@gatebolt/agent-redroom 0.1.0

package/dist/agents/claude-code.d.ts

@@ -0,0 +1,39 @@
+import { type Agent, type AgentWiring } from "./agent.js";
+export declare const ANTHROPIC_URL = "https://api.anthropic.com";
+export declare const PLACEHOLDER_API_KEY = "redroom-placeholder-key";
+export declare const MANAGED_SETTINGS = "/etc/claude-code/managed-settings.json";
+export type ClaudeCodeOptions = {
+    version: string;
+    model: string;
+    maxTurns?: number;
+    maxBudgetUsd?: number;
+    env?: NodeJS.ProcessEnv;
+};
+export declare function managedSettings(wiring: AgentWiring): {
+    allowManagedHooksOnly: boolean;
+    disableAllHooks: boolean;
+    allowedHttpHookUrls: string[];
+    skipWebFetchPreflight: boolean;
+    permissions: {
+        defaultMode: string;
+    };
+    env: {
+        ANTHROPIC_BASE_URL: string;
+        ANTHROPIC_API_KEY: string;
+        CLAUDE_CODE_USE_BEDROCK: string;
+        CLAUDE_CODE_USE_VERTEX: string;
+        CLAUDE_CODE_USE_FOUNDRY: string;
+    };
+    hooks: {
+        PreToolUse: {
+            matcher: string;
+            hooks: {
+                type: string;
+                url: string;
+                onFailure: string;
+                timeout: number;
+            }[];
+        }[];
+    };
+};
+export declare function claudeCode(options: ClaudeCodeOptions): Agent;

package/dist/agents/claude-code.js

@@ -0,0 +1,91 @@
+import { WORKSPACE } from "../docker/plan.js";
+import { packagePath } from "../paths.js";
+import {} from "./agent.js";
+import { parseClaudeStream } from "./claude-stream.js";
+export const ANTHROPIC_URL = "https://api.anthropic.com";
+export const PLACEHOLDER_API_KEY = "redroom-placeholder-key";
+export const MANAGED_SETTINGS = "/etc/claude-code/managed-settings.json";
+const HOOK_TIMEOUT_S = 30;
+// Claude Code names the session folder after the cwd, non-alphanumerics replaced by "-".
+const SESSION_DIR = `/home/node/.claude/projects/${WORKSPACE.replace(/[^a-zA-Z0-9]/g, "-")}`;
+export function managedSettings(wiring) {
+    return {
+        allowManagedHooksOnly: true,
+        disableAllHooks: false,
+        allowedHttpHookUrls: [wiring.toolHookUrl],
+        skipWebFetchPreflight: true,
+        permissions: { defaultMode: "bypassPermissions" },
+        env: {
+            ANTHROPIC_BASE_URL: wiring.modelBaseUrl,
+            ANTHROPIC_API_KEY: PLACEHOLDER_API_KEY,
+            CLAUDE_CODE_USE_BEDROCK: "0",
+            CLAUDE_CODE_USE_VERTEX: "0",
+            CLAUDE_CODE_USE_FOUNDRY: "0",
+        },
+        hooks: {
+            PreToolUse: [
+                {
+                    matcher: "*",
+                    hooks: [
+                        {
+                            type: "http",
+                            url: wiring.toolHookUrl,
+                            onFailure: "block",
+                            timeout: HOOK_TIMEOUT_S,
+                        },
+                    ],
+                },
+            ],
+        },
+    };
+}
+export function claudeCode(options) {
+    const maxTurns = options.maxTurns ?? 30;
+    const maxBudgetUsd = options.maxBudgetUsd ?? 1;
+    const env = options.env ?? process.env;
+    return {
+        name: "claude-code",
+        version: options.version,
+        model: options.model,
+        image: {
+            tag: `agent-redroom-claude-code:${options.version}`,
+            context: packagePath("images", "agent"),
+            buildArgs: { CLAUDE_CODE_VERSION: options.version },
+        },
+        user: "node",
+        uid: 1000,
+        defaultModelProxy() {
+            const key = env.ANTHROPIC_API_KEY;
+            return key
+                ? { baseUrl: ANTHROPIC_URL, headers: { "x-api-key": key } }
+                : null;
+        },
+        env: (wiring) => ({
+            ANTHROPIC_BASE_URL: wiring.modelBaseUrl,
+            ANTHROPIC_API_KEY: PLACEHOLDER_API_KEY,
+            CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
+        }),
+        rootFiles: (wiring) => [
+            {
+                path: MANAGED_SETTINGS,
+                body: JSON.stringify(managedSettings(wiring), null, 2),
+            },
+        ],
+        versionCommand: () => ["claude", "--version"],
+        turnCommand: ({ runId, message, firstTurn }) => [
+            ...["claude", "-p", "--output-format", "stream-json", "--verbose"],
+            ...["--model", options.model],
+            ...["--max-turns", String(maxTurns)],
+            ...["--max-budget-usd", String(maxBudgetUsd)],
+            ...[firstTurn ? "--session-id" : "--resume", runId],
+            ...["--", message],
+        ],
+        killCommand: () => ["pkill", "-f", "claude"],
+        parseTurn: parseClaudeStream,
+        transcriptCommand: (runId) => [
+            "cat",
+            "--",
+            `${SESSION_DIR}/${runId}.jsonl`,
+        ],
+    };
+}

