@geminixiang/mikan 1.0.0-beta.9 → 1.0.0-beta.91

package/dist/provisioner.d.ts

@@ -1,61 +0,0 @@
-export type { ContainerMount, DockerContainerManagerOptions, ProvisionOptions, ResourceLimits, SandboxLimitStatus, } from "./types.js";
-import type { DockerContainerManagerOptions, ProvisionOptions, ResourceLimits, SandboxLimitStatus } from "./types.js";
-export declare class DockerContainerManager {
-    private readonly image;
-    private state;
-    private inflight;
-    private static readonly MANAGED_LABEL;
-    private static readonly IMAGE_MODE_LABEL;
-    private static readonly VAULT_ID_LABEL_KEY;
-    private static readonly CONVERSATION_ID_LABEL_KEY;
-    private static readonly MOUNT_SIGNATURE_LABEL_KEY;
-    private readonly limits?;
-    private readonly boostLimits?;
-    private readonly boostedKeys;
-    private readonly overrideLimits;
-    private readonly execFileImpl;
-    constructor(image: string, options?: DockerContainerManagerOptions);
-    static sanitizeSegment(value: string): string;
-    static containerName(containerKey: string): string;
-    static networkName(containerKey: string): string;
-    provision(containerKey: string, options?: ProvisionOptions): Promise<string>;
-    private provisionInner;
-    boost(containerKey: string): Promise<SandboxLimitStatus>;
-    setLimits(containerKey: string, limits: ResourceLimits): Promise<SandboxLimitStatus>;
-    getLimitStatus(containerKey: string): SandboxLimitStatus;
-    getDefaultLimits(): ResourceLimits | undefined;
-    getBoostLimits(): ResourceLimits | undefined;
-    stop(containerKey: string): Promise<void>;
-    remove(containerKey: string): Promise<void>;
-    stopIdle(maxIdleMs: number): Promise<void>;
-    reconcile(): Promise<void>;
-    private setState;
-    private getContainerName;
-    private mountArgs;
-    private toBindSpec;
-    private runContainer;
-    private effectiveLimits;
-    private resourceLimitArgs;
-    private applyResourceLimits;
-    private hasRuntimeDrift;
-    private hasBindMountDrift;
-    private expectedBinds;
-    private sameBinds;
-    private hasMountSignatureDrift;
-    private mountSignature;
-    private mountSourceFingerprint;
-    private inspectBindMounts;
-    private hasNetworkModeDrift;
-    private ensureNetwork;
-    private inspectStatus;
-    private listContainerNamesByLabel;
-    private listContainerNamesByPrefix;
-    private parseNameLines;
-    private inspectContainerDetails;
-    private normalizeDockerValue;
-    private parseDockerTimestamp;
-    private containerKeyFromContainerName;
-    private forceRemoveContainer;
-    private removeLegacyContainer;
-}
-//# sourceMappingURL=provisioner.d.ts.map

package/dist/provisioner.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../src/provisioner.ts"],"names":[],"mappings":"AAmCA,YAAY,EACV,cAAc,EACd,6BAA6B,EAC7B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAEV,6BAA6B,EAC7B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,qBAAa,sBAAsB;IAgB/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAfxB,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAwB;IAC7D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAyB;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAoB;IAC9D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAE5E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAiB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqC;IACpE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAE7C,YACmB,KAAK,EAAE,MAAM,EAC9B,OAAO,GAAE,6BAAkC,EAK5C;IAED,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM5C;IAED,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjD;IAED,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/C;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CASrF;YAEa,cAAc;IAkCtB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAY7D;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQzF;IAED,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAGvD;IAED,gBAAgB,IAAI,cAAc,GAAG,SAAS,CAE7C;IAED,cAAc,IAAI,cAAc,GAAG,SAAS,CAE3C;IAEK,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc9C;IAEK,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhD;IAEK,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/C;IAEK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CA0C/B;IAED,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,UAAU;YAIJ,YAAY;IAkD1B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;YAaX,mBAAmB;YA2BnB,eAAe;YAcf,iBAAiB;IAS/B,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,SAAS;YAQH,sBAAsB;IAgBpC,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,sBAAsB;YAYhB,iBAAiB;YAqBjB,mBAAmB;YAWnB,aAAa;YAwBb,aAAa;YAeb,yBAAyB;YAsBzB,0BAA0B;IAoBxC,OAAO,CAAC,cAAc;YAOR,uBAAuB;IA4BrC,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,6BAA6B;YAOvB,oBAAoB;YAapB,qBAAqB;CAOpC"}

