@dsh-enhanced/assistant-isolation 0.1.67 → 0.1.70

package/lib/cleanup-receipt.js

@@ -1,137 +0,0 @@
-import { spawn } from 'node:child_process';
-import { chmod, mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { sameLocalDockerSocket } from './docker-socket.js';
-const NAME = /^dsh-isolation-[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/;
-const OUTPUT_LIMIT = 4096;
-const COMMAND_TIMEOUT_MS = 10_000;
-const receipts = new WeakMap();
-function validSocket(path) {
-    return path.startsWith('/') && !/[\p{Cc}]/u.test(path);
-}
-function environment() {
-    return { PATH: process.env.PATH || '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' };
-}
-async function command(dockerPath, configDirectory, socketPath, args, signal, socket) {
-    return await new Promise(resolve => {
-        let child;
-        let stderr = '';
-        let settled = false;
-        let timer;
-        const finish = (code, timedOut, aborted) => {
-            if (settled)
-                return;
-            settled = true;
-            if (timer !== undefined)
-                clearTimeout(timer);
-            signal?.removeEventListener('abort', abort);
-            resolve({ code, stderr, timedOut, aborted });
-        };
-        const abort = () => { child?.kill('SIGKILL'); finish(null, false, true); };
-        if (signal?.aborted) {
-            finish(null, false, true);
-            return;
-        }
-        if (socket && !sameLocalDockerSocket(socket)) {
-            finish(null, false, false);
-            return;
-        }
-        signal?.addEventListener('abort', abort, { once: true });
-        try {
-            child = spawn(dockerPath, ['--config', configDirectory, '-H', `unix://${socketPath}`, ...args], {
-                shell: false, env: environment(), stdio: ['ignore', 'ignore', 'pipe'],
-            });
-        }
-        catch {
-            finish(null, false, false);
-            return;
-        }
-        child.stderr?.on('data', (chunk) => {
-            const remaining = OUTPUT_LIMIT - Buffer.byteLength(stderr);
-            if (remaining <= 0) {
-                child?.kill('SIGKILL');
-                finish(null, false, false);
-                return;
-            }
-            const value = Buffer.from(chunk);
-            if (value.length > remaining) {
-                stderr += value.subarray(0, remaining).toString('utf8');
-                child?.kill('SIGKILL');
-                finish(null, false, false);
-                return;
-            }
-            stderr += value.toString('utf8');
-        });
-        child.once('error', () => finish(null, false, false));
-        child.once('close', (code, signalName) => finish(signalName === null ? code : null, false, false));
-        timer = setTimeout(() => { child?.kill('SIGKILL'); finish(null, true, false); }, COMMAND_TIMEOUT_MS);
-        timer.unref();
-    });
-}
-function absent(result) {
-    return !result.timedOut && !result.aborted && result.code !== null
-        && result.code !== 0 && /no such (object|container|volume)/i.test(result.stderr);
-}
-async function removeOne(dockerPath, configDirectory, socketPath, kind, name, signal, socket) {
-    for (let attempt = 0; attempt < 3; attempt++) {
-        const removal = await command(dockerPath, configDirectory, socketPath, kind === 'volume' ? ['volume', 'rm', name] : ['rm', '-f', name], signal, socket);
-        // A failed or ambiguous remove invalidates this cleanup pass even if a later
-        // inspect happens to find the resource absent.
-        if (removal.timedOut || removal.aborted || removal.code === null)
-            return undefined;
-        const inspection = await command(dockerPath, configDirectory, socketPath, ['inspect', '--type', kind, name], signal, socket);
-        if (absent(inspection))
-            return Object.freeze({ kind, name, removalExitCode: removal.code, inspectionConfirmedAbsent: true });
-        if (inspection.timedOut || inspection.aborted || inspection.code === null)
-            return undefined;
-        if (attempt < 2)
-            await new Promise(resolve => setTimeout(resolve, 100));
-    }
-    return undefined;
-}
-/**
- * Deletes and then independently inspects all three deterministic resources.
- * The returned opaque receipt is evidence of this exact cleanup pass only.
- */
-export async function cleanupIsolationResources(dockerPath, name, options = {}) {
-    const socketPath = options.socketPath ?? '/var/run/docker.sock';
-    if (!NAME.test(name) || !dockerPath.startsWith('/') || !validSocket(socketPath) || options.signal?.aborted
-        || (options.socket && (options.socket.path !== socketPath || !sameLocalDockerSocket(options.socket))))
-        return undefined;
-    let configDirectory;
-    try {
-        configDirectory = await mkdtemp(join(tmpdir(), 'dsh-isolation-docker-'));
-        await chmod(configDirectory, 0o700);
-    }
-    catch {
-        return undefined;
-    }
-    try {
-        const targets = [
-            ['container', name], ['container', `${name}-keeper`], ['volume', `${name}-workspace`],
-        ];
-        const resources = [];
-        let complete = true;
-        for (const [kind, target] of targets) {
-            const receipt = await removeOne(dockerPath, configDirectory, socketPath, kind, target, options.signal, options.socket);
-            if (receipt === undefined)
-                complete = false;
-            else
-                resources.push(receipt);
-        }
-        if (!complete || options.signal?.aborted || (options.socket && !sameLocalDockerSocket(options.socket)))
-            return undefined;
-        const receipt = Object.freeze({});
-        receipts.set(receipt, Object.freeze({ dockerPath, socketPath, containerName: name, checkedAt: Date.now(), resources: Object.freeze(resources) }));
-        return receipt;
-    }
-    finally {
-        await rm(configDirectory, { recursive: true, force: true }).catch(() => undefined);
-    }
-}
-/** Returns immutable receipt data only for receipts minted by this module. */
-export function receiptData(receipt) {
-    return typeof receipt === 'object' && receipt !== null ? receipts.get(receipt) : undefined;
-}
-//# sourceMappingURL=cleanup-receipt.js.map

