@exagone313/dsh-podman 0.2.0-rc.2

package/dist/fs-provider.js

@@ -0,0 +1,184 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import { DIFF_BASIS_MAX_BYTES, detectLineEndings, fsError, guestChunks, guestStat, guestStatResponse, guestTextChunks, guestVersion, normalizeLineEndings, readDiffBasis, readGuestText, resolveGuestPath, restoreLineEndings, throwIfAborted, unaryGuest, writeGuestFile, } from "./guest-rpc.js";
+import { isAbsolute, join, resolve as resolvePath } from "node:path";
+export function createFilesystemProvider(resolver) {
+    return {
+        resolve: async (path, opts) => {
+            throwIfAborted(opts?.signal, "resolve");
+            const resolved = resolveGuestPath(path, opts?.cwd);
+            // An explicit container targets that container's guest; the harness's own
+            // tools never pass one and keep the session workspace's default.
+            const container = typeof opts?.container === "string" ? opts.container : "";
+            const binding = container !== "" && container !== "default"
+                ? await resolver.containerBinding(opts?.cwd, container)
+                : await resolver.resolveForPath(resolved, opts?.cwd);
+            return {
+                targetKey: resolved,
+                displayPath: resolved,
+                binding,
+            };
+        },
+        processPath: (target) => target.targetKey,
+        // The guest mounts each workspace at its mirrored path, so a host path in
+        // the execution world names the same path; anything relative has no world.
+        processPathFromHostPath: (hostPath) => isAbsolute(hostPath) ? resolvePath(hostPath) : undefined,
+        fileUrl: (target) => `file://${target.targetKey}`,
+        contains: (parent, child) => child.targetKey === parent.targetKey ||
+            child.targetKey.startsWith(`${parent.targetKey}/`),
+        readText: (target, signal) => readGuestText(target, signal),
+        streamText: (target, signal) => Promise.resolve(guestTextChunks(target, signal)),
+        readBytes: async (target, signal, maxBytes) => {
+            const chunks = [];
+            let total = 0;
+            for await (const buffer of guestChunks(target, { length: maxBytes + 1 }, signal)) {
+                total += buffer.length;
+                if (total > maxBytes) {
+                    throw fsError("FS_TOO_LARGE", `cannot read "${target.displayPath}": content exceeds the ${maxBytes}-byte limit`);
+                }
+                chunks.push(buffer);
+            }
+            return Buffer.concat(chunks, total);
+        },
+        readByteRange: async (target, range, signal) => {
+            if (range.length === 0)
+                return new Uint8Array(0);
+            const chunks = [];
+            let total = 0;
+            for await (const buffer of guestChunks(target, range, signal)) {
+                total += buffer.length;
+                chunks.push(buffer);
+            }
+            return Buffer.concat(chunks, total);
+        },
+        lstat: async (path, opts, signal) => {
+            throwIfAborted(signal, "lstat");
+            const resolved = resolveGuestPath(path, opts?.cwd);
+            const binding = await resolver.resolveForPath(resolved, opts?.cwd);
+            const result = await unaryGuest({ binding }, "stat", { path: resolved, noFollow: true }, signal);
+            if (!result?.exists)
+                return undefined;
+            return {
+                version: guestVersion(result),
+                type: result.isSymlink
+                    ? "symlink"
+                    : result.isDir
+                        ? "directory"
+                        : "file",
+                ...(result.size !== undefined && result.size !== null
+                    ? { size: Number(result.size) }
+                    : {}),
+            };
+        },
+        writeText: async (target, content, expected, signal) => {
+            throwIfAborted(signal, "write");
+            const current = await guestStatResponse(target, signal);
+            if (current.exists && current.isDir) {
+                throw fsError("FS_NOT_REGULAR_FILE", `cannot write "${target.displayPath}": not a regular file`);
+            }
+            const currentVersion = current.exists ? guestVersion(current) : undefined;
+            if (expected?.kind === "replaceIfVersion") {
+                // A file that is gone is a new file: creating it destroys nothing, so
+                // this backend creates it. (The harness's fs-local reports
+                // FS_STALE_VERSION here; a path the session read and something else
+                // removed must stay writable, so the container tools create it.)
