@geminixiang/mikan 0.3.1 → 0.4.0-beta.0

package/dist/provisioner.d.ts

@@ -1,28 +1,8 @@
 import { execFile } from "child_process";
 declare const execFileAsync: typeof execFile.__promisify__;
 type ExecFileAsync = typeof execFileAsync;
-export interface ContainerMount {
-    source: string;
-    target: string;
-}
-export interface ResourceLimits {
-    cpus?: string;
-    memory?: string;
-}
-export interface SandboxLimitStatus {
-    limits?: ResourceLimits;
-    boosted: boolean;
-}
-export interface ProvisionOptions {
-    containerName?: string;
-    mounts?: ContainerMount[];
-    conversationId?: string;
-}
-export interface DockerContainerManagerOptions {
-    limits?: ResourceLimits;
-    boostLimits?: ResourceLimits;
-    execFileImpl?: ExecFileAsync;
-}
+export type { ContainerMount, DockerContainerManagerOptions, ProvisionOptions, ResourceLimits, SandboxLimitStatus, } from "./types.js";
+import type { DockerContainerManagerOptions, ProvisionOptions, ResourceLimits, SandboxLimitStatus } from "./types.js";
 export declare class DockerContainerManager {
     private readonly image;
     private state;
@@ -81,5 +61,4 @@ export declare class DockerContainerManager {
     private forceRemoveContainer;
     private removeLegacyContainer;
 }
-export {};
 //# sourceMappingURL=provisioner.d.ts.map

