@geminixiang/mikan 1.0.0-beta.76 → 1.0.0-beta.78

package/dist/sandbox/provisioner.js

@@ -1,5 +1,6 @@
 import { execFile } from "node:child_process";
 import { legacyConversationResourceKey, sanitizeIdentitySegment } from "./identity.js";
+import { GUEST_HOME, GUEST_PUBLIC_OFFICES_DIR } from "./layout.js";
 import { createHash } from "node:crypto";
 import { readFileSync, statSync } from "node:fs";
 import { promisify } from "node:util";
@@ -19,7 +20,6 @@ function isDockerNotFoundError(err) {
         /network [^\n]+ not found/.test(haystack) ||
         /error: no such [^\n]+/.test(haystack));
 }
-/** Parse `src:dst[:ro]` back into a ContainerMount for signature computation. */
 function bindSpecToMount(bindSpec) {
     const readOnly = bindSpec.endsWith(":ro");
     const spec = readOnly ? bindSpec.slice(0, -3) : bindSpec;
@@ -43,6 +43,7 @@ export class DockerContainerManager {
         this.state = new Map();
         this.inflight = new Map();
         this.layoutMigrations = new Map();
+        this.keyQueues = new Map();
         this.boostedKeys = new Set();
         this.overrideLimits = new Map();
         this.limits = options.limits;
@@ -58,11 +59,25 @@ export class DockerContainerManager {
     static networkName(containerKey) {
         return `mikan-sandbox-net-${containerKey}`;
     }
+    static homeVolumeName(containerKey) {
+        return `mikan-home-${containerKey}`;
+    }
+    serialize(containerKey, task) {
+        const previous = this.keyQueues.get(containerKey) ?? Promise.resolve();
+        const next = previous.then(task, task);
+        const settled = next.catch(() => undefined);
+        this.keyQueues.set(containerKey, settled);
+        void settled.then(() => {
+            if (this.keyQueues.get(containerKey) === settled)
+                this.keyQueues.delete(containerKey);
+        });
+        return next;
+    }
     async provision(containerKey, options = {}) {
         const existing = this.inflight.get(containerKey);
         if (existing)
             return existing;
-        const pending = this.provisionInner(containerKey, options).finally(() => {
+        const pending = this.serialize(containerKey, () => this.provisionInner(containerKey, options)).finally(() => {
             this.inflight.delete(containerKey);
         });
         this.inflight.set(containerKey, pending);
@@ -71,15 +86,25 @@ export class DockerContainerManager {
     async provisionInner(containerKey, options) {
         const containerName = options.containerName ?? DockerContainerManager.containerName(containerKey);
         const mounts = options.mounts ?? [];
-        // A container still on the pre-office layout must move its writable layer
-        // to the new mounts before the drift check below would recreate it from
-        // the base image and discard everything installed inside.
         await this.migrateContainerLayout(containerName);
         const status = await this.inspectStatus(containerName);
         try {
-            if (status !== "missing" &&
-                (await this.hasRuntimeDrift(containerKey, containerName, mounts))) {
-                log.logInfo(`Container ${containerName} configuration changed; recreating container`);
+            const binds = status === "missing" ? [] : await this.inspectBindMounts(containerName);
+            const homeVolume = this.hasHomeVolumeBind(containerKey, binds);
+            const drift = status === "missing"
+                ? undefined
+                : await this.runtimeDrift(containerKey, containerName, mounts, {
+                    binds,
+                    status,
+                    homeVolume,
+                });
+            if (drift && homeVolume) {
+                log.logInfo(`Container ${containerName} is out of date (${drift}); replacing container`);
+                await this.replaceHomeVolumeContainer(containerKey, containerName, mounts, options);
+                log.logInfo(`Container ${containerName} replaced from image ${this.image}`);
+            }
+            else if (drift) {
+                log.logInfo(`Container ${containerName} configuration changed (${drift}); recreating container`);
                 await this.recreateContainerPreservingContents(containerKey, containerName, mounts);
                 log.logInfo(`Container ${containerName} recreated`);
             }
@@ -131,7 +156,10 @@ export class DockerContainerManager {
     getBoostLimits() {
         return this.boostLimits;
     }
-    async stop(containerKey) {
+    stop(containerKey) {
+        return this.serialize(containerKey, () => this.stopInner(containerKey));
+    }
+    async stopInner(containerKey) {
         const containerName = this.getContainerName(containerKey);
         try {
             await this.execFileImpl("docker", ["stop", containerName]);
@@ -144,14 +172,14 @@ export class DockerContainerManager {
             log.logWarning(`Failed to stop container ${containerName}`, err instanceof Error ? err.message : String(err));
         }
     }
-    async remove(containerKey) {
+    remove(containerKey, options = {}) {
+        return this.serialize(containerKey, () => this.removeInner(containerKey, options));
+    }
+    async removeInner(containerKey, options) {
         const containerName = this.getContainerName(containerKey);
         const networkName = DockerContainerManager.networkName(containerKey);
         const removed = await this.forceRemoveContainer(containerName, `Container ${containerName} removed`, `Failed to remove container ${containerName}`);
         if (!removed) {
-            // The container may still be running with its old mounts. Keeping the
-            // ownership state (and throwing) is the honest outcome: callers such
-            // as credential refresh must not report a teardown that did not happen.