+                if (current.exists && currentVersion !== expected.version) {
+                    throw fsError("FS_STALE_VERSION", `cannot write "${target.displayPath}": file changed since it was read`);
+                }
+            }
+            else if (expected?.kind === "createIfAbsent" && current.exists) {
+                throw fsError("FS_NOT_OBSERVED", `cannot overwrite existing "${target.displayPath}" without reading it first`);
+            }
+            // The basis is gated on the incoming content, like the local backend:
+            // either side at/above the limit yields `before: null` and the consumer
+            // falls back to a whole-file diff. Both sides are LF-normalized so a CRLF
+            // overwrite does not read as every line changed.
+            const rawBasis = current.exists &&
+                Buffer.byteLength(content, "utf8") < DIFF_BASIS_MAX_BYTES
+                ? await readDiffBasis(target, signal)
+                : null;
+            const before = rawBasis === null ? null : normalizeLineEndings(rawBasis);
+            await writeGuestFile({ guest: target.binding.guest, token: target.binding.token }, target.targetKey, content, { create: true, truncate: true }, signal);
+            const after = await guestStatResponse(target, signal);
+            return {
+                operation: current.exists ? "update" : "create",
+                version: guestVersion(after),
+                before,
+                after: normalizeLineEndings(content),
+            };
+        },
+        stat: (target, signal) => guestStat(target, signal),
+        listDir: async (target, signal) => {
+            const response = await unaryGuest(target, "readDir", { path: target.targetKey }, signal);
+            const entries = Array.isArray(response?.entries)
+                ? response.entries
+                : [];
+            return entries.map((entry) => {
+                const childKey = join(target.targetKey, entry.name);
+                // Prefer the guest-reported followed type; fall back to the directory
+                // bit for an agent that predates the field.
+                const type = entry.type === "file" ||
+                    entry.type === "directory" ||
+                    entry.type === "other"
+                    ? entry.type
+                    : entry.isDir
+                        ? "directory"
+                        : "file";
+                return {
+                    name: entry.name,
+                    type,
+                    target: {
+                        targetKey: childKey,
+                        displayPath: childKey,
+                        binding: target.binding,
+                    },
+                    ...(type === "file" &&
+                        entry.size !== undefined &&
+                        entry.size !== null
+                        ? { size: Number(entry.size) }
+                        : {}),
+                };
+            });
+        },
+        mkdir: async (target, parents = true) => unaryGuest(target, "mkdir", { path: target.targetKey, parents }),
+        remove: async (target, recursive = false) => unaryGuest(target, "delete", { path: target.targetKey, recursive }),
+        editText: async (target, edit, expected, signal) => {
+            throwIfAborted(signal, "edit");
+            const current = await guestStatResponse(target, signal);
+            if (!current.exists) {
+                throw fsError("FS_STALE_VERSION", `cannot edit "${target.displayPath}": file changed since it was read`);
+            }
+            if (current.isDir) {
+                throw fsError("FS_NOT_REGULAR_FILE", `cannot edit "${target.displayPath}": not a regular file`);
+            }
+            if (expected !== undefined &&
+                guestVersion(current) !== expected.version) {