package/dist/provisioner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../src/provisioner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAOzC,QAAA,MAAM,aAAa,+BAAsB,CAAC;AAC1C,KAAK,aAAa,GAAG,OAAO,aAAa,CAAC;AA2B1C,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,YAAY,CAAC,EAAE,aAAa,CAAC;CAC9B;AAED,qBAAa,sBAAsB;IAgB/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAfxB,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAwB;IAC7D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAyB;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAoB;IAC9D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAE5E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAiB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqC;IACpE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAE7C,YACmB,KAAK,EAAE,MAAM,EAC9B,OAAO,GAAE,6BAA6B,GAAG,aAAkB,EAS5D;IAED,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM5C;IAED,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjD;IAED,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/C;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CASrF;YAEa,cAAc;IAkCtB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAY7D;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQzF;IAED,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAGvD;IAED,gBAAgB,IAAI,cAAc,GAAG,SAAS,CAE7C;IAED,cAAc,IAAI,cAAc,GAAG,SAAS,CAE3C;IAEK,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc9C;IAEK,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhD;IAEK,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/C;IAEK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CA0C/B;IAED,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,UAAU;YAIJ,YAAY;IA4C1B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;YAaX,mBAAmB;YA2BnB,eAAe;YAcf,iBAAiB;IAS/B,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,SAAS;YAQH,sBAAsB;IAgBpC,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,sBAAsB;YAYhB,iBAAiB;YAqBjB,mBAAmB;YAWnB,aAAa;YAwBb,aAAa;YAeb,yBAAyB;YAsBzB,0BAA0B;IAoBxC,OAAO,CAAC,cAAc;YAOR,uBAAuB;IA4BrC,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,6BAA6B;YAOvB,oBAAoB;YAapB,qBAAqB;CAOpC","sourcesContent":["import { execFile } from \"child_process\";\nimport { createHash } from \"crypto\";\nimport { readFileSync, statSync } from \"fs\";\nimport { promisify } from \"util\";\nimport * as log from \"./log.js\";\nimport { reportUserFacingError } from \"./sentry.js\";\n\nconst execFileAsync = promisify(execFile);\ntype ExecFileAsync = typeof execFileAsync;\n\ntype ContainerStatus = \"running\" | \"stopped\" | \"missing\";\n\nfunction isDockerNotFoundError(err: unknown): boolean {\n  if (!err || typeof err !== \"object\") return false;\n  const stderr = (err as { stderr?: unknown }).stderr;\n  const message = (err as { message?: unknown }).message;\n  const haystack = `${typeof stderr === \"string\" ? stderr : \"\"}\\n${\n    typeof message === \"string\" ? message : \"\"\n  }`.toLowerCase();\n  return (\n    haystack.includes(\"no such network\") ||\n    haystack.includes(\"no such container\") ||\n    haystack.includes(\"no such object\") ||\n    haystack.includes(\"network not found\") ||\n    /network [^\\n]+ not found/.test(haystack) ||\n    /error: no such [^\\n]+/.test(haystack)\n  );\n}\n\ninterface ContainerState {\n  status: ContainerStatus;\n  lastUsed: number;\n  containerName: string;\n}\n\nexport interface ContainerMount {\n  source: string;\n  target: string;\n}\n\nexport interface ResourceLimits {\n  cpus?: string;\n  memory?: string;\n}\n\nexport interface SandboxLimitStatus {\n  limits?: ResourceLimits;\n  boosted: boolean;\n}\n\nexport interface ProvisionOptions {\n  containerName?: string;\n  mounts?: ContainerMount[];\n  conversationId?: string;\n}\n\nexport interface DockerContainerManagerOptions {\n  limits?: ResourceLimits;\n  boostLimits?: ResourceLimits;\n  execFileImpl?: ExecFileAsync;\n}\n\nexport class DockerContainerManager {\n  private state = new Map<string, ContainerState>();\n  private inflight = new Map<string, Promise<string>>();\n  private static readonly MANAGED_LABEL = \"mikan.managed=true\";\n  private static readonly IMAGE_MODE_LABEL = \"mikan.sandbox=image\";\n  private static readonly VAULT_ID_LABEL_KEY = \"mikan.vault-id\";\n  private static readonly CONVERSATION_ID_LABEL_KEY = \"mikan.conversation-id\";\n  private static readonly MOUNT_SIGNATURE_LABEL_KEY = \"mikan.mount-signature\";\n\n  private readonly limits?: ResourceLimits;\n  private readonly boostLimits?: ResourceLimits;\n  private readonly boostedKeys = new Set<string>();\n  private readonly overrideLimits = new Map<string, ResourceLimits>();\n  private readonly execFileImpl: ExecFileAsync;\n\n  constructor(\n    private readonly image: string,\n    options: DockerContainerManagerOptions | ExecFileAsync = {},\n  ) {\n    if (typeof options === \"function\") {\n      this.execFileImpl = options;\n    } else {\n      this.limits = options.limits;\n      this.boostLimits = options.boostLimits;\n      this.execFileImpl = options.execFileImpl ?? execFileAsync;\n    }\n  }\n\n  static sanitizeSegment(value: string): string {\n    const sanitized = value\n      .toLowerCase()\n      .replace(/[^a-z0-9]+/g, \"-\")\n      .replace(/^-+|-+$/g, \"\");\n    return sanitized || \"unknown\";\n  }\n\n  static containerName(containerKey: string): string {\n    return `mikan-sandbox-${containerKey}`;\n  }\n\n  static networkName(containerKey: string): string {\n    return `mikan-sandbox-net-${containerKey}`;\n  }\n\n  async provision(containerKey: string, options: ProvisionOptions = {}): Promise<string> {\n    const existing = this.inflight.get(containerKey);\n    if (existing) return existing;\n\n    const pending = this.provisionInner(containerKey, options).finally(() => {\n      this.inflight.delete(containerKey);\n    });\n    this.inflight.set(containerKey, pending);\n    return pending;\n  }\n\n  private async provisionInner(containerKey: string, options: ProvisionOptions): Promise<string> {\n    const containerName =\n      options.containerName ?? DockerContainerManager.containerName(containerKey);\n    const mounts = options.mounts ?? [];\n    const status = await this.inspectStatus(containerName);\n\n    try {\n      if (\n        status !== \"missing\" &&\n        (await this.hasRuntimeDrift(containerKey, containerName, mounts))\n      ) {\n        log.logInfo(`Container ${containerName} configuration changed; recreating container`);\n        await this.execFileImpl(\"docker\", [\"rm\", \"-f\", containerName]);\n        await this.runContainer(containerKey, containerName, mounts, options);\n        log.logInfo(`Container ${containerName} recreated`);\n      } else if (status === \"running\") {\n        log.logInfo(`Container ${containerName} already running`);\n      } else if (status === \"stopped\") {\n        await this.execFileImpl(\"docker\", [\"start\", containerName]);\n        log.logInfo(`Container ${containerName} started`);\n      } else {\n        await this.runContainer(containerKey, containerName, mounts, options);\n        log.logInfo(`Container ${containerName} created`);\n      }\n    } catch (err) {\n      this.state.delete(containerKey);\n      throw err;\n    }\n\n    this.setState(containerKey, \"running\", containerName);\n    await this.applyResourceLimits(containerKey, containerName);\n    return containerName;\n  }\n\n  async boost(containerKey: string): Promise<SandboxLimitStatus> {\n    if (!this.boostLimits?.cpus && !this.boostLimits?.memory) {\n      return this.getLimitStatus(containerKey);\n    }\n\n    this.overrideLimits.delete(containerKey);\n    this.boostedKeys.add(containerKey);\n    const state = this.state.get(containerKey);\n    if (state?.status === \"running\") {\n      await this.applyResourceLimits(containerKey, state.containerName);\n    }\n    return this.getLimitStatus(containerKey);\n  }\n\n  async setLimits(containerKey: string, limits: ResourceLimits): Promise<SandboxLimitStatus> {\n    this.boostedKeys.delete(containerKey);\n    this.overrideLimits.set(containerKey, { ...this.limits, ...limits });\n    const state = this.state.get(containerKey);\n    if (state?.status === \"running\") {\n      await this.applyResourceLimits(containerKey, state.containerName);\n    }\n    return this.getLimitStatus(containerKey);\n  }\n\n  getLimitStatus(containerKey: string): SandboxLimitStatus {\n    const boosted = this.boostedKeys.has(containerKey);\n    return { limits: this.effectiveLimits(containerKey), boosted };\n  }\n\n  getDefaultLimits(): ResourceLimits | undefined {\n    return this.limits;\n  }\n\n  getBoostLimits(): ResourceLimits | undefined {\n    return this.boostLimits;\n  }\n\n  async stop(containerKey: string): Promise<void> {\n    const containerName = this.getContainerName(containerKey);\n    try {\n      await this.execFileImpl(\"docker\", [\"stop\", containerName]);\n      this.setState(containerKey, \"stopped\", containerName);\n      this.boostedKeys.delete(containerKey);\n      this.overrideLimits.delete(containerKey);\n      log.logInfo(`Container ${containerName} stopped (idle)`);\n    } catch (err) {\n      log.logWarning(\n        `Failed to stop container ${containerName}`,\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n  }\n\n  async remove(containerKey: string): Promise<void> {\n    const containerName = this.getContainerName(containerKey);\n    const networkName = DockerContainerManager.networkName(containerKey);\n\n    await this.forceRemoveContainer(\n      containerName,\n      `Container ${containerName} removed`,\n      `Failed to remove container ${containerName}`,\n    );\n\n    try {\n      await this.execFileImpl(\"docker\", [\"network\", \"rm\", networkName]);\n      log.logInfo(`Network ${networkName} removed`);\n    } catch (err) {\n      log.logWarning(\n        `Failed to remove network ${networkName}`,\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n\n    this.state.delete(containerKey);\n    this.boostedKeys.delete(containerKey);\n    this.overrideLimits.delete(containerKey);\n  }\n\n  async stopIdle(maxIdleMs: number): Promise<void> {\n    const now = Date.now();\n    const toStop: string[] = [];\n    for (const [containerKey, containerState] of this.state) {\n      if (containerState.status === \"running\" && now - containerState.lastUsed > maxIdleMs) {\n        toStop.push(containerKey);\n      }\n    }\n    await Promise.all(toStop.map((containerKey) => this.stop(containerKey)));\n  }\n\n  async reconcile(): Promise<void> {\n    const discovered = new Set<string>();\n    const labeledNames = await this.listContainerNamesByLabel();\n    for (const name of labeledNames) discovered.add(name);\n    const legacyNames = await this.listContainerNamesByPrefix();\n    for (const name of legacyNames) discovered.add(name);\n\n    this.state.clear();\n\n    const inspected = await Promise.all(\n      Array.from(discovered).map(async (containerName) => ({\n        containerName,\n        details: await this.inspectContainerDetails(containerName),\n      })),\n    );\n\n    const legacyRemovals: Promise<void>[] = [];\n    for (const { containerName, details } of inspected) {\n      if (!details) continue;\n\n      if (!details.conversationId) {\n        legacyRemovals.push(this.removeLegacyContainer(containerName));\n        continue;\n      }\n\n      const containerKey = this.containerKeyFromContainerName(containerName);\n      if (!containerKey) {\n        log.logWarning(`Skipping unmanaged-style container without container key`, containerName);\n        continue;\n      }\n\n      const status: ContainerStatus = details.running ? \"running\" : \"stopped\";\n      const lastUsed = details.startedAtMs ?? Date.now();\n      this.state.set(containerKey, { status, lastUsed, containerName });\n    }\n    await Promise.all(legacyRemovals);\n\n    const running = Array.from(this.state.values()).filter((s) => s.status === \"running\").length;\n    const stopped = this.state.size - running;\n    log.logInfo(\n      `Reconciled ${this.state.size} managed containers (running=${running}, stopped=${stopped})`,\n    );\n  }\n\n  private setState(containerKey: string, status: ContainerStatus, containerName: string): void {\n    this.state.set(containerKey, { status, lastUsed: Date.now(), containerName });\n  }\n\n  private getContainerName(containerKey: string): string {\n    return (\n      this.state.get(containerKey)?.containerName ??\n      DockerContainerManager.containerName(containerKey)\n    );\n  }\n\n  private mountArgs(mounts: ContainerMount[]): string[] {\n    return mounts.flatMap((mount) => [\"-v\", this.toBindSpec(mount)]);\n  }\n\n  private toBindSpec(mount: ContainerMount): string {\n    return `${mount.source}:${mount.target}`;\n  }\n\n  private async runContainer(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n    options: ProvisionOptions,\n  ): Promise<void> {\n    const networkName = await this.ensureNetwork(containerKey);\n    log.logInfo(`Creating container ${containerName} from image ${this.image}`);\n    const labels = [\n      \"--label\",\n      DockerContainerManager.MANAGED_LABEL,\n      \"--label\",\n      DockerContainerManager.IMAGE_MODE_LABEL,\n      \"--label\",\n      `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,\n    ];\n    if (options.conversationId) {\n      labels.push(\n        \"--label\",\n        `${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}=${options.conversationId}`,\n      );\n    }\n    if (mounts.length > 0) {\n      labels.push(\n        \"--label\",\n        `${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}=${this.mountSignature(mounts)}`,\n      );\n    }\n    await this.execFileImpl(\"docker\", [\n      \"run\",\n      \"-d\",\n      \"--name\",\n      containerName,\n      \"--network\",\n      networkName,\n      ...labels,\n      ...this.resourceLimitArgs(this.effectiveLimits(containerKey)),\n      ...this.mountArgs(mounts),\n      this.image,\n      \"sleep\",\n      \"infinity\",\n    ]);\n  }\n\n  private effectiveLimits(containerKey: string): ResourceLimits | undefined {\n    const override = this.overrideLimits.get(containerKey);\n    if (override) return override;\n    if (!this.boostedKeys.has(containerKey)) return this.limits;\n    return { ...this.limits, ...this.boostLimits };\n  }\n\n  private resourceLimitArgs(limits: ResourceLimits | undefined): string[] {\n    const args: string[] = [];\n    if (limits?.cpus) args.push(\"--cpus\", limits.cpus);\n    if (limits?.memory) {\n      args.push(\"--memory\", limits.memory);\n      // Keep Docker's no-extra-swap semantics explicit. Docker requires\n      // memory-swap to be updated together when raising an existing memory\n      // limit above the current swap limit.\n      args.push(\"--memory-swap\", limits.memory);\n    }\n    return args;\n  }\n\n  private async applyResourceLimits(containerKey: string, containerName: string): Promise<void> {\n    const limitArgs = this.resourceLimitArgs(this.effectiveLimits(containerKey));\n    if (limitArgs.length === 0) return;\n    const args = [\"update\", ...limitArgs, containerName];\n    try {\n      await this.execFileImpl(\"docker\", args);\n    } catch (err) {\n      log.logWarning(\n        `Failed to apply resource limits to container ${containerName}`,\n        err instanceof Error ? err.message : String(err),\n      );\n      reportUserFacingError(err, {\n        domain: \"sandbox\",\n        surface: \"sandbox_provision\",\n        operation: \"apply_resource_limits\",\n        severity: \"warning\",\n        context: {\n          sandboxType: \"image\",\n          containerKey,\n          containerName,\n          limitArgCount: limitArgs.length,\n          fatal: false,\n        },\n      });\n    }\n  }\n\n  private async hasRuntimeDrift(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<boolean> {\n    if (await this.hasBindMountDrift(containerName, mounts)) {\n      return true;\n    }\n    if (await this.hasMountSignatureDrift(containerName, mounts)) {\n      return true;\n    }\n    return this.hasNetworkModeDrift(containerKey, containerName);\n  }\n\n  private async hasBindMountDrift(\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<boolean> {\n    const expected = this.expectedBinds(mounts);\n    const actual = await this.inspectBindMounts(containerName);\n    return !this.sameBinds(expected, actual);\n  }\n\n  private expectedBinds(mounts: ContainerMount[]): string[] {\n    return mounts\n      .map((mount) => this.toBindSpec(mount))\n      .slice()\n      .toSorted();\n  }\n\n  private sameBinds(expected: string[], actual: string[]): boolean {\n    if (expected.length !== actual.length) {\n      return false;\n    }\n\n    return expected.every((bind, index) => bind === actual[index]);\n  }\n\n  private async hasMountSignatureDrift(\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<boolean> {\n    if (mounts.length === 0) return false;\n    const expected = this.mountSignature(mounts);\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      `{{index .Config.Labels \"${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}\"}}`,\n      containerName,\n    ]);\n    const actual = this.normalizeDockerValue(stdout.trim());\n    return actual !== expected;\n  }\n\n  private mountSignature(mounts: ContainerMount[]): string {\n    const payload = mounts\n      .map((mount) => ({\n        source: mount.source,\n        target: mount.target,\n        fingerprint: this.mountSourceFingerprint(mount.source),\n      }))\n      .toSorted((left, right) =>\n        `${left.target}\\0${left.source}`.localeCompare(`${right.target}\\0${right.source}`),\n      );\n    return createHash(\"sha256\").update(JSON.stringify(payload)).digest(\"hex\");\n  }\n\n  private mountSourceFingerprint(source: string): string {\n    try {\n      const stat = statSync(source);\n      if (stat.isFile()) {\n        return createHash(\"sha256\").update(readFileSync(source)).digest(\"hex\");\n      }\n      return `${stat.isDirectory() ? \"dir\" : \"other\"}:${stat.size}:${stat.mtimeMs}`;\n    } catch {\n      return \"missing\";\n    }\n  }\n\n  private async inspectBindMounts(containerName: string): Promise<string[]> {\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{json .HostConfig.Binds}}\",\n      containerName,\n    ]);\n    const payload = stdout.trim();\n    const parsed = JSON.parse(payload.length > 0 ? payload : \"null\") as unknown;\n\n    if (parsed === null) {\n      return [];\n    }\n\n    if (!Array.isArray(parsed) || parsed.some((bind) => typeof bind !== \"string\")) {\n      throw new Error(`Unexpected docker bind mount payload for container \"${containerName}\"`);\n    }\n\n    return [...parsed].toSorted();\n  }\n\n  private async hasNetworkModeDrift(containerKey: string, containerName: string): Promise<boolean> {\n    const expected = DockerContainerManager.networkName(containerKey);\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.HostConfig.NetworkMode}}\",\n      containerName,\n    ]);\n    return stdout.trim() !== expected;\n  }\n\n  private async ensureNetwork(containerKey: string): Promise<string> {\n    const networkName = DockerContainerManager.networkName(containerKey);\n    try {\n      await this.execFileImpl(\"docker\", [\"network\", \"inspect\", networkName]);\n      return networkName;\n    } catch (err) {\n      if (!isDockerNotFoundError(err)) throw err;\n    }\n    await this.execFileImpl(\"docker\", [\n      \"network\",\n      \"create\",\n      \"--driver\",\n      \"bridge\",\n      \"--label\",\n      DockerContainerManager.MANAGED_LABEL,\n      \"--label\",\n      DockerContainerManager.IMAGE_MODE_LABEL,\n      \"--label\",\n      `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,\n      networkName,\n    ]);\n    return networkName;\n  }\n\n  private async inspectStatus(containerName: string): Promise<ContainerStatus> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"inspect\",\n        \"-f\",\n        \"{{.State.Running}}\",\n        containerName,\n      ]);\n      return stdout.trim() === \"true\" ? \"running\" : \"stopped\";\n    } catch (err) {\n      if (isDockerNotFoundError(err)) return \"missing\";\n      throw err;\n    }\n  }\n\n  private async listContainerNamesByLabel(): Promise<string[]> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"ps\",\n        \"-a\",\n        \"--filter\",\n        `label=${DockerContainerManager.MANAGED_LABEL}`,\n        \"--filter\",\n        `label=${DockerContainerManager.IMAGE_MODE_LABEL}`,\n        \"--format\",\n        \"{{.Names}}\",\n      ]);\n      return this.parseNameLines(stdout);\n    } catch (err) {\n      log.logWarning(\n        \"Failed to list labeled managed containers\",\n        err instanceof Error ? err.message : String(err),\n      );\n      return [];\n    }\n  }\n\n  private async listContainerNamesByPrefix(): Promise<string[]> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"ps\",\n        \"-a\",\n        \"--filter\",\n        `name=${DockerContainerManager.containerName(\"\")}`,\n        \"--format\",\n        \"{{.Names}}\",\n      ]);\n      return this.parseNameLines(stdout);\n    } catch (err) {\n      log.logWarning(\n        \"Failed to list legacy managed containers\",\n        err instanceof Error ? err.message : String(err),\n      );\n      return [];\n    }\n  }\n\n  private parseNameLines(stdout: string): string[] {\n    return stdout\n      .split(\"\\n\")\n      .map((line) => line.trim())\n      .filter((line) => line.length > 0);\n  }\n\n  private async inspectContainerDetails(\n    containerName: string,\n  ): Promise<\n    | { running: boolean; startedAtMs?: number; vaultId?: string; conversationId?: string }\n    | undefined\n  > {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"inspect\",\n        \"-f\",\n        `{{.State.Running}}\\t{{.State.StartedAt}}\\t{{index .Config.Labels \"${DockerContainerManager.VAULT_ID_LABEL_KEY}\"}}\\t{{index .Config.Labels \"${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}\"}}`,\n        containerName,\n      ]);\n      const [runningRaw, startedAtRaw, vaultIdRaw, conversationIdRaw] = stdout.trim().split(\"\\t\");\n      const running = runningRaw === \"true\";\n      const startedAtMs = this.parseDockerTimestamp(startedAtRaw);\n      const vaultId = this.normalizeDockerValue(vaultIdRaw);\n      const conversationId = this.normalizeDockerValue(conversationIdRaw);\n      return { running, startedAtMs, vaultId, conversationId };\n    } catch (err) {\n      log.logWarning(\n        `Failed to inspect container ${containerName} during reconcile`,\n        err instanceof Error ? err.message : String(err),\n      );\n      return undefined;\n    }\n  }\n\n  private normalizeDockerValue(value?: string): string | undefined {\n    if (!value || value === \"<no value>\") return undefined;\n    const trimmed = value.trim();\n    return trimmed.length > 0 ? trimmed : undefined;\n  }\n\n  private parseDockerTimestamp(value?: string): number | undefined {\n    const normalized = this.normalizeDockerValue(value);\n    if (!normalized || normalized.startsWith(\"0001-\")) return undefined;\n    const parsed = Date.parse(normalized);\n    return Number.isNaN(parsed) ? undefined : parsed;\n  }\n\n  private containerKeyFromContainerName(containerName: string): string | undefined {\n    const prefix = DockerContainerManager.containerName(\"\");\n    if (!containerName.startsWith(prefix)) return undefined;\n    const containerKey = containerName.slice(prefix.length);\n    return containerKey.length > 0 ? containerKey : undefined;\n  }\n\n  private async forceRemoveContainer(\n    containerName: string,\n    successLog: string,\n    failureLog: string,\n  ): Promise<void> {\n    try {\n      await this.execFileImpl(\"docker\", [\"rm\", \"-f\", containerName]);\n      log.logInfo(successLog);\n    } catch (err) {\n      log.logWarning(failureLog, err instanceof Error ? err.message : String(err));\n    }\n  }\n\n  private async removeLegacyContainer(containerName: string): Promise<void> {\n    await this.forceRemoveContainer(\n      containerName,\n      `Removed legacy mikan container ${containerName} (pre-channel-isolation scheme)`,\n      `Failed to remove legacy mikan container ${containerName}`,\n    );\n  }\n}\n"]}