             throw new Error(`Failed to remove container ${containerName}`);
         }
         try {
@@ -162,6 +190,8 @@ export class DockerContainerManager {
             log.logWarning(`Failed to remove network ${networkName}`, err instanceof Error ? err.message : String(err));
         }
         await this.removeMigrateSnapshot(containerName);
+        if (options.purgeHome)
+            await this.removeHomeVolume(containerKey);
         this.state.delete(containerKey);
         this.boostedKeys.delete(containerKey);
         this.overrideLimits.delete(containerKey);
@@ -176,12 +206,6 @@ export class DockerContainerManager {
         }
         await Promise.all(toStop.map((containerKey) => this.stop(containerKey)));
     }
-    /**
-     * Force-remove every managed container belonging to the given conversation
-     * ids. The office layout migration renames the host directories a
-     * container's workspace mount points at, so a surviving container would keep
-     * writing through stale mounts while the runtime works in the new location.
-     */
     async removeContainersForConversations(conversationIds) {
         if (conversationIds.size === 0)
             return;
@@ -190,33 +214,20 @@ export class DockerContainerManager {
             const details = await this.inspectContainerDetails(containerName);
             if (!details?.conversationId || !conversationIds.has(details.conversationId))
                 return;
-            await this.forceRemoveContainer(containerName, `Removed container ${containerName} after office migration`, `Failed to remove container ${containerName} after office migration`);
+            const removed = await this.forceRemoveContainer(containerName, `Removed container ${containerName} after office migration`, `Failed to remove container ${containerName} after office migration`);
+            const containerKey = this.containerKeyFromContainerName(containerName);
+            if (removed && containerKey)
+                await this.removeHomeVolume(containerKey);
         }));
     }
-    /**
-     * Arm the office-layout container migration. Containers whose binds still
-     * reference legacy raw-id paths are moved to the office-key layout without
-     * losing their writable layer: commit → remove → create with translated
-     * binds, preserving everything installed inside. Idempotent per container
-     * and resumable — the pre-removal binds ride on the snapshot image label,
-     * so a crash between commit and create resumes from the snapshot.
-     */
     armContainerLayoutMigration(translator) {
         this.bindTranslator = translator;
     }
-    /**
-     * Sweep every managed container through the layout migration, serially and
-     * with a small gap, so the one-time cost never lands on the boot path or on
-     * a message. Safe to fire-and-forget; each unit is idempotent.
-     */
     async sweepContainerLayoutMigration(delayMs = 2000) {
         if (!this.bindTranslator)
             return;
         let names;
         try {
-            // Include snapshot names: a crash between commit and create leaves a
-            // snapshot with no container, which must resume before the GC below
-            // could mistake it for an orphan.
             const containers = await this.listContainerNamesByLabel();
             const snapshots = await this.listMigrateSnapshotContainerNames();
             names = Array.from(new Set([...containers, ...snapshots]));
@@ -234,11 +245,8 @@ export class DockerContainerManager {
             }
             await new Promise((resolve) => setTimeout(resolve, delayMs));
         }
-        // Snapshot images whose container has since been recreated from the base
-        // image are no longer referenced; reclaim them.
         await this.removeDanglingMigrateImages();
     }
-    /** Move one container to the office-key layout; no-op when already there. */
     migrateContainerLayout(containerName) {
         const translator = this.bindTranslator;
         if (!translator)
@@ -257,9 +265,6 @@ export class DockerContainerManager {
         let originalBinds;
         const status = await this.inspectStatus(containerName);
         if (status === "missing") {
-            // Resume path: a previous run committed and removed the container but
-            // died before creating the replacement. The snapshot carries the
-            // pre-removal binds on its label.