+                throw fsError("FS_STALE_VERSION", `cannot edit "${target.displayPath}": file changed since it was read`);
+            }
+            const raw = await readGuestText(target, signal);
+            const before = normalizeLineEndings(raw);
+            const lineEndings = detectLineEndings(raw);
+            const oldNorm = normalizeLineEndings(typeof edit.oldString === "string" ? edit.oldString : "");
+            if (oldNorm.length === 0) {
+                throw fsError("FS_EDIT_NOT_FOUND", "old_string must be a non-empty string");
+            }
+            const newNorm = normalizeLineEndings(typeof edit.newString === "string" ? edit.newString : "");
+            const occurrences = before.split(oldNorm).length - 1;
+            if (occurrences === 0) {
+                throw fsError("FS_EDIT_NOT_FOUND", `old_string was not found in "${target.displayPath}"`);
+            }
+            if (!edit.replaceAll && occurrences > 1) {
+                throw fsError("FS_AMBIGUOUS_EDIT", `old_string matched ${occurrences} times in "${target.displayPath}"; provide a more specific old_string or set replace_all to true`);
+            }
+            const after = before.split(oldNorm).join(newNorm);
+            await writeGuestFile({ guest: target.binding.guest, token: target.binding.token }, target.targetKey, restoreLineEndings(after, lineEndings), { create: true, truncate: true }, signal);
+            const afterInfo = await guestStatResponse(target, signal);
+            return {
+                version: guestVersion(afterInfo),
+                before,
+                after,
+            };
+        },
+    };
+}

package/dist/fs-provider.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/fs-provider.test.js

@@ -0,0 +1,260 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import test from "node:test";
+import assert from "node:assert/strict";
+import { editGuest, editProvider, fakeGuest, providerFor, stubResolver } from "./test-support.js";
+import { createFilesystemProvider } from "./index.js";
+test("filesystem provider resolves absolute safe paths", async () => {
+    const provider = createFilesystemProvider(stubResolver);
+    const target = await provider.resolve("/projects/team/app", { cwd: "/x" });
+    assert.equal(target.targetKey, "/projects/team/app");
+    assert.equal(target.displayPath, "/projects/team/app");
+    assert.deepEqual(target.binding, { kind: "binding" });
+});
+test("filesystem provider resolves absolute paths without a cwd", async () => {
+    const seen = [];
+    const provider = createFilesystemProvider({
+        resolve: async () => ({ kind: "binding" }),
+        resolveForPath: async (path, cwd) => {
+            seen.push([path, cwd]);
+            return { kind: "binding" };
+        },
+    });
+    const target = await provider.resolve("/projects/team/app");
+    assert.equal(target.targetKey, "/projects/team/app");
+    assert.deepEqual(target.binding, { kind: "binding" });
+    assert.deepEqual(seen, [["/projects/team/app", undefined]]);
+});
+test("filesystem provider resolves relative paths against the cwd", async () => {
+    const provider = createFilesystemProvider(stubResolver);
+    const target = await provider.resolve("README.md", {
+        cwd: "/projects/team/app",
+    });
+    assert.equal(target.targetKey, "/projects/team/app/README.md");
+    assert.equal(target.displayPath, "/projects/team/app/README.md");
+    assert.deepEqual(target.binding, { kind: "binding" });
+});
+test("filesystem provider rejects unsafe paths", async () => {
+    const provider = createFilesystemProvider(stubResolver);
+    await assert.rejects(() => provider.resolve("/a/../b"));
+    await assert.rejects(() => provider.resolve("/a/b/../../etc"));
+    await assert.rejects(() => provider.resolve("../escape", { cwd: "/projects/team/app" }));
+});
+test("filesystem provider maps targets", () => {