+{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../src/provisioner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAOzC,QAAA,MAAM,aAAa,+BAAsB,CAAC;AAC1C,KAAK,aAAa,GAAG,OAAO,aAAa,CAAC;AA2B1C,YAAY,EACV,cAAc,EACd,6BAA6B,EAC7B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAEV,6BAA6B,EAC7B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,qBAAa,sBAAsB;IAgB/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAfxB,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAwB;IAC7D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAyB;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAoB;IAC9D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAE5E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAiB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqC;IACpE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAE7C,YACmB,KAAK,EAAE,MAAM,EAC9B,OAAO,GAAE,6BAA6B,GAAG,aAAkB,EAS5D;IAED,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM5C;IAED,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjD;IAED,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/C;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CASrF;YAEa,cAAc;IAkCtB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAY7D;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQzF;IAED,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAGvD;IAED,gBAAgB,IAAI,cAAc,GAAG,SAAS,CAE7C;IAED,cAAc,IAAI,cAAc,GAAG,SAAS,CAE3C;IAEK,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc9C;IAEK,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhD;IAEK,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/C;IAEK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CA0C/B;IAED,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,UAAU;YAIJ,YAAY;IA4C1B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;YAaX,mBAAmB;YA2BnB,eAAe;YAcf,iBAAiB;IAS/B,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,SAAS;YAQH,sBAAsB;IAgBpC,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,sBAAsB;YAYhB,iBAAiB;YAqBjB,mBAAmB;YAWnB,aAAa;YAwBb,aAAa;YAeb,yBAAyB;YAsBzB,0BAA0B;IAoBxC,OAAO,CAAC,cAAc;YAOR,uBAAuB;IA4BrC,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,6BAA6B;YAOvB,oBAAoB;YAapB,qBAAqB;CAOpC","sourcesContent":["import { execFile } from \"child_process\";\nimport { createHash } from \"crypto\";\nimport { readFileSync, statSync } from \"fs\";\nimport { promisify } from \"util\";\nimport * as log from \"./log.js\";\nimport { reportUserFacingError } from \"./observability/sentry.js\";\n\nconst execFileAsync = promisify(execFile);\ntype ExecFileAsync = typeof execFileAsync;\n\ntype ContainerStatus = \"running\" | \"stopped\" | \"missing\";\n\nfunction isDockerNotFoundError(err: unknown): boolean {\n  if (!err || typeof err !== \"object\") return false;\n  const stderr = (err as { stderr?: unknown }).stderr;\n  const message = (err as { message?: unknown }).message;\n  const haystack = `${typeof stderr === \"string\" ? stderr : \"\"}\\n${\n    typeof message === \"string\" ? message : \"\"\n  }`.toLowerCase();\n  return (\n    haystack.includes(\"no such network\") ||\n    haystack.includes(\"no such container\") ||\n    haystack.includes(\"no such object\") ||\n    haystack.includes(\"network not found\") ||\n    /network [^\\n]+ not found/.test(haystack) ||\n    /error: no such [^\\n]+/.test(haystack)\n  );\n}\n\ninterface ContainerState {\n  status: ContainerStatus;\n  lastUsed: number;\n  containerName: string;\n}\n\nexport type {\n  ContainerMount,\n  DockerContainerManagerOptions,\n  ProvisionOptions,\n  ResourceLimits,\n  SandboxLimitStatus,\n} from \"./types.js\";\nimport type {\n  ContainerMount,\n  DockerContainerManagerOptions,\n  ProvisionOptions,\n  ResourceLimits,\n  SandboxLimitStatus,\n} from \"./types.js\";\n\nexport class DockerContainerManager {\n  private state = new Map<string, ContainerState>();\n  private inflight = new Map<string, Promise<string>>();\n  private static readonly MANAGED_LABEL = \"mikan.managed=true\";\n  private static readonly IMAGE_MODE_LABEL = \"mikan.sandbox=image\";\n  private static readonly VAULT_ID_LABEL_KEY = \"mikan.vault-id\";\n  private static readonly CONVERSATION_ID_LABEL_KEY = \"mikan.conversation-id\";\n  private static readonly MOUNT_SIGNATURE_LABEL_KEY = \"mikan.mount-signature\";\n\n  private readonly limits?: ResourceLimits;\n  private readonly boostLimits?: ResourceLimits;\n  private readonly boostedKeys = new Set<string>();\n  private readonly overrideLimits = new Map<string, ResourceLimits>();\n  private readonly execFileImpl: ExecFileAsync;\n\n  constructor(\n    private readonly image: string,\n    options: DockerContainerManagerOptions | ExecFileAsync = {},\n  ) {\n    if (typeof options === \"function\") {\n      this.execFileImpl = options;\n    } else {\n      this.limits = options.limits;\n      this.boostLimits = options.boostLimits;\n      this.execFileImpl = options.execFileImpl ?? execFileAsync;\n    }\n  }\n\n  static sanitizeSegment(value: string): string {\n    const sanitized = value\n      .toLowerCase()\n      .replace(/[^a-z0-9]+/g, \"-\")\n      .replace(/^-+|-+$/g, \"\");\n    return sanitized || \"unknown\";\n  }\n\n  static containerName(containerKey: string): string {\n    return `mikan-sandbox-${containerKey}`;\n  }\n\n  static networkName(containerKey: string): string {\n    return `mikan-sandbox-net-${containerKey}`;\n  }\n\n  async provision(containerKey: string, options: ProvisionOptions = {}): Promise<string> {\n    const existing = this.inflight.get(containerKey);\n    if (existing) return existing;\n\n    const pending = this.provisionInner(containerKey, options).finally(() => {\n      this.inflight.delete(containerKey);\n    });\n    this.inflight.set(containerKey, pending);\n    return pending;\n  }\n\n  private async provisionInner(containerKey: string, options: ProvisionOptions): Promise<string> {\n    const containerName =\n      options.containerName ?? DockerContainerManager.containerName(containerKey);\n    const mounts = options.mounts ?? [];\n    const status = await this.inspectStatus(containerName);\n\n    try {\n      if (\n        status !== \"missing\" &&\n        (await this.hasRuntimeDrift(containerKey, containerName, mounts))\n      ) {\n        log.logInfo(`Container ${containerName} configuration changed; recreating container`);\n        await this.execFileImpl(\"docker\", [\"rm\", \"-f\", containerName]);\n        await this.runContainer(containerKey, containerName, mounts, options);\n        log.logInfo(`Container ${containerName} recreated`);\n      } else if (status === \"running\") {\n        log.logInfo(`Container ${containerName} already running`);\n      } else if (status === \"stopped\") {\n        await this.execFileImpl(\"docker\", [\"start\", containerName]);\n        log.logInfo(`Container ${containerName} started`);\n      } else {\n        await this.runContainer(containerKey, containerName, mounts, options);\n        log.logInfo(`Container ${containerName} created`);\n      }\n    } catch (err) {\n      this.state.delete(containerKey);\n      throw err;\n    }\n\n    this.setState(containerKey, \"running\", containerName);\n    await this.applyResourceLimits(containerKey, containerName);\n    return containerName;\n  }\n\n  async boost(containerKey: string): Promise<SandboxLimitStatus> {\n    if (!this.boostLimits?.cpus && !this.boostLimits?.memory) {\n      return this.getLimitStatus(containerKey);\n    }\n\n    this.overrideLimits.delete(containerKey);\n    this.boostedKeys.add(containerKey);\n    const state = this.state.get(containerKey);\n    if (state?.status === \"running\") {\n      await this.applyResourceLimits(containerKey, state.containerName);\n    }\n    return this.getLimitStatus(containerKey);\n  }\n\n  async setLimits(containerKey: string, limits: ResourceLimits): Promise<SandboxLimitStatus> {\n    this.boostedKeys.delete(containerKey);\n    this.overrideLimits.set(containerKey, { ...this.limits, ...limits });\n    const state = this.state.get(containerKey);\n    if (state?.status === \"running\") {\n      await this.applyResourceLimits(containerKey, state.containerName);\n    }\n    return this.getLimitStatus(containerKey);\n  }\n\n  getLimitStatus(containerKey: string): SandboxLimitStatus {\n    const boosted = this.boostedKeys.has(containerKey);\n    return { limits: this.effectiveLimits(containerKey), boosted };\n  }\n\n  getDefaultLimits(): ResourceLimits | undefined {\n    return this.limits;\n  }\n\n  getBoostLimits(): ResourceLimits | undefined {\n    return this.boostLimits;\n  }\n\n  async stop(containerKey: string): Promise<void> {\n    const containerName = this.getContainerName(containerKey);\n    try {\n      await this.execFileImpl(\"docker\", [\"stop\", containerName]);\n      this.setState(containerKey, \"stopped\", containerName);\n      this.boostedKeys.delete(containerKey);\n      this.overrideLimits.delete(containerKey);\n      log.logInfo(`Container ${containerName} stopped (idle)`);\n    } catch (err) {\n      log.logWarning(\n        `Failed to stop container ${containerName}`,\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n  }\n\n  async remove(containerKey: string): Promise<void> {\n    const containerName = this.getContainerName(containerKey);\n    const networkName = DockerContainerManager.networkName(containerKey);\n\n    await this.forceRemoveContainer(\n      containerName,\n      `Container ${containerName} removed`,\n      `Failed to remove container ${containerName}`,\n    );\n\n    try {\n      await this.execFileImpl(\"docker\", [\"network\", \"rm\", networkName]);\n      log.logInfo(`Network ${networkName} removed`);\n    } catch (err) {\n      log.logWarning(\n        `Failed to remove network ${networkName}`,\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n\n    this.state.delete(containerKey);\n    this.boostedKeys.delete(containerKey);\n    this.overrideLimits.delete(containerKey);\n  }\n\n  async stopIdle(maxIdleMs: number): Promise<void> {\n    const now = Date.now();\n    const toStop: string[] = [];\n    for (const [containerKey, containerState] of this.state) {\n      if (containerState.status === \"running\" && now - containerState.lastUsed > maxIdleMs) {\n        toStop.push(containerKey);\n      }\n    }\n    await Promise.all(toStop.map((containerKey) => this.stop(containerKey)));\n  }\n\n  async reconcile(): Promise<void> {\n    const discovered = new Set<string>();\n    const labeledNames = await this.listContainerNamesByLabel();\n    for (const name of labeledNames) discovered.add(name);\n    const legacyNames = await this.listContainerNamesByPrefix();\n    for (const name of legacyNames) discovered.add(name);\n\n    this.state.clear();\n\n    const inspected = await Promise.all(\n      Array.from(discovered).map(async (containerName) => ({\n        containerName,\n        details: await this.inspectContainerDetails(containerName),\n      })),\n    );\n\n    const legacyRemovals: Promise<void>[] = [];\n    for (const { containerName, details } of inspected) {\n      if (!details) continue;\n\n      if (!details.conversationId) {\n        legacyRemovals.push(this.removeLegacyContainer(containerName));\n        continue;\n      }\n\n      const containerKey = this.containerKeyFromContainerName(containerName);\n      if (!containerKey) {\n        log.logWarning(`Skipping unmanaged-style container without container key`, containerName);\n        continue;\n      }\n\n      const status: ContainerStatus = details.running ? \"running\" : \"stopped\";\n      const lastUsed = details.startedAtMs ?? Date.now();\n      this.state.set(containerKey, { status, lastUsed, containerName });\n    }\n    await Promise.all(legacyRemovals);\n\n    const running = Array.from(this.state.values()).filter((s) => s.status === \"running\").length;\n    const stopped = this.state.size - running;\n    log.logInfo(\n      `Reconciled ${this.state.size} managed containers (running=${running}, stopped=${stopped})`,\n    );\n  }\n\n  private setState(containerKey: string, status: ContainerStatus, containerName: string): void {\n    this.state.set(containerKey, { status, lastUsed: Date.now(), containerName });\n  }\n\n  private getContainerName(containerKey: string): string {\n    return (\n      this.state.get(containerKey)?.containerName ??\n      DockerContainerManager.containerName(containerKey)\n    );\n  }\n\n  private mountArgs(mounts: ContainerMount[]): string[] {\n    return mounts.flatMap((mount) => [\"-v\", this.toBindSpec(mount)]);\n  }\n\n  private toBindSpec(mount: ContainerMount): string {\n    return `${mount.source}:${mount.target}`;\n  }\n\n  private async runContainer(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n    options: ProvisionOptions,\n  ): Promise<void> {\n    const networkName = await this.ensureNetwork(containerKey);\n    log.logInfo(`Creating container ${containerName} from image ${this.image}`);\n    const labels = [\n      \"--label\",\n      DockerContainerManager.MANAGED_LABEL,\n      \"--label\",\n      DockerContainerManager.IMAGE_MODE_LABEL,\n      \"--label\",\n      `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,\n    ];\n    if (options.conversationId) {\n      labels.push(\n        \"--label\",\n        `${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}=${options.conversationId}`,\n      );\n    }\n    if (mounts.length > 0) {\n      labels.push(\n        \"--label\",\n        `${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}=${this.mountSignature(mounts)}`,\n      );\n    }\n    await this.execFileImpl(\"docker\", [\n      \"run\",\n      \"-d\",\n      \"--name\",\n      containerName,\n      \"--network\",\n      networkName,\n      ...labels,\n      ...this.resourceLimitArgs(this.effectiveLimits(containerKey)),\n      ...this.mountArgs(mounts),\n      this.image,\n      \"sleep\",\n      \"infinity\",\n    ]);\n  }\n\n  private effectiveLimits(containerKey: string): ResourceLimits | undefined {\n    const override = this.overrideLimits.get(containerKey);\n    if (override) return override;\n    if (!this.boostedKeys.has(containerKey)) return this.limits;\n    return { ...this.limits, ...this.boostLimits };\n  }\n\n  private resourceLimitArgs(limits: ResourceLimits | undefined): string[] {\n    const args: string[] = [];\n    if (limits?.cpus) args.push(\"--cpus\", limits.cpus);\n    if (limits?.memory) {\n      args.push(\"--memory\", limits.memory);\n      // Keep Docker's no-extra-swap semantics explicit. Docker requires\n      // memory-swap to be updated together when raising an existing memory\n      // limit above the current swap limit.\n      args.push(\"--memory-swap\", limits.memory);\n    }\n    return args;\n  }\n\n  private async applyResourceLimits(containerKey: string, containerName: string): Promise<void> {\n    const limitArgs = this.resourceLimitArgs(this.effectiveLimits(containerKey));\n    if (limitArgs.length === 0) return;\n    const args = [\"update\", ...limitArgs, containerName];\n    try {\n      await this.execFileImpl(\"docker\", args);\n    } catch (err) {\n      log.logWarning(\n        `Failed to apply resource limits to container ${containerName}`,\n        err instanceof Error ? err.message : String(err),\n      );\n      reportUserFacingError(err, {\n        domain: \"sandbox\",\n        surface: \"sandbox_provision\",\n        operation: \"apply_resource_limits\",\n        severity: \"warning\",\n        context: {\n          sandboxType: \"image\",\n          containerKey,\n          containerName,\n          limitArgCount: limitArgs.length,\n          fatal: false,\n        },\n      });\n    }\n  }\n\n  private async hasRuntimeDrift(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<boolean> {\n    if (await this.hasBindMountDrift(containerName, mounts)) {\n      return true;\n    }\n    if (await this.hasMountSignatureDrift(containerName, mounts)) {\n      return true;\n    }\n    return this.hasNetworkModeDrift(containerKey, containerName);\n  }\n\n  private async hasBindMountDrift(\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<boolean> {\n    const expected = this.expectedBinds(mounts);\n    const actual = await this.inspectBindMounts(containerName);\n    return !this.sameBinds(expected, actual);\n  }\n\n  private expectedBinds(mounts: ContainerMount[]): string[] {\n    return mounts\n      .map((mount) => this.toBindSpec(mount))\n      .slice()\n      .toSorted();\n  }\n\n  private sameBinds(expected: string[], actual: string[]): boolean {\n    if (expected.length !== actual.length) {\n      return false;\n    }\n\n    return expected.every((bind, index) => bind === actual[index]);\n  }\n\n  private async hasMountSignatureDrift(\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<boolean> {\n    if (mounts.length === 0) return false;\n    const expected = this.mountSignature(mounts);\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      `{{index .Config.Labels \"${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}\"}}`,\n      containerName,\n    ]);\n    const actual = this.normalizeDockerValue(stdout.trim());\n    return actual !== expected;\n  }\n\n  private mountSignature(mounts: ContainerMount[]): string {\n    const payload = mounts\n      .map((mount) => ({\n        source: mount.source,\n        target: mount.target,\n        fingerprint: this.mountSourceFingerprint(mount.source),\n      }))\n      .toSorted((left, right) =>\n        `${left.target}\\0${left.source}`.localeCompare(`${right.target}\\0${right.source}`),\n      );\n    return createHash(\"sha256\").update(JSON.stringify(payload)).digest(\"hex\");\n  }\n\n  private mountSourceFingerprint(source: string): string {\n    try {\n      const stat = statSync(source);\n      if (stat.isFile()) {\n        return createHash(\"sha256\").update(readFileSync(source)).digest(\"hex\");\n      }\n      return `${stat.isDirectory() ? \"dir\" : \"other\"}:${stat.size}:${stat.mtimeMs}`;\n    } catch {\n      return \"missing\";\n    }\n  }\n\n  private async inspectBindMounts(containerName: string): Promise<string[]> {\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{json .HostConfig.Binds}}\",\n      containerName,\n    ]);\n    const payload = stdout.trim();\n    const parsed = JSON.parse(payload.length > 0 ? payload : \"null\") as unknown;\n\n    if (parsed === null) {\n      return [];\n    }\n\n    if (!Array.isArray(parsed) || parsed.some((bind) => typeof bind !== \"string\")) {\n      throw new Error(`Unexpected docker bind mount payload for container \"${containerName}\"`);\n    }\n\n    return [...parsed].toSorted();\n  }\n\n  private async hasNetworkModeDrift(containerKey: string, containerName: string): Promise<boolean> {\n    const expected = DockerContainerManager.networkName(containerKey);\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.HostConfig.NetworkMode}}\",\n      containerName,\n    ]);\n    return stdout.trim() !== expected;\n  }\n\n  private async ensureNetwork(containerKey: string): Promise<string> {\n    const networkName = DockerContainerManager.networkName(containerKey);\n    try {\n      await this.execFileImpl(\"docker\", [\"network\", \"inspect\", networkName]);\n      return networkName;\n    } catch (err) {\n      if (!isDockerNotFoundError(err)) throw err;\n    }\n    await this.execFileImpl(\"docker\", [\n      \"network\",\n      \"create\",\n      \"--driver\",\n      \"bridge\",\n      \"--label\",\n      DockerContainerManager.MANAGED_LABEL,\n      \"--label\",\n      DockerContainerManager.IMAGE_MODE_LABEL,\n      \"--label\",\n      `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,\n      networkName,\n    ]);\n    return networkName;\n  }\n\n  private async inspectStatus(containerName: string): Promise<ContainerStatus> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"inspect\",\n        \"-f\",\n        \"{{.State.Running}}\",\n        containerName,\n      ]);\n      return stdout.trim() === \"true\" ? \"running\" : \"stopped\";\n    } catch (err) {\n      if (isDockerNotFoundError(err)) return \"missing\";\n      throw err;\n    }\n  }\n\n  private async listContainerNamesByLabel(): Promise<string[]> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"ps\",\n        \"-a\",\n        \"--filter\",\n        `label=${DockerContainerManager.MANAGED_LABEL}`,\n        \"--filter\",\n        `label=${DockerContainerManager.IMAGE_MODE_LABEL}`,\n        \"--format\",\n        \"{{.Names}}\",\n      ]);\n      return this.parseNameLines(stdout);\n    } catch (err) {\n      log.logWarning(\n        \"Failed to list labeled managed containers\",\n        err instanceof Error ? err.message : String(err),\n      );\n      return [];\n    }\n  }\n\n  private async listContainerNamesByPrefix(): Promise<string[]> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"ps\",\n        \"-a\",\n        \"--filter\",\n        `name=${DockerContainerManager.containerName(\"\")}`,\n        \"--format\",\n        \"{{.Names}}\",\n      ]);\n      return this.parseNameLines(stdout);\n    } catch (err) {\n      log.logWarning(\n        \"Failed to list legacy managed containers\",\n        err instanceof Error ? err.message : String(err),\n      );\n      return [];\n    }\n  }\n\n  private parseNameLines(stdout: string): string[] {\n    return stdout\n      .split(\"\\n\")\n      .map((line) => line.trim())\n      .filter((line) => line.length > 0);\n  }\n\n  private async inspectContainerDetails(\n    containerName: string,\n  ): Promise<\n    | { running: boolean; startedAtMs?: number; vaultId?: string; conversationId?: string }\n    | undefined\n  > {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"inspect\",\n        \"-f\",\n        `{{.State.Running}}\\t{{.State.StartedAt}}\\t{{index .Config.Labels \"${DockerContainerManager.VAULT_ID_LABEL_KEY}\"}}\\t{{index .Config.Labels \"${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}\"}}`,\n        containerName,\n      ]);\n      const [runningRaw, startedAtRaw, vaultIdRaw, conversationIdRaw] = stdout.trim().split(\"\\t\");\n      const running = runningRaw === \"true\";\n      const startedAtMs = this.parseDockerTimestamp(startedAtRaw);\n      const vaultId = this.normalizeDockerValue(vaultIdRaw);\n      const conversationId = this.normalizeDockerValue(conversationIdRaw);\n      return { running, startedAtMs, vaultId, conversationId };\n    } catch (err) {\n      log.logWarning(\n        `Failed to inspect container ${containerName} during reconcile`,\n        err instanceof Error ? err.message : String(err),\n      );\n      return undefined;\n    }\n  }\n\n  private normalizeDockerValue(value?: string): string | undefined {\n    if (!value || value === \"<no value>\") return undefined;\n    const trimmed = value.trim();\n    return trimmed.length > 0 ? trimmed : undefined;\n  }\n\n  private parseDockerTimestamp(value?: string): number | undefined {\n    const normalized = this.normalizeDockerValue(value);\n    if (!normalized || normalized.startsWith(\"0001-\")) return undefined;\n    const parsed = Date.parse(normalized);\n    return Number.isNaN(parsed) ? undefined : parsed;\n  }\n\n  private containerKeyFromContainerName(containerName: string): string | undefined {\n    const prefix = DockerContainerManager.containerName(\"\");\n    if (!containerName.startsWith(prefix)) return undefined;\n    const containerKey = containerName.slice(prefix.length);\n    return containerKey.length > 0 ? containerKey : undefined;\n  }\n\n  private async forceRemoveContainer(\n    containerName: string,\n    successLog: string,\n    failureLog: string,\n  ): Promise<void> {\n    try {\n      await this.execFileImpl(\"docker\", [\"rm\", \"-f\", containerName]);\n      log.logInfo(successLog);\n    } catch (err) {\n      log.logWarning(failureLog, err instanceof Error ? err.message : String(err));\n    }\n  }\n\n  private async removeLegacyContainer(containerName: string): Promise<void> {\n    await this.forceRemoveContainer(\n      containerName,\n      `Removed legacy mikan container ${containerName} (pre-channel-isolation scheme)`,\n      `Failed to remove legacy mikan container ${containerName}`,\n    );\n  }\n}\n"]}

