@geminixiang/mama 0.2.0-beta.1 → 0.2.0-beta.11

package/dist/provisioner.js

@@ -1,33 +1,42 @@
 import { execFile } from "child_process";
+import { createHash } from "crypto";
+import { readFileSync, statSync } from "fs";
 import { promisify } from "util";
 import * as log from "./log.js";
 const execFileAsync = promisify(execFile);
-// ── DockerContainerManager ─────────────────────────────────────────────────────
-/**
- * Manages the lifecycle of per-user Docker containers.
- *
- * Tracks each container's status in memory (running / stopped / missing).
- * State is always verified against Docker on provision(), so in-memory state
- * stays accurate without polling.
- */
+function isDockerNotFoundError(err) {
+    if (!err || typeof err !== "object")
+        return false;
+    const stderr = err.stderr;
+    const message = err.message;
+    const haystack = `${typeof stderr === "string" ? stderr : ""}\n${typeof message === "string" ? message : ""}`.toLowerCase();
+    return (haystack.includes("no such network") ||
+        haystack.includes("no such container") ||
+        haystack.includes("no such object") ||
+        haystack.includes("network not found") ||
+        /network [^\n]+ not found/.test(haystack) ||
+        /error: no such [^\n]+/.test(haystack));
+}
 export class DockerContainerManager {
     static { this.MANAGED_LABEL = "mama.managed=true"; }
     static { this.IMAGE_MODE_LABEL = "mama.sandbox=image"; }
     static { this.VAULT_ID_LABEL_KEY = "mama.vault-id"; }
-    constructor(image, workspaceDir, execFileImpl = execFileAsync) {
+    static { this.CONVERSATION_ID_LABEL_KEY = "mama.conversation-id"; }
+    static { this.MOUNT_SIGNATURE_LABEL_KEY = "mama.mount-signature"; }
+    constructor(image, options = {}) {
         this.image = image;
-        this.workspaceDir = workspaceDir;
-        this.execFileImpl = execFileImpl;
         this.state = new Map();
-        /**
-         * In-flight provision() calls per vaultId. A concurrent second call for the
-         * same user piggybacks on the first docker start/run instead of racing —
-         * without this, two parallel messages from one user could produce duplicate
-         * containers or conflict on docker run.
-         */
         this.inflight = new Map();
+        this.boostedKeys = new Set();
+        if (typeof options === "function") {
+            this.execFileImpl = options;
+        }
+        else {
+            this.limits = options.limits;
+            this.boostLimits = options.boostLimits;
+            this.execFileImpl = options.execFileImpl ?? execFileAsync;
+        }
     }
-    /** Sanitize an identifier segment for use in vault keys and container names. */
     static sanitizeSegment(value) {
         const sanitized = value
             .toLowerCase()
@@ -35,45 +44,32 @@ export class DockerContainerManager {
             .replace(/^-+|-+$/g, "");
         return sanitized || "unknown";
     }
-    /**
-     * Deterministic vault key for a platform user.
-     * e.g. ("slack", "U04ABC") → "slack-u04abc"
-     */
-    static vaultId(platform, platformUserId) {
-        return `${DockerContainerManager.sanitizeSegment(platform)}-${DockerContainerManager.sanitizeSegment(platformUserId)}`;
-    }
-    /** Deterministic container name for a vault-backed user sandbox. */
-    static containerName(vaultId) {
-        return `mama-sandbox-${vaultId}`;
-    }
-    /**
-     * Ensure a container exists and is running for the given vaultId.
-     * Always inspects the actual Docker state, then acts accordingly:
-     * - running  → no-op
-     * - stopped  → docker start
-     * - missing  → docker run
-     *
-     * Returns the container name.