+    const provider = createFilesystemProvider(stubResolver);
+    assert.equal(provider.fileUrl({ targetKey: "/a/b" }), "file:///a/b");
+    assert.equal(provider.processPath({ targetKey: "/a/b" }), "/a/b");
+    const parent = { targetKey: "/a" };
+    assert.equal(provider.contains(parent, { targetKey: "/a" }), true);
+    assert.equal(provider.contains(parent, { targetKey: "/a/b" }), true);
+    assert.equal(provider.contains(parent, { targetKey: "/a2" }), false);
+    assert.equal(provider.contains(parent, { targetKey: "/b" }), false);
+});
+test("filesystem provider lstat maps entry types without following links", async () => {
+    const requests = [];
+    const provider = createFilesystemProvider({
+        resolveForPath: async () => ({
+            guest: {
+                stat: (request, _metadata, callback) => {
+                    requests.push(request);
+                    callback(null, {
+                        exists: true,
+                        isDir: false,
+                        isSymlink: true,
+                        size: "3",
+                        mode: "Lrwxrwxrwx",
+                        modifiedAt: "t",
+                    });
+                },
+            },
+            token: "t",
+        }),
+    });
+    const info = await provider.lstat("/projects/team/link", { cwd: "/projects/team" });
+    assert.equal(info.type, "symlink");
+    assert.equal(info.size, 3);
+    assert.deepEqual(requests, [{ path: "/projects/team/link", noFollow: true }]);
+});
+test("filesystem provider lstat reports an absent entry as undefined", async () => {
+    const provider = createFilesystemProvider({
+        resolveForPath: async () => ({
+            guest: {
+                stat: (_request, _metadata, callback) => callback(null, { exists: false }),
+            },
+            token: "t",
+        }),
+    });
+    assert.equal(await provider.lstat("/projects/team/missing", { cwd: "/x" }), undefined);
+});
+test("filesystem provider streamText decodes UTF-8 and rejects binary", async () => {
+    const text = providerFor(fakeGuest(Buffer.from("héllo")).guest);
+    const textTarget = await text.resolve("/a", { cwd: "/x" });
+    let decoded = "";
+    for await (const chunk of await text.streamText(textTarget))
+        decoded += chunk;
+    assert.equal(decoded, "héllo");
+    const binary = providerFor(fakeGuest(Buffer.from([0x68, 0x00, 0x69])).guest);
+    const binaryTarget = await binary.resolve("/a", { cwd: "/x" });
+    await assert.rejects(async () => {
+        for await (const _chunk of await binary.streamText(binaryTarget)) {
+            // Drain the stream so the binary sample is inspected.
+        }
+    }, (error) => error instanceof Error && error.code === "FS_NOT_TEXT");
+});
+test("filesystem provider readBytes returns content and caps at maxBytes", async () => {
+    const fake = fakeGuest(Buffer.from("hello"));
+    const provider = providerFor(fake.guest);
+    const target = await provider.resolve("/a", { cwd: "/x" });
+    const bytes = await provider.readBytes(target, undefined, 10);
+    assert.equal(Buffer.from(bytes).toString(), "hello");
+    assert.equal(fake.requests[0].length, 11);
+    await assert.rejects(() => provider.readBytes(target, undefined, 3), (error) => error instanceof Error && error.code === "FS_TOO_LARGE");
+});
+test("filesystem provider readByteRange returns the window and empty for zero length", async () => {
+    const fake = fakeGuest(Buffer.from("abcdef"));
+    const provider = providerFor(fake.guest);
+    const target = await provider.resolve("/a", { cwd: "/x" });
+    const empty = await provider.readByteRange(target, { offset: 0, length: 0 });
+    assert.equal(empty.length, 0);
+    assert.equal(fake.requests.length, 0);
+    const window = await provider.readByteRange(target, { offset: 1, length: 3 });