package/dist/provisioner.js

@@ -3,7 +3,7 @@ import { createHash } from "crypto";
 import { readFileSync, statSync } from "fs";
 import { promisify } from "util";
 import * as log from "./log.js";
-import { reportUserFacingError } from "./sentry.js";
+import { reportUserFacingError } from "./observability/sentry.js";
 const execFileAsync = promisify(execFile);
 function isDockerNotFoundError(err) {
     if (!err || typeof err !== "object")

package/dist/provisioner.js.map

@@ -1 +1 @@
-{"version":3,"file":"provisioner.js","sourceRoot":"","sources":["../src/provisioner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAK1C,SAAS,qBAAqB,CAAC,GAAY;IACzC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,MAAM,OAAO,GAAI,GAA6B,CAAC,OAAO,CAAC;IACvD,MAAM,QAAQ,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAC1D,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAC1C,EAAE,CAAC,WAAW,EAAE,CAAC;IACjB,OAAO,CACL,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACpC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACtC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACnC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACtC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;QACzC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CACvC,CAAC;AACJ,CAAC;AAmCD,MAAM,OAAO,sBAAsB;aAGT,kBAAa,GAAG,oBAAoB,AAAvB,CAAwB;aACrC,qBAAgB,GAAG,qBAAqB,AAAxB,CAAyB;aACzC,uBAAkB,GAAG,gBAAgB,AAAnB,CAAoB;aACtC,8BAAyB,GAAG,uBAAuB,AAA1B,CAA2B;aACpD,8BAAyB,GAAG,uBAAuB,AAA1B,CAA2B;IAQ5E,YACmB,KAAa,EAC9B,OAAO,GAAkD,EAAE;QAD1C,UAAK,GAAL,KAAK,CAAQ;QAfxB,UAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;QAC1C,aAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;QASrC,gBAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,mBAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;QAOlE,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;YAClC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;YACvC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,aAAa,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,MAAM,CAAC,eAAe,CAAC,KAAa;QAClC,MAAM,SAAS,GAAG,KAAK;aACpB,WAAW,EAAE;aACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;aAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC3B,OAAO,SAAS,IAAI,SAAS,CAAC;IAChC,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,YAAoB;QACvC,OAAO,iBAAiB,YAAY,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,YAAoB;QACrC,OAAO,qBAAqB,YAAY,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,OAAO,GAAqB,EAAE;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACtE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,YAAoB,EAAE,OAAyB;QAC1E,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,IACE,MAAM,KAAK,SAAS;gBACpB,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,EACjE,CAAC;gBACD,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,8CAA8C,CAAC,CAAC;gBACtF,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;gBAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBACtE,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,YAAY,CAAC,CAAC;YACtD,CAAC;iBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,kBAAkB,CAAC,CAAC;YAC5D,CAAC;iBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;gBAC5D,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,UAAU,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBACtE,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,UAAU,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAChC,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,YAAoB;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,MAAsB;QAC1D,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,YAAoB;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;IACjE,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,YAAoB;QAC7B,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YACtD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,iBAAiB,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,4BAA4B,aAAa,EAAE,EAC3C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAoB;QAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,sBAAsB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAErE,MAAM,IAAI,CAAC,oBAAoB,CAC7B,aAAa,EACb,aAAa,aAAa,UAAU,EACpC,8BAA8B,aAAa,EAAE,CAC9C,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,WAAW,WAAW,UAAU,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,4BAA4B,WAAW,EAAE,EACzC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACxD,IAAI,cAAc,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,GAAG,cAAc,CAAC,QAAQ,GAAG,SAAS,EAAE,CAAC;gBACrF,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,YAAY;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,WAAW;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAErD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAEnB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;YACnD,aAAa;YACb,OAAO,EAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC;SAC3D,CAAC,CAAC,CACJ,CAAC;QAEF,MAAM,cAAc,GAAoB,EAAE,CAAC;QAC3C,KAAK,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;YACnD,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC5B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC;gBAC/D,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,CAAC,aAAa,CAAC,CAAC;YACvE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,GAAG,CAAC,UAAU,CAAC,0DAA0D,EAAE,aAAa,CAAC,CAAC;gBAC1F,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAoB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACnD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAElC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;QAC7F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;QAC1C,GAAG,CAAC,OAAO,CACT,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,gCAAgC,OAAO,aAAa,OAAO,GAAG,CAC5F,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,YAAoB,EAAE,MAAuB,EAAE,aAAqB;QACnF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAChF,CAAC;IAEO,gBAAgB,CAAC,YAAoB;QAC3C,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,aAAa;YAC3C,sBAAsB,CAAC,aAAa,CAAC,YAAY,CAAC,CACnD,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,MAAwB;QACxC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAEO,UAAU,CAAC,KAAqB;QACtC,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,YAAoB,EACpB,aAAqB,EACrB,MAAwB,EACxB,OAAyB;QAEzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,sBAAsB,aAAa,eAAe,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG;YACb,SAAS;YACT,sBAAsB,CAAC,aAAa;YACpC,SAAS;YACT,sBAAsB,CAAC,gBAAgB;YACvC,SAAS;YACT,GAAG,sBAAsB,CAAC,kBAAkB,IAAI,YAAY,EAAE;SAC/D,CAAC;QACF,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CACT,SAAS,EACT,GAAG,sBAAsB,CAAC,yBAAyB,IAAI,OAAO,CAAC,cAAc,EAAE,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CACT,SAAS,EACT,GAAG,sBAAsB,CAAC,yBAAyB,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CACrF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YAChC,KAAK;YACL,IAAI;YACJ,QAAQ;YACR,aAAa;YACb,WAAW;YACX,WAAW;YACX,GAAG,MAAM;YACT,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAC7D,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YACzB,IAAI,CAAC,KAAK;YACV,OAAO;YACP,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,YAAoB;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QAC5D,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;IAEO,iBAAiB,CAAC,MAAkC;QAC1D,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,MAAM,EAAE,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACrC,kEAAkE;YAClE,qEAAqE;YACrE,sCAAsC;YACtC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,YAAoB,EAAE,aAAqB;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;QAC7E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACnC,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,SAAS,EAAE,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,gDAAgD,aAAa,EAAE,EAC/D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,qBAAqB,CAAC,GAAG,EAAE;gBACzB,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,mBAAmB;gBAC5B,SAAS,EAAE,uBAAuB;gBAClC,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE;oBACP,WAAW,EAAE,OAAO;oBACpB,YAAY;oBACZ,aAAa;oBACb,aAAa,EAAE,SAAS,CAAC,MAAM;oBAC/B,KAAK,EAAE,KAAK;iBACb;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,YAAoB,EACpB,aAAqB,EACrB,MAAwB;QAExB,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC/D,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,aAAqB,EACrB,MAAwB;QAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAEO,aAAa,CAAC,MAAwB;QAC5C,OAAO,MAAM;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;aACtC,KAAK,EAAE;aACP,QAAQ,EAAE,CAAC;IAChB,CAAC;IAEO,SAAS,CAAC,QAAkB,EAAE,MAAgB;QACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,aAAqB,EACrB,MAAwB;QAExB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,2BAA2B,sBAAsB,CAAC,yBAAyB,KAAK;YAChF,aAAa;SACd,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,MAAM,KAAK,QAAQ,CAAC;IAC7B,CAAC;IAEO,cAAc,CAAC,MAAwB;QAC7C,MAAM,OAAO,GAAG,MAAM;aACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACf,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC;SACvD,CAAC,CAAC;aACF,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxB,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CACnF,CAAC;QACJ,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IAEO,sBAAsB,CAAC,MAAc;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,aAAqB;QACnD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,4BAA4B;YAC5B,aAAa;SACd,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAY,CAAC;QAE5E,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,uDAAuD,aAAa,GAAG,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,YAAoB,EAAE,aAAqB;QAC3E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAClE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,6BAA6B;YAC7B,aAAa;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,YAAoB;QAC9C,MAAM,WAAW,GAAG,sBAAsB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YACvE,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;QAC7C,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YAChC,SAAS;YACT,QAAQ;YACR,UAAU;YACV,QAAQ;YACR,SAAS;YACT,sBAAsB,CAAC,aAAa;YACpC,SAAS;YACT,sBAAsB,CAAC,gBAAgB;YACvC,SAAS;YACT,GAAG,sBAAsB,CAAC,kBAAkB,IAAI,YAAY,EAAE;YAC9D,WAAW;SACZ,CAAC,CAAC;QACH,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,aAAqB;QAC/C,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,SAAS;gBACT,IAAI;gBACJ,oBAAoB;gBACpB,aAAa;aACd,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,qBAAqB,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB;QACrC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,IAAI;gBACJ,IAAI;gBACJ,UAAU;gBACV,SAAS,sBAAsB,CAAC,aAAa,EAAE;gBAC/C,UAAU;gBACV,SAAS,sBAAsB,CAAC,gBAAgB,EAAE;gBAClD,UAAU;gBACV,YAAY;aACb,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,2CAA2C,EAC3C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,0BAA0B;QACtC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,IAAI;gBACJ,IAAI;gBACJ,UAAU;gBACV,QAAQ,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE;gBAClD,UAAU;gBACV,YAAY;aACb,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,0CAA0C,EAC1C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,OAAO,MAAM;aACV,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,aAAqB;QAKrB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,SAAS;gBACT,IAAI;gBACJ,qEAAqE,sBAAsB,CAAC,kBAAkB,gCAAgC,sBAAsB,CAAC,yBAAyB,KAAK;gBACnM,aAAa;aACd,CAAC,CAAC;YACH,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5F,MAAM,OAAO,GAAG,UAAU,KAAK,MAAM,CAAC;YACtC,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;YACtD,MAAM,cAAc,GAAG,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,+BAA+B,aAAa,mBAAmB,EAC/D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QACvD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACnD,CAAC;IAEO,6BAA6B,CAAC,aAAqB;QACzD,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,aAAqB,EACrB,UAAkB,EAClB,UAAkB;QAElB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;YAC/D,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,aAAqB;QACvD,MAAM,IAAI,CAAC,oBAAoB,CAC7B,aAAa,EACb,kCAAkC,aAAa,iCAAiC,EAChF,2CAA2C,aAAa,EAAE,CAC3D,CAAC;IACJ,CAAC;CACF","sourcesContent":["import { execFile } from \"child_process\";\nimport { createHash } from \"crypto\";\nimport { readFileSync, statSync } from \"fs\";\nimport { promisify } from \"util\";\nimport * as log from \"./log.js\";\nimport { reportUserFacingError } from \"./sentry.js\";\n\nconst execFileAsync = promisify(execFile);\ntype ExecFileAsync = typeof execFileAsync;\n\ntype ContainerStatus = \"running\" | \"stopped\" | \"missing\";\n\nfunction isDockerNotFoundError(err: unknown): boolean {\n  if (!err || typeof err !== \"object\") return false;\n  const stderr = (err as { stderr?: unknown }).stderr;\n  const message = (err as { message?: unknown }).message;\n  const haystack = `${typeof stderr === \"string\" ? stderr : \"\"}\\n${\n    typeof message === \"string\" ? message : \"\"\n  }`.toLowerCase();\n  return (\n    haystack.includes(\"no such network\") ||\n    haystack.includes(\"no such container\") ||\n    haystack.includes(\"no such object\") ||\n    haystack.includes(\"network not found\") ||\n    /network [^\\n]+ not found/.test(haystack) ||\n    /error: no such [^\\n]+/.test(haystack)\n  );\n}\n\ninterface ContainerState {\n  status: ContainerStatus;\n  lastUsed: number;\n  containerName: string;\n}\n\nexport interface ContainerMount {\n  source: string;\n  target: string;\n}\n\nexport interface ResourceLimits {\n  cpus?: string;\n  memory?: string;\n}\n\nexport interface SandboxLimitStatus {\n  limits?: ResourceLimits;\n  boosted: boolean;\n}\n\nexport interface ProvisionOptions {\n  containerName?: string;\n  mounts?: ContainerMount[];\n  conversationId?: string;\n}\n\nexport interface DockerContainerManagerOptions {\n  limits?: ResourceLimits;\n  boostLimits?: ResourceLimits;\n  execFileImpl?: ExecFileAsync;\n}\n\nexport class DockerContainerManager {\n  private state = new Map<string, ContainerState>();\n  private inflight = new Map<string, Promise<string>>();\n  private static readonly MANAGED_LABEL = \"mikan.managed=true\";\n  private static readonly IMAGE_MODE_LABEL = \"mikan.sandbox=image\";\n  private static readonly VAULT_ID_LABEL_KEY = \"mikan.vault-id\";\n  private static readonly CONVERSATION_ID_LABEL_KEY = \"mikan.conversation-id\";\n  private static readonly MOUNT_SIGNATURE_LABEL_KEY = \"mikan.mount-signature\";\n\n  private readonly limits?: ResourceLimits;\n  private readonly boostLimits?: ResourceLimits;\n  private readonly boostedKeys = new Set<string>();\n  private readonly overrideLimits = new Map<string, ResourceLimits>();\n  private readonly execFileImpl: ExecFileAsync;\n\n  constructor(\n    private readonly image: string,\n    options: DockerContainerManagerOptions | ExecFileAsync = {},\n  ) {\n    if (typeof options === \"function\") {\n      this.execFileImpl = options;\n    } else {\n      this.limits = options.limits;\n      this.boostLimits = options.boostLimits;\n      this.execFileImpl = options.execFileImpl ?? execFileAsync;\n    }\n  }\n\n  static sanitizeSegment(value: string): string {\n    const sanitized = value\n      .toLowerCase()\n      .replace(/[^a-z0-9]+/g, \"-\")\n      .replace(/^-+|-+$/g, \"\");\n    return sanitized || \"unknown\";\n  }\n\n  static containerName(containerKey: string): string {\n    return `mikan-sandbox-${containerKey}`;\n  }\n\n  static networkName(containerKey: string): string {\n    return `mikan-sandbox-net-${containerKey}`;\n  }\n\n  async provision(containerKey: string, options: ProvisionOptions = {}): Promise<string> {\n    const existing = this.inflight.get(containerKey);\n    if (existing) return existing;\n\n    const pending = this.provisionInner(containerKey, options).finally(() => {\n      this.inflight.delete(containerKey);\n    });\n    this.inflight.set(containerKey, pending);\n    return pending;\n  }\n\n  private async provisionInner(containerKey: string, options: ProvisionOptions): Promise<string> {\n    const containerName =\n      options.containerName ?? DockerContainerManager.containerName(containerKey);\n    const mounts = options.mounts ?? [];\n    const status = await this.inspectStatus(containerName);\n\n    try {\n      if (\n        status !== \"missing\" &&\n        (await this.hasRuntimeDrift(containerKey, containerName, mounts))\n      ) {\n        log.logInfo(`Container ${containerName} configuration changed; recreating container`);\n        await this.execFileImpl(\"docker\", [\"rm\", \"-f\", containerName]);\n        await this.runContainer(containerKey, containerName, mounts, options);\n        log.logInfo(`Container ${containerName} recreated`);\n      } else if (status === \"running\") {\n        log.logInfo(`Container ${containerName} already running`);\n      } else if (status === \"stopped\") {\n        await this.execFileImpl(\"docker\", [\"start\", containerName]);\n        log.logInfo(`Container ${containerName} started`);\n      } else {\n        await this.runContainer(containerKey, containerName, mounts, options);\n        log.logInfo(`Container ${containerName} created`);\n      }\n    } catch (err) {\n      this.state.delete(containerKey);\n      throw err;\n    }\n\n    this.setState(containerKey, \"running\", containerName);\n    await this.applyResourceLimits(containerKey, containerName);\n    return containerName;\n  }\n\n  async boost(containerKey: string): Promise<SandboxLimitStatus> {\n    if (!this.boostLimits?.cpus && !this.boostLimits?.memory) {\n      return this.getLimitStatus(containerKey);\n    }\n\n    this.overrideLimits.delete(containerKey);\n    this.boostedKeys.add(containerKey);\n    const state = this.state.get(containerKey);\n    if (state?.status === \"running\") {\n      await this.applyResourceLimits(containerKey, state.containerName);\n    }\n    return this.getLimitStatus(containerKey);\n  }\n\n  async setLimits(containerKey: string, limits: ResourceLimits): Promise<SandboxLimitStatus> {\n    this.boostedKeys.delete(containerKey);\n    this.overrideLimits.set(containerKey, { ...this.limits, ...limits });\n    const state = this.state.get(containerKey);\n    if (state?.status === \"running\") {\n      await this.applyResourceLimits(containerKey, state.containerName);\n    }\n    return this.getLimitStatus(containerKey);\n  }\n\n  getLimitStatus(containerKey: string): SandboxLimitStatus {\n    const boosted = this.boostedKeys.has(containerKey);\n    return { limits: this.effectiveLimits(containerKey), boosted };\n  }\n\n  getDefaultLimits(): ResourceLimits | undefined {\n    return this.limits;\n  }\n\n  getBoostLimits(): ResourceLimits | undefined {\n    return this.boostLimits;\n  }\n\n  async stop(containerKey: string): Promise<void> {\n    const containerName = this.getContainerName(containerKey);\n    try {\n      await this.execFileImpl(\"docker\", [\"stop\", containerName]);\n      this.setState(containerKey, \"stopped\", containerName);\n      this.boostedKeys.delete(containerKey);\n      this.overrideLimits.delete(containerKey);\n      log.logInfo(`Container ${containerName} stopped (idle)`);\n    } catch (err) {\n      log.logWarning(\n        `Failed to stop container ${containerName}`,\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n  }\n\n  async remove(containerKey: string): Promise<void> {\n    const containerName = this.getContainerName(containerKey);\n    const networkName = DockerContainerManager.networkName(containerKey);\n\n    await this.forceRemoveContainer(\n      containerName,\n      `Container ${containerName} removed`,\n      `Failed to remove container ${containerName}`,\n    );\n\n    try {\n      await this.execFileImpl(\"docker\", [\"network\", \"rm\", networkName]);\n      log.logInfo(`Network ${networkName} removed`);\n    } catch (err) {\n      log.logWarning(\n        `Failed to remove network ${networkName}`,\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n\n    this.state.delete(containerKey);\n    this.boostedKeys.delete(containerKey);\n    this.overrideLimits.delete(containerKey);\n  }\n\n  async stopIdle(maxIdleMs: number): Promise<void> {\n    const now = Date.now();\n    const toStop: string[] = [];\n    for (const [containerKey, containerState] of this.state) {\n      if (containerState.status === \"running\" && now - containerState.lastUsed > maxIdleMs) {\n        toStop.push(containerKey);\n      }\n    }\n    await Promise.all(toStop.map((containerKey) => this.stop(containerKey)));\n  }\n\n  async reconcile(): Promise<void> {\n    const discovered = new Set<string>();\n    const labeledNames = await this.listContainerNamesByLabel();\n    for (const name of labeledNames) discovered.add(name);\n    const legacyNames = await this.listContainerNamesByPrefix();\n    for (const name of legacyNames) discovered.add(name);\n\n    this.state.clear();\n\n    const inspected = await Promise.all(\n      Array.from(discovered).map(async (containerName) => ({\n        containerName,\n        details: await this.inspectContainerDetails(containerName),\n      })),\n    );\n\n    const legacyRemovals: Promise<void>[] = [];\n    for (const { containerName, details } of inspected) {\n      if (!details) continue;\n\n      if (!details.conversationId) {\n        legacyRemovals.push(this.removeLegacyContainer(containerName));\n        continue;\n      }\n\n      const containerKey = this.containerKeyFromContainerName(containerName);\n      if (!containerKey) {\n        log.logWarning(`Skipping unmanaged-style container without container key`, containerName);\n        continue;\n      }\n\n      const status: ContainerStatus = details.running ? \"running\" : \"stopped\";\n      const lastUsed = details.startedAtMs ?? Date.now();\n      this.state.set(containerKey, { status, lastUsed, containerName });\n    }\n    await Promise.all(legacyRemovals);\n\n    const running = Array.from(this.state.values()).filter((s) => s.status === \"running\").length;\n    const stopped = this.state.size - running;\n    log.logInfo(\n      `Reconciled ${this.state.size} managed containers (running=${running}, stopped=${stopped})`,\n    );\n  }\n\n  private setState(containerKey: string, status: ContainerStatus, containerName: string): void {\n    this.state.set(containerKey, { status, lastUsed: Date.now(), containerName });\n  }\n\n  private getContainerName(containerKey: string): string {\n    return (\n      this.state.get(containerKey)?.containerName ??\n      DockerContainerManager.containerName(containerKey)\n    );\n  }\n\n  private mountArgs(mounts: ContainerMount[]): string[] {\n    return mounts.flatMap((mount) => [\"-v\", this.toBindSpec(mount)]);\n  }\n\n  private toBindSpec(mount: ContainerMount): string {\n    return `${mount.source}:${mount.target}`;\n  }\n\n  private async runContainer(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n    options: ProvisionOptions,\n  ): Promise<void> {\n    const networkName = await this.ensureNetwork(containerKey);\n    log.logInfo(`Creating container ${containerName} from image ${this.image}`);\n    const labels = [\n      \"--label\",\n      DockerContainerManager.MANAGED_LABEL,\n      \"--label\",\n      DockerContainerManager.IMAGE_MODE_LABEL,\n      \"--label\",\n      `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,\n    ];\n    if (options.conversationId) {\n      labels.push(\n        \"--label\",\n        `${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}=${options.conversationId}`,\n      );\n    }\n    if (mounts.length > 0) {\n      labels.push(\n        \"--label\",\n        `${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}=${this.mountSignature(mounts)}`,\n      );\n    }\n    await this.execFileImpl(\"docker\", [\n      \"run\",\n      \"-d\",\n      \"--name\",\n      containerName,\n      \"--network\",\n      networkName,\n      ...labels,\n      ...this.resourceLimitArgs(this.effectiveLimits(containerKey)),\n      ...this.mountArgs(mounts),\n      this.image,\n      \"sleep\",\n      \"infinity\",\n    ]);\n  }\n\n  private effectiveLimits(containerKey: string): ResourceLimits | undefined {\n    const override = this.overrideLimits.get(containerKey);\n    if (override) return override;\n    if (!this.boostedKeys.has(containerKey)) return this.limits;\n    return { ...this.limits, ...this.boostLimits };\n  }\n\n  private resourceLimitArgs(limits: ResourceLimits | undefined): string[] {\n    const args: string[] = [];\n    if (limits?.cpus) args.push(\"--cpus\", limits.cpus);\n    if (limits?.memory) {\n      args.push(\"--memory\", limits.memory);\n      // Keep Docker's no-extra-swap semantics explicit. Docker requires\n      // memory-swap to be updated together when raising an existing memory\n      // limit above the current swap limit.\n      args.push(\"--memory-swap\", limits.memory);\n    }\n    return args;\n  }\n\n  private async applyResourceLimits(containerKey: string, containerName: string): Promise<void> {\n    const limitArgs = this.resourceLimitArgs(this.effectiveLimits(containerKey));\n    if (limitArgs.length === 0) return;\n    const args = [\"update\", ...limitArgs, containerName];\n    try {\n      await this.execFileImpl(\"docker\", args);\n    } catch (err) {\n      log.logWarning(\n        `Failed to apply resource limits to container ${containerName}`,\n        err instanceof Error ? err.message : String(err),\n      );\n      reportUserFacingError(err, {\n        domain: \"sandbox\",\n        surface: \"sandbox_provision\",\n        operation: \"apply_resource_limits\",\n        severity: \"warning\",\n        context: {\n          sandboxType: \"image\",\n          containerKey,\n          containerName,\n          limitArgCount: limitArgs.length,\n          fatal: false,\n        },\n      });\n    }\n  }\n\n  private async hasRuntimeDrift(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<boolean> {\n    if (await this.hasBindMountDrift(containerName, mounts)) {\n      return true;\n    }\n    if (await this.hasMountSignatureDrift(containerName, mounts)) {\n      return true;\n    }\n    return this.hasNetworkModeDrift(containerKey, containerName);\n  }\n\n  private async hasBindMountDrift(\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<boolean> {\n    const expected = this.expectedBinds(mounts);\n    const actual = await this.inspectBindMounts(containerName);\n    return !this.sameBinds(expected, actual);\n  }\n\n  private expectedBinds(mounts: ContainerMount[]): string[] {\n    return mounts\n      .map((mount) => this.toBindSpec(mount))\n      .slice()\n      .toSorted();\n  }\n\n  private sameBinds(expected: string[], actual: string[]): boolean {\n    if (expected.length !== actual.length) {\n      return false;\n    }\n\n    return expected.every((bind, index) => bind === actual[index]);\n  }\n\n  private async hasMountSignatureDrift(\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<boolean> {\n    if (mounts.length === 0) return false;\n    const expected = this.mountSignature(mounts);\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      `{{index .Config.Labels \"${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}\"}}`,\n      containerName,\n    ]);\n    const actual = this.normalizeDockerValue(stdout.trim());\n    return actual !== expected;\n  }\n\n  private mountSignature(mounts: ContainerMount[]): string {\n    const payload = mounts\n      .map((mount) => ({\n        source: mount.source,\n        target: mount.target,\n        fingerprint: this.mountSourceFingerprint(mount.source),\n      }))\n      .toSorted((left, right) =>\n        `${left.target}\\0${left.source}`.localeCompare(`${right.target}\\0${right.source}`),\n      );\n    return createHash(\"sha256\").update(JSON.stringify(payload)).digest(\"hex\");\n  }\n\n  private mountSourceFingerprint(source: string): string {\n    try {\n      const stat = statSync(source);\n      if (stat.isFile()) {\n        return createHash(\"sha256\").update(readFileSync(source)).digest(\"hex\");\n      }\n      return `${stat.isDirectory() ? \"dir\" : \"other\"}:${stat.size}:${stat.mtimeMs}`;\n    } catch {\n      return \"missing\";\n    }\n  }\n\n  private async inspectBindMounts(containerName: string): Promise<string[]> {\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{json .HostConfig.Binds}}\",\n      containerName,\n    ]);\n    const payload = stdout.trim();\n    const parsed = JSON.parse(payload.length > 0 ? payload : \"null\") as unknown;\n\n    if (parsed === null) {\n      return [];\n    }\n\n    if (!Array.isArray(parsed) || parsed.some((bind) => typeof bind !== \"string\")) {\n      throw new Error(`Unexpected docker bind mount payload for container \"${containerName}\"`);\n    }\n\n    return [...parsed].toSorted();\n  }\n\n  private async hasNetworkModeDrift(containerKey: string, containerName: string): Promise<boolean> {\n    const expected = DockerContainerManager.networkName(containerKey);\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.HostConfig.NetworkMode}}\",\n      containerName,\n    ]);\n    return stdout.trim() !== expected;\n  }\n\n  private async ensureNetwork(containerKey: string): Promise<string> {\n    const networkName = DockerContainerManager.networkName(containerKey);\n    try {\n      await this.execFileImpl(\"docker\", [\"network\", \"inspect\", networkName]);\n      return networkName;\n    } catch (err) {\n      if (!isDockerNotFoundError(err)) throw err;\n    }\n    await this.execFileImpl(\"docker\", [\n      \"network\",\n      \"create\",\n      \"--driver\",\n      \"bridge\",\n      \"--label\",\n      DockerContainerManager.MANAGED_LABEL,\n      \"--label\",\n      DockerContainerManager.IMAGE_MODE_LABEL,\n      \"--label\",\n      `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,\n      networkName,\n    ]);\n    return networkName;\n  }\n\n  private async inspectStatus(containerName: string): Promise<ContainerStatus> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"inspect\",\n        \"-f\",\n        \"{{.State.Running}}\",\n        containerName,\n      ]);\n      return stdout.trim() === \"true\" ? \"running\" : \"stopped\";\n    } catch (err) {\n      if (isDockerNotFoundError(err)) return \"missing\";\n      throw err;\n    }\n  }\n\n  private async listContainerNamesByLabel(): Promise<string[]> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"ps\",\n        \"-a\",\n        \"--filter\",\n        `label=${DockerContainerManager.MANAGED_LABEL}`,\n        \"--filter\",\n        `label=${DockerContainerManager.IMAGE_MODE_LABEL}`,\n        \"--format\",\n        \"{{.Names}}\",\n      ]);\n      return this.parseNameLines(stdout);\n    } catch (err) {\n      log.logWarning(\n        \"Failed to list labeled managed containers\",\n        err instanceof Error ? err.message : String(err),\n      );\n      return [];\n    }\n  }\n\n  private async listContainerNamesByPrefix(): Promise<string[]> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"ps\",\n        \"-a\",\n        \"--filter\",\n        `name=${DockerContainerManager.containerName(\"\")}`,\n        \"--format\",\n        \"{{.Names}}\",\n      ]);\n      return this.parseNameLines(stdout);\n    } catch (err) {\n      log.logWarning(\n        \"Failed to list legacy managed containers\",\n        err instanceof Error ? err.message : String(err),\n      );\n      return [];\n    }\n  }\n\n  private parseNameLines(stdout: string): string[] {\n    return stdout\n      .split(\"\\n\")\n      .map((line) => line.trim())\n      .filter((line) => line.length > 0);\n  }\n\n  private async inspectContainerDetails(\n    containerName: string,\n  ): Promise<\n    | { running: boolean; startedAtMs?: number; vaultId?: string; conversationId?: string }\n    | undefined\n  > {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"inspect\",\n        \"-f\",\n        `{{.State.Running}}\\t{{.State.StartedAt}}\\t{{index .Config.Labels \"${DockerContainerManager.VAULT_ID_LABEL_KEY}\"}}\\t{{index .Config.Labels \"${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}\"}}`,\n        containerName,\n      ]);\n      const [runningRaw, startedAtRaw, vaultIdRaw, conversationIdRaw] = stdout.trim().split(\"\\t\");\n      const running = runningRaw === \"true\";\n      const startedAtMs = this.parseDockerTimestamp(startedAtRaw);\n      const vaultId = this.normalizeDockerValue(vaultIdRaw);\n      const conversationId = this.normalizeDockerValue(conversationIdRaw);\n      return { running, startedAtMs, vaultId, conversationId };\n    } catch (err) {\n      log.logWarning(\n        `Failed to inspect container ${containerName} during reconcile`,\n        err instanceof Error ? err.message : String(err),\n      );\n      return undefined;\n    }\n  }\n\n  private normalizeDockerValue(value?: string): string | undefined {\n    if (!value || value === \"<no value>\") return undefined;\n    const trimmed = value.trim();\n    return trimmed.length > 0 ? trimmed : undefined;\n  }\n\n  private parseDockerTimestamp(value?: string): number | undefined {\n    const normalized = this.normalizeDockerValue(value);\n    if (!normalized || normalized.startsWith(\"0001-\")) return undefined;\n    const parsed = Date.parse(normalized);\n    return Number.isNaN(parsed) ? undefined : parsed;\n  }\n\n  private containerKeyFromContainerName(containerName: string): string | undefined {\n    const prefix = DockerContainerManager.containerName(\"\");\n    if (!containerName.startsWith(prefix)) return undefined;\n    const containerKey = containerName.slice(prefix.length);\n    return containerKey.length > 0 ? containerKey : undefined;\n  }\n\n  private async forceRemoveContainer(\n    containerName: string,\n    successLog: string,\n    failureLog: string,\n  ): Promise<void> {\n    try {\n      await this.execFileImpl(\"docker\", [\"rm\", \"-f\", containerName]);\n      log.logInfo(successLog);\n    } catch (err) {\n      log.logWarning(failureLog, err instanceof Error ? err.message : String(err));\n    }\n  }\n\n  private async removeLegacyContainer(containerName: string): Promise<void> {\n    await this.forceRemoveContainer(\n      containerName,\n      `Removed legacy mikan container ${containerName} (pre-channel-isolation scheme)`,\n      `Failed to remove legacy mikan container ${containerName}`,\n    );\n  }\n}\n"]}
