;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AAE3G,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACnD,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACxE,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,4BAA4B,CAAC,EAAE,CAAC,QAAQ,EAAE,wBAAwB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxF,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AACD,MAAM,WAAW,yBAAyB;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;CAAE;AAC9G,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,2BAA2B,CAAC;IAAC,OAAO,EAAE,sBAAsB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IACvF,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAC;CACpE;AA+CD,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAEnF;AAED,wBAAsB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAUjG;AA0ID,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAO7F;AAcD,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAKvG;AAmBD,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,yBAAyB,EAC9E,YAAY,EAAE,0BAA0B,EAAE,OAAO,EAAE,OAAO,iBAM3D;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAAE,0BAA0B;;;;;;GA2BvH;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAAE,0BAA0B,oBAUtH;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAAE,0BAA0B,iBAE5H;AAYD,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,yBAAyB,8CAKjF;AA0BD,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,OAAO,CAAC,CAapE;AAoBD,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,yBAAyB,GAAG;IACrF,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,0BAA0B,KAAK,YAAY,CAAC;IAC7F,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACvF;;;GAoFA"}