+    assert.equal(Buffer.from(window).toString(), "bcd");
+    assert.deepEqual(fake.requests[0], { path: "/a", offset: 1, length: 3 });
+});
+test("filesystem provider editText reports the harness error codes", async () => {
+    const binary = editProvider(editGuest({}, Buffer.from([0x68, 0x00, 0x69])));
+    const binaryTarget = await binary.resolve("/a", { cwd: "/x" });
+    await assert.rejects(() => binary.editText(binaryTarget, {
+        oldString: "h",
+        newString: "H",
+        replaceAll: false,
+    }), (error) => error.code === "FS_NOT_TEXT");
+    const notFound = editProvider(editGuest({}, Buffer.from("hello")));
+    const notFoundTarget = await notFound.resolve("/a", { cwd: "/x" });
+    await assert.rejects(() => notFound.editText(notFoundTarget, {
+        oldString: "zzz",
+        newString: "x",
+        replaceAll: false,
+    }), (error) => error.code === "FS_EDIT_NOT_FOUND");
+    const ambiguous = editProvider(editGuest({}, Buffer.from("aa")));
+    const ambiguousTarget = await ambiguous.resolve("/a", { cwd: "/x" });
+    await assert.rejects(() => ambiguous.editText(ambiguousTarget, {
+        oldString: "a",
+        newString: "b",
+        replaceAll: false,
+    }), (error) => error.code === "FS_AMBIGUOUS_EDIT");
+    const stale = editProvider(editGuest({}, Buffer.from("hello")));
+    const staleTarget = await stale.resolve("/a", { cwd: "/x" });
+    await assert.rejects(() => stale.editText(staleTarget, { oldString: "h", newString: "H", replaceAll: false }, { version: "other" }), (error) => error.code === "FS_STALE_VERSION");
+});
+test("filesystem provider writeText reports the harness error codes", async () => {
+    const existing = editProvider(editGuest({}, Buffer.from("hello")));
+    const target = await existing.resolve("/a", { cwd: "/x" });
+    await assert.rejects(() => existing.writeText(target, "x", { kind: "createIfAbsent" }), (error) => error.code === "FS_NOT_OBSERVED");
+    await assert.rejects(() => existing.writeText(target, "x", { kind: "replaceIfVersion", version: "other" }), (error) => error.code === "FS_STALE_VERSION");
+    const dir = editProvider(editGuest({ isDir: true }));
+    const dirTarget = await dir.resolve("/a", { cwd: "/x" });
+    await assert.rejects(() => dir.writeText(dirTarget, "x"), (error) => error.code === "FS_NOT_REGULAR_FILE");
+});
+test("filesystem provider writeText creates a file that was removed", async () => {
+    // A read-then-removed path is a new file: creating it destroys nothing, so
+    // the write must succeed instead of reporting a stale version.
+    const gone = editProvider(editGuest({ exists: false }));
+    const target = await gone.resolve("/a", { cwd: "/x" });
+    const outcome = await gone.writeText(target, "fresh", {
+        kind: "replaceIfVersion",
+        version: "agent:1:5:-rw-r--r--",
+    });
+    assert.equal(outcome.operation, "create");
+    assert.equal(outcome.before, null);
+    assert.equal(outcome.after, "fresh");
+});
+test("filesystem provider rejects a pre-aborted signal with FS_ABORTED", async () => {
+    const provider = editProvider(editGuest({}, Buffer.from("hello")));
+    const target = await provider.resolve("/a", { cwd: "/x" });
+    const controller = new AbortController();
+    controller.abort();
+    await assert.rejects(() => provider.readText(target, controller.signal), (error) => error.code === "FS_ABORTED");
+});
+test("filesystem provider editText normalizes line endings for matching", async () => {
+    const binding = editGuest({}, Buffer.from("a\r\nb\r\n"));
+    const provider = editProvider(binding);
+    const target = await provider.resolve("/a", { cwd: "/x" });
+    const outcome = await provider.editText(target, {
+        oldString: "b",
+        newString: "B",
+        replaceAll: false,
+    });
+    // The diff basis is LF-normalized, and the file keeps its CRLF style.
