@geminixiang/mikan 1.0.0 → 1.0.2

package/dist/harness/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/harness/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { OfficeAddress, PlatformTrustModel } from \"../types.js\";\nimport type { MikanAgentSession } from \"./session.js\";\nimport type { Api, ImageContent, Model, RetryPolicy, Usage } from \"@earendil-works/pi-ai\";\nimport type { ConversationResponder, MessagingInfo, SubagentProgressSnapshot } from \"../types.js\";\nimport type { resolveConversationSettings } from \"../settings/index.js\";\nimport type { Executor, RuntimePathContext, SandboxConfig } from \"../sandbox/types.js\";\nimport type { WorkspaceProjection, Office } from \"../office/types.js\";\n\nimport type { AgentMessage, AgentTool, ThinkingLevel } from \"@earendil-works/pi-agent-core\";\nimport type { Context, JsonValue } from \"@earendil-works/chord\";\nimport type {\n  CompactionPolicy,\n  ToolControl,\n  ToolExecutionApi,\n  ToolRegistration,\n} from \"@earendil-works/pi-durable\";\nimport type { ExecutionEnv } from \"@earendil-works/pi-durable/env\";\nimport type { JsonValue as ModelJsonValue, TextContent } from \"@earendil-works/pi-ai\";\nimport type { MikanModels } from \"./models.js\";\nimport type { SessionStore } from \"../sessions/session-store.js\";\nimport type { Static, TSchema } from \"typebox\";\n\nexport interface EnsureDefaultOpenConnectorOptions {\n  office: Office;\n  platformWorkspaceId?: string;\n  defaultServer?: McpServerConfig;\n  signal?: AbortSignal;\n  fetch?: typeof globalThis.fetch;\n}\n\nexport interface BuildSystemPromptOptions {\n  workspacePath: string;\n  office: Office;\n  memory: string;\n  sandboxConfig: SandboxConfig;\n  platform: MessagingInfo;\n  skills: MikanSkill[];\n  projection: WorkspaceProjection;\n  skippedSkillLinks?: string[];\n}\n\nexport interface RunnerSessionState {\n  responder: ConversationResponder | null;\n  logCtx: {\n    conversationId: string;\n    userName?: string;\n    conversationName?: string;\n    sessionId?: string;\n  } | null;\n  queue: {\n    enqueue(fn: () => Promise<void>, errorContext: string): void;\n  } | null;\n  pendingTools: Map<string, { toolName: string; args: unknown; startTime: number }>;\n  completedTools: ToolTiming[];\n  toolProgress: Map<string, { label: string; status: \"running\" | \"done\" | \"error\" }>;\n  subagentProgress: Map<string, SubagentProgressSnapshot>;\n  completedSubagentProgress: SubagentProgressSnapshot[];\n  subagentToolCalls: Set<string>;\n  subagentProgressShown: boolean;\n  suppressResponseDeltas: boolean;\n  answerStreamStarted: boolean;\n  workAcknowledged: boolean;\n  publishRunEvent: RunEventListener | undefined;\n  lastSubagentProgressAt: number;\n  toolProgressTimer: ReturnType<typeof setTimeout> | undefined;\n  llmCallCount: number;\n  toolCallCount: number;\n  toolErrorCount: number;\n  toolInputCharacters: number;\n  toolOutputCharacters: number;\n  assistantMessageCount: number;\n  outputCharacters: number;\n  retryCount: number;\n  compactionCount: number;\n  budgetExceeded: boolean;\n  firstTokenLatencyMs?: number;\n  responseModel?: string;\n  stopReason: string;\n  errorMessage: string | undefined;\n  reportedLlmError: boolean;\n  finalResponseHandledByTool: boolean;\n  triggerAttribution?: string;\n}\n\nexport interface UsageReportContext {\n  session: MikanAgentSession;\n  runState: RunnerSessionState;\n  responder: ConversationResponder;\n  platform: MessagingInfo;\n  model: Model<Api>;\n  sessionConversation: string;\n  sessionUuid: string;\n  waitForQueue: () => Promise<void>;\n}\n\nexport interface RunnerExecutionContext {\n  executor: Executor;\n  resolveForRun(context: {\n    address: OfficeAddress;\n    userId: string;\n    trustModel?: PlatformTrustModel;\n  }): Promise<{\n    pathContext: RuntimePathContext;\n    projection: WorkspaceProjection;\n  }>;\n}\n\nexport interface RunPresentation {\n  wait(): Promise<void>;\n  dispose(): void;\n}\n\nexport interface RunPresentationContext {\n  responder: ConversationResponder;\n  sessionConversation: string;\n  userName: string | undefined;\n  sessionUuid: string;\n  triggerAttribution: string | undefined;\n  publishRunEvent?: RunEventListener;\n}\n\nexport interface PlatformToolRoles {\n  platformTools: ReadonlySet<string>;\n  finalResponseTools: ReadonlySet<string>;\n}\n\nexport interface SessionEventHandlerParams {\n  session: MikanAgentSession;\n  runState: RunnerSessionState;\n  model: Model<Api>;\n  agentConfig: ReturnType<typeof resolveConversationSettings>;\n  platformToolRoles: PlatformToolRoles;\n}\n\nexport interface FinalizeRunResponseOptions {\n  triggerSessionLink?: string;\n  createOverflowLink?: () => string;\n  platform?: string;\n  model?: Model<Api>;\n  sessionConversation?: string;\n  sessionUuid?: string;\n  initialTask?: boolean;\n}\n\nexport interface PreparedRunContext {\n  sessionConversation: string;\n  userMessage: string;\n  imageAttachments: ImageContent[];\n  triggerAttribution?: string;\n}\n\nexport interface SubagentModelSpec {\n  provider: string;\n  id: string;\n}\n\nexport interface SubagentProfile {\n  name: string;\n  description: string;\n  systemPrompt: string;\n  tools: string[];\n  model?: SubagentModelSpec;\n  thinkingLevel?: ThinkingLevel;\n  maxTurns?: number;\n  maxTokens?: number;\n  maxCostUsd?: number;\n  maxDurationMs?: number;\n}\n\ninterface SubagentRunBudget {\n  maxTurns?: number;\n  maxTokens?: number;\n  maxCostUsd?: number;\n  maxDurationMs?: number;\n}\n\nexport type SubagentRunStatus =\n  | \"completed\"\n  | \"failed\"\n  | \"cancelled\"\n  | \"timeout\"\n  | \"budget_exceeded\"\n  | \"invalid_output\";\n\ninterface SubagentParentContext {\n  mode: \"normalized\";\n  recentTurns?: number;\n}\n\nexport type SubagentUsage = Usage;\n\nexport type SubagentUsageSink = (usage: SubagentUsage) => void | Promise<void>;\n\nexport interface SubagentRunRequest<TOutputSchema extends TSchema | undefined = undefined> {\n  task: string;\n  profile?: string;\n  parentContext?: SubagentParentContext;\n  systemPrompt?: string;\n  input?: unknown;\n  model?: SubagentModelSpec;\n  tools?: string[];\n  thinkingLevel?: ThinkingLevel;\n  outputSchema?: TOutputSchema;\n  budget?: SubagentRunBudget;\n  signal?: AbortSignal;\n}\n\nexport type SubagentRunOutput<TSchemaOrUndefined