package/lib/cleanup-receipt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cleanup-receipt.js","sourceRoot":"","sources":["../src/cleanup-receipt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,qBAAqB,EAAqB,MAAM,oBAAoB,CAAA;AAE7E,MAAM,IAAI,GAAG,6DAA6D,CAAA;AAC1E,MAAM,YAAY,GAAG,IAAI,CAAA;AACzB,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAmBjC,MAAM,QAAQ,GAAG,IAAI,OAAO,EAA8B,CAAA;AAE1D,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;AAC9E,CAAC;AAID,KAAK,UAAU,OAAO,CAAC,UAAkB,EAAE,eAAuB,EAAE,UAAkB,EAAE,IAAuB,EAAE,MAAoB,EAAE,MAAqB;IAC1J,OAAO,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QACjC,IAAI,KAA2C,CAAA;QAC/C,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,IAAI,KAAiC,CAAA;QACrC,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,QAAiB,EAAE,OAAgB,EAAQ,EAAE;YAChF,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC5C,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAC3C,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;QAC9C,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,GAAS,EAAE,GAAG,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA,CAAC,CAAC,CAAA;QAC/E,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAAC,OAAM;QAAC,CAAC;QAC1D,IAAI,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAAC,OAAM;QAAC,CAAC;QACpF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE;gBAC9F,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;aACtE,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAAC,OAAM;QAAC,CAAC;QAC9C,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,SAAS,GAAG,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAC1D,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;gBAAC,OAAM;YAAC,CAAC;YAClF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAChC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;gBAAC,OAAM;YAAC,CAAC;YACrJ,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAClC,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;QACrD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;QAClG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAA;QACnG,KAAK,CAAC,KAAK,EAAE,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,MAAqB;IACnC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;WAC7D,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AACpF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,eAAuB,EAAE,UAAkB,EAAE,IAA4B,EAAE,IAAY,EAAE,MAAoB,EAAE,MAAqB;IAC/K,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QACvJ,6EAA6E;QAC7E,+CAA+C;QAC/C,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAClF,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QAC5H,IAAI,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5H,IAAI,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAC3F,IAAI,OAAO,GAAG,CAAC;YAAE,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,UAAkB,EAAE,IAAY,EAAE,UAAgF,EAAE;IAClK,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,sBAAsB,CAAA;IAC/D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;WACrG,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IACzH,IAAI,eAAmC,CAAA;IACvC,IAAI,CAAC;QACH,eAAe,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAA;QACxE,MAAM,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,OAAO,GAAqD;YAChE,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,IAAI,YAAY,CAAC;SACtF,CAAA;QACD,MAAM,SAAS,GAA6B,EAAE,CAAA;QAC9C,IAAI,QAAQ,GAAG,IAAI,CAAA;QACnB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;YACtH,IAAI,OAAO,KAAK,SAAS;gBAAE,QAAQ,GAAG,KAAK,CAAA;;gBACtC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC9B,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QACxH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACjC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAA;QACjJ,OAAO,OAAO,CAAA;IAChB,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACpF,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5F,CAAC"}