-     */
-    async provision(vaultId, options = {}) {
-        const existing = this.inflight.get(vaultId);
+    static containerName(containerKey) {
+        return `mama-sandbox-${containerKey}`;
+    }
+    static networkName(containerKey) {
+        return `mama-sandbox-net-${containerKey}`;
+    }
+    async provision(containerKey, options = {}) {
+        const existing = this.inflight.get(containerKey);
         if (existing)
             return existing;
-        const pending = this.provisionInner(vaultId, options).finally(() => {
-            this.inflight.delete(vaultId);
+        const pending = this.provisionInner(containerKey, options).finally(() => {
+            this.inflight.delete(containerKey);
         });
-        this.inflight.set(vaultId, pending);
+        this.inflight.set(containerKey, pending);
         return pending;
     }
-    async provisionInner(vaultId, options) {
-        const containerName = options.containerName ?? DockerContainerManager.containerName(vaultId);
+    async provisionInner(containerKey, options) {
+        const containerName = options.containerName ?? DockerContainerManager.containerName(containerKey);
         const mounts = options.mounts ?? [];
         const status = await this.inspectStatus(containerName);
         try {
-            if (status !== "missing" && (await this.hasBindMountDrift(containerName, mounts))) {
-                log.logInfo(`Container ${containerName} mounts changed; recreating container`);
+            if (status !== "missing" &&
+                (await this.hasRuntimeDrift(containerKey, containerName, mounts))) {
+                log.logInfo(`Container ${containerName} configuration changed; recreating container`);
                 await this.execFileImpl("docker", ["rm", "-f", containerName]);
-                await this.runContainer(vaultId, containerName, mounts);
+                await this.runContainer(containerKey, containerName, mounts, options);
                 log.logInfo(`Container ${containerName} recreated`);
             }
             else if (status === "running") {
@@ -84,65 +80,75 @@ export class DockerContainerManager {
                 log.logInfo(`Container ${containerName} started`);
             }
             else {
-                await this.runContainer(vaultId, containerName, mounts);
+                await this.runContainer(containerKey, containerName, mounts, options);
                 log.logInfo(`Container ${containerName} created`);
             }
         }
         catch (err) {
-            // Drop cached state so the next provision() re-inspects Docker cleanly
-            // and stopIdle doesn't keep trying to stop a container that never
-            // became running. We deliberately don't bump lastUsed here.
-            this.state.delete(vaultId);
+            this.state.delete(containerKey);
             throw err;
         }
-        this.setState(vaultId, "running", containerName);
+        this.setState(containerKey, "running", containerName);
+        await this.applyResourceLimits(containerKey, containerName);
         return containerName;
     }
-    /**
-     * Stop a running container (docker stop). Container is preserved and can be
-     * restarted via provision(). Intended for idle lifecycle management.
-     */
-    async stop(vaultId) {
-        const containerName = this.getContainerName(vaultId);
+    async boost(containerKey) {
+        if (!this.boostLimits?.cpus && !this.boostLimits?.memory) {
+            return this.getLimitStatus(containerKey);
+        }
+        this.boostedKeys.add(containerKey);
+        const state = this.state.get(containerKey);
+        if (state?.status === "running") {
+            await this.applyResourceLimits(containerKey, state.containerName);
+        }
+        return this.getLimitStatus(containerKey);
+    }
+    getLimitStatus(containerKey) {
+        const boosted = this.boostedKeys.has(containerKey);
+        return { limits: this.effectiveLimits(containerKey), boosted };
+    }
+    getDefaultLimits() {
+        return this.limits;
+    }
+    getBoostLimits() {
+        return this.boostLimits;
+    }
+    async stop(containerKey) {
+        const containerName = this.getContainerName(containerKey);
         try {
             await this.execFileImpl("docker", ["stop", containerName]);
-            this.setState(vaultId, "stopped", containerName);
+            this.setState(containerKey, "stopped", containerName);
+            this.boostedKeys.delete(containerKey);
             log.logInfo(`Container ${containerName} stopped (idle)`);
         }
         catch (err) {
             log.logWarning(`Failed to stop container ${containerName}`, err instanceof Error ? err.message : String(err));
         }
     }
-    /** Stop and remove a container permanently (e.g. on vault revocation). */
-    async remove(vaultId) {
-        const containerName = this.getContainerName(vaultId);
+    async remove(containerKey) {
+        const containerName = this.getContainerName(containerKey);
+        const networkName = DockerContainerManager.networkName(containerKey);
+        await this.forceRemoveContainer(containerName, `Container ${containerName} removed`, `Failed to remove container ${containerName}`);
         try {
-            await this.execFileImpl("docker", ["rm", "-f", containerName]);
-            this.state.delete(vaultId);
-            log.logInfo(`Container ${containerName} removed`);
+            await this.execFileImpl("docker", ["network", "rm", networkName]);
+            log.logInfo(`Network ${networkName} removed`);
         }
         catch (err) {
-            log.logWarning(`Failed to remove container ${containerName}`, err instanceof Error ? err.message : String(err));
+            log.logWarning(`Failed to remove network ${networkName}`, err instanceof Error ? err.message : String(err));
         }
+        this.state.delete(containerKey);
+        this.boostedKeys.delete(containerKey);
     }
-    /**
-     * Stop all containers that have been idle for longer than maxIdleMs.