package/dist/agents/claude-stream.d.ts

@@ -0,0 +1,2 @@
+import { type ParsedTurn } from "./agent.js";
+export declare function parseClaudeStream(stdout: string): ParsedTurn;

package/dist/agents/claude-stream.js

@@ -0,0 +1,64 @@
+import { isRecord } from "../types.js";
+import {} from "./agent.js";
+const LIMITS = {
+    error_max_turns: "max_turns",
+    error_max_budget_usd: "max_budget",
+};
+function parseLine(line) {
+    if (line.trim() === "")
+        return null;
+    try {
+        const value = JSON.parse(line);
+        return isRecord(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function assistantText(event) {
+    if (event.type !== "assistant" || !isRecord(event.message))
+        return null;
+    const { content } = event.message;
+    if (!Array.isArray(content))
+        return null;
+    const text = content
+        .filter(isRecord)
+        .map((block) => block.type === "text" && typeof block.text === "string" ? block.text : "")
+        .join("");
+    return text === "" ? null : text;
+}
+const numberOr = (value, fallback) => typeof value === "number" ? value : fallback;
+export function parseClaudeStream(stdout) {
+    const events = stdout
+        .split("\n")
+        .map(parseLine)
+        .filter((event) => event !== null);
+    const latest = [...events].reverse();
+    const result = latest.find((event) => event.type === "result");
+    const lastText = latest.map(assistantText).find((text) => text !== null) ?? "";
+    if (!result) {
+        return {
+            complete: false,
+            events,
+            finalText: lastText,
+            costUsd: 0,
+            usage: null,
+            durationMs: 0,
+            stopReason: null,
+            limitHit: null,
+            isError: true,
+        };
+    }
+    const subtype = typeof result.subtype === "string" ? result.subtype : "";
+    return {
+        complete: true,
+        events,
+        finalText: typeof result.result === "string" ? result.result : lastText,
+        costUsd: numberOr(result.total_cost_usd, 0),
+        usage: result.usage ?? null,
+        durationMs: numberOr(result.duration_ms, 0),
+        stopReason: typeof result.stop_reason === "string" ? result.stop_reason : null,
+        limitHit: LIMITS[subtype] ?? null,
+        isError: result.is_error === true || subtype !== "success",
+    };
+}

package/dist/deadline.d.ts

@@ -0,0 +1 @@
+export declare function withDeadline<T>(ms: number, timeout: () => Error, work: (signal: AbortSignal) => Promise<T>): Promise<T>;

package/dist/deadline.js

@@ -0,0 +1,17 @@
+export async function withDeadline(ms, timeout, work) {
+    const controller = new AbortController();
+    let timer;
+    const expired = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            const error = timeout();
+            controller.abort(error);
+            reject(error);
+        }, ms);
+    });
+    try {
+        return await Promise.race([work(controller.signal), expired]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/docker/cli.d.ts