+    assert.equal(outcome.before, "a\nb\n");
+    assert.equal(outcome.after, "a\nB\n");
+    assert.equal(Buffer.concat(binding.writes).toString(), "a\r\nB\r\n");
+});
+test("filesystem provider maps absolute host paths into the execution world", () => {
+    const provider = createFilesystemProvider({});
+    assert.equal(provider.processPathFromHostPath("/home/u/project/f"), "/home/u/project/f");
+    assert.equal(provider.processPathFromHostPath("rel/f"), undefined);
+});
+test("filesystem provider listDir returns resolved child targets", async () => {
+    const requests = [];
+    const provider = createFilesystemProvider({
+        resolveForPath: async () => ({
+            guest: {
+                readDir: (request, _metadata, callback) => {
+                    requests.push(request);
+                    callback(null, {
+                        entries: [
+                            { name: "src", isDir: true, size: "0", type: "directory" },
+                            { name: "a.txt", isDir: false, size: "3", type: "file" },
+                            { name: "link", isDir: false, size: "1", type: "other" },
+                        ],
+                    });
+                },
+            },
+            token: "t",
+        }),
+    });
+    const target = await provider.resolve("/projects/team", { cwd: "/projects/team" });
+    const entries = await provider.listDir(target);
+    assert.deepEqual(requests, [{ path: "/projects/team" }]);
+    assert.deepEqual(entries.map((entry) => ({
+        name: entry.name,
+        type: entry.type,
+        path: entry.target.displayPath,
+        binding: entry.target.binding.token,
+    })), [
+        { name: "src", type: "directory", path: "/projects/team/src", binding: "t" },
+        { name: "a.txt", type: "file", path: "/projects/team/a.txt", binding: "t" },
+        { name: "link", type: "other", path: "/projects/team/link", binding: "t" },
+    ]);
+    assert.equal(entries[1].size, 3);
+    assert.equal(entries[0].size, undefined);
+});
+test("filesystem provider listDir falls back to the directory bit", async () => {
+    const provider = createFilesystemProvider({
+        resolveForPath: async () => ({
+            guest: {
+                readDir: (_request, _metadata, callback) => callback(null, {
+                    entries: [
+                        { name: "d", isDir: true, size: "0" },
+                        { name: "f", isDir: false, size: "1" },
+                    ],
+                }),
+            },
+            token: "t",
+        }),
+    });
+    const target = await provider.resolve("/w", { cwd: "/w" });
+    const entries = await provider.listDir(target);
+    assert.deepEqual(entries.map((entry) => entry.type), ["directory", "file"]);
+});
+test("filesystem provider writeText normalizes the diff basis", async () => {
+    const binding = editGuest({}, Buffer.from("a\r\nb\r\n"));
+    const provider = editProvider(binding);
+    const target = await provider.resolve("/a", { cwd: "/x" });
+    const outcome = await provider.writeText(target, "c\r\nd\r\n");
+    assert.equal(outcome.before, "a\nb\n");
+    assert.equal(outcome.after, "c\nd\n");
+    assert.equal(Buffer.concat(binding.writes).toString(), "c\r\nd\r\n");
+});

package/dist/generated/version.d.ts

@@ -0,0 +1,2 @@
+export declare const VERSION = "0.2.0-rc.2";
+export declare const GIT_COMMIT = "124ee2a";

package/dist/generated/version.js

@@ -0,0 +1,6 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+// Generated by scripts/generate-version.mjs; do not edit.
+export const VERSION = "0.2.0-rc.2";
+export const GIT_COMMIT = "124ee2a";

package/dist/grpc/proto/dshctl/v1/control.proto

@@ -0,0 +1,133 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+
+syntax = "proto3";
+package dshctl.v1;
+option go_package = "github.com/Exagone313/dsh-podman/internal/genproto/dshctl/v1;dshctlv1";