             const labeled = await this.readMigrateImageBinds(snapshotImage);
             if (labeled === undefined)
                 return;
@@ -269,7 +274,7 @@ export class DockerContainerManager {
             originalBinds = await this.inspectBindMounts(containerName);
             const translated = originalBinds.map(translator);
             if (this.sameBinds(translated.toSorted(), originalBinds.slice().toSorted())) {
-                return; // already on the office layout
+                return;
             }
             log.logInfo(`Migrating container ${containerName} to the office layout`);
             await this.execFileImpl("docker", [
@@ -282,25 +287,11 @@ export class DockerContainerManager {
             await this.execFileImpl("docker", ["rm", "-f", containerName]);
         }
         await this.createContainerFromSnapshot(containerName, originalBinds.map(translator));
-        // The snapshot's only job was bridging commit → create; the new container
-        // already owns that content in its own writable layer; untagging it now
-        // (rather than waiting for a "natural recreation from the base image"
-        // that never happens — every recreation path here targets this same
-        // snapshot family) is what makes migration actually one-time instead of
-        // repeating on every future sweep that still finds the tag.
         await this.removeMigrateSnapshot(containerName);
         log.logInfo(`Container ${containerName} migrated to the office layout`);
     }
-    /**
-     * Create `containerName` from its layout snapshot with `bindSpecs`,
-     * restoring the managed labels and recomputing the mount signature.
-     * `create`, not `run`: idle containers stay stopped exactly as they were;
-     * callers that need the container running start it themselves.
-     */
     async createContainerFromSnapshot(containerName, bindSpecs, knownContainerKey) {
         const snapshotImage = `${DockerContainerManager.MIGRATE_IMAGE_PREFIX}:${containerName}`;
-        // The sweep has only the container name and derives the key; the drift
-        // path knows the real key (container names can be caller-supplied).
         const containerKey = knownContainerKey ?? this.containerKeyFromContainerName(containerName) ?? containerName;
         const networkName = await this.ensureNetwork(containerKey);
         const conversationId = await this.readImageLabel(snapshotImage, DockerContainerManager.CONVERSATION_ID_LABEL_KEY);
@@ -336,21 +327,14 @@ export class DockerContainerManager {
             "infinity",
         ]);
     }
-    /**
-     * `docker commit` captures the empty directories Docker created as bind
-     * targets, so a public office that stopped being mounted would linger in
-     * the snapshot as an empty `/workspace/public/<key>`. Remove any entry
-     * there that no current bind targets; only empty directories are removed,
-     * so a real file could never be deleted by this pass.
-     */
     async removeStaleMountpoints(containerName, bindSpecs) {
         const keep = new Set(bindSpecs
             .map((bind) => bindSpecToMount(bind).target)
-            .filter((target) => target.startsWith("/workspace/public/"))
-            .map((target) => target.slice("/workspace/public/".length)));
+            .filter((target) => target.startsWith(`${GUEST_PUBLIC_OFFICES_DIR}/`))
+            .map((target) => target.slice(GUEST_PUBLIC_OFFICES_DIR.length + 1)));
         const script = [
-            "[ -d /workspace/public ] || exit 0",
-            "for d in /workspace/public/*; do",
+            `cd ${GUEST_PUBLIC_OFFICES_DIR} 2>/dev/null || exit 0`,
+            "for d in *; do",
             '  [ -e "$d" ] || continue',
             '  case " $KEEP " in *" ${d##*/} "*) continue;; esac',
             '  rmdir "$d" 2>/dev/null || true',
@@ -371,15 +355,6 @@ export class DockerContainerManager {
             log.logWarning(`Could not clean stale mountpoints in ${containerName}`, String(err));
         }
     }
-    /**
-     * Recreate a drifted container with the desired mounts while keeping its
-     * writable layer: commit — the new binds ride the snapshot label, so a
-     * crash at any point resumes through the layout-migration path — then
-     * remove, create from the snapshot, and start. The snapshot is untagged
-     * once the new container is confirmed up: its only job was bridging
-     * commit → create, and the container now owns that content in its own
-     * writable layer, so nothing still needs the tag.