@@ -0,0 +1,28 @@
+export type DockerResult = {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    timedOut: boolean;
+    outputTooLarge?: boolean;
+};
+export type DockerOptions = {
+    env?: Record<string, string>;
+    input?: Buffer;
+    timeoutMs?: number;
+};
+export type Docker = (args: string[], options?: DockerOptions) => Promise<DockerResult>;
+export declare const MAX_OUTPUT_MB = 64;
+export declare const MAX_OUTPUT_BYTES: number;
+export declare const DOCKER_TIMEOUT_MS: number;
+export declare const BUILD_TIMEOUT_MS: number;
+export declare function dockerCli(bin?: string): Docker;
+export declare function withDefaultTimeouts(docker: Docker): Docker;
+export type TarEntry = {
+    path: string;
+    body: string | Buffer;
+    mode?: number;
+    owner?: number;
+};
+export declare function tarOf(entries: readonly TarEntry[], options?: {
+    dirs: boolean;
+}): Buffer;

package/dist/docker/cli.js

@@ -0,0 +1,102 @@
+import { execFile } from "node:child_process";
+import { posix } from "node:path";
+import { withDeadline } from "../deadline.js";
+import { RedroomError } from "../types.js";
+export const MAX_OUTPUT_MB = 64;
+export const MAX_OUTPUT_BYTES = MAX_OUTPUT_MB * 1024 * 1024;
+export const DOCKER_TIMEOUT_MS = 2 * 60 * 1000;
+export const BUILD_TIMEOUT_MS = 30 * 60 * 1000;
+export function dockerCli(bin = "docker") {
+    return (args, options = {}) => new Promise((resolve, reject) => {
+        const child = execFile(bin, args, {
+            env: { ...process.env, ...options.env },
+            maxBuffer: MAX_OUTPUT_BYTES,
+            timeout: options.timeoutMs ?? 0,
+            killSignal: "SIGKILL",
+            encoding: "utf8",
+        }, (error, stdout, stderr) => {
+            if (error?.code === "ENOENT") {
+                reject(new RedroomError("docker_unavailable", `${bin} not found on PATH`, "docker", { command: bin }));
+                return;
+            }
+            resolve({
+                exitCode: typeof error?.code === "number" ? error.code : error ? 1 : 0,
+                stdout,
+                stderr,
+                timedOut: error?.killed === true,
+                outputTooLarge: error?.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER",
+            });
+        });
+        child.stdin?.on("error", () => undefined);
+        child.stdin?.end(options.input);
+    });
+}
+export function withDefaultTimeouts(docker) {
+    return async (args, options = {}) => {
+        if (options.timeoutMs !== undefined)
+            return docker(args, options);
+        const timeoutMs = args[0] === "build" ? BUILD_TIMEOUT_MS : DOCKER_TIMEOUT_MS;
+        const timeoutError = () => new RedroomError("docker_timeout", `docker ${args[0]} ran past ${timeoutMs} ms`, "docker", {
+            command: `docker ${args.slice(0, 2).join(" ")}`,
+            durationMs: timeoutMs,
+        });
+        const result = await withDeadline(timeoutMs, timeoutError, () => docker(args, { ...options, timeoutMs }));
+        if (result.timedOut)
+            throw timeoutError();
+        return result;
+    };
+}
+const BLOCK = 512;
+function octal(value, width) {
+    return `${value.toString(8).padStart(width - 1, "0")}\0`;
+}
+function header(path, size, mode, owner, type) {
+    const block = Buffer.alloc(BLOCK);
+    const slash = path.length > 100 ? path.lastIndexOf("/", 155) : -1;
+    const [prefix, name] = slash > 0 ? [path.slice(0, slash), path.slice(slash + 1)] : ["", path];
+    if (Buffer.byteLength(name) > 100 || Buffer.byteLength(prefix) > 155) {
+        throw new Error(`tar path too long: ${path}`);
+    }
+    block.write(name, 0);
+    block.write(octal(mode, 8), 100);
+    block.write(octal(owner, 8), 108);
+    block.write(octal(owner, 8), 116);
+    block.write(octal(size, 12), 124);
+    block.write(octal(0, 12), 136);
+    block.write("        ", 148);
+    block.write(type, 156);
+    block.write("ustar\0", 257);
+    block.write("00", 263);
+    block.write(prefix, 345);
+    const sum = block.reduce((total, byte) => total + byte, 0);
+    block.write(`${sum.toString(8).padStart(6, "0")}\0 `, 148);
+    return block;
+}
+function safePath(path) {
+    const normal = posix.normalize(path);
+    if (posix.isAbsolute(normal) || normal === ".." || normal.startsWith("../")) {
+        throw new Error(`tar path leaves the archive: ${path}`);
+    }
+    return normal;
+}
+export function tarOf(entries, options = { dirs: true }) {
+    const parts = [];
+    const dirs = new Set();
+    for (const entry of entries) {
+        const path = safePath(entry.path);
+        const owner = entry.owner ?? 0;
+        const segments = options.dirs ? path.split("/").slice(0, -1) : [];
+        for (let index = 1; index <= segments.length; index += 1) {
+            const dir = `${segments.slice(0, index).join("/")}/`;
+            if (dirs.has(dir))
+                continue;
+            dirs.add(dir);
+            parts.push(header(dir, 0, 0o755, owner, "5"));
+        }
+        const body = Buffer.from(entry.body);
+        parts.push(header(path, body.length, entry.mode ?? 0o644, owner, "0"));
+        parts.push(body, Buffer.alloc((BLOCK - (body.length % BLOCK)) % BLOCK));
+    }
+    parts.push(Buffer.alloc(BLOCK * 2));
+    return Buffer.concat(parts);
+}