extends TSchema | undefined> =\n  TSchemaOrUndefined extends TSchema ? Static<TSchemaOrUndefined> : string;\n\ninterface SubagentRunMetadata {\n  runId: string;\n  text?: string;\n  model: SubagentModelSpec;\n  turns: number;\n  toolCalls: number;\n  toolCallCounts: Record<string, number>;\n  usage: SubagentUsage;\n  tokens: number;\n  costUsd: number;\n  durationMs: number;\n  cleanupPending?: boolean;\n}\n\ninterface SubagentRunCompletedResult<TOutput> extends SubagentRunMetadata {\n  status: \"completed\";\n  output: TOutput;\n  error?: never;\n}\n\ninterface SubagentRunIncompleteResult extends SubagentRunMetadata {\n  status: Exclude<SubagentRunStatus, \"completed\">;\n  output?: never;\n  error?: string;\n}\n\nexport type SubagentRunResult<TOutput = string> =\n  | SubagentRunCompletedResult<TOutput>\n  | SubagentRunIncompleteResult;\n\nexport interface CreateMikanModelsOptions {\n  modelsJsonPath: string;\n}\n\nexport interface MikanSkill {\n  name: string;\n  description: string;\n  content: string;\n  filePath: string;\n  disableModelInvocation?: boolean;\n  baseDir: string;\n  source: string;\n  inline?: boolean;\n  directory?: string;\n  enabled?: boolean;\n}\n\nexport type SkillScope = \"global\" | \"conversation\";\n\nexport interface SkillPatterns {\n  global: readonly string[];\n  conversation: readonly string[];\n}\n\nexport interface SkillDiagnostic {\n  type: \"warning\";\n  message: string;\n  path: string;\n  code?: \"symlink\";\n}\n\nexport interface LoadSkillsResult {\n  skills: MikanSkill[];\n  diagnostics: SkillDiagnostic[];\n}\n\nexport type RetrySettings = RetryPolicy;\n\nexport interface BudgetSettings {\n  maxTokens?: number;\n  maxCostUsd?: number;\n  maxDurationMs?: number;\n  maxLlmCalls?: number;\n}\n\nexport type CompactionSettings = CompactionPolicy;\n\nexport interface HarnessSettings {\n  compaction: CompactionSettings;\n  retry: RetrySettings;\n  budget: BudgetSettings;\n}\n\nexport type ToolLoopVerdict =\n  | { kind: \"allow\" }\n  | { kind: \"notice\"; text: string }\n  | { kind: \"block\"; reason: string }\n  | { kind: \"stop\"; reason: string };\n\nexport interface SubagentProfileDiagnostic {\n  type: \"warning\";\n  message: string;\n  path: string;\n}\n\nexport interface LoadSubagentProfilesResult {\n  profiles: Map<string, SubagentProfile>;\n  diagnostics: SubagentProfileDiagnostic[];\n}\n\ntype CompactionReason = \"threshold\" | \"overflow\" | \"manual\";\n\nexport type HarnessEvent =\n  | { type: \"message_start\"; message: AgentMessage }\n  | { type: \"text_delta\"; delta: string }\n  | { type: \"message_end\"; message: AgentMessage }\n  | { type: \"tool_execution_start\"; toolCallId: string; toolName: string; args: unknown }\n  | { type: \"tool_execution_update\"; toolCallId: string; toolName: string; details: JsonValue }\n  | {\n      type: \"tool_execution_end\";\n      toolCallId: string;\n      toolName: string;\n      result: { content: (TextContent | ImageContent)[]; details?: unknown };\n      isError: boolean;\n    }\n  | { type: \"compaction_start\"; reason: CompactionReason }\n  | {\n      type: \"compaction_end\";\n      reason: CompactionReason;\n      aborted: boolean;\n      errorMessage?: string;\n    }\n  | {\n      type: \"auto_retry_start\";\n      attempt: number;\n      maxAttempts: number;\n      delayMs: number;\n      errorMessage: string;\n    }\n  | { type: \"auto_retry_end\"; success: boolean; attempt: number; finalError?: string }\n  | {\n      type: \"budget_exceeded\";\n      reason: string;\n      tokens: number;\n      costUsd: number;\n      llmCalls: number;\n      durationMs: number;\n    };\n\nexport type HarnessEventListener = (event: HarnessEvent) => void | Promise<void>;\n\nexport type RunEvent =\n  | { type: \"tool_started\"; toolCallId: string; toolName: string; label: string }\n  | { type: \"subagent_progress\"; toolCallId: string; snapshot: SubagentProgressSnapshot }\n  | {\n      type: \"tool_ended\";\n      toolCallId: string;\n      toolName: string;\n      isError: boolean;\n      resultText: string;\n    }\n  | { type: \"assistant_delta\"; delta: string }\n  | { type: \"assistant_message\"; thinking: string[]; text: string; callsTools: boolean }\n  | { type: \"compaction_started\" }\n  | { type: \"retry_started\"; attempt: number; maxAttempts: number }\n  | { type: \"budget_exceeded\"; reason: string; llmCalls: number; durationMs: number }\n  | { type: \"run_started\"; userName: string; text: string }\n  | { type: \"run_ended\" };\n\nexport type RunEventListener = (event: RunEvent) => void;\n\nexport interface RunEventPublisher {\n  publish(address: OfficeAddress, sessionKey: string, event: RunEvent): void;\n}\n\nexport interface MikanToolContext {\n  env: ExecutionEnv;\n}\n\nexport interface MikanToolResult {\n  content?: (TextContent | ImageContent)[];\n  details?: JsonValue;\n  isError?: boolean;\n  structuredContent?: ModelJsonValue;\n  usage?: Usage;\n  control?: ToolControl;\n}\n\nexport type MikanHarnessTool = Omit<ToolRegistration, \"execute\"> & {\n  outputSchema?: TSchema;\n  exposure?: McpExposure;\n  namespace?: string;\n  execute(args: unknown, api: ToolExecutionApi, context: Context): Promise<MikanToolResult>;\n};\n\nexport interface ToolSearchOptions {\n  tools: readonly MikanHarnessTool[];\n  query: string;\n  limit?: number;\n  namespace?: string;\n}\n\nexport interface ToolSearchToolOptions {\n  tools: readonly MikanHarnessTool[];\n  loaded: ReadonlySet<string>;\n  load: (names: string[], context: Context) => Promise<void>;\n}\n\nexport interface CodemodeToolOptions {\n  tools: readonly MikanHarnessTool[];\n  servers?: readonly McpServerSummary[];\n  executeNested: (\n    tool: MikanHarnessTool,\n    args: Parameters<MikanHarnessTool[\"execute\"]>,\n  ) => Promise<MikanToolResult>;\n}\n\nexport type MikanToolInput = AgentTool | MikanHarnessTool;\n\nexport interface MikanAgentSessionOptions {\n  systemPrompt: string;\n  model: Model<Api>;\n  thinkingLevel: ThinkingLevel;\n  tools: MikanToolInput[];\n  toolContext?: MikanToolContext;\n  models: MikanModels;\n  sessionStore: SessionStore;\n  settings?: {\n    compaction?: Partial<CompactionSettings>;\n    retry?: Partial<RetrySettings>;\n    budget?: Partial<BudgetSettings>;\n  };\n}\n\nexport interface McpServerConfig {\n  