package/dist/provisioner.js

@@ -1,517 +0,0 @@
-import { execFile } from "child_process";
-import { createHash } from "crypto";
-import { readFileSync, statSync } from "fs";
-import { promisify } from "util";
-import * as log from "./log.js";
-import { reportUserFacingError } from "./observability/sentry.js";
-const execFileAsync = promisify(execFile);
-function isDockerNotFoundError(err) {
-    if (!err || typeof err !== "object")
-        return false;
-    const stderr = err.stderr;
-    const message = err.message;
-    const haystack = `${typeof stderr === "string" ? stderr : ""}\n${typeof message === "string" ? message : ""}`.toLowerCase();
-    return (haystack.includes("no such network") ||
-        haystack.includes("no such container") ||
-        haystack.includes("no such object") ||
-        haystack.includes("network not found") ||
-        /network [^\n]+ not found/.test(haystack) ||
-        /error: no such [^\n]+/.test(haystack));
-}
-export class DockerContainerManager {
-    static { this.MANAGED_LABEL = "mikan.managed=true"; }
-    static { this.IMAGE_MODE_LABEL = "mikan.sandbox=image"; }
-    static { this.VAULT_ID_LABEL_KEY = "mikan.vault-id"; }
-    static { this.CONVERSATION_ID_LABEL_KEY = "mikan.conversation-id"; }
-    static { this.MOUNT_SIGNATURE_LABEL_KEY = "mikan.mount-signature"; }
-    constructor(image, options = {}) {
-        this.image = image;
-        this.state = new Map();
-        this.inflight = new Map();
-        this.boostedKeys = new Set();
-        this.overrideLimits = new Map();
-        this.limits = options.limits;
-        this.boostLimits = options.boostLimits;
-        this.execFileImpl = options.execFileImpl ?? execFileAsync;
-    }
-    static sanitizeSegment(value) {
-        const sanitized = value
-            .toLowerCase()
-            .replace(/[^a-z0-9]+/g, "-")
-            .replace(/^-+|-+$/g, "");
-        return sanitized || "unknown";
-    }
-    static containerName(containerKey) {
-        return `mikan-sandbox-${containerKey}`;
-    }
-    static networkName(containerKey) {
-        return `mikan-sandbox-net-${containerKey}`;
-    }
-    async provision(containerKey, options = {}) {
-        const existing = this.inflight.get(containerKey);
-        if (existing)
-            return existing;
-        const pending = this.provisionInner(containerKey, options).finally(() => {
-            this.inflight.delete(containerKey);
-        });
-        this.inflight.set(containerKey, pending);
-        return pending;
-    }
-    async provisionInner(containerKey, options) {
-        const containerName = options.containerName ?? DockerContainerManager.containerName(containerKey);
-        const mounts = options.mounts ?? [];
-        const status = await this.inspectStatus(containerName);
-        try {
-            if (status !== "missing" &&
-                (await this.hasRuntimeDrift(containerKey, containerName, mounts))) {
-                log.logInfo(`Container ${containerName} configuration changed; recreating container`);
-                await this.execFileImpl("docker", ["rm", "-f", containerName]);
-                await this.runContainer(containerKey, containerName, mounts, options);
-                log.logInfo(`Container ${containerName} recreated`);
-            }
-            else if (status === "running") {
-                log.logInfo(`Container ${containerName} already running`);
-            }
-            else if (status === "stopped") {
-                await this.execFileImpl("docker", ["start", containerName]);
-                log.logInfo(`Container ${containerName} started`);
-            }
-            else {
-                await this.runContainer(containerKey, containerName, mounts, options);
-                log.logInfo(`Container ${containerName} created`);
-            }
-        }
-        catch (err) {
-            this.state.delete(containerKey);
-            throw err;
-        }
-        this.setState(containerKey, "running", containerName);
-        await this.applyResourceLimits(containerKey, containerName);
-        return containerName;
-    }
-    async boost(containerKey) {
-        if (!this.boostLimits?.cpus && !this.boostLimits?.memory) {
-            return this.getLimitStatus(containerKey);
-        }
-        this.overrideLimits.delete(containerKey);
-        this.boostedKeys.add(containerKey);
-        const state = this.state.get(containerKey);
-        if (state?.status === "running") {
