@geminixiang/mikan 1.0.0-beta.4 → 1.0.0-beta.41

package/dist/provisioner.js

@@ -1,8 +1,10 @@
-import { execFile } from "child_process";
-import { createHash } from "crypto";
-import { readFileSync, statSync } from "fs";
-import { promisify } from "util";
+import { execFile } from "node:child_process";
+import { sanitizeIdentitySegment } from "./sandbox/identity.js";
+import { createHash } from "node:crypto";
+import { readFileSync, statSync } from "node:fs";
+import { promisify } from "node:util";
 import * as log from "./log.js";
+import { readEnv } from "./env-manifest.js";
 import { reportUserFacingError } from "./observability/sentry.js";
 const execFileAsync = promisify(execFile);
 function isDockerNotFoundError(err) {
@@ -18,16 +20,30 @@ function isDockerNotFoundError(err) {
         /network [^\n]+ not found/.test(haystack) ||
         /error: no such [^\n]+/.test(haystack));
 }
+/** Parse `src:dst[:ro]` back into a ContainerMount for signature computation. */
+function bindSpecToMount(bindSpec) {
+    const readOnly = bindSpec.endsWith(":ro");
+    const spec = readOnly ? bindSpec.slice(0, -3) : bindSpec;
+    const separator = spec.indexOf(":");
+    return {
+        source: spec.slice(0, separator),
+        target: spec.slice(separator + 1),
+        ...(readOnly ? { readOnly: true } : {}),
+    };
+}
 export class DockerContainerManager {
     static { this.MANAGED_LABEL = "mikan.managed=true"; }
     static { this.IMAGE_MODE_LABEL = "mikan.sandbox=image"; }
     static { this.VAULT_ID_LABEL_KEY = "mikan.vault-id"; }
     static { this.CONVERSATION_ID_LABEL_KEY = "mikan.conversation-id"; }
     static { this.MOUNT_SIGNATURE_LABEL_KEY = "mikan.mount-signature"; }
+    static { this.MIGRATE_IMAGE_PREFIX = "mikan-migrate"; }
+    static { this.MIGRATE_BINDS_LABEL_KEY = "mikan.migrate-binds"; }
     constructor(image, options = {}) {
         this.image = image;
         this.state = new Map();
         this.inflight = new Map();
+        this.layoutMigrations = new Map();
         this.boostedKeys = new Set();
         this.overrideLimits = new Map();
         this.limits = options.limits;
@@ -35,11 +51,7 @@ export class DockerContainerManager {
         this.execFileImpl = options.execFileImpl ?? execFileAsync;
     }
     static sanitizeSegment(value) {
-        const sanitized = value
-            .toLowerCase()
-            .replace(/[^a-z0-9]+/g, "-")
-            .replace(/^-+|-+$/g, "");
-        return sanitized || "unknown";
+        return sanitizeIdentitySegment(value);
     }
     static containerName(containerKey) {
         return `mikan-sandbox-${containerKey}`;
@@ -60,13 +72,23 @@ export class DockerContainerManager {
     async provisionInner(containerKey, options) {
         const containerName = options.containerName ?? DockerContainerManager.containerName(containerKey);
         const mounts = options.mounts ?? [];
+        // A container still on the pre-office layout must move its writable layer
+        // to the new mounts before the drift check below would recreate it from
+        // the base image and discard everything installed inside.
+        await this.migrateContainerLayout(containerName);
         const status = await this.inspectStatus(containerName);
         try {
             if (status !== "missing" &&
                 (await this.hasRuntimeDrift(containerKey, containerName, mounts))) {
                 log.logInfo(`Container ${containerName} configuration changed; recreating container`);
-                await this.execFileImpl("docker", ["rm", "-f", containerName]);
-                await this.runContainer(containerKey, containerName, mounts, options);
+                if (readEnv("SKIP_CONTAINER_PRESERVATION") === "1") {
+                    await this.execFileImpl("docker", ["rm", "-f", containerName]);
+                    await this.removeMigrateSnapshot(containerName);
+                    await this.runContainer(containerKey, containerName, mounts, options);
+                }
+                else {
+                    await this.recreateContainerPreservingContents(containerKey, containerName, mounts);
+                }
                 log.logInfo(`Container ${containerName} recreated`);
             }
             else if (status === "running") {
@@ -144,6 +166,7 @@ export class DockerContainerManager {
         catch (err) {
             log.logWarning(`Failed to remove network ${networkName}`, err instanceof Error ? err.message : String(err));
         }
+        await this.removeMigrateSnapshot(containerName);
         this.state.delete(containerKey);
         this.boostedKeys.delete(containerKey);
         this.overrideLimits.delete(containerKey);
@@ -158,6 +181,294 @@ export class DockerContainerManager {
         }
         await Promise.all(toStop.map((containerKey) => this.stop(containerKey)));
     }
+    /**
+     * Force-remove every managed container belonging to the given conversation
+     * ids. The office layout migration renames the host directories a
+     * container's workspace mount points at, so a surviving container would keep
+     * writing through stale mounts while the runtime works in the new location.