command?: string;\n  args?: string[];\n  env?: Record<string, string>;\n  url?: string;\n  headers?: Record<string, string>;\n  disabled?: boolean;\n  exposure?: McpExposure;\n  description?: string;\n}\n\nexport type McpExposure = \"codemode\" | \"deferred\";\n\nexport interface McpServerSummary {\n  name: string;\n  exposure: McpExposure;\n  description?: string;\n  instructions?: string;\n}\n\ntype McpPresetCredentialTarget = \"env\" | \"header\" | \"url\";\n\ninterface McpPresetCredential {\n  key: string;\n  label: string;\n  description: string;\n  target: McpPresetCredentialTarget;\n  required: boolean;\n  secret: boolean;\n  valuePrefix?: string;\n}\n\nexport interface McpPreset {\n  id: string;\n  name: string;\n  description: string;\n  category: string;\n  serverName: string;\n  sourceUrl: string;\n  setupUrl: string;\n  server: McpServerConfig;\n  credentials: McpPresetCredential[];\n}\n\nexport interface McpLoadError {\n  server: string;\n  error: string;\n}\n\nexport interface McpToolsResult {\n  tools: MikanHarnessTool[];\n  errors: McpLoadError[];\n  servers: McpServerSummary[];\n  dispose: () => Promise<void>;\n}\n\nexport interface ToolTiming {\n  label: string;\n  toolName: string;\n  durationMs: number;\n  isError: boolean;\n}\n\nexport interface BudgetStopReport {\n  reason: string;\n  llmCalls: number;\n  durationMs: number;\n  completed: readonly ToolTiming[];\n  running: readonly ToolTiming[];\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/harness/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { OfficeAddress, PlatformTrustModel } from \"../types.js\";\nimport type { MikanAgentSession } from \"./session.js\";\nimport type { Api, ImageContent, Model, RetryPolicy, Usage } from \"@earendil-works/pi-ai\";\nimport type { ConversationResponder, MessagingInfo, SubagentProgressSnapshot } from \"../types.js\";\nimport type { resolveConversationSettings } from \"../settings/index.js\";\nimport type { Executor, RuntimePathContext, SandboxConfig } from \"../sandbox/types.js\";\nimport type { WorkspaceProjection, Office } from \"../office/types.js\";\n\nimport type { AgentMessage, AgentTool, ThinkingLevel } from \"@earendil-works/pi-agent-core\";\nimport type { Context, JsonValue } from \"@earendil-works/chord\";\nimport type {\n  CompactionPolicy,\n  ToolControl,\n  ToolExecutionApi,\n  ToolRegistration,\n} from \"@earendil-works/pi-durable\";\nimport type { ExecutionEnv } from \"@earendil-works/pi-durable/env\";\nimport type { JsonValue as ModelJsonValue, TextContent } from \"@earendil-works/pi-ai\";\nimport type { MikanModels } from \"./models.js\";\nimport type { SessionStore } from \"../sessions/session-store.js\";\nimport type { Static, TSchema } from \"typebox\";\n\nexport interface EnsureDefaultOpenConnectorOptions {\n  office: Office;\n  platformWorkspaceId?: string;\n  defaultServer?: McpServerConfig;\n  signal?: AbortSignal;\n  fetch?: typeof globalThis.fetch;\n}\n\nexport interface ScratchListing {\n  folders: string[];\n  omitted: number;\n}\n\nexport interface BuildSystemPromptOptions {\n  workspacePath: string;\n  office: Office;\n  memory: string;\n  sandboxConfig: SandboxConfig;\n  platform: MessagingInfo;\n  skills: MikanSkill[];\n  projection: WorkspaceProjection;\n  skippedSkillLinks?: string[];\n  scratch: ScratchListing;\n}\n\nexport interface RunnerSessionState {\n  responder: ConversationResponder | null;\n  logCtx: {\n    conversationId: string;\n    userName?: string;\n    conversationName?: string;\n    sessionId?: string;\n  } | null;\n  queue: {\n    enqueue(fn: () => Promise<void>, errorContext: string): void;\n  } | null;\n  pendingTools: Map<string, { toolName: string; args: unknown; startTime: number }>;\n  completedTools: ToolTiming[];\n  toolProgress: Map<string, { label: string; status: \"running\" | \"done\" | \"error\" }>;\n  subagentProgress: Map<string, SubagentProgressSnapshot>;\n  completedSubagentProgress: SubagentProgressSnapshot[];\n  subagentToolCalls: Set<string>;\n  subagentProgressShown: boolean;\n  suppressResponseDeltas: boolean;\n  answerStreamStarted: boolean;\n  workAcknowledged: boolean;\n  publishRunEvent: RunEventListener | undefined;\n  lastSubagentProgressAt: number;\n  toolProgressTimer: ReturnType<typeof setTimeout> | undefined;\n  llmCallCount: number;\n  toolCallCount: number;\n  toolErrorCount: number;\n  toolInputCharacters: number;\n  toolOutputCharacters: number;\n  assistantMessageCount: number;\n  outputCharacters: number;\n  retryCount: number;\n  compactionCount: number;\n  budgetExceeded: boolean;\n  firstTokenLatencyMs?: number;\n  responseModel?: string;\n  stopReason: string;\n  errorMessage: string | undefined;\n  reportedLlmError: boolean;\n  finalResponseHandledByTool: boolean;\n  triggerAttribution?: string;\n}\n\nexport interface UsageReportContext {\n  session: MikanAgentSession;\n  runState: RunnerSessionState;\n  responder: ConversationResponder;\n  platform: MessagingInfo;\n  model: Model<Api>;\n  sessionConversation: string;\n  sessionUuid: string;\n  waitForQueue: () => Promise<void>;\n}\n\nexport interface RunnerExecutionContext {\n  executor: Executor;\n  resolveForRun(context: {\n    address: OfficeAddress;\n    userId: string;\n    trustModel?: PlatformTrustModel;\n  }): Promise<{\n    pathContext: RuntimePathContext;\n    projection: WorkspaceProjection;\n  }>;\n}\n\nexport interface RunPresentation {\n  wait(): Promise<void>;\n  dispose(): void;\n}\n\nexport interface RunPresentationContext {\n  responder: ConversationResponder;\n  sessionConversation: string;\n  userName: string | undefined;\n  sessionUuid: string;\n  triggerAttribution: string | undefined;\n  publishRunEvent?: RunEventListener;\n}\n\nexport interface PlatformToolRoles {\n  platformTools: ReadonlySet<string>;\n  finalResponseTools: ReadonlySet<string>;\n}\n\nexport interface SessionEventHandlerParams {\n  session: MikanAgentSession;\n  runState: RunnerSessionState;\n  model: Model<Api>;\n  agentConfig: ReturnType<typeof resolveConversationSettings>;\n  platformToolRoles: PlatformToolRoles;\n}\n\nexport interface FinalizeRunResponseOptions {\n  triggerSessionLink?: string;\n  createOverflowLink?: () => string;\n  platform?: string;\n  model?: Model<Api>;\n  sessionConversation?: string;\n  sessionUuid?: string;\n  