+
+service OrchestratorControl {
+  rpc ListProjects(ListProjectsRequest) returns (ListProjectsResponse);
+  rpc CreateWorkspace(CreateWorkspaceRequest) returns (Workspace);
+  rpc DescribeWorkspace(DescribeWorkspaceRequest) returns (Workspace);
+  rpc ListWorkspaces(ListWorkspacesRequest) returns (ListWorkspacesResponse);
+  rpc RemoveWorkspace(RemoveWorkspaceRequest) returns (RemoveWorkspaceResponse);
+  rpc ListImages(ListImagesRequest) returns (ListImagesResponse);
+  rpc GetImage(GetImageRequest) returns (Image);
+  rpc BuildImage(BuildImageRequest) returns (Image);
+  rpc RebuildImage(RebuildImageRequest) returns (Image);
+  rpc RebuildAllImages(RebuildAllImagesRequest) returns (RebuildAllImagesResponse);
+  rpc RemoveImage(RemoveImageRequest) returns (RemoveImageResponse);
+  rpc RebuildBaseImage(RebuildBaseImageRequest) returns (Image);
+  rpc PullBaseImage(PullBaseImageRequest) returns (Image);
+  rpc ListCaches(ListCachesRequest) returns (ListCachesResponse);
+  rpc CleanCaches(CleanCachesRequest) returns (CleanCachesResponse);
+  rpc ListContainers(ListContainersRequest) returns (ListContainersResponse);
+  rpc StartContainer(StartContainerRequest) returns (Container);
+  rpc RecreateContainer(RecreateContainerRequest) returns (Container);
+  rpc RemoveContainer(RemoveContainerRequest) returns (RemoveContainerResponse);
+  rpc AddContainerMount(AddContainerMountRequest) returns (Container);
+  rpc RemoveContainerMount(RemoveContainerMountRequest) returns (Container);
+  rpc UpdateContainerMount(UpdateContainerMountRequest) returns (Container);
+  rpc SetContainerPaths(SetContainerPathsRequest) returns (Container);
+  rpc ListVolumes(ListVolumesRequest) returns (ListVolumesResponse);
+  rpc CreateVolume(CreateVolumeRequest) returns (Volume);
+  rpc RemoveVolume(RemoveVolumeRequest) returns (RemoveVolumeResponse);
+  rpc ListSecrets(ListSecretsRequest) returns (ListSecretsResponse);
+  rpc CreateSecret(CreateSecretRequest) returns (Secret);
+  rpc WriteSecretValue(WriteSecretValueRequest) returns (Secret);
+  rpc RemoveSecret(RemoveSecretRequest) returns (RemoveSecretResponse);
+  rpc AddContainerSecret(AddContainerSecretRequest) returns (Container);
+  rpc RemoveContainerSecret(RemoveContainerSecretRequest) returns (Container);
+}
+
+message ListProjectsRequest {}
+message ListProjectsResponse { repeated Project projects = 1; }
+message Project { string name = 1; string host_path = 2; }
+enum MountMode { MOUNT_MODE_UNSPECIFIED = 0; MOUNT_MODE_READ_ONLY = 1; MOUNT_MODE_READ_WRITE = 2; }
+enum MountKind { MOUNT_KIND_UNSPECIFIED = 0; MOUNT_KIND_PROJECT = 1; MOUNT_KIND_TMPFS = 2; MOUNT_KIND_VOLUME = 3; MOUNT_KIND_SECRET = 4; }
+message ProjectMount {
+  string project_name = 1;
+  MountMode mode = 2;
+  reserved 3;
+  string destination = 4;
+  MountKind kind = 5;
+  string volume = 6;
+  string secret = 7;
+}
+message CreateWorkspaceRequest { string workspace_slug = 1; string image_id = 2; repeated ProjectMount mounts = 3; map<string, string> env = 4; map<string, string> secret_env = 5; string project_name = 6; repeated string paths = 7; }
+message DescribeWorkspaceRequest { string workspace_slug = 1; }
+message RemoveWorkspaceRequest { string workspace_slug = 1; }
+message RemoveWorkspaceResponse {}
+message ListWorkspacesRequest {}
+message ListWorkspacesResponse { repeated Workspace workspaces = 1; }
+message Workspace {
+  string workspace_slug = 1;
+  string container_name = 2;
+  string image_id = 3;
+  repeated ProjectMount mounts = 4;
+  string status = 5;
+  string agent_socket_path = 6;
+  string agent_token = 7;
+  string created_at = 8;
+  map<string, string> env = 9;
+  map<string, string> secret_env = 10;
+  string project_name = 11;
+}
+message ListImagesRequest {}
+message ListImagesResponse { repeated Image images = 1; }