+{"version":3,"file":"provisioner.js","sourceRoot":"","sources":["../src/provisioner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAK1C,SAAS,qBAAqB,CAAC,GAAY;IACzC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,MAAM,OAAO,GAAI,GAA6B,CAAC,OAAO,CAAC;IACvD,MAAM,QAAQ,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAC1D,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAC1C,EAAE,CAAC,WAAW,EAAE,CAAC;IACjB,OAAO,CACL,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACpC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACtC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACnC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACtC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;QACzC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CACvC,CAAC;AACJ,CAAC;AAuBD,MAAM,OAAO,sBAAsB;aAGT,kBAAa,GAAG,oBAAoB,AAAvB,CAAwB;aACrC,qBAAgB,GAAG,qBAAqB,AAAxB,CAAyB;aACzC,uBAAkB,GAAG,gBAAgB,AAAnB,CAAoB;aACtC,8BAAyB,GAAG,uBAAuB,AAA1B,CAA2B;aACpD,8BAAyB,GAAG,uBAAuB,AAA1B,CAA2B;IAQ5E,YACmB,KAAa,EAC9B,OAAO,GAAkD,EAAE;QAD1C,UAAK,GAAL,KAAK,CAAQ;QAfxB,UAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;QAC1C,aAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;QASrC,gBAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,mBAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;QAOlE,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;YAClC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;YACvC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,aAAa,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,MAAM,CAAC,eAAe,CAAC,KAAa;QAClC,MAAM,SAAS,GAAG,KAAK;aACpB,WAAW,EAAE;aACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;aAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC3B,OAAO,SAAS,IAAI,SAAS,CAAC;IAChC,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,YAAoB;QACvC,OAAO,iBAAiB,YAAY,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,YAAoB;QACrC,OAAO,qBAAqB,YAAY,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,OAAO,GAAqB,EAAE;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACtE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,YAAoB,EAAE,OAAyB;QAC1E,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,IACE,MAAM,KAAK,SAAS;gBACpB,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,EACjE,CAAC;gBACD,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,8CAA8C,CAAC,CAAC;gBACtF,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;gBAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBACtE,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,YAAY,CAAC,CAAC;YACtD,CAAC;iBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,kBAAkB,CAAC,CAAC;YAC5D,CAAC;iBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;gBAC5D,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,UAAU,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBACtE,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,UAAU,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAChC,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,YAAoB;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,MAAsB;QAC1D,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,YAAoB;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;IACjE,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,YAAoB;QAC7B,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YACtD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,iBAAiB,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,4BAA4B,aAAa,EAAE,EAC3C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAoB;QAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,sBAAsB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAErE,MAAM,IAAI,CAAC,oBAAoB,CAC7B,aAAa,EACb,aAAa,aAAa,UAAU,EACpC,8BAA8B,aAAa,EAAE,CAC9C,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,WAAW,WAAW,UAAU,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,4BAA4B,WAAW,EAAE,EACzC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACxD,IAAI,cAAc,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,GAAG,cAAc,CAAC,QAAQ,GAAG,SAAS,EAAE,CAAC;gBACrF,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,YAAY;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,WAAW;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAErD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAEnB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;YACnD,aAAa;YACb,OAAO,EAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC;SAC3D,CAAC,CAAC,CACJ,CAAC;QAEF,MAAM,cAAc,GAAoB,EAAE,CAAC;QAC3C,KAAK,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;YACnD,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC5B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC;gBAC/D,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,CAAC,aAAa,CAAC,CAAC;YACvE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,GAAG,CAAC,UAAU,CAAC,0DAA0D,EAAE,aAAa,CAAC,CAAC;gBAC1F,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAoB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACnD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAElC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;QAC7F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;QAC1C,GAAG,CAAC,OAAO,CACT,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,gCAAgC,OAAO,aAAa,OAAO,GAAG,CAC5F,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,YAAoB,EAAE,MAAuB,EAAE,aAAqB;QACnF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAChF,CAAC;IAEO,gBAAgB,CAAC,YAAoB;QAC3C,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,aAAa;YAC3C,sBAAsB,CAAC,aAAa,CAAC,YAAY,CAAC,CACnD,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,MAAwB;QACxC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAEO,UAAU,CAAC,KAAqB;QACtC,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,YAAoB,EACpB,aAAqB,EACrB,MAAwB,EACxB,OAAyB;QAEzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,sBAAsB,aAAa,eAAe,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG;YACb,SAAS;YACT,sBAAsB,CAAC,aAAa;YACpC,SAAS;YACT,sBAAsB,CAAC,gBAAgB;YACvC,SAAS;YACT,GAAG,sBAAsB,CAAC,kBAAkB,IAAI,YAAY,EAAE;SAC/D,CAAC;QACF,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CACT,SAAS,EACT,GAAG,sBAAsB,CAAC,yBAAyB,IAAI,OAAO,CAAC,cAAc,EAAE,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CACT,SAAS,EACT,GAAG,sBAAsB,CAAC,yBAAyB,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CACrF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YAChC,KAAK;YACL,IAAI;YACJ,QAAQ;YACR,aAAa;YACb,WAAW;YACX,WAAW;YACX,GAAG,MAAM;YACT,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAC7D,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YACzB,IAAI,CAAC,KAAK;YACV,OAAO;YACP,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,YAAoB;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QAC5D,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;IAEO,iBAAiB,CAAC,MAAkC;QAC1D,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,MAAM,EAAE,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACrC,kEAAkE;YAClE,qEAAqE;YACrE,sCAAsC;YACtC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,YAAoB,EAAE,aAAqB;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;QAC7E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACnC,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,SAAS,EAAE,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,gDAAgD,aAAa,EAAE,EAC/D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,qBAAqB,CAAC,GAAG,EAAE;gBACzB,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,mBAAmB;gBAC5B,SAAS,EAAE,uBAAuB;gBAClC,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE;oBACP,WAAW,EAAE,OAAO;oBACpB,YAAY;oBACZ,aAAa;oBACb,aAAa,EAAE,SAAS,CAAC,MAAM;oBAC/B,KAAK,EAAE,KAAK;iBACb;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,YAAoB,EACpB,aAAqB,EACrB,MAAwB;QAExB,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC/D,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,aAAqB,EACrB,MAAwB;QAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAEO,aAAa,CAAC,MAAwB;QAC5C,OAAO,MAAM;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;aACtC,KAAK,EAAE;aACP,QAAQ,EAAE,CAAC;IAChB,CAAC;IAEO,SAAS,CAAC,QAAkB,EAAE,MAAgB;QACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,aAAqB,EACrB,MAAwB;QAExB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,2BAA2B,sBAAsB,CAAC,yBAAyB,KAAK;YAChF,aAAa;SACd,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,MAAM,KAAK,QAAQ,CAAC;IAC7B,CAAC;IAEO,cAAc,CAAC,MAAwB;QAC7C,MAAM,OAAO,GAAG,MAAM;aACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACf,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC;SACvD,CAAC,CAAC;aACF,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxB,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CACnF,CAAC;QACJ,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IAEO,sBAAsB,CAAC,MAAc;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,aAAqB;QACnD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,4BAA4B;YAC5B,aAAa;SACd,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAY,CAAC;QAE5E,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,uDAAuD,aAAa,GAAG,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,YAAoB,EAAE,aAAqB;QAC3E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAClE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,6BAA6B;YAC7B,aAAa;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,YAAoB;QAC9C,MAAM,WAAW,GAAG,sBAAsB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YACvE,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;QAC7C,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YAChC,SAAS;YACT,QAAQ;YACR,UAAU;YACV,QAAQ;YACR,SAAS;YACT,sBAAsB,CAAC,aAAa;YACpC,SAAS;YACT,sBAAsB,CAAC,gBAAgB;YACvC,SAAS;YACT,GAAG,sBAAsB,CAAC,kBAAkB,IAAI,YAAY,EAAE;YAC9D,WAAW;SACZ,CAAC,CAAC;QACH,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,aAAqB;QAC/C,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,SAAS;gBACT,IAAI;gBACJ,oBAAoB;gBACpB,aAAa;aACd,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,qBAAqB,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB;QACrC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,IAAI;gBACJ,IAAI;gBACJ,UAAU;gBACV,SAAS,sBAAsB,CAAC,aAAa,EAAE;gBAC/C,UAAU;gBACV,SAAS,sBAAsB,CAAC,gBAAgB,EAAE;gBAClD,UAAU;gBACV,YAAY;aACb,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,2CAA2C,EAC3C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,0BAA0B;QACtC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,IAAI;gBACJ,IAAI;gBACJ,UAAU;gBACV,QAAQ,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE;gBAClD,UAAU;gBACV,YAAY;aACb,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,0CAA0C,EAC1C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,OAAO,MAAM;aACV,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,aAAqB;QAKrB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,SAAS;gBACT,IAAI;gBACJ,qEAAqE,sBAAsB,CAAC,kBAAkB,gCAAgC,sBAAsB,CAAC,yBAAyB,KAAK;gBACnM,aAAa;aACd,CAAC,CAAC;YACH,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5F,MAAM,OAAO,GAAG,UAAU,KAAK,MAAM,CAAC;YACtC,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;YACtD,MAAM,cAAc,GAAG,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,+BAA+B,aAAa,mBAAmB,EAC/D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QACvD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACnD,CAAC;IAEO,6BAA6B,CAAC,aAAqB;QACzD,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,aAAqB,EACrB,UAAkB,EAClB,UAAkB;QAElB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;YAC/D,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,aAAqB;QACvD,MAAM,IAAI,CAAC,oBAAoB,CAC7B,aAAa,EACb,kCAAkC,aAAa,iCAAiC,EAChF,2CAA2C,aAAa,EAAE,CAC3D,CAAC;IACJ,CAAC;CACF","sourcesContent":["import { execFile } from \"child_process\";\nimport { createHash } from \"crypto\";\nimport { readFileSync, statSync } from \"fs\";\nimport { promisify } from \"util\";\nimport * as log from \"./log.js\";\nimport { reportUserFacingError } from \"./observability/sentry.js\";\n\nconst execFileAsync = promisify(execFile);\ntype ExecFileAsync = typeof execFileAsync;\n\ntype ContainerStatus = \"running\" | \"stopped\" | \"missing\";\n\nfunction isDockerNotFoundError(err: unknown): boolean {\n  if (!err || typeof err !== \"object\") return false;\n  const stderr = (err as { stderr?: unknown }).stderr;\n  const message = (err as { message?: unknown }).message;\n  const haystack = `${typeof stderr === \"string\" ? stderr : \"\"}\\n${\n    typeof message === \"string\" ? message : \"\"\n  }`.toLowerCase();\n  return (\n    haystack.includes(\"no such network\") ||\n    haystack.includes(\"no such container\") ||\n    haystack.includes(\"no such object\") ||\n    haystack.includes(\"network not found\") ||\n    /network [^\\n]+ not found/.test(haystack) ||\n    /error: no such [^\\n]+/.test(haystack)\n  );\n}\n\ninterface ContainerState {\n  status: ContainerStatus;\n  lastUsed: number;\n  containerName: string;\n}\n\nexport type {\n  ContainerMount,\n  DockerContainerManagerOptions,\n  ProvisionOptions,\n  ResourceLimits,\n  SandboxLimitStatus,\n} from \"./types.js\";\nimport type {\n  ContainerMount,\n  DockerContainerManagerOptions,\n  ProvisionOptions,\n  ResourceLimits,\n  SandboxLimitStatus,\n} from \"./types.js\";\n\nexport class DockerContainerManager {\n  private state = new Map<string, ContainerState>();\n  private inflight = new Map<string, Promise<string>>();\n  private static readonly MANAGED_LABEL = \"mikan.managed=true\";\n  private static readonly IMAGE_MODE_LABEL = \"mikan.sandbox=image\";\n  private static readonly VAULT_ID_LABEL_KEY = \"mikan.vault-id\";\n  private static readonly CONVERSATION_ID_LABEL_KEY = \"mikan.conversation-id\";\n  private static readonly MOUNT_SIGNATURE_LABEL_KEY = \"mikan.mount-signature\";\n\n  private readonly limits?: ResourceLimits;\n  private readonly boostLimits?: ResourceLimits;\n  private readonly boostedKeys = new Set<string>();\n  private readonly overrideLimits = new Map<string, ResourceLimits>();\n  private readonly execFileImpl: ExecFileAsync;\n\n  constructor(\n    private readonly image: string,\n    options: DockerContainerManagerOptions | ExecFileAsync = {},\n  ) {\n    if (typeof options === \"function\") {\n      this.execFileImpl = options;\n    } else {\n      this.limits = options.limits;\n      this.boostLimits = options.boostLimits;\n      this.execFileImpl = options.execFileImpl ?? execFileAsync;\n    }\n  }\n\n  static sanitizeSegment(value: string): string {\n    const sanitized = value\n      .toLowerCase()\n      .replace(/[^a-z0-9]+/g, \"-\")\n      .replace(/^-+|-+$/g, \"\");\n    return sanitized || \"unknown\";\n  }\n\n  static containerName(containerKey: string): string {\n    return `mikan-sandbox-${containerKey}`;\n  }\n\n  static networkName(containerKey: string): string {\n    return `mikan-sandbox-net-${containerKey}`;\n  }\n\n  async provision(containerKey: string, options: ProvisionOptions = {}): Promise<string> {\n    const existing = this.inflight.get(containerKey);\n    if (existing) return existing;\n\n    const pending = this.provisionInner(containerKey, options).finally(() => {\n      this.inflight.delete(containerKey);\n    });\n    this.inflight.set(containerKey, pending);\n    return pending;\n  }\n\n  private async provisionInner(containerKey: string, options: ProvisionOptions): Promise<string> {\n    const containerName =\n      options.containerName ?? DockerContainerManager.containerName(containerKey);\n    const mounts = options.mounts ?? [];\n    const status = await this.inspectStatus(containerName);\n\n    try {\n      if (\n        status !== \"missing\" &&\n        (await this.hasRuntimeDrift(containerKey, containerName, mounts))\n      ) {\n        log.logInfo(`Container ${containerName} configuration changed; recreating container`);\n        await this.execFileImpl(\"docker\", [\"rm\", \"-f\", containerName]);\n        await this.runContainer(containerKey, containerName, mounts, options);\n        log.logInfo(`Container ${containerName} recreated`);\n      } else if (status === \"running\") {\n        log.logInfo(`Container ${containerName} already running`);\n      } else if (status === \"stopped\") {\n        await this.execFileImpl(\"docker\", [\"start\", containerName]);\n        log.logInfo(`Container ${containerName} started`);\n      } else {\n        await this.runContainer(containerKey, containerName, mounts, options);\n        log.logInfo(`Container ${containerName} created`);\n      }\n    } catch (err) {\n      this.state.delete(containerKey);\n      throw err;\n    }\n\n    this.setState(containerKey, \"running\", containerName);\n    await this.applyResourceLimits(containerKey, containerName);\n    return containerName;\n  }\n\n  async boost(containerKey: string): Promise<SandboxLimitStatus> {\n    if (!this.boostLimits?.cpus && !this.boostLimits?.memory) {\n      return this.getLimitStatus(containerKey);\n    }\n\n    this.overrideLimits.delete(containerKey);\n    this.boostedKeys.add(containerKey);\n    const state = this.state.get(containerKey);\n    if (state?.status === \"running\") {\n      await this.applyResourceLimits(containerKey, state.containerName);\n    }\n    return this.getLimitStatus(containerKey);\n  }\n\n  async setLimits(containerKey: string, limits: ResourceLimits): Promise<SandboxLimitStatus> {\n    this.boostedKeys.delete(containerKey);\n    this.overrideLimits.set(containerKey, { ...this.limits, ...limits });\n    const state = this.state.get(containerKey);\n    if (state?.status === \"running\") {\n      await this.applyResourceLimits(containerKey, state.containerName);\n    }\n    return this.getLimitStatus(containerKey);\n  }\n\n  getLimitStatus(containerKey: string): SandboxLimitStatus {\n    const boosted = this.boostedKeys.has(containerKey);\n    return { limits: this.effectiveLimits(containerKey), boosted };\n  }\n\n  getDefaultLimits(): ResourceLimits | undefined {\n    return this.limits;\n  }\n\n  getBoostLimits(): ResourceLimits | undefined {\n    return this.boostLimits;\n  }\n\n  async stop(containerKey: string): Promise<void> {\n    const containerName = this.getContainerName(containerKey);\n    try {\n      await this.execFileImpl(\"docker\", [\"stop\", containerName]);\n      this.setState(containerKey, \"stopped\", containerName);\n      this.boostedKeys.delete(containerKey);\n      this.overrideLimits.delete(containerKey);\n      log.logInfo(`Container ${containerName} stopped (idle)`);\n    } catch (err) {\n      log.logWarning(\n        `Failed to stop container ${containerName}`,\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n  }\n\n  async remove(containerKey: string): Promise<void> {\n    const containerName = this.getContainerName(containerKey);\n    const networkName = DockerContainerManager.networkName(containerKey);\n\n    await this.forceRemoveContainer(\n      containerName,\n      `Container ${containerName} removed`,\n      `Failed to remove container ${containerName}`,\n    );\n\n    try {\n      await this.execFileImpl(\"docker\", [\"network\", \"rm\", networkName]);\n      log.logInfo(`Network ${networkName} removed`);\n    } catch (err) {\n      log.logWarning(\n        `Failed to remove network ${networkName}`,\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n\n    this.state.delete(containerKey);\n    this.boostedKeys.delete(containerKey);\n    this.overrideLimits.delete(containerKey);\n  }\n\n  async stopIdle(maxIdleMs: number): Promise<void> {\n    const now = Date.now();\n    const toStop: string[] = [];\n    for (const [containerKey, containerState] of this.state) {\n      if (containerState.status === \"running\" && now - containerState.lastUsed > maxIdleMs) {\n        toStop.push(containerKey);\n      }\n    }\n    await Promise.all(toStop.map((containerKey) => this.stop(containerKey)));\n  }\n\n  async reconcile(): Promise<void> {\n    const discovered = new Set<string>();\n    const labeledNames = await this.listContainerNamesByLabel();\n    for (const name of labeledNames) discovered.add(name);\n    const legacyNames = await this.listContainerNamesByPrefix();\n    for (const name of legacyNames) discovered.add(name);\n\n    this.state.clear();\n\n    const inspected = await Promise.all(\n      Array.from(discovered).map(async (containerName) => ({\n        containerName,\n        details: await this.inspectContainerDetails(containerName),\n      })),\n    );\n\n    const legacyRemovals: Promise<void>[] = [];\n    for (const { containerName, details } of inspected) {\n      if (!details) continue;\n\n      if (!details.conversationId) {\n        legacyRemovals.push(this.removeLegacyContainer(containerName));\n        continue;\n      }\n\n      const containerKey = this.containerKeyFromContainerName(containerName);\n      if (!containerKey) {\n        log.logWarning(`Skipping unmanaged-style container without container key`, containerName);\n        continue;\n      }\n\n      const status: ContainerStatus = details.running ? \"running\" : \"stopped\";\n      const lastUsed = details.startedAtMs ?? Date.now();\n      this.state.set(containerKey, { status, lastUsed, containerName });\n    }\n    await Promise.all(legacyRemovals);\n\n    const running = Array.from(this.state.values()).filter((s) => s.status === \"running\").length;\n    const stopped = this.state.size - running;\n    log.logInfo(\n      `Reconciled ${this.state.size} managed containers (running=${running}, stopped=${stopped})`,\n    );\n  }\n\n  private setState(containerKey: string, status: ContainerStatus, containerName: string): void {\n    this.state.set(containerKey, { status, lastUsed: Date.now(), containerName });\n  }\n\n  private getContainerName(containerKey: string): string {\n    return (\n      this.state.get(containerKey)?.containerName ??\n      DockerContainerManager.containerName(containerKey)\n    );\n  }\n\n  private mountArgs(mounts: ContainerMount[]): string[] {\n    return mounts.flatMap((mount) => [\"-v\", this.toBindSpec(mount)]);\n  }\n\n  private toBindSpec(mount: ContainerMount): string {\n    return `${mount.source}:${mount.target}`;\n  }\n\n  private async runContainer(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n    options: ProvisionOptions,\n  ): Promise<void> {\n    const networkName = await this.ensureNetwork(containerKey);\n    log.logInfo(`Creating container ${containerName} from image ${this.image}`);\n    const labels = [\n      \"--label\",\n      DockerContainerManager.MANAGED_LABEL,\n      \"--label\",\n      DockerContainerManager.IMAGE_MODE_LABEL,\n      \"--label\",\n      `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,\n    ];\n    if (options.conversationId) {\n      labels.push(\n        \"--label\",\n        `${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}=${options.conversationId}`,\n      );\n    }\n    if (mounts.length > 0) {\n      labels.push(\n        \"--label\",\n        `${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}=${this.mountSignature(mounts)}`,\n      );\n    }\n    await this.execFileImpl(\"docker\", [\n      \"run\",\n      \"-d\",\n      \"--name\",\n      containerName,\n      \"--network\",\n      networkName,\n      ...labels,\n      ...this.resourceLimitArgs(this.effectiveLimits(containerKey)),\n      ...this.mountArgs(mounts),\n      this.image,\n      \"sleep\",\n      \"infinity\",\n    ]);\n  }\n\n  private effectiveLimits(containerKey: string): ResourceLimits | undefined {\n    const override = this.overrideLimits.get(containerKey);\n    if (override) return override;\n    if (!this.boostedKeys.has(containerKey)) return this.limits;\n    return { ...this.limits, ...this.boostLimits };\n  }\n\n  private resourceLimitArgs(limits: ResourceLimits | undefined): string[] {\n    const args: string[] = [];\n    if (limits?.cpus) args.push(\"--cpus\", limits.cpus);\n    if (limits?.memory) {\n      args.push(\"--memory\", limits.memory);\n      // Keep Docker's no-extra-swap semantics explicit. Docker requires\n      // memory-swap to be updated together when raising an existing memory\n      // limit above the current swap limit.\n      args.push(\"--memory-swap\", limits.memory);\n    }\n    return args;\n  }\n\n  private async applyResourceLimits(containerKey: string, containerName: string): Promise<void> {\n    const limitArgs = this.resourceLimitArgs(this.effectiveLimits(containerKey));\n    if (limitArgs.length === 0) return;\n    const args = [\"update\", ...limitArgs, containerName];\n    try {\n      await this.execFileImpl(\"docker\", args);\n    } catch (err) {\n      log.logWarning(\n        `Failed to apply resource limits to container ${containerName}`,\n        err instanceof Error ? err.message : String(err),\n      );\n      reportUserFacingError(err, {\n        domain: \"sandbox\",\n        surface: \"sandbox_provision\",\n        operation: \"apply_resource_limits\",\n        severity: \"warning\",\n        context: {\n          sandboxType: \"image\",\n          containerKey,\n          containerName,\n          limitArgCount: limitArgs.length,\n          fatal: false,\n        },\n      });\n    }\n  }\n\n  private async hasRuntimeDrift(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<boolean> {\n    if (await this.hasBindMountDrift(containerName, mounts)) {\n      return true;\n    }\n    if (await this.hasMountSignatureDrift(containerName, mounts)) {\n      return true;\n    }\n    return this.hasNetworkModeDrift(containerKey, containerName);\n  }\n\n  private async hasBindMountDrift(\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<boolean> {\n    const expected = this.expectedBinds(mounts);\n    const actual = await this.inspectBindMounts(containerName);\n    return !this.sameBinds(expected, actual);\n  }\n\n  private expectedBinds(mounts: ContainerMount[]): string[] {\n    return mounts\n      .map((mount) => this.toBindSpec(mount))\n      .slice()\n      .toSorted();\n  }\n\n  private sameBinds(expected: string[], actual: string[]): boolean {\n    if (expected.length !== actual.length) {\n      return false;\n    }\n\n    return expected.every((bind, index) => bind === actual[index]);\n  }\n\n  private async hasMountSignatureDrift(\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<boolean> {\n    if (mounts.length === 0) return false;\n    const expected = this.mountSignature(mounts);\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      `{{index .Config.Labels \"${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}\"}}`,\n      containerName,\n    ]);\n    const actual = this.normalizeDockerValue(stdout.trim());\n    return actual !== expected;\n  }\n\n  private mountSignature(mounts: ContainerMount[]): string {\n    const payload = mounts\n      .map((mount) => ({\n        source: mount.source,\n        target: mount.target,\n        fingerprint: this.mountSourceFingerprint(mount.source),\n      }))\n      .toSorted((left, right) =>\n        `${left.target}\\0${left.source}`.localeCompare(`${right.target}\\0${right.source}`),\n      );\n    return createHash(\"sha256\").update(JSON.stringify(payload)).digest(\"hex\");\n  }\n\n  private mountSourceFingerprint(source: string): string {\n    try {\n      const stat = statSync(source);\n      if (stat.isFile()) {\n        return createHash(\"sha256\").update(readFileSync(source)).digest(\"hex\");\n      }\n      return `${stat.isDirectory() ? \"dir\" : \"other\"}:${stat.size}:${stat.mtimeMs}`;\n    } catch {\n      return \"missing\";\n    }\n  }\n\n  private async inspectBindMounts(containerName: string): Promise<string[]> {\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{json .HostConfig.Binds}}\",\n      containerName,\n    ]);\n    const payload = stdout.trim();\n    const parsed = JSON.parse(payload.length > 0 ? payload : \"null\") as unknown;\n\n    if (parsed === null) {\n      return [];\n    }\n\n    if (!Array.isArray(parsed) || parsed.some((bind) => typeof bind !== \"string\")) {\n      throw new Error(`Unexpected docker bind mount payload for container \"${containerName}\"`);\n    }\n\n    return [...parsed].toSorted();\n  }\n\n  private async hasNetworkModeDrift(containerKey: string, containerName: string): Promise<boolean> {\n    const expected = DockerContainerManager.networkName(containerKey);\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.HostConfig.NetworkMode}}\",\n      containerName,\n    ]);\n    return stdout.trim() !== expected;\n  }\n\n  private async ensureNetwork(containerKey: string): Promise<string> {\n    const networkName = DockerContainerManager.networkName(containerKey);\n    try {\n      await this.execFileImpl(\"docker\", [\"network\", \"inspect\", networkName]);\n      return networkName;\n    } catch (err) {\n      if (!isDockerNotFoundError(err)) throw err;\n    }\n    await this.execFileImpl(\"docker\", [\n      \"network\",\n      \"create\",\n      \"--driver\",\n      \"bridge\",\n      \"--label\",\n      DockerContainerManager.MANAGED_LABEL,\n      \"--label\",\n      DockerContainerManager.IMAGE_MODE_LABEL,\n      \"--label\",\n      `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,\n      networkName,\n    ]);\n    return networkName;\n  }\n\n  private async inspectStatus(containerName: string): Promise<ContainerStatus> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"inspect\",\n        \"-f\",\n        \"{{.State.Running}}\",\n        containerName,\n      ]);\n      return stdout.trim() === \"true\" ? \"running\" : \"stopped\";\n    } catch (err) {\n      if (isDockerNotFoundError(err)) return \"missing\";\n      throw err;\n    }\n  }\n\n  private async listContainerNamesByLabel(): Promise<string[]> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"ps\",\n        \"-a\",\n        \"--filter\",\n        `label=${DockerContainerManager.MANAGED_LABEL}`,\n        \"--filter\",\n        `label=${DockerContainerManager.IMAGE_MODE_LABEL}`,\n        \"--format\",\n        \"{{.Names}}\",\n      ]);\n      return this.parseNameLines(stdout);\n    } catch (err) {\n      log.logWarning(\n        \"Failed to list labeled managed containers\",\n        err instanceof Error ? err.message : String(err),\n      );\n      return [];\n    }\n  }\n\n  private async listContainerNamesByPrefix(): Promise<string[]> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"ps\",\n        \"-a\",\n        \"--filter\",\n        `name=${DockerContainerManager.containerName(\"\")}`,\n        \"--format\",\n        \"{{.Names}}\",\n      ]);\n      return this.parseNameLines(stdout);\n    } catch (err) {\n      log.logWarning(\n        \"Failed to list legacy managed containers\",\n        err instanceof Error ? err.message : String(err),\n      );\n      return [];\n    }\n  }\n\n  private parseNameLines(stdout: string): string[] {\n    return stdout\n      .split(\"\\n\")\n      .map((line) => line.trim())\n      .filter((line) => line.length > 0);\n  }\n\n  private async inspectContainerDetails(\n    containerName: string,\n  ): Promise<\n    | { running: boolean; startedAtMs?: number; vaultId?: string; conversationId?: string }\n    | undefined\n  > {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"inspect\",\n        \"-f\",\n        `{{.State.Running}}\\t{{.State.StartedAt}}\\t{{index .Config.Labels \"${DockerContainerManager.VAULT_ID_LABEL_KEY}\"}}\\t{{index .Config.Labels \"${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}\"}}`,\n        containerName,\n      ]);\n      const [runningRaw, startedAtRaw, vaultIdRaw, conversationIdRaw] = stdout.trim().split(\"\\t\");\n      const running = runningRaw === \"true\";\n      const startedAtMs = this.parseDockerTimestamp(startedAtRaw);\n      const vaultId = this.normalizeDockerValue(vaultIdRaw);\n      const conversationId = this.normalizeDockerValue(conversationIdRaw);\n      return { running, startedAtMs, vaultId, conversationId };\n    } catch (err) {\n      log.logWarning(\n        `Failed to inspect container ${containerName} during reconcile`,\n        err instanceof Error ? err.message : String(err),\n      );\n      return undefined;\n    }\n  }\n\n  private normalizeDockerValue(value?: string): string | undefined {\n    if (!value || value === \"<no value>\") return undefined;\n    const trimmed = value.trim();\n    return trimmed.length > 0 ? trimmed : undefined;\n  }\n\n  private parseDockerTimestamp(value?: string): number | undefined {\n    const normalized = this.normalizeDockerValue(value);\n    if (!normalized || normalized.startsWith(\"0001-\")) return undefined;\n    const parsed = Date.parse(normalized);\n    return Number.isNaN(parsed) ? undefined : parsed;\n  }\n\n  private containerKeyFromContainerName(containerName: string): string | undefined {\n    const prefix = DockerContainerManager.containerName(\"\");\n    if (!containerName.startsWith(prefix)) return undefined;\n    const containerKey = containerName.slice(prefix.length);\n    return containerKey.length > 0 ? containerKey : undefined;\n  }\n\n  private async forceRemoveContainer(\n    containerName: string,\n    successLog: string,\n    failureLog: string,\n  ): Promise<void> {\n    try {\n      await this.execFileImpl(\"docker\", [\"rm\", \"-f\", containerName]);\n      log.logInfo(successLog);\n    } catch (err) {\n      log.logWarning(failureLog, err instanceof Error ? err.message : String(err));\n    }\n  }\n\n  private async removeLegacyContainer(containerName: string): Promise<void> {\n    await this.forceRemoveContainer(\n      containerName,\n      `Removed legacy mikan container ${containerName} (pre-channel-isolation scheme)`,\n      `Failed to remove legacy mikan container ${containerName}`,\n    );\n  }\n}\n"]}