initialTask?: boolean;\n}\n\nexport interface PreparedRunContext {\n  sessionConversation: string;\n  userMessage: string;\n  imageAttachments: ImageContent[];\n  triggerAttribution?: string;\n}\n\nexport interface SubagentModelSpec {\n  provider: string;\n  id: string;\n}\n\nexport interface SubagentProfile {\n  name: string;\n  description: string;\n  systemPrompt: string;\n  tools: string[];\n  model?: SubagentModelSpec;\n  thinkingLevel?: ThinkingLevel;\n  maxTurns?: number;\n  maxTokens?: number;\n  maxCostUsd?: number;\n  maxDurationMs?: number;\n}\n\ninterface SubagentRunBudget {\n  maxTurns?: number;\n  maxTokens?: number;\n  maxCostUsd?: number;\n  maxDurationMs?: number;\n}\n\nexport type SubagentRunStatus =\n  | \"completed\"\n  | \"failed\"\n  | \"cancelled\"\n  | \"timeout\"\n  | \"budget_exceeded\"\n  | \"invalid_output\";\n\ninterface SubagentParentContext {\n  mode: \"normalized\";\n  recentTurns?: number;\n}\n\nexport type SubagentUsage = Usage;\n\nexport type SubagentUsageSink = (usage: SubagentUsage) => void | Promise<void>;\n\nexport interface SubagentRunRequest<TOutputSchema extends TSchema | undefined = undefined> {\n  task: string;\n  profile?: string;\n  parentContext?: SubagentParentContext;\n  systemPrompt?: string;\n  input?: unknown;\n  model?: SubagentModelSpec;\n  tools?: string[];\n  thinkingLevel?: ThinkingLevel;\n  outputSchema?: TOutputSchema;\n  budget?: SubagentRunBudget;\n  signal?: AbortSignal;\n}\n\nexport type SubagentRunOutput<TSchemaOrUndefined extends TSchema | undefined> =\n  TSchemaOrUndefined extends TSchema ? Static<TSchemaOrUndefined> : string;\n\ninterface SubagentRunMetadata {\n  runId: string;\n  text?: string;\n  model: SubagentModelSpec;\n  turns: number;\n  toolCalls: number;\n  toolCallCounts: Record<string, number>;\n  usage: SubagentUsage;\n  tokens: number;\n  costUsd: number;\n  durationMs: number;\n  cleanupPending?: boolean;\n}\n\ninterface SubagentRunCompletedResult<TOutput> extends SubagentRunMetadata {\n  status: \"completed\";\n  output: TOutput;\n  error?: never;\n}\n\ninterface SubagentRunIncompleteResult extends SubagentRunMetadata {\n  status: Exclude<SubagentRunStatus, \"completed\">;\n  output?: never;\n  error?: string;\n}\n\nexport type SubagentRunResult<TOutput = string> =\n  | SubagentRunCompletedResult<TOutput>\n  | SubagentRunIncompleteResult;\n\nexport interface CreateMikanModelsOptions {\n  modelsJsonPath: string;\n}\n\nexport interface MikanSkill {\n  name: string;\n  description: string;\n  content: string;\n  filePath: string;\n  disableModelInvocation?: boolean;\n  baseDir: string;\n  source: string;\n  inline?: boolean;\n  directory?: string;\n  enabled?: boolean;\n}\n\nexport type SkillScope = \"global\" | \"conversation\";\n\nexport interface SkillPatterns {\n  global: readonly string[];\n  conversation: readonly string[];\n}\n\nexport interface SkillDiagnostic {\n  type: \"warning\";\n  message: string;\n  path: string;\n  code?: \"symlink\";\n}\n\nexport interface LoadSkillsResult {\n  skills: MikanSkill[];\n  diagnostics: SkillDiagnostic[];\n}\n\nexport type RetrySettings = RetryPolicy;\n\nexport interface BudgetSettings {\n  maxTokens?: number;\n  maxCostUsd?: number;\n  maxDurationMs?: number;\n  maxLlmCalls?: number;\n}\n\nexport type CompactionSettings = CompactionPolicy;\n\nexport interface HarnessSettings {\n  compaction: CompactionSettings;\n  retry: RetrySettings;\n  budget: BudgetSettings;\n}\n\nexport type ToolLoopVerdict =\n  | { kind: \"allow\" }\n  | { kind: \"notice\"; text: string }\n  | { kind: \"block\"; reason: string }\n  | { kind: \"stop\"; reason: string };\n\nexport interface SubagentProfileDiagnostic {\n  type: \"warning\";\n  message: string;\n  path: string;\n}\n\nexport interface LoadSubagentProfilesResult {\n  profiles: Map<string, SubagentProfile>;\n  diagnostics: SubagentProfileDiagnostic[];\n}\n\ntype CompactionReason = \"threshold\" | \"overflow\" | \"manual\";\n\nexport type HarnessEvent =\n  | { type: \"message_start\"; message: AgentMessage }\n  | { type: \"text_delta\"; delta: string }\n  | { type: \"message_end\"; message: AgentMessage }\n  | { type: \"tool_execution_start\"; toolCallId: string; toolName: string; args: unknown }\n  | { type: \"tool_execution_update\"; toolCallId: string; toolName: string; details: JsonValue }\n  | {\n      type: \"tool_execution_end\";\n      toolCallId: string;\n      toolName: string;\n      result: { content: (TextContent | ImageContent)[]; details?: unknown };\n      isError: boolean;\n    }\n  | { type: \"compaction_start\"; reason: CompactionReason }\n  | {\n      type: \"compaction_end\";\n      reason: CompactionReason;\n      aborted: boolean;\n      errorMessage?: string;\n    }\n  | {\n      type: \"auto_retry_start\";\n      attempt: number;\n      maxAttempts: number;\n      delayMs: number;\n      errorMessage: string;\n    }\n  | { type: \"auto_retry_end\"; success: boolean; attempt: number; finalError?: string }\n  | {\n      type: \"budget_exceeded\";\n      reason: string;\n      tokens: number;\n      costUsd: number;\n      llmCalls: number;\n      durationMs: number;\n    };\n\nexport type HarnessEventListener = (event: HarnessEvent) => void | Promise<void>;\n\nexport type RunEvent =\n  | { type: \"tool_started\"; toolCallId: string; toolName: string; label: string }\n  | { type: \"subagent_progress\"; toolCallId: string; snapshot: SubagentProgressSnapshot }\n  | {\n      type: \"tool_ended\";\n      toolCallId: string;\n      toolName: string;\n      isError: boolean;\n      resultText: string;\n    }\n  | { type: \"assistant_delta\"; delta: string }\n  | { type: \"assistant_message\"; thinking: string[]; text: string; callsTools: boolean }\n  | { type: \"compaction_started\" }\n  | { type: \"retry_started\"; attempt: number; maxAttempts: number }\n  | { type: \"budget_exceeded\"; reason: string; llmCalls: number; durationMs: number }\n  | { type: \"run_started\"; userName: string; text: string }\n  | { type: \"run_ended\" };\n\nexport type RunEventListener = (event: RunEvent) => void;\n\nexport interface RunEventPublisher {\n  publish(address: OfficeAddress, sessionKey: string, event: RunEvent): void;\n}\n\nexport interface MikanToolContext {\n  env: ExecutionEnv;\n}\n\nexport interface MikanToolResult {\n  content?: (TextContent | ImageContent)[];\n  details?: JsonValue;\n  isError?: boolean;\n  structuredContent?: ModelJsonValue;\n  usage?: Usage;\n  control?: ToolControl;\n}\n\nexport type MikanHarnessTool = Omit<ToolRegistration, \"execute\"> & {\n  outputSchema?: TSchema;\n  exposure?: McpExposure;\n  namespace?: string;\n  execute(args: unknown, api: ToolExecutionApi, context: Context): Promise<MikanToolResult>;\n};\n\nexport interface ToolSearchOptions {\n  tools: readonly MikanHarnessTool[];\n  query: string;\n  limit?: number;\n  namespace?: string;\n}\n\nexport interface ToolSearchToolOptions {\n  tools: readonly MikanHarnessTool[];\n  loaded: ReadonlySet<string>;\n  load: (names: string[], context: Context) => Promise<void>;\n}\n\nexport interface CodemodeToolOptions {\n  tools: readonly MikanHarnessTool[];\n  servers?: readonly McpServerSummary[];\n  executeNested: (\n    tool: MikanHarnessTool,\n    args: Parameters<MikanHarnessTool[\"execute\"]>,\n  ) => Promise<MikanToolResult>;\n}\n\nexport type MikanToolInput = AgentTool | MikanHarnessTool;\n\nexport interface MikanAgentSessionOptions {\n  systemPrompt: string;\n  model: Model<Api>;\n  thinkingLevel: ThinkingLevel;\n  tools: MikanToolInput[];\n  toolContext?: MikanToolContext;\n  models: MikanModels;\n  sessionStore: SessionStore;\n  settings?: {\n    compaction?: Partial<CompactionSettings>;\n    retry?: Partial<RetrySettings>;\n    budget?: Partial<BudgetSettings>;\n  };\n}\n\nexport interface McpServerConfig {\n  command?: string;\n  args?: string[];\n  env?: Record<string, string>;\n  url?: string;\n  headers?: Record<string, string>;\n  disabled?: boolean;\n  exposure?: McpExposure;\n  description?: string;\n}\n\nexport type McpExposure = \"codemode\" | \"deferred\";\n\nexport interface McpServerSummary {\n  name: string;\n  exposure: McpExposure;\n  description?: string;\n  instructions?: string;\n}\n\ntype McpPresetCredentialTarget = \"env\" | \"header\" | \"url\";\n\ninterface McpPresetCredential {\n  key: string;\n  label: string;\n  description: string;\n  target: McpPresetCredentialTarget;\n  required: boolean;\n  secret: boolean;\n  valuePrefix?: string;\n}\n\nexport interface McpPreset {\n  id: string;\n  name: string;\n  description: string;\n  category: string;\n  serverName: string;\n  sourceUrl: string;\n  setupUrl: string;\n  server: McpServerConfig;\n  credentials: McpPresetCredential[];\n}\n\nexport interface McpLoadError {\n  server: string;\n  error: string;\n}\n\nexport interface McpToolsResult {\n  tools: MikanHarnessTool[];\n  errors: McpLoadError[];\n  servers: McpServerSummary[];\n  dispose: () => Promise<void>;\n}\n\nexport interface ToolTiming {\n  label: string;\n  toolName: string;\n  durationMs: number;\n  isError: boolean;\n}\n\nexport interface BudgetStopReport {\n  reason: string;\n  llmCalls: number;\n  durationMs: number;\n  completed: readonly ToolTiming[];\n  running: readonly ToolTiming[];\n}\n"]}

package/dist/sandbox/container.d.ts

@@ -1,4 +1,5 @@
-import type { ContainerSandboxConfig, ExecOptions, ExecResult, Executor, RuntimePathContext, SandboxAdapter } from "./types.js";
+import type { ContainerSandboxConfig, DockerExecFile, ExecOptions, ExecResult, Executor, RuntimePathContext, SandboxAdapter } from "./types.js";
+export declare function sweepOrphanedCommands(containerName: string, execFile: DockerExecFile): Promise<void>;
 export declare class ContainerExecutor implements Executor {
     private container;
     private env?;
@@ -6,6 +7,7 @@ export declare class ContainerExecutor implements Executor {
     private readonly hostExecutor;
     constructor(container: string, env?: Record<string, string> | undefined, ensureReady?: (() => Promise<void>) | undefined);
     exec(command: string, options?: ExecOptions): Promise<ExecResult>;
+    private killProcessGroup;
     readFile(path: string, options?: ExecOptions): Promise<string>;
     readFileBase64(path: string, options?: ExecOptions): Promise<string>;
     writeFile(path: string, content: string, options?: ExecOptions): Promise<void>;

package/dist/sandbox/container.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACf,MAAM,YAAY,CAAC;AA+FpB,qBAAa,iBAAkB,YAAW,QAAQ;IAI9C,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,GAAG,CAAC;IACZ,OAAO,CAAC,WAAW,CAAC;IALtB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IAEnD,YACU,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAA,EAC5B,WAAW,CAAC,GAAE,MAAM,OAAO,CAAC,IAAI,CAAC,aAAA,EACvC;IAEE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAqBtE;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7D;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;IAED,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;IAED,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1C;IAED,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAE5D;IAED,gBAAgB,IAAI,sBAAsB,CAEzC;CACF;AAED,eAAO,MAAM,uBAAuB,EAAE,cAAc,CAAC,sBAAsB,CAQ1E,CAAC"}
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,sBAAsB,EACtB,cAAc,EACd,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACf,MAAM,YAAY,CAAC;AA0FpB,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,IAAI,CAAC,CAMf;AAyCD,qBAAa,iBAAkB,YAAW,QAAQ;IAI9C,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,GAAG,CAAC;IACZ,OAAO,CAAC,WAAW,CAAC;IALtB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IAEnD,YACU,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAA,EAC5B,WAAW,CAAC,GAAE,MAAM,OAAO,CAAC,IAAI,CAAC,aAAA,EACvC;IAEE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BtE;YAEa,gBAAgB;IAW9B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7D;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;IAED,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;IAED,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1C;IAED,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAE5D;IAED,gBAAgB,IAAI,sBAAsB,CAEzC;CACF;AAED,eAAO,MAAM,uBAAuB,EAAE,cAAc,CAAC,sBAAsB,CAQ1E,CAAC"}

package/dist/sandbox/container.js

@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -5,6 +6,7 @@ import { SandboxError, createMountedRuntimePathContext, execReadFile, execReadFi
 import { HostExecutor } from "./host.js";
 import { GUEST_WORKSPACE_ROOT } from "./layout.js";
 import { errorMessage } from "../unknown-values.js";
+import * as log from "../log.js";
 const PRIVATE_DIR_MODE = 0o700;