-            await this.applyResourceLimits(containerKey, state.containerName);
-        }
-        return this.getLimitStatus(containerKey);
-    }
-    async setLimits(containerKey, limits) {
-        this.boostedKeys.delete(containerKey);
-        this.overrideLimits.set(containerKey, { ...this.limits, ...limits });
-        const state = this.state.get(containerKey);
-        if (state?.status === "running") {
-            await this.applyResourceLimits(containerKey, state.containerName);
-        }
-        return this.getLimitStatus(containerKey);
-    }
-    getLimitStatus(containerKey) {
-        const boosted = this.boostedKeys.has(containerKey);
-        return { limits: this.effectiveLimits(containerKey), boosted };
-    }
-    getDefaultLimits() {
-        return this.limits;
-    }
-    getBoostLimits() {
-        return this.boostLimits;
-    }
-    async stop(containerKey) {
-        const containerName = this.getContainerName(containerKey);
-        try {
-            await this.execFileImpl("docker", ["stop", containerName]);
-            this.setState(containerKey, "stopped", containerName);
-            this.boostedKeys.delete(containerKey);
-            this.overrideLimits.delete(containerKey);
-            log.logInfo(`Container ${containerName} stopped (idle)`);
-        }
-        catch (err) {
-            log.logWarning(`Failed to stop container ${containerName}`, err instanceof Error ? err.message : String(err));
-        }
-    }
-    async remove(containerKey) {
-        const containerName = this.getContainerName(containerKey);
-        const networkName = DockerContainerManager.networkName(containerKey);
-        await this.forceRemoveContainer(containerName, `Container ${containerName} removed`, `Failed to remove container ${containerName}`);
-        try {
-            await this.execFileImpl("docker", ["network", "rm", networkName]);
-            log.logInfo(`Network ${networkName} removed`);
-        }
-        catch (err) {
-            log.logWarning(`Failed to remove network ${networkName}`, err instanceof Error ? err.message : String(err));
-        }
-        this.state.delete(containerKey);
-        this.boostedKeys.delete(containerKey);
-        this.overrideLimits.delete(containerKey);
-    }
-    async stopIdle(maxIdleMs) {
-        const now = Date.now();
-        const toStop = [];
-        for (const [containerKey, containerState] of this.state) {
-            if (containerState.status === "running" && now - containerState.lastUsed > maxIdleMs) {
-                toStop.push(containerKey);
-            }
-        }
-        await Promise.all(toStop.map((containerKey) => this.stop(containerKey)));
-    }
-    async reconcile() {
-        const discovered = new Set();
-        const labeledNames = await this.listContainerNamesByLabel();
-        for (const name of labeledNames)
-            discovered.add(name);
-        const legacyNames = await this.listContainerNamesByPrefix();
-        for (const name of legacyNames)
-            discovered.add(name);
-        this.state.clear();
-        const inspected = await Promise.all(Array.from(discovered).map(async (containerName) => ({
-            containerName,
-            details: await this.inspectContainerDetails(containerName),
-        })));
-        const legacyRemovals = [];
-        for (const { containerName, details } of inspected) {
-            if (!details)
-                continue;
-            if (!details.conversationId) {
-                legacyRemovals.push(this.removeLegacyContainer(containerName));
-                continue;
-            }
-            const containerKey = this.containerKeyFromContainerName(containerName);
-            if (!containerKey) {
-                log.logWarning(`Skipping unmanaged-style container without container key`, containerName);
-                continue;
-            }
-            const status = details.running ? "running" : "stopped";
-            const lastUsed = details.startedAtMs ?? Date.now();
-            this.state.set(containerKey, { status, lastUsed, containerName });
-        }
-        await Promise.all(legacyRemovals);
-        const running = Array.from(this.state.values()).filter((s) => s.status === "running").length;
-        const stopped = this.state.size - running;
-        log.logInfo(`Reconciled ${this.state.size} managed containers (running=${running}, stopped=${stopped})`);
-    }
-    setState(containerKey, status, containerName) {
-        this.state.set(containerKey, { status, lastUsed: Date.now(), containerName });
-    }
-    getContainerName(containerKey) {
-        return (this.state.get(containerKey)?.containerName ??