package/dist/runtime/conversation-orchestrator.d.ts

@@ -1,20 +1,6 @@
-import type { Bot, BotAdapters, BotEvent } from "../adapter.js";
-import type { AgentRunner } from "../agent.js";
-import type { CommandHandler, CommandServices } from "../commands/index.js";
-export interface ConversationRuntimeState {
-    running: boolean;
-    runner: AgentRunner;
-    stopRequested: boolean;
-    stopMessageTs?: string;
-    lastAccessedAt: number;
-    startedAt?: number;
-    lastActivityAt?: number;
-}
-export interface RunConversationOptions {
-    event: BotEvent;
-    bot: Bot;
-    adapters: BotAdapters;
-}
+import type { CommandHandler, CommandServices } from "../commands/types.js";
+export type { ConversationRuntimeState, RunSessionOptions } from "./types.js";
+import type { ConversationRuntimeState, RunSessionOptions } from "./types.js";
 interface ConversationOrchestratorOptions {
     workingDir: string;
     commandHandlers: readonly CommandHandler[];
@@ -37,8 +23,7 @@ interface ConversationOrchestratorOptions {
 export declare class ConversationOrchestrator {
     private readonly options;
     constructor(options: ConversationOrchestratorOptions);
-    runSession({ event, bot, adapters }: RunConversationOptions): Promise<void>;
+    runSession({ event, bot, adapters }: RunSessionOptions): Promise<void>;
     private runWithInstrumentation;
 }
-export {};
 //# sourceMappingURL=conversation-orchestrator.d.ts.map