 const PRIVATE_FILE_MODE = 0o600;
 function parseContainerSandboxArg(value) {
@@ -47,10 +49,44 @@ async function validateContainerSandbox(config) {
     }
     console.log(`  Container '${config.container}' is running.`);
 }
-function buildContainerExecCommand(container, command, envFilePath, cwd) {
+const GROUP_FILE_PREFIX = "/tmp/mikan-exec-";
+const RUN_IN_PROCESS_GROUP = [
+    "if command -v setsid >/dev/null 2>&1; then",
+    `setsid sh -c 'echo "$$ $(cut -d" " -f22 /proc/$$/stat)" > "$1"; exec sh -c "$2"' _ "$1" "$2" & wait $!;`,
+    'status=$?; rm -f "$1"; exit $status;',
+    'fi; exec sh -c "$2"',
+].join(" ");
+const STOP_RECORDED_GROUP = [
+    'stop_group() { read group start < "$1" 2>/dev/null || return 0; rm -f "$1";',
+    '[ "$group" -gt 1 ] 2>/dev/null || return 0;',
+    '[ "$(cut -d" " -f22 /proc/$group/stat 2>/dev/null)" = "$start" ] || return 0;',
+    'kill -s KILL -- -"$group" 2>/dev/null || kill -s KILL -"$group" 2>/dev/null; return 0; };',
+].join(" ");
+const KILL_PROCESS_GROUP = [
+    STOP_RECORDED_GROUP,
+    'i=0; while [ ! -s "$1" ] && [ $i -lt 10 ]; do sleep 0.1; i=$((i+1)); done;',
+    'stop_group "$1"; exit 0',
+].join(" ");
+const SWEEP_PROCESS_GROUPS = [
+    STOP_RECORDED_GROUP,
+    `for file in ${GROUP_FILE_PREFIX}*; do [ -f "$file" ] && stop_group "$file"; done; exit 0`,
+].join(" ");
+export async function sweepOrphanedCommands(containerName, execFile) {
+    try {
+        await execFile("docker", ["exec", containerName, "sh", "-c", SWEEP_PROCESS_GROUPS]);
+    }
+    catch (error) {
+        log.logWarning(`Could not end leftover commands in ${containerName}`, errorMessage(error));
+    }
+}
+function buildContainerExecCommand(container, command, groupFile, envFilePath, cwd) {
     const envPart = envFilePath ? `--env-file ${shellEscape(envFilePath)} ` : "";
     const workdir = cwd === undefined ? GUEST_WORKSPACE_ROOT : shellEscape(cwd);
-    return `docker exec ${envPart}-w ${workdir} ${container} sh -c ${shellEscape(command)}`;
+    const script = `${shellEscape(RUN_IN_PROCESS_GROUP)} _ ${shellEscape(groupFile)} ${shellEscape(command)}`;
+    return `docker exec ${envPart}-w ${workdir} ${container} sh -c ${script}`;
+}
+function buildKillProcessGroupCommand(container, groupFile) {
+    return `docker exec ${container} sh -c ${shellEscape(KILL_PROCESS_GROUP)} _ ${shellEscape(groupFile)}`;
 }
 const GITHUB_CREDENTIAL_KEY = "credential.https://github.com.helper";
 function withGitHubCredentialHelper(env) {
@@ -85,15 +121,28 @@ export class ContainerExecutor {
         }
         const env = withGitHubCredentialHelper(this.env);
         const temp = env ? createSecureEnvFile(env) : undefined;
+        const groupFile = `${GROUP_FILE_PREFIX}${randomUUID()}`;
         try {
-            const dockerCmd = buildContainerExecCommand(this.container, command, temp?.envFilePath, options?.cwd);
+            const dockerCmd = buildContainerExecCommand(this.container, command, groupFile, temp?.envFilePath, options?.cwd);
             const { cwd: _cwd, ...hostOptions } = options ?? {};
             return await this.hostExecutor.exec(dockerCmd, options ? hostOptions : undefined);
         }
+        catch (error) {
+            await this.killProcessGroup(groupFile);
+            throw error;
+        }
         finally {
             temp?.cleanup();
         }
     }
+    async killProcessGroup(groupFile) {
+        try {
+            await this.hostExecutor.exec(buildKillProcessGroupCommand(this.container, groupFile));
+        }
+        catch (error) {
+            log.logWarning(`Could not stop a command in container ${this.container}`, errorMessage(error));
+        }
+    }
     readFile(path, options) {
         return execReadFile(this, path, options);
     }

package/dist/sandbox/container.js.map

@@ -1 +1 @@
-{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AASjC,OAAO,EACL,YAAY,EACZ,+BAA+B,EAC/B,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,SAAS,wBAAwB,CAAC,KAAa;IAC7C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,MAA8B;IACpE,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE;YACxC,SAAS;YACT,IAAI;YACJ,oBAAoB;YACpB,MAAM,CAAC,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;gBAC/E,+BAA+B,MAAM,CAAC,SAAS,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;YAC/E,wCAAwC,MAAM,CAAC,SAAS,yDAAyD;SAClH,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,yBAAyB,CAChC,SAAiB,EACjB,OAAe,EACf,WAAoB,EACpB,GAAY;IAEZ,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,cAAc,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5E,OAAO,eAAe,OAAO,MAAM,OAAO,IAAI,SAAS,UAAU,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AAErE,SAAS,0BAA0B,CACjC,GAA4B;IAE5B,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACvE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO;QACL,GAAG,GAAG;QACN,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,qBAAqB;QACvC,kBAAkB,EAAE,EAAE;QACtB,gBAAgB,EAAE,qBAAqB;QACvC,kBAAkB,EAAE,yBAAyB;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAA2B;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,OAAO,iBAAiB;IAG5B,YACU,SAAiB,EACjB,GAA4B,EAC5B,WAAiC;QAFjC,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAyB;QAC5B,gBAAW,GAAX,WAAW,CAAsB;QAL1B,iBAAY,GAAG,IAAI,YAAY,EAAE,CAAC;IAMhD,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,yBAAyB,CACzC,IAAI,CAAC,SAAS,EACd,OAAO,EACP,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,GAAG,CACb,CAAC;YACF,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;YACpD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpF,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,OAAO,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,OAAqB;QAC1C,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,IAAY,EAAE,OAAqB;QAChD,OAAO,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,OAAe,EAAE,OAAqB;QAC5D,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAClF,CAAC;IAED,gBAAgB;QACd,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1D,CAAC;CACF;AAED,MAAM,CAAC,MAAM,uBAAuB,GAA2C;IAC7E,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE;IAC7C,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACvC,KAAK,EAAE,wBAAwB;IAC/B,QAAQ,EAAE,wBAAwB;IAClC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,CAC3C,IAAI,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC;CAC5D,CAAC;AAEF,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IACrD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/F,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,sBAAsB;YAC3C,gFAAgF,OAAO,EAAE,CAAC,IAAI,EAAE,EAClG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAA2B;IAItD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACjE,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;SAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvB,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACpF,SAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAE1C,OAAO;QACL,WAAW;QACX,OAAO,EAAE,GAAG,EAAE;YACZ,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { chmodSync, mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type {\n  ContainerSandboxConfig,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport {\n  SandboxError,\n  createMountedRuntimePathContext,\n  execReadFile,\n  execReadFileBase64,\n  execSimple,\n  execWriteFile,\n  shellEscape,\n} from \"./utils.js\";\nimport { HostExecutor } from \"./host.js\";\nimport { GUEST_WORKSPACE_ROOT } from \"./layout.js\";\nimport { errorMessage } from \"../unknown-values.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\n\nfunction parseContainerSandboxArg(value: string): ContainerSandboxConfig | undefined {\n  if (!value.startsWith(\"container:\")) {\n    return undefined;\n  }\n\n  const container = value.slice(\"container:\".length);\n  if (!container) {\n    throw new SandboxError(\n      \"Error: container sandbox requires container name (e.g., container:mikan-sandbox)\",\n    );\n  }\n  return { type: \"container\", container };\n}\n\nasync function validateContainerSandbox(config: ContainerSandboxConfig): Promise<void> {\n  try {\n    await execSimple(\"docker\", [\"--version\"]);\n  } catch {\n    throw new SandboxError(\"Error: Docker is not installed or not in PATH\");\n  }\n\n  try {\n    const result = await execSimple(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.State.Running}}\",\n      config.container,\n    ]);\n    if (result.trim() !== \"true\") {\n      throw new SandboxError(`Error: Container '${config.container}' is not running.`, [\n        `Start it with: docker start ${config.container}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    throw new SandboxError(`Error: Container '${config.container}' does not exist.`, [\n      `Create it with: docker run -d --name ${config.container} -v <workspace>:/workspace alpine:latest sleep infinity`,\n    ]);\n  }\n\n  console.log(`  Container '${config.container}' is running.`);\n}\n\nfunction buildContainerExecCommand(\n  container: string,\n  command: string,\n  envFilePath?: string,\n  cwd?: string,\n): string {\n  const envPart = envFilePath ? `--env-file ${shellEscape(envFilePath)} ` : \"\";\n  const workdir = cwd === undefined ? GUEST_WORKSPACE_ROOT : shellEscape(cwd);\n  return `docker exec ${envPart}-w ${workdir} ${container} sh -c ${shellEscape(command)}`;\n}\n\nconst GITHUB_CREDENTIAL_KEY = \"credential.https://github.com.helper\";\n\nfunction withGitHubCredentialHelper(\n  env?: Record<string, string>,\n): Record<string, string> | undefined {\n  if (!env || !hasGitHubToken(env) || env.GIT_CONFIG_COUNT !== undefined) {\n    return env;\n  }\n  return {\n    ...env,\n    GIT_CONFIG_COUNT: \"2\",\n    GIT_CONFIG_KEY_0: GITHUB_CREDENTIAL_KEY,\n    GIT_CONFIG_VALUE_0: \"\",\n    GIT_CONFIG_KEY_1: GITHUB_CREDENTIAL_KEY,\n    GIT_CONFIG_VALUE_1: \"!gh auth git-credential\",\n  };\n}\n\nfunction hasGitHubToken(env: Record<string, string>): boolean {\n  return Boolean(env.GH_TOKEN || env.GITHUB_TOKEN);\n}\n\nexport class ContainerExecutor implements Executor {\n  private readonly hostExecutor = new HostExecutor();\n\n  constructor(\n    private container: string,\n    private env?: Record<string, string>,\n    private ensureReady?: () => Promise<void>,\n  ) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    if (this.ensureReady) {\n      await this.ensureReady();\n    } else {\n      await ensureContainerRunning(this.container);\n    }\n\n    const env = withGitHubCredentialHelper(this.env);\n    const temp = env ? createSecureEnvFile(env) : undefined;\n    try {\n      const dockerCmd = buildContainerExecCommand(\n        this.container,\n        command,\n        temp?.envFilePath,\n        options?.cwd,\n      );\n      const { cwd: _cwd, ...hostOptions } = options ?? {};\n      return await this.hostExecutor.exec(dockerCmd, options ? hostOptions : undefined);\n    } finally {\n      temp?.cleanup();\n    }\n  }\n\n  readFile(path: string, options?: ExecOptions): Promise<string> {\n    return execReadFile(this, path, options);\n  }\n\n  readFileBase64(path: string, options?: ExecOptions): Promise<string> {\n    return execReadFileBase64(this, path, options);\n  }\n\n  writeFile(path: string, content: string, options?: ExecOptions): Promise<void> {\n    return execWriteFile(this, path, content, options);\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return GUEST_WORKSPACE_ROOT;\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, GUEST_WORKSPACE_ROOT);\n  }\n\n  getSandboxConfig(): ContainerSandboxConfig {\n    return { type: \"container\", container: this.container };\n  }\n}\n\nexport const containerSandboxAdapter: SandboxAdapter<ContainerSandboxConfig> = {\n  type: \"container\",\n  credentials: { env: true, fileMounts: false },\n  workspace: { managedProjection: false },\n  parse: parseContainerSandboxArg,\n  validate: validateContainerSandbox,\n  createExecutor: (config, env, ensureReady) =>\n    new ContainerExecutor(config.container, env, ensureReady),\n};\n\nasync function ensureContainerRunning(container: string): Promise<void> {\n  try {\n    const running = await execSimple(\"docker\", [\"inspect\", \"-f\", \"{{.State.Running}}\", container]);\n    if (running.trim() === \"true\") {\n      return;\n    }\n    await execSimple(\"docker\", [\"start\", container]);\n  } catch (error) {\n    const details = errorMessage(error);\n    throw new Error(\n      `Container \"${container}\" is not available. ` +\n        `Expected a pre-existing container or image provisioning to keep it running.\\n${details}`.trim(),\n      { cause: error },\n    );\n  }\n}\n\nfunction createSecureEnvFile(env: Record<string, string>): {\n  envFilePath: string;\n  cleanup: () => void;\n} {\n  const tempDir = mkdtempSync(join(tmpdir(), \"mikan-docker-env-\"));\n  chmodSync(tempDir, PRIVATE_DIR_MODE);\n  const envFilePath = join(tempDir, \"env.list\");\n  const content =\n    Object.entries(env)\n      .map(([key, value]) => `${key}=${value.replace(/\\r?\\n/g, \"\")}`)\n      .join(\"\\n\") + \"\\n\";\n  writeFileSync(envFilePath, content, { encoding: \"utf-8\", mode: PRIVATE_FILE_MODE });\n  chmodSync(envFilePath, PRIVATE_FILE_MODE);\n\n  return {\n    envFilePath,\n    cleanup: () => {\n      rmSync(tempDir, { recursive: true, force: true });\n    },\n  };\n}\n"]}