package/lib/daemon-binding.d.ts

@@ -1,13 +0,0 @@
-import type { DaemonWitness } from './runtime-witness.js';
-export interface SystemdBinding {
-    kind: 'systemd';
-    serviceInvocationId: string;
-    socketInvocationId: string;
-}
-/**
- * Attests the systemd configuration chain, not a kernel-level ownership proof
- * for a particular inherited file descriptor. Every missing or changing datum
- * is rejected so callers retain uncertainty rather than freeing work.
- */
-export declare function captureSystemdBinding(daemon: DaemonWitness): Promise<SystemdBinding | undefined>;
-//# sourceMappingURL=daemon-binding.d.ts.map

package/lib/daemon-binding.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"daemon-binding.d.ts","sourceRoot":"","sources":["../src/daemon-binding.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEzD,MAAM,WAAW,cAAc;IAAG,IAAI,EAAE,SAAS,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE;AAmE5G;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAUtG"}

package/lib/daemon-binding.js

@@ -1,120 +0,0 @@
-import { spawn } from 'node:child_process';
-import { readFile } from 'node:fs/promises';
-import { basename } from 'node:path';
-import { processWitness } from './runtime-witness.js';
-const systemctl = '/usr/bin/systemctl';
-const outputMaximum = 16_384;
-const invocationId = /^[0-9a-f]{32}$/;
-const pid = /^[1-9][0-9]*$/;
-const properties = ['MainPID', 'InvocationID', 'ActiveState', 'SubState', 'TriggeredBy', 'Triggers', 'Listen', 'ExecStart'];
-const required = {
-    'docker.service': ['MainPID', 'InvocationID', 'ActiveState', 'SubState', 'TriggeredBy', 'ExecStart'],
-    'docker.socket': ['InvocationID', 'ActiveState', 'SubState', 'Triggers', 'Listen'],
-};
-function equalUnit(left, right) { return properties.every(key => left[key] === right[key]); }
-function includesUnit(value, unit) { return value.split(/\s+/).includes(unit); }
-async function show(unit) {
-    return await new Promise(resolve => {
-        let stdout = Buffer.alloc(0);
-        let stderr = Buffer.alloc(0);
-        let complete = false;
-        let timeout;
-        const finish = (value) => { if (complete)
-            return; complete = true; if (timeout !== undefined)
-            clearTimeout(timeout); resolve(value); };
-        let child;
-        try {
-            child = spawn(systemctl, ['show', unit, ...properties.map(property => `--property=${property}`)], { shell: false, env: { LANG: 'C', LC_ALL: 'C' }, stdio: ['ignore', 'pipe', 'pipe'] });
-        }
-        catch {
-            finish(undefined);
-            return;
-        }
-        const collect = (target, chunk) => {
-            const bytes = stdout.length + stderr.length + chunk.length;
-            if (bytes > outputMaximum) {
-                child.kill('SIGKILL');
-                finish(undefined);
-                return;
-            }
-            if (target === 'stdout')
-                stdout = Buffer.concat([stdout, chunk]);
-            else
-                stderr = Buffer.concat([stderr, chunk]);
-        };
-        child.stdout?.on('data', chunk => collect('stdout', chunk));
-        child.stderr?.on('data', chunk => collect('stderr', chunk));
-        child.once('error', () => finish(undefined));
-        child.once('close', code => {
-            if (code !== 0 || stderr.length !== 0) {
-                finish(undefined);
-                return;
-            }
-            const values = new Map();
-            for (const line of stdout.toString('utf8').split('\n').filter(Boolean)) {
-                const separator = line.indexOf('=');