package/dist/runtime/conversation-orchestrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conversation-orchestrator.d.ts","sourceRoot":"","sources":["../../src/runtime/conversation-orchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAgB,MAAM,eAAe,CAAC;AAE9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAQ5E,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,GAAG,CAAC;IACT,QAAQ,EAAE,WAAW,CAAC;CACvB;AAED,UAAU,+BAA+B;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,EAAE,MAAM,OAAO,CAAC;IAC9B,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;IACvE,gBAAgB,EAAE,CAAC,OAAO,EAAE;QAC1B,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACxC,sBAAsB,EAAE,CAAC,OAAO,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;IAC9F,gBAAgB,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IACtD,eAAe,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IACrD,aAAa,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,qBAAa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,+BAA+B,EAAI;IAEnE,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8GhF;YAEa,sBAAsB;CAyFrC","sourcesContent":["import type { Bot, BotAdapters, BotEvent, PlatformName } from \"../adapter.js\";\nimport { waitForThreadSessionBootstrap } from \"../sessions/chat-session-manager.js\";\nimport type { AgentRunner } from \"../agent.js\";\nimport { dispatchCommand } from \"../commands/index.js\";\nimport type { CommandHandler, CommandServices } from \"../commands/index.js\";\nimport { isPrivateConversation } from \"../commands/utils.js\";\nimport * as log from \"../log.js\";\nimport { addLifecycleBreadcrumb, applyRunScope, reportUserFacingError } from \"../sentry.js\";\nimport { formatStopped } from \"../ui-copy.js\";\nimport * as Sentry from \"@sentry/node\";\nimport { join } from \"path\";\n\nexport interface ConversationRuntimeState {\n  running: boolean;\n  runner: AgentRunner;\n  stopRequested: boolean;\n  stopMessageTs?: string;\n  lastAccessedAt: number;\n  startedAt?: number;\n  lastActivityAt?: number;\n}\n\nexport interface RunConversationOptions {\n  event: BotEvent;\n  bot: Bot;\n  adapters: BotAdapters;\n}\n\ninterface ConversationOrchestratorOptions {\n  workingDir: string;\n  commandHandlers: readonly CommandHandler[];\n  commandServices: CommandServices;\n  isShuttingDown: () => boolean;\n  getState: (sessionKey: string) => ConversationRuntimeState | undefined;\n  getOrCreateState: (options: {\n    conversationId: string;\n    sessionKey: string;\n    currentMessageId?: string;\n  }) => Promise<ConversationRuntimeState>;\n  hasMaterializedSession: (options: { conversationDir: string; sessionKey: string }) => boolean;\n  beforeRunTracked: (runPromise: Promise<void>) => void;\n  afterRunTracked: (runPromise: Promise<void>) => void;\n  onRunFinished: () => void;\n}\n\nexport class ConversationOrchestrator {\n  constructor(private readonly options: ConversationOrchestratorOptions) {}\n\n  async runSession({ event, bot, adapters }: RunConversationOptions): Promise<void> {\n    const conversationId = event.conversationId;\n    if (this.options.isShuttingDown()) {\n      log.logInfo(\n        `[${conversationId}] Rejected event during shutdown: ${event.text.substring(0, 50)}`,\n      );\n      return;\n    }\n\n    const sessionKey = event.sessionKey ?? `${conversationId}:${event.thread_ts ?? event.ts}`;\n    const privateConversation = isPrivateConversation(event);\n    const handledCommand = await dispatchCommand(this.options.commandHandlers, {\n      bot,\n      responseCtx: adapters.responseCtx,\n      platform: adapters.platform.name as PlatformName,\n      platformUserId: event.user,\n      conversationId,\n      vaultConversationId: event.vaultConversationId,\n      sessionKey,\n      commandText: event.text,\n      privateConversation,\n      services: this.options.commandServices,\n    });\n    if (handledCommand) return;\n\n    const conversationDir = join(this.options.workingDir, conversationId);\n    const waitedForParent = await waitForThreadSessionBootstrap({\n      parentSessionKey: conversationId,\n      sessionKey,\n      hasThreadSession: () => this.options.hasMaterializedSession({ conversationDir, sessionKey }),\n      isParentRunning: () => this.options.getState(conversationId)?.running === true,\n    });\n    if (waitedForParent) {\n      log.logInfo(\n        `[${conversationId}] Delayed thread bootstrap until parent session sealed: ${sessionKey}`,\n      );\n    }\n\n    let state: ConversationRuntimeState;\n    try {\n      state = await this.options.getOrCreateState({\n        conversationId,\n        sessionKey,\n        currentMessageId: event.ts,\n      });\n      state.runner.syncChatHistory(event.ts);\n    } catch (err) {\n      reportUserFacingError(err, {\n        domain: \"mikan\",\n        surface: \"session_setup\",\n        operation: \"get_or_create_state\",\n        severity: \"error\",\n        platform: adapters.platform.name,\n        context: {\n          conversationId,\n          sessionKey,\n          messageId: adapters.message.id,\n          threadTs: adapters.message.threadTs,\n          attachmentCount: adapters.message.attachments?.length ?? 0,\n        },\n      });\n      throw err;\n    }\n\n    state.running = true;\n    state.stopRequested = false;\n    state.startedAt = Date.now();\n    state.lastActivityAt = Date.now();\n\n    log.logInfo(`[${conversationId}] Starting run: ${event.text.substring(0, 50)}`);\n\n    const runPromise = (async () => {\n      try {\n        const result = await this.runWithInstrumentation(\n          adapters,\n          { conversationId, sessionKey, startedAt: state.startedAt! },\n          async () => {\n            await adapters.responseCtx.setTyping(true);\n            await adapters.responseCtx.setWorking(true);\n            const runnerResult = await state.runner.run(\n              adapters.message,\n              adapters.responseCtx,\n              adapters.platform,\n            );\n            await adapters.responseCtx.setWorking(false);\n            return runnerResult;\n          },\n        );\n\n        if (result?.stopReason === \"aborted\" && state.stopRequested) {\n          if (state.stopMessageTs) {\n            await bot.updateMessage(conversationId, state.stopMessageTs, formatStopped(bot));\n            state.stopMessageTs = undefined;\n          } else {\n            await bot.postMessage(conversationId, formatStopped(bot));\n          }\n        }\n      } finally {\n        state.running = false;\n        state.lastAccessedAt = Date.now();\n        this.options.onRunFinished();\n      }\n    })();\n\n    this.options.beforeRunTracked(runPromise);\n    try {\n      await runPromise;\n    } finally {\n      this.options.afterRunTracked(runPromise);\n    }\n  }\n\n  private async runWithInstrumentation(\n    adapters: BotAdapters,\n    meta: {\n      conversationId: string;\n      sessionKey: string;\n      startedAt: number;\n    },\n    body: () => Promise<{ stopReason: string; errorMessage?: string }>,\n  ): Promise<{ stopReason: string; errorMessage?: string } | undefined> {\n    const { conversationId, sessionKey, startedAt } = meta;\n    const { message, platform } = adapters;\n\n    Sentry.metrics.count(\"agent.run.started\", 1, {\n      attributes: { channel: conversationId },\n    });\n\n    return Sentry.startSpan(\n      { name: \"agent.run\", op: \"agent\", attributes: { conversationId, sessionKey } },\n      async () =>\n        Sentry.withScope(async (scope) => {\n          applyRunScope(scope, {\n            conversationId,\n            sessionKey,\n            messageId: message.id,\n            platform: platform.name,\n            userId: message.userId,\n            userName: message.userName,\n            threadTs: message.threadTs,\n          });\n          addLifecycleBreadcrumb(\"agent.run.started\", {\n            channel_id: conversationId,\n            platform: platform.name,\n            has_attachments: (message.attachments?.length ?? 0) > 0,\n          });\n\n          try {\n            const result = await body();\n            const durationMs = Date.now() - startedAt;\n            const completionAttrs = {\n              channel: conversationId,\n              platform: platform.name,\n              stop_reason: result.stopReason,\n            };\n            Sentry.metrics.distribution(\"agent.run.duration\", durationMs, {\n              unit: \"millisecond\",\n              attributes: completionAttrs,\n            });\n            Sentry.metrics.count(\"agent.run.completed\", 1, { attributes: completionAttrs });\n            addLifecycleBreadcrumb(\"agent.run.completed\", {\n              channel_id: conversationId,\n              platform: platform.name,\n              stop_reason: result.stopReason,\n              duration_ms: durationMs,\n            });\n            return result;\n          } catch (err) {\n            scope.setContext(\"agent_run_error\", {\n              conversationId,\n              sessionKey,\n              platform: platform.name,\n              messageId: message.id,\n              threadTs: message.threadTs,\n            });\n            reportUserFacingError(err, {\n              domain: \"mikan\",\n              surface: \"agent_run\",\n              operation: \"run\",\n              severity: \"error\",\n              platform: platform.name,\n              context: {\n                conversationId,\n                sessionKey,\n                messageId: message.id,\n                threadTs: message.threadTs,\n                attachmentCount: message.attachments?.length ?? 0,\n              },\n            });\n            Sentry.metrics.count(\"agent.run.errors\", 1, {\n              attributes: { channel: conversationId, platform: platform.name },\n            });\n            log.logWarning(\n              `[${conversationId}] Run error`,\n              err instanceof Error ? err.message : String(err),\n            );\n            return undefined;\n          }\n        }),\n    );\n  }\n}\n"]}
+{"version":3,"file":"conversation-orchestrator.d.ts","sourceRoot":"","sources":["../../src/runtime/conversation-orchestrator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAY5E,YAAY,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,KAAK,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE9E,UAAU,+BAA+B;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,EAAE,MAAM,OAAO,CAAC;IAC9B,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,wBAAwB,GAAG,SAAS,CAAC;IACvE,gBAAgB,EAAE,CAAC,OAAO,EAAE;QAC1B,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACxC,sBAAsB,EAAE,CAAC,OAAO,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;IAC9F,gBAAgB,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IACtD,eAAe,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IACrD,aAAa,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,qBAAa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,+BAA+B,EAAI;IAEnE,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8G3E;YAEa,sBAAsB;CAyFrC","sourcesContent":["import type { BotAdapters, PlatformName } from \"../adapter.js\";\nimport { waitForThreadSessionBootstrap } from \"../sessions/chat-session-manager.js\";\nimport { dispatchCommand } from \"../commands/registry.js\";\nimport type { CommandHandler, CommandServices } from \"../commands/types.js\";\nimport { isPrivateConversation } from \"../commands/utils.js\";\nimport * as log from \"../log.js\";\nimport {\n  addLifecycleBreadcrumb,\n  applyRunScope,\n  reportUserFacingError,\n} from \"../observability/sentry.js\";\nimport { formatStopped } from \"../platform-messages.js\";\nimport * as Sentry from \"@sentry/node\";\nimport { join } from \"path\";\n\nexport type { ConversationRuntimeState, RunSessionOptions } from \"./types.js\";\nimport type { ConversationRuntimeState, RunSessionOptions } from \"./types.js\";\n\ninterface ConversationOrchestratorOptions {\n  workingDir: string;\n  commandHandlers: readonly CommandHandler[];\n  commandServices: CommandServices;\n  isShuttingDown: () => boolean;\n  getState: (sessionKey: string) => ConversationRuntimeState | undefined;\n  getOrCreateState: (options: {\n    conversationId: string;\n    sessionKey: string;\n    currentMessageId?: string;\n  }) => Promise<ConversationRuntimeState>;\n  hasMaterializedSession: (options: { conversationDir: string; sessionKey: string }) => boolean;\n  beforeRunTracked: (runPromise: Promise<void>) => void;\n  afterRunTracked: (runPromise: Promise<void>) => void;\n  onRunFinished: () => void;\n}\n\nexport class ConversationOrchestrator {\n  constructor(private readonly options: ConversationOrchestratorOptions) {}\n\n  async runSession({ event, bot, adapters }: RunSessionOptions): Promise<void> {\n    const conversationId = event.conversationId;\n    if (this.options.isShuttingDown()) {\n      log.logInfo(\n        `[${conversationId}] Rejected event during shutdown: ${event.text.substring(0, 50)}`,\n      );\n      return;\n    }\n\n    const sessionKey = event.sessionKey ?? `${conversationId}:${event.thread_ts ?? event.ts}`;\n    const privateConversation = isPrivateConversation(event);\n    const handledCommand = await dispatchCommand(this.options.commandHandlers, {\n      bot,\n      responseCtx: adapters.responseCtx,\n      platform: adapters.platform.name as PlatformName,\n      platformUserId: event.user,\n      conversationId,\n      vaultConversationId: event.vaultConversationId,\n      sessionKey,\n      commandText: event.text,\n      privateConversation,\n      services: this.options.commandServices,\n    });\n    if (handledCommand) return;\n\n    const conversationDir = join(this.options.workingDir, conversationId);\n    const waitedForParent = await waitForThreadSessionBootstrap({\n      parentSessionKey: conversationId,\n      sessionKey,\n      hasThreadSession: () => this.options.hasMaterializedSession({ conversationDir, sessionKey }),\n      isParentRunning: () => this.options.getState(conversationId)?.running === true,\n    });\n    if (waitedForParent) {\n      log.logInfo(\n        `[${conversationId}] Delayed thread bootstrap until parent session sealed: ${sessionKey}`,\n      );\n    }\n\n    let state: ConversationRuntimeState;\n    try {\n      state = await this.options.getOrCreateState({\n        conversationId,\n        sessionKey,\n        currentMessageId: event.ts,\n      });\n      state.runner.syncChatHistory(event.ts);\n    } catch (err) {\n      reportUserFacingError(err, {\n        domain: \"mikan\",\n        surface: \"session_setup\",\n        operation: \"get_or_create_state\",\n        severity: \"error\",\n        platform: adapters.platform.name,\n        context: {\n          conversationId,\n          sessionKey,\n          messageId: adapters.message.id,\n          threadTs: adapters.message.threadTs,\n          attachmentCount: adapters.message.attachments?.length ?? 0,\n        },\n      });\n      throw err;\n    }\n\n    state.running = true;\n    state.stopRequested = false;\n    state.startedAt = Date.now();\n    state.lastActivityAt = Date.now();\n\n    log.logInfo(`[${conversationId}] Starting run: ${event.text.substring(0, 50)}`);\n\n    const runPromise = (async () => {\n      try {\n        const result = await this.runWithInstrumentation(\n          adapters,\n          { conversationId, sessionKey, startedAt: state.startedAt },\n          async () => {\n            await adapters.responseCtx.setTyping(true);\n            await adapters.responseCtx.setWorking(true);\n            const runnerResult = await state.runner.run(\n              adapters.message,\n              adapters.responseCtx,\n              adapters.platform,\n            );\n            await adapters.responseCtx.setWorking(false);\n            return runnerResult;\n          },\n        );\n\n        if (result?.stopReason === \"aborted\" && state.stopRequested) {\n          if (state.stopMessageTs) {\n            await bot.updateMessage(conversationId, state.stopMessageTs, formatStopped(bot));\n            state.stopMessageTs = undefined;\n          } else {\n            await bot.postMessage(conversationId, formatStopped(bot));\n          }\n        }\n      } finally {\n        state.running = false;\n        state.lastAccessedAt = Date.now();\n        this.options.onRunFinished();\n      }\n    })();\n\n    this.options.beforeRunTracked(runPromise);\n    try {\n      await runPromise;\n    } finally {\n      this.options.afterRunTracked(runPromise);\n    }\n  }\n\n  private async runWithInstrumentation(\n    adapters: BotAdapters,\n    meta: {\n      conversationId: string;\n      sessionKey: string;\n      startedAt: number;\n    },\n    body: () => Promise<{ stopReason: string; errorMessage?: string }>,\n  ): Promise<{ stopReason: string; errorMessage?: string } | undefined> {\n    const { conversationId, sessionKey, startedAt } = meta;\n    const { message, platform } = adapters;\n\n    Sentry.metrics.count(\"agent.run.started\", 1, {\n      attributes: { channel: conversationId },\n    });\n\n    return Sentry.startSpan(\n      { name: \"agent.run\", op: \"agent\", attributes: { conversationId, sessionKey } },\n      async () =>\n        Sentry.withScope(async (scope) => {\n          applyRunScope(scope, {\n            conversationId,\n            sessionKey,\n            messageId: message.id,\n            platform: platform.name,\n            userId: message.userId,\n            userName: message.userName,\n            threadTs: message.threadTs,\n          });\n          addLifecycleBreadcrumb(\"agent.run.started\", {\n            channel_id: conversationId,\n            platform: platform.name,\n            has_attachments: (message.attachments?.length ?? 0) > 0,\n          });\n\n          try {\n            const result = await body();\n            const durationMs = Date.now() - startedAt;\n            const completionAttrs = {\n              channel: conversationId,\n              platform: platform.name,\n              stop_reason: result.stopReason,\n            };\n            Sentry.metrics.distribution(\"agent.run.duration\", durationMs, {\n              unit: \"millisecond\",\n              attributes: completionAttrs,\n            });\n            Sentry.metrics.count(\"agent.run.completed\", 1, { attributes: completionAttrs });\n            addLifecycleBreadcrumb(\"agent.run.completed\", {\n              channel_id: conversationId,\n              platform: platform.name,\n              stop_reason: result.stopReason,\n              duration_ms: durationMs,\n            });\n            return result;\n          } catch (err) {\n            scope.setContext(\"agent_run_error\", {\n              conversationId,\n              sessionKey,\n              platform: platform.name,\n              messageId: message.id,\n              threadTs: message.threadTs,\n            });\n            reportUserFacingError(err, {\n              domain: \"mikan\",\n              surface: \"agent_run\",\n              operation: \"run\",\n              severity: \"error\",\n              platform: platform.name,\n              context: {\n                conversationId,\n                sessionKey,\n                messageId: message.id,\n                threadTs: message.threadTs,\n                attachmentCount: message.attachments?.length ?? 0,\n              },\n            });\n            Sentry.metrics.count(\"agent.run.errors\", 1, {\n              attributes: { channel: conversationId, platform: platform.name },\n            });\n            log.logWarning(\n              `[${conversationId}] Run error`,\n              err instanceof Error ? err.message : String(err),\n            );\n            return undefined;\n          }\n        }),\n    );\n  }\n}\n"]}

package/dist/runtime/conversation-orchestrator.js

@@ -1,9 +1,9 @@
 import { waitForThreadSessionBootstrap } from "../sessions/chat-session-manager.js";
-import { dispatchCommand } from "../commands/index.js";
+import { dispatchCommand } from "../commands/registry.js";
 import { isPrivateConversation } from "../commands/utils.js";
 import * as log from "../log.js";
-import { addLifecycleBreadcrumb, applyRunScope, reportUserFacingError } from "../sentry.js";
-import { formatStopped } from "../ui-copy.js";
+import { addLifecycleBreadcrumb, applyRunScope, reportUserFacingError, } from "../observability/sentry.js";
+import { formatStopped } from "../platform-messages.js";
 import * as Sentry from "@sentry/node";
 import { join } from "path";
 export class ConversationOrchestrator {