package/dist/docker/plan.d.ts

@@ -0,0 +1,42 @@
+import { type Limits } from "../types.js";
+export declare const LABEL = "agent-redroom=1";
+export declare const SESSION_LABEL = "agent-redroom.session";
+export declare const ROLE_LABEL = "agent-redroom.role";
+export declare const RUN_LABEL = "agent-redroom.run";
+export declare const SIDECAR_IMAGE = "agent-redroom-sidecar:local";
+export declare const WORKSPACE = "/workspace";
+export declare const CA_DIR = "/etc/redroom";
+export declare const CA_FILE = "ca.pem";
+export declare const SYSTEM_CA_DIR = "/usr/local/share/ca-certificates";
+export declare const SYSTEM_CA_FILE = "agent-redroom-ca.crt";
+export declare const SIDECAR_HOST = 2;
+export declare const AGENT_HOST = 10;
+export declare const DEFAULT_LIMITS: Limits;
+export declare const SIDECAR_LIMITS: {
+    memory: string;
+    heapMb: number;
+    pids: number;
+};
+export declare const setEnv: (vars: Record<string, string>) => string[];
+export declare const passEnv: (vars: Record<string, string>) => string[];
+export declare function sessionPlan(session: string): {
+    session: string;
+    labels: string[];
+    egress: string;
+    sidecar: string;
+    agent: (runId: string) => string;
+    internal: (runId: string) => string;
+};
+export type SessionPlan = ReturnType<typeof sessionPlan>;
+export declare function sidecarArgs(plan: SessionPlan, env: Record<string, string>, publish: boolean): string[];
+export declare function agentArgs(plan: SessionPlan, input: {
+    name: string;
+    runId: string;
+    ip: string;
+    sidecarIp: string;
+    image: string;
+    limits: Limits;
+    env: Record<string, string>;
+}): string[];
+export declare const GIT_INIT = "git init -q && git add -A && git -c user.name=redroom -c user.email=redroom@localhost commit -q --allow-empty -m workspace";
+export declare const gitDiff: (baseline: string) => string;