-     */
     async recreateContainerPreservingContents(containerKey, containerName, mounts) {
         const snapshotImage = `${DockerContainerManager.MIGRATE_IMAGE_PREFIX}:${containerName}`;
         const bindSpecs = mounts.map((mount) => this.toBindSpec(mount));
@@ -396,7 +371,6 @@ export class DockerContainerManager {
         await this.removeStaleMountpoints(containerName, bindSpecs);
         await this.removeMigrateSnapshot(containerName);
     }
-    /** Binds recorded on a snapshot image, or undefined when no snapshot exists. */
     async readMigrateImageBinds(snapshotImage) {
         const raw = await this.readImageLabel(snapshotImage, DockerContainerManager.MIGRATE_BINDS_LABEL_KEY);
         if (raw === undefined)
@@ -421,11 +395,6 @@ export class DockerContainerManager {
             return undefined;
         }
     }
-    /**
-     * Delete a container's layout snapshot after an intentional removal, so a
-     * missing container plus a surviving snapshot can only mean a crash in the
-     * middle of the layout migration (the resume discriminator).
-     */
     async removeMigrateSnapshot(containerName) {
         try {
             await this.execFileImpl("docker", [
@@ -433,9 +402,7 @@ export class DockerContainerManager {
                 `${DockerContainerManager.MIGRATE_IMAGE_PREFIX}:${containerName}`,
             ]);
         }
-        catch {
-            // No snapshot for this container — the common case.
-        }
+        catch { }
     }
     async listMigrateSnapshotContainerNames() {
         try {
@@ -451,17 +418,6 @@ export class DockerContainerManager {
             return [];
         }
     }
-    /**
-     * Catch-up pass for snapshots the success path in
-     * `migrateContainerLayoutInner` did not get to remove itself — e.g. a
-     * crash between `createContainerFromSnapshot` and its own cleanup. A
-     * snapshot is only still needed while its container remains "missing"
-     * (the resume path in `migrateContainerLayoutInner` reads pre-removal
-     * binds off it); once the container exists again in any state, the
-     * snapshot has done its job regardless of whether that container's
-     * `Config.Image` still points at it — removing a tag never deletes
-     * layers a live container still uses.
-     */
     async removeDanglingMigrateImages() {
         let stdout;
         try {
@@ -479,7 +435,7 @@ export class DockerContainerManager {
             const containerName = image.slice(DockerContainerManager.MIGRATE_IMAGE_PREFIX.length + 1);
             const status = await this.inspectStatus(containerName);
             if (status === "missing")
-                continue; // still needed for a future resume
+                continue;
             try {
                 await this.execFileImpl("docker", ["rmi", image]);
                 log.logInfo(`Removed layout-migration snapshot image ${image}`);
@@ -515,9 +471,6 @@ export class DockerContainerManager {
                 log.logWarning(`Skipping unmanaged-style container without container key`, containerName);
                 continue;
             }
-            // Containers keyed under the pre-office raw-conversation resource key
-            // are unreachable now that resource identity is the office key: no
-            // provision will ever address them again, so reap rather than adopt.
             if (containerKey === legacyConversationResourceKey(details.conversationId)) {
                 legacyRemovals.push(this.forceRemoveContainer(containerName, `Removed container ${containerName} keyed by pre-office resource identity`, `Failed to remove legacy-keyed container ${containerName}`).then(() => undefined));
                 continue;
@@ -542,13 +495,11 @@ export class DockerContainerManager {
         return mounts.flatMap((mount) => ["-v", this.toBindSpec(mount)]);
     }
     toBindSpec(mount) {
-        // The `:ro` suffix is part of the bind spec, so it also flows into
-        // expectedBinds/mountSignature — flipping a mount's writability is drift
-        // and recreates the container rather than leaving a stale writable bind.
         return `${mount.source}:${mount.target}${mount.readOnly ? ":ro" : ""}`;
     }
     async runContainer(containerKey, containerName, mounts, options) {
         const networkName = await this.ensureNetwork(containerKey);
+        const homeVolume = await this.ensureHomeVolume(containerKey);
         log.logInfo(`Creating container ${containerName} from image ${this.image}`);
         const labels = [
             "--label",
@@ -579,6 +530,8 @@ export class DockerContainerManager {
             "1024",
             ...labels,
             ...this.resourceLimitArgs(this.effectiveLimits(containerKey)),
+            "-v",
+            `${homeVolume}:${GUEST_HOME}`,
             ...this.mountArgs(mounts),
             this.image,
             "sleep",
@@ -599,9 +552,6 @@ export class DockerContainerManager {
             args.push("--cpus", limits.cpus);
         if (limits?.memory) {
             args.push("--memory", limits.memory);
-            // Keep Docker's no-extra-swap semantics explicit. Docker requires
-            // memory-swap to be updated together when raising an existing memory
-            // limit above the current swap limit.