package/dist/runtime/conversation-orchestrator.js.map

@@ -1 +1 @@
-{"version":3,"file":"conversation-orchestrator.js","sourceRoot":"","sources":["../../src/runtime/conversation-orchestrator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AAEpF,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAmC5B,MAAM,OAAO,wBAAwB;IACnC,YAA6B,OAAwC;uBAAxC,OAAO;IAAoC,CAAC;IAEzE,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAA0B;QAC/D,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC5C,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;YAClC,GAAG,CAAC,OAAO,CACT,IAAI,cAAc,qCAAqC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CACrF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,GAAG,cAAc,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QAC1F,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE;YACzE,GAAG;YACH,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAoB;YAChD,cAAc,EAAE,KAAK,CAAC,IAAI;YAC1B,cAAc;YACd,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,UAAU;YACV,WAAW,EAAE,KAAK,CAAC,IAAI;YACvB,mBAAmB;YACnB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe;SACvC,CAAC,CAAC;QACH,IAAI,cAAc;YAAE,OAAO;QAE3B,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QACtE,MAAM,eAAe,GAAG,MAAM,6BAA6B,CAAC;YAC1D,gBAAgB,EAAE,cAAc;YAChC,UAAU;YACV,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;YAC5F,eAAe,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,KAAK,IAAI;SAC/E,CAAC,CAAC;QACH,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,OAAO,CACT,IAAI,cAAc,2DAA2D,UAAU,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBAC1C,cAAc;gBACd,UAAU;gBACV,gBAAgB,EAAE,KAAK,CAAC,EAAE;aAC3B,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qBAAqB,CAAC,GAAG,EAAE;gBACzB,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,eAAe;gBACxB,SAAS,EAAE,qBAAqB;gBAChC,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;gBAChC,OAAO,EAAE;oBACP,cAAc;oBACd,UAAU;oBACV,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE;oBAC9B,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ;oBACnC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC;iBAC3D;aACF,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC;QAC5B,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAElC,GAAG,CAAC,OAAO,CAAC,IAAI,cAAc,mBAAmB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAEhF,MAAM,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE;YAC7B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAC9C,QAAQ,EACR,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,SAAU,EAAE,EAC3D,KAAK,IAAI,EAAE;oBACT,MAAM,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;oBAC3C,MAAM,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;oBAC5C,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CACzC,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,WAAW,EACpB,QAAQ,CAAC,QAAQ,CAClB,CAAC;oBACF,MAAM,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;oBAC7C,OAAO,YAAY,CAAC;gBACtB,CAAC,CACF,CAAC;gBAEF,IAAI,MAAM,EAAE,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;oBAC5D,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;wBACxB,MAAM,GAAG,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;wBACjF,KAAK,CAAC,aAAa,GAAG,SAAS,CAAC;oBAClC,CAAC;yBAAM,CAAC;wBACN,MAAM,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;gBACtB,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAClC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,UAAU,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,QAAqB,EACrB,IAIC,EACD,IAAkE;QAElE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QACvD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;QAEvC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC,EAAE;YAC3C,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;SACxC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,SAAS,CACrB,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,EAC9E,KAAK,IAAI,EAAE,CACT,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC/B,aAAa,CAAC,KAAK,EAAE;gBACnB,cAAc;gBACd,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;YACH,sBAAsB,CAAC,mBAAmB,EAAE;gBAC1C,UAAU,EAAE,cAAc;gBAC1B,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,eAAe,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAC1C,MAAM,eAAe,GAAG;oBACtB,OAAO,EAAE,cAAc;oBACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,WAAW,EAAE,MAAM,CAAC,UAAU;iBAC/B,CAAC;gBACF,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,oBAAoB,EAAE,UAAU,EAAE;oBAC5D,IAAI,EAAE,aAAa;oBACnB,UAAU,EAAE,eAAe;iBAC5B,CAAC,CAAC;gBACH,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC;gBAChF,sBAAsB,CAAC,qBAAqB,EAAE;oBAC5C,UAAU,EAAE,cAAc;oBAC1B,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,WAAW,EAAE,MAAM,CAAC,UAAU;oBAC9B,WAAW,EAAE,UAAU;iBACxB,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,KAAK,CAAC,UAAU,CAAC,iBAAiB,EAAE;oBAClC,cAAc;oBACd,UAAU;oBACV,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC3B,CAAC,CAAC;gBACH,qBAAqB,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE,WAAW;oBACpB,SAAS,EAAE,KAAK;oBAChB,QAAQ,EAAE,OAAO;oBACjB,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,OAAO,EAAE;wBACP,cAAc;wBACd,UAAU;wBACV,SAAS,EAAE,OAAO,CAAC,EAAE;wBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,eAAe,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC;qBAClD;iBACF,CAAC,CAAC;gBACH,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,EAAE;oBAC1C,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;iBACjE,CAAC,CAAC;gBACH,GAAG,CAAC,UAAU,CACZ,IAAI,cAAc,aAAa,EAC/B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC,CAAC,CACL,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { Bot, BotAdapters, BotEvent, PlatformName } from \"../adapter.js\";\nimport { waitForThreadSessionBootstrap } from \"../sessions/chat-session-manager.js\";\nimport type { AgentRunner } from \"../agent.js\";\nimport { dispatchCommand } from \"../commands/index.js\";\nimport type { CommandHandler, CommandServices } from \"../commands/index.js\";\nimport { isPrivateConversation } from \"../commands/utils.js\";\nimport * as log from \"../log.js\";\nimport { addLifecycleBreadcrumb, applyRunScope, reportUserFacingError } from \"../sentry.js\";\nimport { formatStopped } from \"../ui-copy.js\";\nimport * as Sentry from \"@sentry/node\";\nimport { join } from \"path\";\n\nexport interface ConversationRuntimeState {\n  running: boolean;\n  runner: AgentRunner;\n  stopRequested: boolean;\n  stopMessageTs?: string;\n  lastAccessedAt: number;\n  startedAt?: number;\n  lastActivityAt?: number;\n}\n\nexport interface RunConversationOptions {\n  event: BotEvent;\n  bot: Bot;\n  adapters: BotAdapters;\n}\n\ninterface ConversationOrchestratorOptions {\n  workingDir: string;\n  commandHandlers: readonly CommandHandler[];\n  commandServices: CommandServices;\n  isShuttingDown: () => boolean;\n  getState: (sessionKey: string) => ConversationRuntimeState | undefined;\n  getOrCreateState: (options: {\n    conversationId: string;\n    sessionKey: string;\n    currentMessageId?: string;\n  }) => Promise<ConversationRuntimeState>;\n  hasMaterializedSession: (options: { conversationDir: string; sessionKey: string }) => boolean;\n  beforeRunTracked: (runPromise: Promise<void>) => void;\n  afterRunTracked: (runPromise: Promise<void>) => void;\n  onRunFinished: () => void;\n}\n\nexport class ConversationOrchestrator {\n  constructor(private readonly options: ConversationOrchestratorOptions) {}\n\n  async runSession({ event, bot, adapters }: RunConversationOptions): Promise<void> {\n    const conversationId = event.conversationId;\n    if (this.options.isShuttingDown()) {\n      log.logInfo(\n        `[${conversationId}] Rejected event during shutdown: ${event.text.substring(0, 50)}`,\n      );\n      return;\n    }\n\n    const sessionKey = event.sessionKey ?? `${conversationId}:${event.thread_ts ?? event.ts}`;\n    const privateConversation = isPrivateConversation(event);\n    const handledCommand = await dispatchCommand(this.options.commandHandlers, {\n      bot,\n      responseCtx: adapters.responseCtx,\n      platform: adapters.platform.name as PlatformName,\n      platformUserId: event.user,\n      conversationId,\n      vaultConversationId: event.vaultConversationId,\n      sessionKey,\n      commandText: event.text,\n      privateConversation,\n      services: this.options.commandServices,\n    });\n    if (handledCommand) return;\n\n    const conversationDir = join(this.options.workingDir, conversationId);\n    const waitedForParent = await waitForThreadSessionBootstrap({\n      parentSessionKey: conversationId,\n      sessionKey,\n      hasThreadSession: () => this.options.hasMaterializedSession({ conversationDir, sessionKey }),\n      isParentRunning: () => this.options.getState(conversationId)?.running === true,\n    });\n    if (waitedForParent) {\n      log.logInfo(\n        `[${conversationId}] Delayed thread bootstrap until parent session sealed: ${sessionKey}`,\n      );\n    }\n\n    let state: ConversationRuntimeState;\n    try {\n      state = await this.options.getOrCreateState({\n        conversationId,\n        sessionKey,\n        currentMessageId: event.ts,\n      });\n      state.runner.syncChatHistory(event.ts);\n    } catch (err) {\n      reportUserFacingError(err, {\n        domain: \"mikan\",\n        surface: \"session_setup\",\n        operation: \"get_or_create_state\",\n        severity: \"error\",\n        platform: adapters.platform.name,\n        context: {\n          conversationId,\n          sessionKey,\n          messageId: adapters.message.id,\n          threadTs: adapters.message.threadTs,\n          attachmentCount: adapters.message.attachments?.length ?? 0,\n        },\n      });\n      throw err;\n    }\n\n    state.running = true;\n    state.stopRequested = false;\n    state.startedAt = Date.now();\n    state.lastActivityAt = Date.now();\n\n    log.logInfo(`[${conversationId}] Starting run: ${event.text.substring(0, 50)}`);\n\n    const runPromise = (async () => {\n      try {\n        const result = await this.runWithInstrumentation(\n          adapters,\n          { conversationId, sessionKey, startedAt: state.startedAt! },\n          async () => {\n            await adapters.responseCtx.setTyping(true);\n            await adapters.responseCtx.setWorking(true);\n            const runnerResult = await state.runner.run(\n              adapters.message,\n              adapters.responseCtx,\n              adapters.platform,\n            );\n            await adapters.responseCtx.setWorking(false);\n            return runnerResult;\n          },\n        );\n\n        if (result?.stopReason === \"aborted\" && state.stopRequested) {\n          if (state.stopMessageTs) {\n            await bot.updateMessage(conversationId, state.stopMessageTs, formatStopped(bot));\n            state.stopMessageTs = undefined;\n          } else {\n            await bot.postMessage(conversationId, formatStopped(bot));\n          }\n        }\n      } finally {\n        state.running = false;\n        state.lastAccessedAt = Date.now();\n        this.options.onRunFinished();\n      }\n    })();\n\n    this.options.beforeRunTracked(runPromise);\n    try {\n      await runPromise;\n    } finally {\n      this.options.afterRunTracked(runPromise);\n    }\n  }\n\n  private async runWithInstrumentation(\n    adapters: BotAdapters,\n    meta: {\n      conversationId: string;\n      sessionKey: string;\n      startedAt: number;\n    },\n    body: () => Promise<{ stopReason: string; errorMessage?: string }>,\n  ): Promise<{ stopReason: string; errorMessage?: string } | undefined> {\n    const { conversationId, sessionKey, startedAt } = meta;\n    const { message, platform } = adapters;\n\n    Sentry.metrics.count(\"agent.run.started\", 1, {\n      attributes: { channel: conversationId },\n    });\n\n    return Sentry.startSpan(\n      { name: \"agent.run\", op: \"agent\", attributes: { conversationId, sessionKey } },\n      async () =>\n        Sentry.withScope(async (scope) => {\n          applyRunScope(scope, {\n            conversationId,\n            sessionKey,\n            messageId: message.id,\n            platform: platform.name,\n            userId: message.userId,\n            userName: message.userName,\n            threadTs: message.threadTs,\n          });\n          addLifecycleBreadcrumb(\"agent.run.started\", {\n            channel_id: conversationId,\n            platform: platform.name,\n            has_attachments: (message.attachments?.length ?? 0) > 0,\n          });\n\n          try {\n            const result = await body();\n            const durationMs = Date.now() - startedAt;\n            const completionAttrs = {\n              channel: conversationId,\n              platform: platform.name,\n              stop_reason: result.stopReason,\n            };\n            Sentry.metrics.distribution(\"agent.run.duration\", durationMs, {\n              unit: \"millisecond\",\n              attributes: completionAttrs,\n            });\n            Sentry.metrics.count(\"agent.run.completed\", 1, { attributes: completionAttrs });\n            addLifecycleBreadcrumb(\"agent.run.completed\", {\n              channel_id: conversationId,\n              platform: platform.name,\n              stop_reason: result.stopReason,\n              duration_ms: durationMs,\n            });\n            return result;\n          } catch (err) {\n            scope.setContext(\"agent_run_error\", {\n              conversationId,\n              sessionKey,\n              platform: platform.name,\n              messageId: message.id,\n              threadTs: message.threadTs,\n            });\n            reportUserFacingError(err, {\n              domain: \"mikan\",\n              surface: \"agent_run\",\n              operation: \"run\",\n              severity: \"error\",\n              platform: platform.name,\n              context: {\n                conversationId,\n                sessionKey,\n                messageId: message.id,\n                threadTs: message.threadTs,\n                attachmentCount: message.attachments?.length ?? 0,\n              },\n            });\n            Sentry.metrics.count(\"agent.run.errors\", 1, {\n              attributes: { channel: conversationId, platform: platform.name },\n            });\n            log.logWarning(\n              `[${conversationId}] Run error`,\n              err instanceof Error ? err.message : String(err),\n            );\n            return undefined;\n          }\n        }),\n    );\n  }\n}\n"]}
+{"version":3,"file":"conversation-orchestrator.js","sourceRoot":"","sources":["../../src/runtime/conversation-orchestrator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,qBAAqB,GACtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAsB5B,MAAM,OAAO,wBAAwB;IACnC,YAA6B,OAAwC;uBAAxC,OAAO;IAAoC,CAAC;IAEzE,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAqB;QAC1D,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC5C,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;YAClC,GAAG,CAAC,OAAO,CACT,IAAI,cAAc,qCAAqC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CACrF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,GAAG,cAAc,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QAC1F,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE;YACzE,GAAG;YACH,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAoB;YAChD,cAAc,EAAE,KAAK,CAAC,IAAI;YAC1B,cAAc;YACd,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,UAAU;YACV,WAAW,EAAE,KAAK,CAAC,IAAI;YACvB,mBAAmB;YACnB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe;SACvC,CAAC,CAAC;QACH,IAAI,cAAc;YAAE,OAAO;QAE3B,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QACtE,MAAM,eAAe,GAAG,MAAM,6BAA6B,CAAC;YAC1D,gBAAgB,EAAE,cAAc;YAChC,UAAU;YACV,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;YAC5F,eAAe,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,KAAK,IAAI;SAC/E,CAAC,CAAC;QACH,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,OAAO,CACT,IAAI,cAAc,2DAA2D,UAAU,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBAC1C,cAAc;gBACd,UAAU;gBACV,gBAAgB,EAAE,KAAK,CAAC,EAAE;aAC3B,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qBAAqB,CAAC,GAAG,EAAE;gBACzB,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,eAAe;gBACxB,SAAS,EAAE,qBAAqB;gBAChC,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;gBAChC,OAAO,EAAE;oBACP,cAAc;oBACd,UAAU;oBACV,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE;oBAC9B,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ;oBACnC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC;iBAC3D;aACF,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC;QAC5B,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAElC,GAAG,CAAC,OAAO,CAAC,IAAI,cAAc,mBAAmB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAEhF,MAAM,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE;YAC7B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAC9C,QAAQ,EACR,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAC1D,KAAK,IAAI,EAAE;oBACT,MAAM,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;oBAC3C,MAAM,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;oBAC5C,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CACzC,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,WAAW,EACpB,QAAQ,CAAC,QAAQ,CAClB,CAAC;oBACF,MAAM,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;oBAC7C,OAAO,YAAY,CAAC;gBACtB,CAAC,CACF,CAAC;gBAEF,IAAI,MAAM,EAAE,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;oBAC5D,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;wBACxB,MAAM,GAAG,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;wBACjF,KAAK,CAAC,aAAa,GAAG,SAAS,CAAC;oBAClC,CAAC;yBAAM,CAAC;wBACN,MAAM,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;gBACtB,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAClC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,UAAU,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,QAAqB,EACrB,IAIC,EACD,IAAkE;QAElE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QACvD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;QAEvC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC,EAAE;YAC3C,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;SACxC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,SAAS,CACrB,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,EAC9E,KAAK,IAAI,EAAE,CACT,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC/B,aAAa,CAAC,KAAK,EAAE;gBACnB,cAAc;gBACd,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;YACH,sBAAsB,CAAC,mBAAmB,EAAE;gBAC1C,UAAU,EAAE,cAAc;gBAC1B,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,eAAe,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAC1C,MAAM,eAAe,GAAG;oBACtB,OAAO,EAAE,cAAc;oBACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,WAAW,EAAE,MAAM,CAAC,UAAU;iBAC/B,CAAC;gBACF,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,oBAAoB,EAAE,UAAU,EAAE;oBAC5D,IAAI,EAAE,aAAa;oBACnB,UAAU,EAAE,eAAe;iBAC5B,CAAC,CAAC;gBACH,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC;gBAChF,sBAAsB,CAAC,qBAAqB,EAAE;oBAC5C,UAAU,EAAE,cAAc;oBAC1B,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,WAAW,EAAE,MAAM,CAAC,UAAU;oBAC9B,WAAW,EAAE,UAAU;iBACxB,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,KAAK,CAAC,UAAU,CAAC,iBAAiB,EAAE;oBAClC,cAAc;oBACd,UAAU;oBACV,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC3B,CAAC,CAAC;gBACH,qBAAqB,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE,WAAW;oBACpB,SAAS,EAAE,KAAK;oBAChB,QAAQ,EAAE,OAAO;oBACjB,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,OAAO,EAAE;wBACP,cAAc;wBACd,UAAU;wBACV,SAAS,EAAE,OAAO,CAAC,EAAE;wBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,eAAe,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC;qBAClD;iBACF,CAAC,CAAC;gBACH,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,EAAE;oBAC1C,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;iBACjE,CAAC,CAAC;gBACH,GAAG,CAAC,UAAU,CACZ,IAAI,cAAc,aAAa,EAC/B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC,CAAC,CACL,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { BotAdapters, PlatformName } from \"../adapter.js\";\nimport { waitForThreadSessionBootstrap } from \"../sessions/chat-session-manager.js\";\nimport { dispatchCommand } from \"../commands/registry.js\";\nimport type { CommandHandler, CommandServices } from \"../commands/types.js\";\nimport { isPrivateConversation } from \"../commands/utils.js\";\nimport * as log from \"../log.js\";\nimport {\n  addLifecycleBreadcrumb,\n  applyRunScope,\n  reportUserFacingError,\n} from \"../observability/sentry.js\";\nimport { formatStopped } from \"../platform-messages.js\";\nimport * as Sentry from \"@sentry/node\";\nimport { join } from \"path\";\n\nexport type { ConversationRuntimeState, RunSessionOptions } from \"./types.js\";\nimport type { ConversationRuntimeState, RunSessionOptions } from \"./types.js\";\n\ninterface ConversationOrchestratorOptions {\n  workingDir: string;\n  commandHandlers: readonly CommandHandler[];\n  commandServices: CommandServices;\n  isShuttingDown: () => boolean;\n  getState: (sessionKey: string) => ConversationRuntimeState | undefined;\n  getOrCreateState: (options: {\n    conversationId: string;\n    sessionKey: string;\n    currentMessageId?: string;\n  }) => Promise<ConversationRuntimeState>;\n  hasMaterializedSession: (options: { conversationDir: string; sessionKey: string }) => boolean;\n  beforeRunTracked: (runPromise: Promise<void>) => void;\n  afterRunTracked: (runPromise: Promise<void>) => void;\n  onRunFinished: () => void;\n}\n\nexport class ConversationOrchestrator {\n  constructor(private readonly options: ConversationOrchestratorOptions) {}\n\n  async runSession({ event, bot, adapters }: RunSessionOptions): Promise<void> {\n    const conversationId = event.conversationId;\n    if (this.options.isShuttingDown()) {\n      log.logInfo(\n        `[${conversationId}] Rejected event during shutdown: ${event.text.substring(0, 50)}`,\n      );\n      return;\n    }\n\n    const sessionKey = event.sessionKey ?? `${conversationId}:${event.thread_ts ?? event.ts}`;\n    const privateConversation = isPrivateConversation(event);\n    const handledCommand = await dispatchCommand(this.options.commandHandlers, {\n      bot,\n      responseCtx: adapters.responseCtx,\n      platform: adapters.platform.name as PlatformName,\n      platformUserId: event.user,\n      conversationId,\n      vaultConversationId: event.vaultConversationId,\n      sessionKey,\n      commandText: event.text,\n      privateConversation,\n      services: this.options.commandServices,\n    });\n    if (handledCommand) return;\n\n    const conversationDir = join(this.options.workingDir, conversationId);\n    const waitedForParent = await waitForThreadSessionBootstrap({\n      parentSessionKey: conversationId,\n      sessionKey,\n      hasThreadSession: () => this.options.hasMaterializedSession({ conversationDir, sessionKey }),\n      isParentRunning: () => this.options.getState(conversationId)?.running === true,\n    });\n    if (waitedForParent) {\n      log.logInfo(\n        `[${conversationId}] Delayed thread bootstrap until parent session sealed: ${sessionKey}`,\n      );\n    }\n\n    let state: ConversationRuntimeState;\n    try {\n      state = await this.options.getOrCreateState({\n        conversationId,\n        sessionKey,\n        currentMessageId: event.ts,\n      });\n      state.runner.syncChatHistory(event.ts);\n    } catch (err) {\n      reportUserFacingError(err, {\n        domain: \"mikan\",\n        surface: \"session_setup\",\n        operation: \"get_or_create_state\",\n        severity: \"error\",\n        platform: adapters.platform.name,\n        context: {\n          conversationId,\n          sessionKey,\n          messageId: adapters.message.id,\n          threadTs: adapters.message.threadTs,\n          attachmentCount: adapters.message.attachments?.length ?? 0,\n        },\n      });\n      throw err;\n    }\n\n    state.running = true;\n    state.stopRequested = false;\n    state.startedAt = Date.now();\n    state.lastActivityAt = Date.now();\n\n    log.logInfo(`[${conversationId}] Starting run: ${event.text.substring(0, 50)}`);\n\n    const runPromise = (async () => {\n      try {\n        const result = await this.runWithInstrumentation(\n          adapters,\n          { conversationId, sessionKey, startedAt: state.startedAt },\n          async () => {\n            await adapters.responseCtx.setTyping(true);\n            await adapters.responseCtx.setWorking(true);\n            const runnerResult = await state.runner.run(\n              adapters.message,\n              adapters.responseCtx,\n              adapters.platform,\n            );\n            await adapters.responseCtx.setWorking(false);\n            return runnerResult;\n          },\n        );\n\n        if (result?.stopReason === \"aborted\" && state.stopRequested) {\n          if (state.stopMessageTs) {\n            await bot.updateMessage(conversationId, state.stopMessageTs, formatStopped(bot));\n            state.stopMessageTs = undefined;\n          } else {\n            await bot.postMessage(conversationId, formatStopped(bot));\n          }\n        }\n      } finally {\n        state.running = false;\n        state.lastAccessedAt = Date.now();\n        this.options.onRunFinished();\n      }\n    })();\n\n    this.options.beforeRunTracked(runPromise);\n    try {\n      await runPromise;\n    } finally {\n      this.options.afterRunTracked(runPromise);\n    }\n  }\n\n  private async runWithInstrumentation(\n    adapters: BotAdapters,\n    meta: {\n      conversationId: string;\n      sessionKey: string;\n      startedAt: number;\n    },\n    body: () => Promise<{ stopReason: string; errorMessage?: string }>,\n  ): Promise<{ stopReason: string; errorMessage?: string } | undefined> {\n    const { conversationId, sessionKey, startedAt } = meta;\n    const { message, platform } = adapters;\n\n    Sentry.metrics.count(\"agent.run.started\", 1, {\n      attributes: { channel: conversationId },\n    });\n\n    return Sentry.startSpan(\n      { name: \"agent.run\", op: \"agent\", attributes: { conversationId, sessionKey } },\n      async () =>\n        Sentry.withScope(async (scope) => {\n          applyRunScope(scope, {\n            conversationId,\n            sessionKey,\n            messageId: message.id,\n            platform: platform.name,\n            userId: message.userId,\n            userName: message.userName,\n            threadTs: message.threadTs,\n          });\n          addLifecycleBreadcrumb(\"agent.run.started\", {\n            channel_id: conversationId,\n            platform: platform.name,\n            has_attachments: (message.attachments?.length ?? 0) > 0,\n          });\n\n          try {\n            const result = await body();\n            const durationMs = Date.now() - startedAt;\n            const completionAttrs = {\n              channel: conversationId,\n              platform: platform.name,\n              stop_reason: result.stopReason,\n            };\n            Sentry.metrics.distribution(\"agent.run.duration\", durationMs, {\n              unit: \"millisecond\",\n              attributes: completionAttrs,\n            });\n            Sentry.metrics.count(\"agent.run.completed\", 1, { attributes: completionAttrs });\n            addLifecycleBreadcrumb(\"agent.run.completed\", {\n              channel_id: conversationId,\n              platform: platform.name,\n              stop_reason: result.stopReason,\n              duration_ms: durationMs,\n            });\n            return result;\n          } catch (err) {\n            scope.setContext(\"agent_run_error\", {\n              conversationId,\n              sessionKey,\n              platform: platform.name,\n              messageId: message.id,\n              threadTs: message.threadTs,\n            });\n            reportUserFacingError(err, {\n              domain: \"mikan\",\n              surface: \"agent_run\",\n              operation: \"run\",\n              severity: \"error\",\n              platform: platform.name,\n              context: {\n                conversationId,\n                sessionKey,\n                messageId: message.id,\n                threadTs: message.threadTs,\n                attachmentCount: message.attachments?.length ?? 0,\n              },\n            });\n            Sentry.metrics.count(\"agent.run.errors\", 1, {\n              attributes: { channel: conversationId, platform: platform.name },\n            });\n            log.logWarning(\n              `[${conversationId}] Run error`,\n              err instanceof Error ? err.message : String(err),\n            );\n            return undefined;\n          }\n        }),\n    );\n  }\n}\n"]}

package/dist/runtime/session-runtime.d.ts

@@ -1,25 +1,4 @@
-import type { Bot, BotAdapters, BotEvent, BotHandler } from "../adapter.js";
-import { type AgentRunner } from "../agent.js";
-import type { CommandHandler, CommandServices } from "../commands/index.js";
-export interface RunSessionOptions {
-    event: BotEvent;
-    bot: Bot;
-    adapters: BotAdapters;
-}
-export interface CreateSessionSandboxOptions {
-    conversationId: string;
-    sessionKey: string;
-}
-export interface SessionRuntimeOptions extends Omit<CommandServices, "runtime"> {
-    /** Override the default command handlers (e.g., to add /help, /status). */
-    commandHandlers?: readonly CommandHandler[];
-}
-export interface SessionRuntime extends BotHandler {
-    runSession(options: RunSessionOptions): Promise<void>;
-    createSessionSandbox(options: CreateSessionSandboxOptions): Promise<AgentRunner>;
-    switchConversationModel(conversationId: string, provider: string, model: string): boolean;
-    refreshConversationEnvironment(conversationId: string): boolean;
-    shutdown(timeoutMs?: number): Promise<void>;
-}
+export type { CreateSessionSandboxOptions, RunSessionOptions, SessionRuntime, SessionRuntimeOptions, } from "./types.js";
+import type { SessionRuntime, SessionRuntimeOptions } from "./types.js";
 export declare function createSessionRuntime(options: SessionRuntimeOptions): SessionRuntime;
 //# sourceMappingURL=session-runtime.d.ts.map