package/dist/docker/plan.js

@@ -0,0 +1,80 @@
+import { PORTS } from "../sidecar/config.js";
+import {} from "../types.js";
+export const LABEL = "agent-redroom=1";
+export const SESSION_LABEL = "agent-redroom.session";
+export const ROLE_LABEL = "agent-redroom.role";
+export const RUN_LABEL = "agent-redroom.run";
+export const SIDECAR_IMAGE = "agent-redroom-sidecar:local";
+export const WORKSPACE = "/workspace";
+export const CA_DIR = "/etc/redroom";
+export const CA_FILE = "ca.pem";
+export const SYSTEM_CA_DIR = "/usr/local/share/ca-certificates";
+export const SYSTEM_CA_FILE = "agent-redroom-ca.crt";
+const SYSTEM_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
+export const SIDECAR_HOST = 2;
+export const AGENT_HOST = 10;
+export const DEFAULT_LIMITS = {
+    cpus: 2,
+    memory: "2g",
+    pids: 1024,
+    turnTimeoutMs: 10 * 60 * 1000,
+};
+// MAX_PARALLEL (245) runs x 3 logs x MAX_LOG_BYTES is about 2.9 GiB; heap leaves
+// room for overhead, the rest holds off-heap request buffers.
+export const SIDECAR_LIMITS = { memory: "8g", heapMb: 6144, pids: 256 };
+export const setEnv = (vars) => Object.entries(vars).flatMap(([name, value]) => ["-e", `${name}=${value}`]);
+export const passEnv = (vars) => Object.keys(vars).flatMap((name) => ["-e", name]);
+export function sessionPlan(session) {
+    const prefix = `redroom-${session}`;
+    return {
+        session,
+        labels: ["--label", LABEL, "--label", `${SESSION_LABEL}=${session}`],
+        egress: `${prefix}-egress`,
+        sidecar: `${prefix}-sidecar`,
+        agent: (runId) => `${prefix}-${runId}`,
+        internal: (runId) => `${prefix}-${runId}-internal`,
+    };
+}
+export function sidecarArgs(plan, env, publish) {
+    return [
+        ...["create", "--name", plan.sidecar, "--network", plan.egress],
+        ...plan.labels,
+        ...["--label", `${ROLE_LABEL}=sidecar`],
+        ...["--add-host", "host.docker.internal:host-gateway"],
+        ...["--memory", SIDECAR_LIMITS.memory],
+        ...["--pids-limit", String(SIDECAR_LIMITS.pids)],
+        ...(publish ? ["-p", `127.0.0.1::${PORTS.control}`] : []),
+        ...passEnv(env),
+        ...setEnv({
+            NODE_OPTIONS: `--max-old-space-size=${SIDECAR_LIMITS.heapMb}`,
+        }),
+        SIDECAR_IMAGE,
+    ];
+}
+export function agentArgs(plan, input) {
+    return [
+        ...["create", "--name", input.name, ...plan.labels],
+        ...[
+            "--label",
+            `${ROLE_LABEL}=agent`,
+            "--label",
+            `${RUN_LABEL}=${input.runId}`,
+        ],
+        ...["--network", plan.internal(input.runId), "--ip", input.ip],
+        ...["--dns", input.sidecarIp],
+        ...["--init", "--memory", input.limits.memory],
+        ...["--cpus", String(input.limits.cpus)],
+        ...["--pids-limit", String(input.limits.pids)],
+        ...["--cap-drop", "ALL", "--security-opt", "no-new-privileges"],
+        ...setEnv(input.env),
+        ...setEnv({
+            NODE_EXTRA_CA_CERTS: `${CA_DIR}/${CA_FILE}`,
+            SSL_CERT_FILE: SYSTEM_CA_BUNDLE,
+            CURL_CA_BUNDLE: SYSTEM_CA_BUNDLE,
+            REQUESTS_CA_BUNDLE: SYSTEM_CA_BUNDLE,
+        }),
+        input.image,
+    ];
+}
+export const GIT_INIT = "git init -q && git add -A && git -c user.name=redroom -c user.email=redroom@localhost commit -q --allow-empty -m workspace";
+export const gitDiff = (baseline) => `git add -A && git diff --cached --binary ${baseline}`;

package/dist/docker/session.d.ts

@@ -0,0 +1,14 @@
+import { type Docker } from "./cli.js";
+import { type SessionPlan } from "./plan.js";
+export declare const LEASE_MS = 90000;
+export declare const LEASE_RENEW_MS = 30000;
+export declare function dockerTime(text: string): number | null;
+export type Leftovers = {
+    containers: string[];
+    networks: string[];
+};
+export declare function findLeftovers(docker: Docker, now: number): Promise<Leftovers>;
+export declare function removeLeftovers(docker: Docker, now?: number): Promise<Leftovers>;
+export declare function createInternalNetwork(docker: Docker, labels: string[], name: string, pickSubnet: () => string, redact: (text: string) => string): Promise<string>;
+export declare function tearDownSession(docker: Docker, plan: Pick<SessionPlan, "session">): Promise<string[]>;
+export declare function networkIp(inspected: string, network: string): string | null;