-                if (separator <= 0) {
-                    finish(undefined);
-                    return;
-                }
-                const key = line.slice(0, separator);
-                const value = line.slice(separator + 1);
-                if (!properties.includes(key) || values.has(key)) {
-                    finish(undefined);
-                    return;
-                }
-                values.set(key, value);
-            }
-            if (required[unit].some(property => !values.has(property))) {
-                finish(undefined);
-                return;
-            }
-            finish(Object.fromEntries(properties.map(property => [property, values.get(property) ?? ''])));
-        });
-        timeout = setTimeout(() => { child.kill('SIGKILL'); finish(undefined); }, 5_000);
-        timeout.unref();
-    });
-}
-function matches(daemon, service, socket) {
-    if (!pid.test(service.MainPID) || Number(service.MainPID) !== daemon.process.pid || !invocationId.test(service.InvocationID) || !invocationId.test(socket.InvocationID)
-        || service.ActiveState !== 'active' || service.SubState !== 'running' || socket.ActiveState !== 'active' || socket.SubState !== 'running'
-        || !includesUnit(service.TriggeredBy, 'docker.socket') || !includesUnit(socket.Triggers, 'docker.service') || socket.Listen !== `${daemon.socketPath} (Stream)`
-        || !/\bpath=\/usr\/bin\/dockerd\b/.test(service.ExecStart) || !/\bargv\[\]=.*\bdockerd -H fd:\/\//.test(service.ExecStart))
-        return undefined;
-    return { kind: 'systemd', serviceInvocationId: service.InvocationID, socketInvocationId: socket.InvocationID };
-}
-function sameProcess(left, daemon) {
-    return !!left && left.bootId === daemon.process.bootId && left.pid === daemon.process.pid && left.startTicks === daemon.process.startTicks;
-}
-async function dockerdFdCommand(pid) {
-    try {
-        const arguments_ = (await readFile(`/proc/${pid}/cmdline`)).toString('utf8').split('\0').filter(Boolean);
-        return basename(arguments_[0] ?? '') === 'dockerd' && arguments_.some((value, index) => value === '-H' && arguments_[index + 1] === 'fd://');
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Attests the systemd configuration chain, not a kernel-level ownership proof
- * for a particular inherited file descriptor. Every missing or changing datum
- * is rejected so callers retain uncertainty rather than freeing work.
- */
-export async function captureSystemdBinding(daemon) {
-    if (!daemon || typeof daemon !== 'object' || daemon.socketPath !== '/run/docker.sock')
-        return undefined;
-    if (!sameProcess(await processWitness(daemon.process.pid), daemon))
-        return undefined;
-    const [firstService, firstSocket] = await Promise.all([show('docker.service'), show('docker.socket')]);
-    if (!firstService || !firstSocket || !matches(daemon, firstService, firstSocket) || !await dockerdFdCommand(daemon.process.pid))
-        return undefined;
-    if (!sameProcess(await processWitness(daemon.process.pid), daemon))
-        return undefined;
-    const [secondService, secondSocket] = await Promise.all([show('docker.service'), show('docker.socket')]);
-    if (!secondService || !secondSocket || !equalUnit(firstService, secondService) || !equalUnit(firstSocket, secondSocket))
-        return undefined;
-    if (!sameProcess(await processWitness(daemon.process.pid), daemon) || !await dockerdFdCommand(daemon.process.pid))
-        return undefined;
-    return matches(daemon, secondService, secondSocket);
-}
-//# sourceMappingURL=daemon-binding.js.map