-            DockerContainerManager.containerName(containerKey));
-    }
-    mountArgs(mounts) {
-        return mounts.flatMap((mount) => ["-v", this.toBindSpec(mount)]);
-    }
-    toBindSpec(mount) {
-        return `${mount.source}:${mount.target}`;
-    }
-    async runContainer(containerKey, containerName, mounts, options) {
-        const networkName = await this.ensureNetwork(containerKey);
-        log.logInfo(`Creating container ${containerName} from image ${this.image}`);
-        const labels = [
-            "--label",
-            DockerContainerManager.MANAGED_LABEL,
-            "--label",
-            DockerContainerManager.IMAGE_MODE_LABEL,
-            "--label",
-            `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,
-        ];
-        if (options.conversationId) {
-            labels.push("--label", `${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}=${options.conversationId}`);
-        }
-        if (mounts.length > 0) {
-            labels.push("--label", `${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}=${this.mountSignature(mounts)}`);
-        }
-        await this.execFileImpl("docker", [
-            "run",
-            "-d",
-            "--name",
-            containerName,
-            "--network",
-            networkName,
-            "--cap-drop",
-            "ALL",
-            "--security-opt",
-            "no-new-privileges",
-            "--pids-limit",
-            "1024",
-            ...labels,
-            ...this.resourceLimitArgs(this.effectiveLimits(containerKey)),
-            ...this.mountArgs(mounts),
-            this.image,
-            "sleep",
-            "infinity",
-        ]);
-    }
-    effectiveLimits(containerKey) {
-        const override = this.overrideLimits.get(containerKey);
-        if (override)
-            return override;
-        if (!this.boostedKeys.has(containerKey))
-            return this.limits;
-        return { ...this.limits, ...this.boostLimits };
-    }
-    resourceLimitArgs(limits) {
-        const args = [];
-        if (limits?.cpus)
-            args.push("--cpus", limits.cpus);
-        if (limits?.memory) {
-            args.push("--memory", limits.memory);
-            // Keep Docker's no-extra-swap semantics explicit. Docker requires
-            // memory-swap to be updated together when raising an existing memory
-            // limit above the current swap limit.