-     * Idle time is measured from the last provision() call.
-     */
     async stopIdle(maxIdleMs) {
         const now = Date.now();
         const toStop = [];
-        for (const [vaultId, containerState] of this.state) {
+        for (const [containerKey, containerState] of this.state) {
             if (containerState.status === "running" && now - containerState.lastUsed > maxIdleMs) {
-                toStop.push(vaultId);
+                toStop.push(containerKey);
             }
         }
-        await Promise.all(toStop.map((vaultId) => this.stop(vaultId)));
+        await Promise.all(toStop.map((containerKey) => this.stop(containerKey)));
     }
-    /**
-     * Rebuild in-memory state from existing Docker containers managed by mama image mode.
-     * Supports both new labeled containers and legacy name-prefixed containers.
-     */
     async reconcile() {
         const discovered = new Set();
         const labeledNames = await this.listContainerNamesByLabel();
@@ -152,28 +158,38 @@ export class DockerContainerManager {
         for (const name of legacyNames)
             discovered.add(name);
         this.state.clear();
-        for (const containerName of discovered) {
-            const details = await this.inspectContainerDetails(containerName);
+        const inspected = await Promise.all(Array.from(discovered).map(async (containerName) => ({
+            containerName,
+            details: await this.inspectContainerDetails(containerName),
+        })));
+        const legacyRemovals = [];
+        for (const { containerName, details } of inspected) {
             if (!details)
                 continue;
-            const vaultId = details.vaultId || this.vaultIdFromContainerName(containerName);
-            if (!vaultId) {
-                log.logWarning(`Skipping unmanaged-style container without vault id`, containerName);
+            if (!details.conversationId) {
+                legacyRemovals.push(this.removeLegacyContainer(containerName));
+                continue;
+            }
+            const containerKey = this.containerKeyFromContainerName(containerName);
+            if (!containerKey) {
+                log.logWarning(`Skipping unmanaged-style container without container key`, containerName);
                 continue;
             }
             const status = details.running ? "running" : "stopped";
             const lastUsed = details.startedAtMs ?? Date.now();
-            this.state.set(vaultId, { status, lastUsed, containerName });
+            this.state.set(containerKey, { status, lastUsed, containerName });
         }
+        await Promise.all(legacyRemovals);
         const running = Array.from(this.state.values()).filter((s) => s.status === "running").length;
         const stopped = this.state.size - running;
         log.logInfo(`Reconciled ${this.state.size} managed containers (running=${running}, stopped=${stopped})`);
     }
-    setState(vaultId, status, containerName) {
-        this.state.set(vaultId, { status, lastUsed: Date.now(), containerName });
+    setState(containerKey, status, containerName) {
+        this.state.set(containerKey, { status, lastUsed: Date.now(), containerName });
     }
-    getContainerName(vaultId) {
-        return this.state.get(vaultId)?.containerName ?? DockerContainerManager.containerName(vaultId);
+    getContainerName(containerKey) {
+        return (this.state.get(containerKey)?.containerName ??