+     */
+    async removeContainersForConversations(conversationIds) {
+        if (conversationIds.size === 0)
+            return;
+        const names = await this.listContainerNamesByLabel();
+        await Promise.all(names.map(async (containerName) => {
+            const details = await this.inspectContainerDetails(containerName);
+            if (!details?.conversationId || !conversationIds.has(details.conversationId))
+                return;
+            await this.forceRemoveContainer(containerName, `Removed container ${containerName} after office migration`, `Failed to remove container ${containerName} after office migration`);
+        }));
+    }
+    /**
+     * Arm the office-layout container migration. Containers whose binds still
+     * reference legacy raw-id paths are moved to the office-key layout without
+     * losing their writable layer: commit → remove → create with translated
+     * binds, preserving everything installed inside. Idempotent per container
+     * and resumable — the pre-removal binds ride on the snapshot image label,
+     * so a crash between commit and create resumes from the snapshot.
+     */
+    armContainerLayoutMigration(translator) {
+        this.bindTranslator = translator;
+    }
+    /**
+     * Sweep every managed container through the layout migration, serially and
+     * with a small gap, so the one-time cost never lands on the boot path or on
+     * a message. Safe to fire-and-forget; each unit is idempotent.
+     */
+    async sweepContainerLayoutMigration(delayMs = 2000) {
+        if (!this.bindTranslator)
+            return;
+        let names;
+        try {
+            // Include snapshot names: a crash between commit and create leaves a
+            // snapshot with no container, which must resume before the GC below
+            // could mistake it for an orphan.
+            const containers = await this.listContainerNamesByLabel();
+            const snapshots = await this.listMigrateSnapshotContainerNames();
+            names = Array.from(new Set([...containers, ...snapshots]));
+        }
+        catch (err) {
+            log.logWarning("Container layout sweep could not list containers", String(err));
+            return;
+        }
+        for (const containerName of names) {
+            try {
+                await this.migrateContainerLayout(containerName);
+            }
+            catch (err) {
+                log.logWarning(`Container layout migration failed for ${containerName}; leaving it in place`, err instanceof Error ? err.message : String(err));
+            }
+            await new Promise((resolve) => setTimeout(resolve, delayMs));
+        }
+        // Snapshot images whose container has since been recreated from the base
+        // image are no longer referenced; reclaim them.
+        await this.removeDanglingMigrateImages();
+    }
+    /** Move one container to the office-key layout; no-op when already there. */
+    migrateContainerLayout(containerName) {
+        const translator = this.bindTranslator;
+        if (!translator)
+            return Promise.resolve();
+        const existing = this.layoutMigrations.get(containerName);
+        if (existing)
+            return existing;
+        const pending = this.migrateContainerLayoutInner(containerName, translator).finally(() => {
+            this.layoutMigrations.delete(containerName);
+        });
+        this.layoutMigrations.set(containerName, pending);
+        return pending;
+    }
+    async migrateContainerLayoutInner(containerName, translator) {
+        const snapshotImage = `${DockerContainerManager.MIGRATE_IMAGE_PREFIX}:${containerName}`;
+        let originalBinds;
+        const status = await this.inspectStatus(containerName);
+        if (status === "missing") {
+            // Resume path: a previous run committed and removed the container but
+            // died before creating the replacement. The snapshot carries the
+            // pre-removal binds on its label.
+            const labeled = await this.readMigrateImageBinds(snapshotImage);
+            if (labeled === undefined)
+                return;
+            originalBinds = labeled;
+        }
+        else {
+            originalBinds = await this.inspectBindMounts(containerName);
+            const translated = originalBinds.map(translator);
+            if (this.sameBinds(translated.toSorted(), originalBinds.slice().toSorted())) {
+                return; // already on the office layout
+            }
+            log.logInfo(`Migrating container ${containerName} to the office layout`);
+            await this.execFileImpl("docker", [
+                "commit",
+                "-c",
+                `LABEL ${DockerContainerManager.MIGRATE_BINDS_LABEL_KEY}=${JSON.stringify(JSON.stringify(originalBinds))}`,
+                containerName,
+                snapshotImage,
+            ]);
+            await this.execFileImpl("docker", ["rm", "-f", containerName]);
+        }
+        await this.createContainerFromSnapshot(containerName, originalBinds.map(translator));
+        log.logInfo(`Container ${containerName} migrated to the office layout`);
+    }
+    /**
+     * Create `containerName` from its layout snapshot with `bindSpecs`,
+     * restoring the managed labels and recomputing the mount signature.