-            args.push("--memory-swap", limits.memory);
-        }
-        return args;
-    }
-    async applyResourceLimits(containerKey, containerName) {
-        const limitArgs = this.resourceLimitArgs(this.effectiveLimits(containerKey));
-        if (limitArgs.length === 0)
-            return;
-        const args = ["update", ...limitArgs, containerName];
-        try {
-            await this.execFileImpl("docker", args);
-        }
-        catch (err) {
-            log.logWarning(`Failed to apply resource limits to container ${containerName}`, err instanceof Error ? err.message : String(err));
-            reportUserFacingError(err, {
-                domain: "sandbox",
-                surface: "sandbox_provision",
-                operation: "apply_resource_limits",
-                severity: "warning",
-                context: {
-                    sandboxType: "image",
-                    containerKey,
-                    containerName,
-                    limitArgCount: limitArgs.length,
-                    fatal: false,
-                },
-            });
-        }
-    }
-    async hasRuntimeDrift(containerKey, containerName, mounts) {
-        if (await this.hasBindMountDrift(containerName, mounts)) {
-            return true;
-        }
-        if (await this.hasMountSignatureDrift(containerName, mounts)) {
-            return true;
-        }
-        return this.hasNetworkModeDrift(containerKey, containerName);
-    }
-    async hasBindMountDrift(containerName, mounts) {
-        const expected = this.expectedBinds(mounts);
-        const actual = await this.inspectBindMounts(containerName);
-        return !this.sameBinds(expected, actual);
-    }
-    expectedBinds(mounts) {
-        return mounts
-            .map((mount) => this.toBindSpec(mount))
-            .slice()
-            .toSorted();
-    }
-    sameBinds(expected, actual) {
-        if (expected.length !== actual.length) {
-            return false;
-        }
-        return expected.every((bind, index) => bind === actual[index]);
-    }
-    async hasMountSignatureDrift(containerName, mounts) {
-        if (mounts.length === 0)
-            return false;
-        const expected = this.mountSignature(mounts);
-        const { stdout } = await this.execFileImpl("docker", [
-            "inspect",
-            "-f",
-            `{{index .Config.Labels "${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}"}}`,
-            containerName,
-        ]);
-        const actual = this.normalizeDockerValue(stdout.trim());
-        return actual !== expected;
-    }
-    mountSignature(mounts) {
-        const payload = mounts
-            .map((mount) => ({
-            source: mount.source,
-            target: mount.target,
-            fingerprint: this.mountSourceFingerprint(mount.source),
-        }))
-            .toSorted((left, right) => `${left.target}\0${left.source}`.localeCompare(`${right.target}\0${right.source}`));
-        return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
-    }
-    mountSourceFingerprint(source) {
-        try {
-            const stat = statSync(source);
-            if (stat.isFile()) {
-                return createHash("sha256").update(readFileSync(source)).digest("hex");
-            }
-            return `${stat.isDirectory() ? "dir" : "other"}:${stat.size}:${stat.mtimeMs}`;
-        }
-        catch {
-            return "missing";
-        }
-    }
-    async inspectBindMounts(containerName) {
-        const { stdout } = await this.execFileImpl("docker", [
-            "inspect",
-            "-f",
-            "{{json .HostConfig.Binds}}",
-            containerName,
-        ]);
-        const payload = stdout.trim();
-        const parsed = JSON.parse(payload.length > 0 ? payload : "null");
-        if (parsed === null) {
-            return [];
-        }
-        if (!Array.isArray(parsed) || parsed.some((bind) => typeof bind !== "string")) {
-            throw new Error(`Unexpected docker bind mount payload for container "${containerName}"`);
-        }
-        return [...parsed].toSorted();
-    }
-    async hasNetworkModeDrift(containerKey, containerName) {
-        const expected = DockerContainerManager.networkName(containerKey);
-        const { stdout } = await this.execFileImpl("docker", [
-            "inspect",
-            "-f",
-            "{{.HostConfig.NetworkMode}}",
-            containerName,
-        ]);
-        return stdout.trim() !== expected;
-    }
-    async ensureNetwork(containerKey) {
-        const networkName = DockerContainerManager.networkName(containerKey);
-        try {
-            await this.execFileImpl("docker", ["network", "inspect", networkName]);
-            return networkName;
-        }
-        catch (err) {
-            if (!isDockerNotFoundError(err))
-                throw err;
-        }
-        await this.execFileImpl("docker", [
-            "network",
-            "create",