+            DockerContainerManager.containerName(containerKey));
     }
     mountArgs(mounts) {
         return mounts.flatMap((mount) => ["-v", this.toBindSpec(mount)]);
@@ -181,36 +197,82 @@ export class DockerContainerManager {
     toBindSpec(mount) {
         return `${mount.source}:${mount.target}`;
     }
-    async runContainer(vaultId, containerName, mounts) {
+    async runContainer(containerKey, containerName, mounts, options) {
+        const networkName = await this.ensureNetwork(containerKey);
         log.logInfo(`Creating container ${containerName} from image ${this.image}`);
-        await this.execFileImpl("docker", [
-            "run",
-            "-d",
-            "--name",
-            containerName,
+        const labels = [
             "--label",
             DockerContainerManager.MANAGED_LABEL,
             "--label",
             DockerContainerManager.IMAGE_MODE_LABEL,
             "--label",
-            `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${vaultId}`,
-            "-v",
-            `${this.workspaceDir}:/workspace`,
+            `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,
+        ];
+        if (options.conversationId) {
+            labels.push("--label", `${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}=${options.conversationId}`);
+        }
+        if (mounts.length > 0) {
+            labels.push("--label", `${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}=${this.mountSignature(mounts)}`);
+        }
+        await this.execFileImpl("docker", [
+            "run",
+            "-d",
+            "--name",
+            containerName,
+            "--network",
+            networkName,
+            ...labels,
+            ...this.resourceLimitArgs(this.effectiveLimits(containerKey)),
             ...this.mountArgs(mounts),
             this.image,
             "sleep",
             "infinity",
         ]);
     }
+    effectiveLimits(containerKey) {
+        if (!this.boostedKeys.has(containerKey))
+            return this.limits;
+        return { ...this.limits, ...this.boostLimits };
+    }
+    resourceLimitArgs(limits) {
+        const args = [];
+        if (limits?.cpus)
+            args.push("--cpus", limits.cpus);
+        if (limits?.memory)
+            args.push("--memory", limits.memory);
+        return args;
+    }
+    async applyResourceLimits(containerKey, containerName) {
+        const limitArgs = this.resourceLimitArgs(this.effectiveLimits(containerKey));
+        if (limitArgs.length === 0)
+            return;
+        const args = ["update", ...limitArgs, containerName];
+        try {
+            await this.execFileImpl("docker", args);
+        }
+        catch (err) {
+            log.logWarning(`Failed to apply resource limits to container ${containerName}`, err instanceof Error ? err.message : String(err));
+        }
+    }
+    async hasRuntimeDrift(containerKey, containerName, mounts) {
+        if (await this.hasBindMountDrift(containerName, mounts)) {
+            return true;
+        }
+        if (await this.hasMountSignatureDrift(containerName, mounts)) {
+            return true;
+        }
+        return this.hasNetworkModeDrift(containerKey, containerName);
+    }
     async hasBindMountDrift(containerName, mounts) {
         const expected = this.expectedBinds(mounts);
         const actual = await this.inspectBindMounts(containerName);
         return !this.sameBinds(expected, actual);
     }
     expectedBinds(mounts) {
-        return [`${this.workspaceDir}:/workspace`, ...mounts.map((mount) => this.toBindSpec(mount))]
+        return mounts
+            .map((mount) => this.toBindSpec(mount))
             .slice()
-            .sort();
+            .toSorted();
     }
     sameBinds(expected, actual) {
         if (expected.length !== actual.length) {
@@ -218,6 +280,41 @@ export class DockerContainerManager {
         }
         return expected.every((bind, index) => bind === actual[index]);
     }
+    async hasMountSignatureDrift(containerName, mounts) {
+        if (mounts.length === 0)
+            return false;
+        const expected = this.mountSignature(mounts);
+        const { stdout } = await this.execFileImpl("docker", [
+            "inspect",
+            "-f",
+            `{{index .Config.Labels "${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}"}}`,
+            containerName,
+        ]);
+        const actual = this.normalizeDockerValue(stdout.trim());
+        return actual !== expected;
+    }
+    mountSignature(mounts) {
+        const payload = mounts
+            .map((mount) => ({
+            source: mount.source,
+            target: mount.target,
+            fingerprint: this.mountSourceFingerprint(mount.source),
+        }))
+            .toSorted((left, right) => `${left.target}\0${left.source}`.localeCompare(`${right.target}\0${right.source}`));
+        return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
+    }
+    mountSourceFingerprint(source) {
+        try {
+            const stat = statSync(source);
+            if (stat.isFile()) {