+     * `create`, not `run`: idle containers stay stopped exactly as they were;
+     * callers that need the container running start it themselves.
+     */
+    async createContainerFromSnapshot(containerName, bindSpecs, knownContainerKey) {
+        const snapshotImage = `${DockerContainerManager.MIGRATE_IMAGE_PREFIX}:${containerName}`;
+        // The sweep has only the container name and derives the key; the drift
+        // path knows the real key (container names can be caller-supplied).
+        const containerKey = knownContainerKey ?? this.containerKeyFromContainerName(containerName) ?? containerName;
+        const networkName = await this.ensureNetwork(containerKey);
+        const conversationId = await this.readImageLabel(snapshotImage, DockerContainerManager.CONVERSATION_ID_LABEL_KEY);
+        const labels = [
+            "--label",
+            DockerContainerManager.MANAGED_LABEL,
+            "--label",
+            DockerContainerManager.IMAGE_MODE_LABEL,
+            "--label",
+            `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,
+        ];
+        if (conversationId) {
+            labels.push("--label", `${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}=${conversationId}`);
+        }
+        labels.push("--label", `${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}=${this.mountSignature(bindSpecs.map(bindSpecToMount))}`);
+        await this.execFileImpl("docker", [
+            "create",
+            "--name",
+            containerName,
+            "--network",
+            networkName,
+            "--cap-drop",
+            "ALL",
+            "--security-opt",
+            "no-new-privileges",
+            "--pids-limit",
+            "1024",
+            ...labels,
+            ...this.resourceLimitArgs(this.effectiveLimits(containerKey)),
+            ...bindSpecs.flatMap((bind) => ["-v", bind]),
+            snapshotImage,
+            "sleep",
+            "infinity",
+        ]);
+    }
+    /**
+     * Recreate a drifted container with the desired mounts while keeping its
+     * writable layer: commit — the new binds ride the snapshot label, so a
+     * crash at any point resumes through the layout-migration path — then
+     * remove, create from the snapshot, and start. Committing replaces any
+     * older snapshot tag for this container; the untagged predecessor is
+     * removed once the new container is up.
+     */
+    async recreateContainerPreservingContents(containerKey, containerName, mounts) {
+        const snapshotImage = `${DockerContainerManager.MIGRATE_IMAGE_PREFIX}:${containerName}`;
+        const bindSpecs = mounts.map((mount) => this.toBindSpec(mount));
+        const previousImageId = await this.readImageId(snapshotImage);
+        await this.execFileImpl("docker", [
+            "commit",
+            "-c",
+            `LABEL ${DockerContainerManager.MIGRATE_BINDS_LABEL_KEY}=${JSON.stringify(JSON.stringify(bindSpecs))}`,
+            containerName,
+            snapshotImage,
+        ]);
+        await this.execFileImpl("docker", ["rm", "-f", containerName]);
+        await this.createContainerFromSnapshot(containerName, bindSpecs, containerKey);
+        await this.execFileImpl("docker", ["start", containerName]);
+        const currentImageId = await this.readImageId(snapshotImage);
+        if (previousImageId && previousImageId !== currentImageId) {
+            try {
+                await this.execFileImpl("docker", ["rmi", previousImageId]);
+            }
+            catch (err) {
+                log.logWarning(`Could not remove superseded snapshot image ${previousImageId}`, String(err));
+            }
+        }
+    }
+    /** Resolved image id for a reference, or undefined when it does not exist. */
+    async readImageId(image) {
+        try {
+            const { stdout } = await this.execFileImpl("docker", ["inspect", "-f", "{{.Id}}", image]);
+            const id = stdout.trim();
+            return id.length > 0 ? id : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** Binds recorded on a snapshot image, or undefined when no snapshot exists. */
+    async readMigrateImageBinds(snapshotImage) {
+        const raw = await this.readImageLabel(snapshotImage, DockerContainerManager.MIGRATE_BINDS_LABEL_KEY);
+        if (raw === undefined)
+            return undefined;
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed) || parsed.some((bind) => typeof bind !== "string")) {
+            throw new Error(`Snapshot image ${snapshotImage} carries malformed migrate binds`);
+        }
+        return parsed;
+    }
+    async readImageLabel(image, key) {
+        try {
+            const { stdout } = await this.execFileImpl("docker", [
+                "inspect",
+                "-f",
+                `{{index .Config.Labels "${key}"}}`,
+                image,
+            ]);
+            return this.normalizeDockerValue(stdout.trim());
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * Delete a container's layout snapshot after an intentional removal, so a
+     * missing container plus a surviving snapshot can only mean a crash in the
+     * middle of the layout migration (the resume discriminator).