+message Image { string image_id = 1; string parent = 2; repeated string packages = 3; string image_tag = 4; string built_at = 5; bool is_base = 6; string status = 7; string primitive = 8; string package_manager = 9; bool base_public = 10; }
+message RebuildImageRequest { string image_id = 1; }
+message RebuildAllImagesRequest {}
+message RebuildAllImagesResponse { repeated string rebuilt = 1; repeated string skipped = 2; }
+message RemoveImageRequest { string image_id = 1; }
+message RemoveImageResponse {}
+message RebuildBaseImageRequest { string name = 1; }
+message PullBaseImageRequest { string name = 1; }
+message GetImageRequest { string image_id = 1; }
+message BuildImageRequest { string image_id = 1; string parent = 2; repeated string packages = 3; }
+message ListCachesRequest {}
+message ListCachesResponse { repeated Cache caches = 1; }
+message Cache { string manager = 1; string path = 2; int32 files = 3; int64 bytes = 4; }
+enum CacheCleanMode { CACHE_CLEAN_MODE_UNSPECIFIED = 0; CACHE_CLEAN_MODE_KEEP_LATEST = 1; CACHE_CLEAN_MODE_ALL = 2; }
+message CleanCachesRequest { CacheCleanMode mode = 1; }
+message CleanCachesResponse { CacheCleanMode mode = 1; int32 removed_files = 2; int64 removed_bytes = 3; repeated Cache caches = 4; }
+message ListContainersRequest {}
+message ListContainersResponse { repeated Container containers = 1; }
+message Container {
+  string container_name = 1;
+  string workspace_slug = 2;
+  string image_id = 3;
+  string status = 4;
+  string created_at = 5;
+  repeated ProjectMount mounts = 6;
+  string podman_name = 7;
+  string agent_socket_path = 8;
+  string agent_token = 9;
+  map<string, string> env = 10;
+  map<string, string> secret_env = 11;
+  repeated string paths = 12;
+}
+message StartContainerRequest { string workspace_slug = 1; string container = 2; string image_id = 3; repeated ProjectMount mounts = 4; map<string, string> env = 5; map<string, string> secret_env = 6; repeated string paths = 7; }
+message RecreateContainerRequest { string workspace_slug = 1; string image_id = 2; string container = 3; repeated ProjectMount mounts = 4; map<string, string> env = 5; repeated string paths = 6; }
+message RemoveContainerRequest { string workspace_slug = 1; string container = 2; }
+message RemoveContainerResponse {}
+message AddContainerMountRequest { string workspace_slug = 1; string container = 2; string project = 3; reserved 4; string destination = 5; MountMode mode = 6; MountKind kind = 7; string volume = 8; string secret = 9; }
+message RemoveContainerMountRequest { string workspace_slug = 1; string container = 2; string project = 3; reserved 4; MountKind kind = 5; string volume = 6; string destination = 7; string secret = 8; }
+message UpdateContainerMountRequest { string workspace_slug = 1; string container = 2; string project = 3; reserved 4; MountKind kind = 5; string volume = 6; string destination = 7; string secret = 8; MountMode mode = 9; }
+message SetContainerPathsRequest { string workspace_slug = 1; string container = 2; repeated string paths = 3; }
+message ListVolumesRequest {}
+message ListVolumesResponse { repeated Volume volumes = 1; }
+message Volume { string name = 1; }
+message CreateVolumeRequest { string name = 1; }
+message RemoveVolumeRequest { string name = 1; }
+message RemoveVolumeResponse {}
+message ListSecretsRequest {}
+message ListSecretsResponse { repeated Secret secrets = 1; }
+message Secret { string name = 1; }
+message CreateSecretRequest { string name = 1; int32 length = 2; string charset = 3; }
+message WriteSecretValueRequest { string name = 1; string value = 2; }
+message RemoveSecretRequest { string name = 1; }
+message RemoveSecretResponse {}
+message AddContainerSecretRequest { string workspace_slug = 1; string container = 2; string env = 3; string secret = 4; }
+message RemoveContainerSecretRequest { string workspace_slug = 1; string container = 2; string env = 3; }