package/lib/daemon-binding.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"daemon-binding.js","sourceRoot":"","sources":["../src/daemon-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAKrD,MAAM,SAAS,GAAG,oBAAoB,CAAA;AACtC,MAAM,aAAa,GAAG,MAAM,CAAA;AAC5B,MAAM,YAAY,GAAG,gBAAgB,CAAA;AACrC,MAAM,GAAG,GAAG,eAAe,CAAA;AAC3B,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAA;AAEpI,MAAM,QAAQ,GAAG;IACf,gBAAgB,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,CAAC;IACpG,eAAe,EAAE,CAAC,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC;CAC1E,CAAA;AAEV,SAAS,SAAS,CAAC,IAAU,EAAE,KAAW,IAAa,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA,CAAC,CAAC;AACjH,SAAS,YAAY,CAAC,KAAa,EAAE,IAAY,IAAa,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC;AAExG,KAAK,UAAU,IAAI,CAAC,IAAwC;IAC1D,OAAO,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QACjC,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAC,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAC,IAAI,QAAQ,GAAG,KAAK,CAAC;QAAC,IAAI,OAAmC,CAAA;QACzH,MAAM,MAAM,GAAG,CAAC,KAAuB,EAAQ,EAAE,GAAG,IAAI,QAAQ;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,IAAI,OAAO,KAAK,SAAS;YAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,CAAA;QAC7J,IAAI,KAA+B,CAAA;QACnC,IAAI,CAAC;YAAC,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QAAC,CAAC;QAC/L,MAAM,CAAC;YAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAAC,OAAM;QAAC,CAAC;QACnC,MAAM,OAAO,GAAG,CAAC,MAA2B,EAAE,KAAa,EAAQ,EAAE;YACnE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;YAC1D,IAAI,KAAK,GAAG,aAAa,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAAC,OAAM;YAAC,CAAC;YAC/E,IAAI,MAAM,KAAK,QAAQ;gBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;;gBAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;QAChH,CAAC,CAAA;QACD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;QAC3D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;QAC3D,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;QAC5C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAAC,OAAM;YAAC,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;YACxC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;oBAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAAC,OAAM;gBAAC,CAAC;gBACtF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;gBAC7E,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAkC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAAC,OAAM;gBAAC,CAAC;gBAC9G,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACxB,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAAC,OAAM;YAAC,CAAC;YACzF,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAS,CAAC,CAAA;QACxG,CAAC,CAAC,CAAA;QACF,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC/E,OAAO,CAAC,KAAK,EAAE,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,MAAqB,EAAE,OAAa,EAAE,MAAY;IACjE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;WAClK,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;WACtI,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,WAAW;WAC5J,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IAC9I,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,EAAE,OAAO,CAAC,YAAY,EAAE,kBAAkB,EAAE,MAAM,CAAC,YAAY,EAAE,CAAA;AAChH,CAAC;AAED,SAAS,WAAW,CAAC,IAAqE,EAAE,MAAqB;IAC/G,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,OAAO,CAAC,UAAU,CAAA;AAC5I,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,CAAC,MAAM,QAAQ,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACxG,OAAO,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO,CAAC,CAAA;IAC9I,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAqB;IAC/D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAA;IACvG,IAAI,CAAC,WAAW,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAE,OAAO,SAAS,CAAA;IACpF,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IACtG,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACjJ,IAAI,CAAC,WAAW,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAE,OAAO,SAAS,CAAA;IACpF,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IACxG,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,YAAY,CAAC;QAAE,OAAO,SAAS,CAAA;IACzI,IAAI,CAAC,WAAW,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACnI,OAAO,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAA;AACrD,CAAC"}