+                return createHash("sha256").update(readFileSync(source)).digest("hex");
+            }
+            return `${stat.isDirectory() ? "dir" : "other"}:${stat.size}:${stat.mtimeMs}`;
+        }
+        catch {
+            return "missing";
+        }
+    }
     async inspectBindMounts(containerName) {
         const { stdout } = await this.execFileImpl("docker", [
             "inspect",
@@ -233,7 +330,42 @@ export class DockerContainerManager {
         if (!Array.isArray(parsed) || parsed.some((bind) => typeof bind !== "string")) {
             throw new Error(`Unexpected docker bind mount payload for container "${containerName}"`);
         }
-        return [...parsed].sort();
+        return [...parsed].toSorted();
+    }
+    async hasNetworkModeDrift(containerKey, containerName) {
+        const expected = DockerContainerManager.networkName(containerKey);
+        const { stdout } = await this.execFileImpl("docker", [
+            "inspect",
+            "-f",
+            "{{.HostConfig.NetworkMode}}",
+            containerName,
+        ]);
+        return stdout.trim() !== expected;
+    }
+    async ensureNetwork(containerKey) {
+        const networkName = DockerContainerManager.networkName(containerKey);
+        try {
+            await this.execFileImpl("docker", ["network", "inspect", networkName]);
+            return networkName;
+        }
+        catch (err) {
+            if (!isDockerNotFoundError(err))
+                throw err;
+        }
+        await this.execFileImpl("docker", [
+            "network",
+            "create",
+            "--driver",
+            "bridge",
+            "--label",
+            DockerContainerManager.MANAGED_LABEL,
+            "--label",
+            DockerContainerManager.IMAGE_MODE_LABEL,
+            "--label",
+            `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,
+            networkName,
+        ]);
+        return networkName;
     }
     async inspectStatus(containerName) {
         try {
@@ -245,8 +377,10 @@ export class DockerContainerManager {
             ]);
             return stdout.trim() === "true" ? "running" : "stopped";
         }
-        catch {
-            return "missing";
+        catch (err) {
+            if (isDockerNotFoundError(err))
+                return "missing";
+            throw err;
         }
     }
     async listContainerNamesByLabel() {
@@ -296,14 +430,15 @@ export class DockerContainerManager {
             const { stdout } = await this.execFileImpl("docker", [
                 "inspect",
                 "-f",
-                `{{.State.Running}}\t{{.State.StartedAt}}\t{{index .Config.Labels "${DockerContainerManager.VAULT_ID_LABEL_KEY}"}}`,
+                `{{.State.Running}}\t{{.State.StartedAt}}\t{{index .Config.Labels "${DockerContainerManager.VAULT_ID_LABEL_KEY}"}}\t{{index .Config.Labels "${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}"}}`,
                 containerName,
             ]);
-            const [runningRaw, startedAtRaw, vaultIdRaw] = stdout.trim().split("\t");
+            const [runningRaw, startedAtRaw, vaultIdRaw, conversationIdRaw] = stdout.trim().split("\t");
             const running = runningRaw === "true";
             const startedAtMs = this.parseDockerTimestamp(startedAtRaw);
             const vaultId = this.normalizeDockerValue(vaultIdRaw);
-            return { running, startedAtMs, vaultId };
+            const conversationId = this.normalizeDockerValue(conversationIdRaw);
+            return { running, startedAtMs, vaultId, conversationId };
         }
         catch (err) {
             log.logWarning(`Failed to inspect container ${containerName} during reconcile`, err instanceof Error ? err.message : String(err));
@@ -323,14 +458,24 @@ export class DockerContainerManager {
         const parsed = Date.parse(normalized);
         return Number.isNaN(parsed) ? undefined : parsed;
     }
-    vaultIdFromContainerName(containerName) {
+    containerKeyFromContainerName(containerName) {
         const prefix = DockerContainerManager.containerName("");
         if (!containerName.startsWith(prefix))
             return undefined;
-        const vaultId = containerName.slice(prefix.length);
-        return vaultId.length > 0 ? vaultId : undefined;
+        const containerKey = containerName.slice(prefix.length);
+        return containerKey.length > 0 ? containerKey : undefined;
+    }
+    async forceRemoveContainer(containerName, successLog, failureLog) {
+        try {
+            await this.execFileImpl("docker", ["rm", "-f", containerName]);
+            log.logInfo(successLog);
+        }
+        catch (err) {
+            log.logWarning(failureLog, err instanceof Error ? err.message : String(err));
+        }
+    }
+    async removeLegacyContainer(containerName) {
+        await this.forceRemoveContainer(containerName, `Removed legacy mama container ${containerName} (pre-channel-isolation scheme)`, `Failed to remove legacy mama container ${containerName}`);
     }
 }
-/** @deprecated Use DockerContainerManager */
-export const DockerProvisioner = DockerContainerManager;
 //# sourceMappingURL=provisioner.js.map