+     */
+    async removeMigrateSnapshot(containerName) {
+        try {
+            await this.execFileImpl("docker", [
+                "rmi",
+                `${DockerContainerManager.MIGRATE_IMAGE_PREFIX}:${containerName}`,
+            ]);
+        }
+        catch {
+            // No snapshot for this container — the common case.
+        }
+    }
+    async listMigrateSnapshotContainerNames() {
+        try {
+            const { stdout } = await this.execFileImpl("docker", [
+                "images",
+                DockerContainerManager.MIGRATE_IMAGE_PREFIX,
+                "--format",
+                "{{.Tag}}",
+            ]);
+            return this.parseNameLines(stdout);
+        }
+        catch {
+            return [];
+        }
+    }
+    async removeDanglingMigrateImages() {
+        let stdout;
+        try {
+            ({ stdout } = await this.execFileImpl("docker", [
+                "images",
+                `${DockerContainerManager.MIGRATE_IMAGE_PREFIX}`,
+                "--format",
+                "{{.Repository}}:{{.Tag}}",
+            ]));
+        }
+        catch {
+            return;
+        }
+        for (const image of this.parseNameLines(stdout)) {
+            const containerName = image.slice(DockerContainerManager.MIGRATE_IMAGE_PREFIX.length + 1);
+            const status = await this.inspectStatus(containerName);
+            if (status !== "missing") {
+                // Still referenced (until the container's next natural recreation
+                // from the base image); keep the snapshot.
+                const { stdout: imageRef } = await this.execFileImpl("docker", [
+                    "inspect",
+                    "-f",
+                    "{{.Config.Image}}",
+                    containerName,
+                ]);
+                if (imageRef.trim() === image)
+                    continue;
+            }
+            try {
+                await this.execFileImpl("docker", ["rmi", image]);
+                log.logInfo(`Removed layout-migration snapshot image ${image}`);
+            }
+            catch (err) {
+                log.logWarning(`Could not remove snapshot image ${image}`, String(err));
+            }
+        }
+    }
     async reconcile() {
         const discovered = new Set();
         const labeledNames = await this.listContainerNamesByLabel();
@@ -204,7 +515,10 @@ export class DockerContainerManager {
         return mounts.flatMap((mount) => ["-v", this.toBindSpec(mount)]);
     }
     toBindSpec(mount) {
-        return `${mount.source}:${mount.target}`;
+        // The `:ro` suffix is part of the bind spec, so it also flows into
+        // expectedBinds/mountSignature — flipping a mount's writability is drift
+        // and recreates the container rather than leaving a stale writable bind.
+        return `${mount.source}:${mount.target}${mount.readOnly ? ":ro" : ""}`;
     }
     async runContainer(containerKey, containerName, mounts, options) {
         const networkName = await this.ensureNetwork(containerKey);
@@ -343,9 +657,17 @@ export class DockerContainerManager {
         try {
             const stat = statSync(source);
             if (stat.isFile()) {
+                // Files are atomically replaced (rename), which leaves the container
+                // holding a stale inode — content changes must recreate the mount.
                 return createHash("sha256").update(readFileSync(source)).digest("hex");
             }
-            return `${stat.isDirectory() ? "dir" : "other"}:${stat.size}:${stat.mtimeMs}`;
+            // Directories: a bind mount follows changes inside the directory live,
+            // so only replacing the directory itself makes the mount stale.
+            // Size/mtime churn from ordinary activity — event files coming and
+            // going, children being created — must not read as drift. Identity is
+            // dev:ino plus birth time, because ext4 recycles inode numbers
+            // immediately and a same-path replacement can reuse the old one.
+            return `${stat.isDirectory() ? "dir" : "other"}:${stat.dev}:${stat.ino}:${stat.birthtimeMs}`;
         }
         catch {
             return "missing";