package/lib/docker-socket.d.ts

@@ -1,10 +0,0 @@
-export interface DockerSocket {
-    path: string;
-    dev: number;
-    ino: number;
-}
-export declare function configuredDockerSocketPath(path: string | undefined, platform?: NodeJS.Platform, home?: string): string;
-/** Resolve once for a job and retain the inode through supervisor and cleanup. */
-export declare function resolveLocalDockerSocket(path: string, platform?: NodeJS.Platform, home?: string): DockerSocket;
-export declare function sameLocalDockerSocket(socket: DockerSocket): boolean;
-//# sourceMappingURL=docker-socket.d.ts.map

package/lib/docker-socket.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"docker-socket.d.ts","sourceRoot":"","sources":["../src/docker-socket.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,YAAY;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AAExE,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,kBAAmB,EAAE,IAAI,SAAY,GAAG,MAAM,CAU1H;AAED,kFAAkF;AAClF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,kBAAmB,EAAE,IAAI,SAAY,GAAG,YAAY,CAclH;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAKnE"}

package/lib/docker-socket.js

@@ -1,43 +0,0 @@
-import { lstatSync, realpathSync, statSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { isAbsolute, join, resolve } from 'node:path';
-export function configuredDockerSocketPath(path, platform = process.platform, home = homedir()) {
-    const value = path ?? (platform === 'darwin' ? join(home, '.docker', 'run', 'docker.sock') : '/var/run/docker.sock');
-    if (!isAbsolute(value) || resolve(value) !== value || /[\p{Cc},]/u.test(value) || value.includes('://'))
-        throw new Error('assistant-isolation: canonical absolute local Docker socket required');
-    if (platform === 'darwin') {
-        const directory = join(home, '.docker', 'run');
-        if (value !== join(directory, 'docker.sock')) {
-            throw new Error('assistant-isolation: macOS Docker socket must be in the current user Docker run directory');
-        }
-    }
-    return value;
-}
-/** Resolve once for a job and retain the inode through supervisor and cleanup. */
-export function resolveLocalDockerSocket(path, platform = process.platform, home = homedir()) {
-    configuredDockerSocketPath(path, platform, home);
-    const canonical = realpathSync(path);
-    if (platform === 'darwin' && canonical !== path)
-        throw new Error('assistant-isolation: macOS Docker socket must not be a symlink');
-    const info = lstatSync(canonical);
-    if (!info.isSocket())
-        throw new Error('assistant-isolation: Docker endpoint is not a local Unix socket');
-    if (platform === 'darwin') {
-        const directory = join(home, '.docker', 'run');
-        const parent = statSync(directory);
-        if (!parent.isDirectory() || parent.uid !== process.getuid?.() || (parent.mode & 0o022) !== 0 || info.uid !== process.getuid?.()) {
-            throw new Error('assistant-isolation: macOS Docker socket must be owned by the current user');
-        }
-    }
-    return { path: canonical, dev: info.dev, ino: info.ino };
-}
-export function sameLocalDockerSocket(socket) {
-    try {
-        const info = lstatSync(socket.path);
-        return info.isSocket() && info.dev === socket.dev && info.ino === socket.ino;
-    }
-    catch {
-        return false;
-    }
-}
-//# sourceMappingURL=docker-socket.js.map

package/lib/docker-socket.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"docker-socket.js","sourceRoot":"","sources":["../src/docker-socket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAIrD,MAAM,UAAU,0BAA0B,CAAC,IAAwB,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,GAAG,OAAO,EAAE;IAChH,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAA;IACpH,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;IAChM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;QAC9C,IAAI,KAAK,KAAK,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAA;QAC9G,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,GAAG,OAAO,EAAE;IAClG,0BAA0B,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;IAChD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IACpC,IAAI,QAAQ,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IAClI,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IACxG,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAA;QAClC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YACjI,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAA;QAC/F,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAA;AAC1D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAoB;IACxD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACnC,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAA;IAC9E,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;AAC1B,CAAC"}