package/dist/docker/session.js

@@ -0,0 +1,118 @@
+import { messageOf, RedroomError } from "../types.js";
+import {} from "./cli.js";
+import { LABEL, ROLE_LABEL, SESSION_LABEL } from "./plan.js";
+export const LEASE_MS = 90_000;
+export const LEASE_RENEW_MS = 30_000;
+const GRACE_MS = 2 * LEASE_MS;
+const SUBNET_ATTEMPTS = 8;
+const NO_HOST_GATEWAY = "com.docker.network.bridge.gateway_mode_ipv4=isolated";
+const rows = (text) => text
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line !== "")
+    .map((line) => line.split("\t"));
+const DOCKER_TIME = /^(\d{4}-\d{2}-\d{2}) (\d{2}:\d{2}:\d{2})(\.\d+)? ([+-]\d{2})(\d{2})/;
+export function dockerTime(text) {
+    const match = DOCKER_TIME.exec(text);
+    if (!match)
+        return null;
+    const [, day, time, fraction = "", hours, minutes] = match;
+    return Date.parse(`${day}T${time}${fraction.slice(0, 4)}${hours}:${minutes}`);
+}
+export async function findLeftovers(docker, now) {
+    const filter = ["--filter", `label=${LABEL}`];
+    const ps = await docker([
+        ...["ps", "-a", ...filter, "--format"],
+        `{{.ID}}\t{{.Label "${SESSION_LABEL}"}}\t{{.Label "${ROLE_LABEL}"}}\t{{.State}}\t{{.CreatedAt}}`,
+    ]);
+    const nets = await docker([
+        ...["network", "ls", ...filter, "--format"],
+        `{{.ID}}\t{{.Label "${SESSION_LABEL}"}}\t{{.CreatedAt}}`,
+    ]);
+    const containers = rows(ps.stdout).map(([id = "", session = "", role = "", state = "", created = ""]) => ({
+        id,
+        session,
+        live: role === "sidecar" && state === "running",
+        created,
+    }));
+    const networks = rows(nets.stdout).map(([id = "", session = "", created = ""]) => ({
+        id,
+        session,
+        live: false,
+        created,
+    }));
+    const young = (created) => {
+        const at = dockerTime(created);
+        return at === null || now - at < GRACE_MS;
+    };
+    const live = new Set([...containers, ...networks]
+        .filter((item) => item.live || young(item.created))
+        .map((item) => item.session));
+    return {
+        containers: containers
+            .filter((item) => !live.has(item.session))
+            .map((item) => item.id),
+        networks: networks
+            .filter((item) => !live.has(item.session))
+            .map((item) => item.id),
+    };
+}
+export async function removeLeftovers(docker, now = Date.now()) {
+    const found = await findLeftovers(docker, now);
+    if (found.containers.length > 0) {
+        await docker(["rm", "-f", ...found.containers]);
+    }
+    if (found.networks.length > 0) {
+        await docker(["network", "rm", ...found.networks]);
+    }
+    return found;
+}
+export async function createInternalNetwork(docker, labels, name, pickSubnet, redact) {
+    let stderr = "";
+    for (let attempt = 0; attempt < SUBNET_ATTEMPTS; attempt += 1) {
+        const subnet = pickSubnet();
+        const created = await docker([
+            ...["network", "create", "--internal", "-o", NO_HOST_GATEWAY],
+            ...["--subnet", `${subnet}.0/24`, ...labels, name],
+        ]);
+        if (created.exitCode === 0)
+            return subnet;
+        stderr = created.stderr;
+        if (!/overlap|pool/i.test(stderr))
+            break;
+    }
+    throw new RedroomError("network_create_failed", `could not create ${name}: ${redact(stderr.trim())}`, "docker", { command: "docker network create" });
+}
+export async function tearDownSession(docker, plan) {
+    const problems = [];
+    const attempt = async (args) => {
+        try {
+            const result = await docker(args);
+            if (result.exitCode !== 0)
+                problems.push(result.stderr.trim());
+            return result.stdout;
+        }
+        catch (error) {
+            problems.push(messageOf(error));
+            return "";
+        }
+    };
+    const filter = ["--filter", `label=${SESSION_LABEL}=${plan.session}`];
+    const ids = rows(await attempt(["ps", "-a", "-q", ...filter])).map(([id = ""]) => id);
+    if (ids.length > 0)
+        await attempt(["rm", "-f", ...ids]);
+    const networks = rows(await attempt(["network", "ls", "-q", ...filter])).map(([id = ""]) => id);
+    if (networks.length > 0)
+        await attempt(["network", "rm", ...networks]);
+    return problems;
+}
+export function networkIp(inspected, network) {
+    try {
+        const parsed = JSON.parse(inspected);
+        const ip = parsed[network]?.IPAddress;
+        return ip === undefined || ip === "" ? null : ip;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/hooks.d.ts