             args.push("--memory-swap", limits.memory);
         }
         return args;
@@ -631,18 +581,22 @@ export class DockerContainerManager {
             });
         }
     }
-    async hasRuntimeDrift(containerKey, containerName, mounts) {
-        if (await this.hasBindMountDrift(containerName, mounts)) {
-            return true;
-        }
-        if (await this.hasMountSignatureDrift(containerName, mounts)) {
-            return true;
+    async runtimeDrift(containerKey, containerName, mounts, current) {
+        const { binds, status, homeVolume } = current;
+        if (this.hasBindMountDrift(binds, mounts))
+            return "binds";
+        if (await this.hasMountSignatureDrift(containerName, mounts))
+            return "mount-content";
+        if (await this.hasNetworkModeDrift(containerKey, containerName))
+            return "network";
+        if (homeVolume && status === "stopped" && (await this.hasImageDrift(containerName))) {
+            return "image";
         }
-        return this.hasNetworkModeDrift(containerKey, containerName);
+        return undefined;
     }
-    async hasBindMountDrift(containerName, mounts) {
+    hasBindMountDrift(binds, mounts) {
         const expected = this.expectedBinds(mounts);
-        const actual = await this.inspectBindMounts(containerName);
+        const actual = binds.filter((bind) => !this.isHomeVolumeBind(bind));
         return !this.sameBinds(expected, actual);
     }
     expectedBinds(mounts) {
@@ -684,16 +638,8 @@ export class DockerContainerManager {
         try {
             const stat = statSync(source);
             if (stat.isFile()) {
-                // Files are atomically replaced (rename), which leaves the container
-                // holding a stale inode — content changes must recreate the mount.
                 return createHash("sha256").update(readFileSync(source)).digest("hex");
             }
-            // Directories: a bind mount follows changes inside the directory live,
-            // so only replacing the directory itself makes the mount stale.
-            // Size/mtime churn from ordinary activity — event files coming and
-            // going, children being created — must not read as drift. Identity is
-            // dev:ino plus birth time, because ext4 recycles inode numbers
-            // immediately and a same-path replacement can reuse the old one.
             return `${stat.isDirectory() ? "dir" : "other"}:${stat.dev}:${stat.ino}:${stat.birthtimeMs}`;
         }
         catch {
@@ -717,6 +663,149 @@ export class DockerContainerManager {
         }
         return [...parsed].toSorted();
     }
+    isHomeVolumeBind(bind) {
+        const separator = bind.indexOf(":");
+        if (separator === -1)
+            return false;
+        const source = bind.slice(0, separator);
+        const target = bind.slice(separator + 1).replace(/:r[ow]$/, "");
+        return source.startsWith(DockerContainerManager.homeVolumeName("")) && target === GUEST_HOME;
+    }
+    hasHomeVolumeBind(containerKey, binds) {
+        const expected = `${DockerContainerManager.homeVolumeName(containerKey)}:${GUEST_HOME}`;
+        return binds.includes(expected);
+    }
+    async hasHomeVolume(containerKey, containerName) {
+        return this.hasHomeVolumeBind(containerKey, await this.inspectBindMounts(containerName));
+    }
+    async hasImageDrift(containerName) {
+        const desired = await this.localImageId();
+        if (!desired)
+            return false;
+        const { stdout } = await this.execFileImpl("docker", [
+            "inspect",
+            "-f",
+            "{{.Image}}",
+            containerName,
+        ]);
+        return stdout.trim() !== desired;
+    }
+    async localImageId() {
+        try {
+            const { stdout } = await this.execFileImpl("docker", [
+                "image",
+                "inspect",
+                "-f",
+                "{{.Id}}",
+                this.image,
+            ]);
+            return this.normalizeDockerValue(stdout.trim());
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async ensureHomeVolume(containerKey) {
+        const volumeName = DockerContainerManager.homeVolumeName(containerKey);
+        await this.execFileImpl("docker", [
+            "volume",
+            "create",
+            "--label",
+            DockerContainerManager.MANAGED_LABEL,
+            "--label",
+            `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,
+            volumeName,
+        ]);
+        return volumeName;
+    }
+    async removeHomeVolume(containerKey) {
+        const volumeName = DockerContainerManager.homeVolumeName(containerKey);
+        try {
+            await this.execFileImpl("docker", ["volume", "rm", volumeName]);
+            log.logInfo(`Home volume ${volumeName} removed`);
+        }