package/lib/reconcile.d.ts

@@ -1,5 +0,0 @@
-import type { IsolationControllerAuthority, IsolationLedger } from './ledger.js';
-import type { IsolationJob } from './types.js';
-/** Host-only reconciliation. Lost mutation receipts never acquire release authority. */
-export declare function reconcileUnknownJob(ledger: IsolationLedger, authority: IsolationControllerAuthority, job: IsolationJob, dockerPath: string, signal: AbortSignal, socketPath?: string): Promise<boolean>;
-//# sourceMappingURL=reconcile.d.ts.map

package/lib/reconcile.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,4BAA4B,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAGhF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,wFAAwF;AACxF,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,4BAA4B,EACxG,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBnG"}

package/lib/reconcile.js

@@ -1,31 +0,0 @@
-import { realpath } from 'node:fs/promises';
-import { cleanupIsolationResources } from './cleanup-receipt.js';
-import { captureDaemonWitness, processExited, sameDaemonWitness } from './runtime-witness.js';
-import { configuredDockerSocketPath, resolveLocalDockerSocket } from './docker-socket.js';
-/** Host-only reconciliation. Lost mutation receipts never acquire release authority. */
-export async function reconcileUnknownJob(ledger, authority, job, dockerPath, signal, socketPath) {
-    const original = job.creationWitness;
-    if (signal.aborted || job.status !== 'unknown' || job.result?.quiescent !== false
-        || original?.requestsSettled !== true || !processExited(original.supervisor))
-        return false;
-    try {
-        if (!ledger.hasController(authority) || await realpath(dockerPath) !== original.daemon.dockerPath
-            || resolveLocalDockerSocket(configuredDockerSocketPath(socketPath)).path !== original.daemon.socketPath)
-            return false;
-        const before = await captureDaemonWitness(original.daemon);
-        if (!before || !sameDaemonWitness(original.daemon, before) || signal.aborted)
-            return false;
-        const cleanup = await cleanupIsolationResources(before.dockerPath, job.containerName, { socketPath: before.socketPath, signal });
-        if (!cleanup || signal.aborted)
-            return false;
-        const current = await captureDaemonWitness(before);
-        if (!current || !sameDaemonWitness(before, current) || signal.aborted)
-            return false;
-        ledger.settleReconciledUnknown(job.id, job.version, { original, current, checkedAt: Date.now(), cleanup }, authority);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-//# sourceMappingURL=reconcile.js.map

package/lib/reconcile.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"reconcile.js","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAEhE,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC7F,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAGzF,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAuB,EAAE,SAAuC,EACxG,GAAiB,EAAE,UAAkB,EAAE,MAAmB,EAAE,UAAmB;IAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAA;IACpC,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,KAAK;WAC5E,QAAQ,EAAE,eAAe,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5F,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,MAAM,QAAQ,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,MAAM,CAAC,UAAU;eAC5F,wBAAwB,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,UAAU;YAAE,OAAO,KAAK,CAAA;QACvH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC1D,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QAC1F,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,aAAa,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;QAChI,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QAC5C,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAA;QAClD,IAAI,CAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QACnF,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;QACrH,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;AAC1B,CAAC"}

package/lib/runner.d.ts

@@ -1,12 +0,0 @@
-import type { IsolationProcessResult, IsolationRunInput } from './types.js';
-/**
- * Starts a one-shot supervisor. The supervisor owns Docker after creation so a
- * Host crash closes IPC and causes container cleanup instead of an orphaned job.
- */
-export declare function runIsolatedProcess(input: IsolationRunInput): Promise<IsolationProcessResult>;
-/** Removes only names generated by this plugin; arbitrary Docker names are rejected. */
-export declare function removeIsolatedContainer(dockerPath: string, name: string, options?: {
-    socketPath?: string;
-    signal?: AbortSignal;
-}): Promise<boolean>;
-//# sourceMappingURL=runner.d.ts.map

package/lib/runner.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAmB,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AA+D5F;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAwHlG;AAED,wFAAwF;AACxF,wBAAsB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAI7J"}