@@ -0,0 +1,5 @@
+import { type AgentWiring } from "./agents/agent.js";
+export declare function wiring(sidecarIp: string, runId: string): AgentWiring;
+export declare function headerValues(...settings: ({
+    headers?: Record<string, string>;
+} | null | undefined)[]): string[];

package/dist/hooks.js

@@ -0,0 +1,13 @@
+import {} from "./agents/agent.js";
+import { PORTS } from "./sidecar/config.js";
+export function wiring(sidecarIp, runId) {
+    return {
+        runId,
+        modelBaseUrl: `http://${sidecarIp}:${PORTS.relay}`,
+        toolHookUrl: `http://${sidecarIp}:${PORTS.hook}/hook/${runId}`,
+    };
+}
+export function headerValues(...settings) {
+    const values = settings.flatMap((setting) => Object.values(setting?.headers ?? {}));
+    return [...values, ...values.map((value) => value.replace(/^\S+\s+/, ""))];
+}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export { type Agent, type AgentWiring, type ParsedTurn, type RootFile, } from "./agents/agent.js";
+export { claudeCode, type ClaudeCodeOptions } from "./agents/claude-code.js";
+export { type Docker, dockerCli } from "./docker/cli.js";
+export { removeLeftovers } from "./docker/session.js";
+export { redactSecrets } from "./redact.js";
+export { DEFAULT_DOMAIN, type Redroom, type RedroomOptions, startRedroom, } from "./redroom.js";
+export { type Run } from "./run.js";
+export { findSecrets } from "./secrets.js";
+export { type Artifact, type CallInfo, type Encoding, type ErrorBy, type ErrorInfo, type FileBody, type Hit, type Limits, type ModelCall, type ModelProxy, type Page, type PlantedFile, RedroomError, type RunOptions, type RunResult, type SecretMatch, type Secrets, type Sighting, type ToolCall, type ToolCallCheck, type Turn, type Workspace, } from "./types.js";

package/dist/index.js

@@ -0,0 +1,9 @@
+export {} from "./agents/agent.js";
+export { claudeCode } from "./agents/claude-code.js";
+export { dockerCli } from "./docker/cli.js";
+export { removeLeftovers } from "./docker/session.js";
+export { redactSecrets } from "./redact.js";
+export { DEFAULT_DOMAIN, startRedroom, } from "./redroom.js";
+export {} from "./run.js";
+export { findSecrets } from "./secrets.js";
+export { RedroomError, } from "./types.js";

package/dist/paths.d.ts

@@ -0,0 +1,2 @@
+export declare const PACKAGE_ROOT: string;
+export declare const packagePath: (...parts: string[]) => string;

package/dist/paths.js

@@ -0,0 +1,3 @@
+import { fileURLToPath } from "node:url";
+export const PACKAGE_ROOT = fileURLToPath(new URL("..", import.meta.url));
+export const packagePath = (...parts) => [PACKAGE_ROOT.replace(/\/$/, ""), ...parts].join("/");

package/dist/planting.d.ts

@@ -0,0 +1,6 @@
+import { type TarEntry } from "./docker/cli.js";
+import { type ServedPage } from "./sidecar/state.js";
+import { type Page, type PlantedFile } from "./types.js";
+export declare function servedPages(pages: Record<string, Page>, domain: string): Record<string, ServedPage>;
+export declare function workspaceEntries(workspace: Record<string, PlantedFile>, owner: number): TarEntry[];
+export declare function absoluteEntries(files: Record<string, PlantedFile>, owner: number): TarEntry[];