+        catch (err) {
+            if (isDockerNotFoundError(err))
+                return;
+            log.logWarning(`Failed to remove home volume ${volumeName}`, err instanceof Error ? err.message : String(err));
+        }
+    }
+    async replaceHomeVolumeContainer(containerKey, containerName, mounts, options) {
+        const removed = await this.forceRemoveContainer(containerName, `Container ${containerName} removed for replacement`, `Failed to remove container ${containerName} for replacement`);
+        if (!removed)
+            throw new Error(`Failed to remove container ${containerName} for replacement`);
+        await this.runContainer(containerKey, containerName, mounts, options);
+    }
+    async inventory() {
+        const names = await this.listContainerNamesByLabel();
+        const entries = [];
+        for (const containerName of names) {
+            const containerKey = this.containerKeyFromContainerName(containerName);
+            const status = await this.inspectStatus(containerName);
+            if (status === "missing")
+                continue;
+            const homeVolume = containerKey
+                ? await this.hasHomeVolume(containerKey, containerName)
+                : false;
+            entries.push({
+                containerName,
+                ...(containerKey ? { containerKey } : {}),
+                running: status === "running",
+                homeVolume,
+                imageStale: await this.hasImageDrift(containerName),
+            });
+        }
+        return entries;
+    }
+    async systemChanges(containerName) {
+        const { stdout } = await this.execFileImpl("docker", ["diff", containerName]);
+        return this.parseNameLines(stdout).filter((line) => {
+            const path = line.slice(2);
+            return !this.isUnderGuestPath(path, GUEST_HOME) && !this.isUnderGuestPath(path, "/workspace");
+        });
+    }
+    isUnderGuestPath(path, root) {
+        return path === root || path.startsWith(`${root}/`);
+    }
+    migrateToHomeVolume(containerKey) {
+        return this.serialize(containerKey, () => this.migrateToHomeVolumeInner(containerKey));
+    }
+    async migrateToHomeVolumeInner(containerKey) {
+        const containerName = DockerContainerManager.containerName(containerKey);
+        const status = await this.inspectStatus(containerName);
+        if (status === "missing")
+            return "missing";
+        if (await this.hasHomeVolume(containerKey, containerName))
+            return "already-migrated";
+        const details = await this.inspectContainerDetails(containerName);
+        const mounts = (await this.inspectBindMounts(containerName))
+            .filter((bind) => !this.isHomeVolumeBind(bind))
+            .map(bindSpecToMount);
+        const snapshotImage = `${DockerContainerManager.MIGRATE_IMAGE_PREFIX}:${containerName}`;
+        log.logInfo(`Migrating container ${containerName} to a home volume`);
+        await this.execFileImpl("docker", ["commit", containerName, snapshotImage]);
+        const homeVolume = await this.ensureHomeVolume(containerKey);
+        await this.execFileImpl("docker", [
+            "run",
+            "--rm",
+            "--network",
+            "none",
+            "-v",
+            `${homeVolume}:${GUEST_HOME}`,
+            snapshotImage,
+            "true",
+        ]);
+        const removed = await this.forceRemoveContainer(containerName, `Container ${containerName} removed for home-volume migration`, `Failed to remove container ${containerName} for home-volume migration`);
+        if (!removed)
+            throw new Error(`Failed to remove container ${containerName}`);
+        await this.runContainer(containerKey, containerName, mounts, details?.conversationId ? { conversationId: details.conversationId } : {});
+        if (status === "stopped")
+            await this.execFileImpl("docker", ["stop", containerName]);
+        await this.removeMigrateSnapshot(containerName);
+        this.setState(containerKey, status === "stopped" ? "stopped" : "running", containerName);
+        log.logInfo(`Container ${containerName} migrated to home volume ${homeVolume}`);
+        return "migrated";
+    }
     async hasNetworkModeDrift(containerKey, containerName) {
         const expected = DockerContainerManager.networkName(containerKey);
         const { stdout } = await this.execFileImpl("docker", [
@@ -849,7 +938,6 @@ export class DockerContainerManager {
         const containerKey = containerName.slice(prefix.length);
         return containerKey.length > 0 ? containerKey : undefined;
     }
-    /** @returns true when the container is gone (removed or already missing). */
     async forceRemoveContainer(containerName, successLog, failureLog) {
         try {
             await this.execFileImpl("docker", ["rm", "-f", containerName]);