-            "--driver",
-            "bridge",
-            "--label",
-            DockerContainerManager.MANAGED_LABEL,
-            "--label",
-            DockerContainerManager.IMAGE_MODE_LABEL,
-            "--label",
-            `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,
-            networkName,
-        ]);
-        return networkName;
-    }
-    async inspectStatus(containerName) {
-        try {
-            const { stdout } = await this.execFileImpl("docker", [
-                "inspect",
-                "-f",
-                "{{.State.Running}}",
-                containerName,
-            ]);
-            return stdout.trim() === "true" ? "running" : "stopped";
-        }
-        catch (err) {
-            if (isDockerNotFoundError(err))
-                return "missing";
-            throw err;
-        }
-    }
-    async listContainerNamesByLabel() {
-        try {
-            const { stdout } = await this.execFileImpl("docker", [
-                "ps",
-                "-a",
-                "--filter",
-                `label=${DockerContainerManager.MANAGED_LABEL}`,
-                "--filter",
-                `label=${DockerContainerManager.IMAGE_MODE_LABEL}`,
-                "--format",
-                "{{.Names}}",
-            ]);
-            return this.parseNameLines(stdout);
-        }
-        catch (err) {
-            log.logWarning("Failed to list labeled managed containers", err instanceof Error ? err.message : String(err));
-            return [];
-        }
-    }
-    async listContainerNamesByPrefix() {
-        try {
-            const { stdout } = await this.execFileImpl("docker", [
-                "ps",
-                "-a",
-                "--filter",
-                `name=${DockerContainerManager.containerName("")}`,
-                "--format",
-                "{{.Names}}",
-            ]);
-            return this.parseNameLines(stdout);
-        }
-        catch (err) {
-            log.logWarning("Failed to list legacy managed containers", err instanceof Error ? err.message : String(err));
-            return [];
-        }
-    }
-    parseNameLines(stdout) {
-        return stdout
-            .split("\n")
-            .map((line) => line.trim())
-            .filter((line) => line.length > 0);
-    }
-    async inspectContainerDetails(containerName) {
-        try {
-            const { stdout } = await this.execFileImpl("docker", [
-                "inspect",
-                "-f",
-                `{{.State.Running}}\t{{.State.StartedAt}}\t{{index .Config.Labels "${DockerContainerManager.VAULT_ID_LABEL_KEY}"}}\t{{index .Config.Labels "${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}"}}`,
-                containerName,
-            ]);
-            const [runningRaw, startedAtRaw, vaultIdRaw, conversationIdRaw] = stdout.trim().split("\t");
-            const running = runningRaw === "true";
-            const startedAtMs = this.parseDockerTimestamp(startedAtRaw);
-            const vaultId = this.normalizeDockerValue(vaultIdRaw);
-            const conversationId = this.normalizeDockerValue(conversationIdRaw);
-            return { running, startedAtMs, vaultId, conversationId };
-        }
-        catch (err) {
-            log.logWarning(`Failed to inspect container ${containerName} during reconcile`, err instanceof Error ? err.message : String(err));
-            return undefined;
-        }
-    }
-    normalizeDockerValue(value) {
-        if (!value || value === "<no value>")
-            return undefined;
-        const trimmed = value.trim();
-        return trimmed.length > 0 ? trimmed : undefined;
-    }
-    parseDockerTimestamp(value) {
-        const normalized = this.normalizeDockerValue(value);
-        if (!normalized || normalized.startsWith("0001-"))
-            return undefined;
-        const parsed = Date.parse(normalized);
-        return Number.isNaN(parsed) ? undefined : parsed;
-    }
-    containerKeyFromContainerName(containerName) {
-        const prefix = DockerContainerManager.containerName("");
-        if (!containerName.startsWith(prefix))
-            return undefined;
-        const containerKey = containerName.slice(prefix.length);
-        return containerKey.length > 0 ? containerKey : undefined;
-    }
-    async forceRemoveContainer(containerName, successLog, failureLog) {
-        try {
-            await this.execFileImpl("docker", ["rm", "-f", containerName]);
-            log.logInfo(successLog);
-        }
-        catch (err) {
-            log.logWarning(failureLog, err instanceof Error ? err.message : String(err));
-        }
-    }
-    async removeLegacyContainer(containerName) {
-        await this.forceRemoveContainer(containerName, `Removed legacy mikan container ${containerName} (pre-channel-isolation scheme)`, `Failed to remove legacy mikan container ${containerName}`);
-    }
-}
-//# sourceMappingURL=provisioner.js.map