+{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAUjC,OAAO,EACL,YAAY,EACZ,+BAA+B,EAC/B,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAEjC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,SAAS,wBAAwB,CAAC,KAAa;IAC7C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,MAA8B;IACpE,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE;YACxC,SAAS;YACT,IAAI;YACJ,oBAAoB;YACpB,MAAM,CAAC,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;gBAC/E,+BAA+B,MAAM,CAAC,SAAS,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;YAC/E,wCAAwC,MAAM,CAAC,SAAS,yDAAyD;SAClH,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAE7C,MAAM,oBAAoB,GAAG;IAC3B,4CAA4C;IAC5C,yGAAyG;IACzG,sCAAsC;IACtC,qBAAqB;CACtB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,MAAM,mBAAmB,GAAG;IAC1B,6EAA6E;IAC7E,6CAA6C;IAC7C,+EAA+E;IAC/E,2FAA2F;CAC5F,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,MAAM,kBAAkB,GAAG;IACzB,mBAAmB;IACnB,4EAA4E;IAC5E,yBAAyB;CAC1B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,MAAM,oBAAoB,GAAG;IAC3B,mBAAmB;IACnB,eAAe,iBAAiB,0DAA0D;CAC3F,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAqB,EACrB,QAAwB;IAExB,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,UAAU,CAAC,sCAAsC,aAAa,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,SAAiB,EACjB,OAAe,EACf,SAAiB,EACjB,WAAoB,EACpB,GAAY;IAEZ,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,cAAc,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,GAAG,WAAW,CAAC,oBAAoB,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1G,OAAO,eAAe,OAAO,MAAM,OAAO,IAAI,SAAS,UAAU,MAAM,EAAE,CAAC;AAC5E,CAAC;AAED,SAAS,4BAA4B,CAAC,SAAiB,EAAE,SAAiB;IACxE,OAAO,eAAe,SAAS,UAAU,WAAW,CAAC,kBAAkB,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;AACzG,CAAC;AAED,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AAErE,SAAS,0BAA0B,CACjC,GAA4B;IAE5B,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACvE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO;QACL,GAAG,GAAG;QACN,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,qBAAqB;QACvC,kBAAkB,EAAE,EAAE;QACtB,gBAAgB,EAAE,qBAAqB;QACvC,kBAAkB,EAAE,yBAAyB;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAA2B;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,OAAO,iBAAiB;IAG5B,YACU,SAAiB,EACjB,GAA4B,EAC5B,WAAiC;QAFjC,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAyB;QAC5B,gBAAW,GAAX,WAAW,CAAsB;QAL1B,iBAAY,GAAG,IAAI,YAAY,EAAE,CAAC;IAMhD,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,MAAM,SAAS,GAAG,GAAG,iBAAiB,GAAG,UAAU,EAAE,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,yBAAyB,CACzC,IAAI,CAAC,SAAS,EACd,OAAO,EACP,SAAS,EACT,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,GAAG,CACb,CAAC;YACF,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;YACpD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,OAAO,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,UAAU,CACZ,yCAAyC,IAAI,CAAC,SAAS,EAAE,EACzD,YAAY,CAAC,KAAK,CAAC,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,OAAqB;QAC1C,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,IAAY,EAAE,OAAqB;QAChD,OAAO,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,OAAe,EAAE,OAAqB;QAC5D,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAClF,CAAC;IAED,gBAAgB;QACd,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1D,CAAC;CACF;AAED,MAAM,CAAC,MAAM,uBAAuB,GAA2C;IAC7E,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE;IAC7C,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACvC,KAAK,EAAE,wBAAwB;IAC/B,QAAQ,EAAE,wBAAwB;IAClC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,CAC3C,IAAI,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC;CAC5D,CAAC;AAEF,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IACrD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/F,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,sBAAsB;YAC3C,gFAAgF,OAAO,EAAE,CAAC,IAAI,EAAE,EAClG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAA2B;IAItD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACjE,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;SAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvB,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACpF,SAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAE1C,OAAO;QACL,WAAW;QACX,OAAO,EAAE,GAAG,EAAE;YACZ,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { chmodSync, mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type {\n  ContainerSandboxConfig,\n  DockerExecFile,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport {\n  SandboxError,\n  createMountedRuntimePathContext,\n  execReadFile,\n  execReadFileBase64,\n  execSimple,\n  execWriteFile,\n  shellEscape,\n} from \"./utils.js\";\nimport { HostExecutor } from \"./host.js\";\nimport { GUEST_WORKSPACE_ROOT } from \"./layout.js\";\nimport { errorMessage } from \"../unknown-values.js\";\nimport * as log from \"../log.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\n\nfunction parseContainerSandboxArg(value: string): ContainerSandboxConfig | undefined {\n  if (!value.startsWith(\"container:\")) {\n    return undefined;\n  }\n\n  const container = value.slice(\"container:\".length);\n  if (!container) {\n    throw new SandboxError(\n      \"Error: container sandbox requires container name (e.g., container:mikan-sandbox)\",\n    );\n  }\n  return { type: \"container\", container };\n}\n\nasync function validateContainerSandbox(config: ContainerSandboxConfig): Promise<void> {\n  try {\n    await execSimple(\"docker\", [\"--version\"]);\n  } catch {\n    throw new SandboxError(\"Error: Docker is not installed or not in PATH\");\n  }\n\n  try {\n    const result = await execSimple(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.State.Running}}\",\n      config.container,\n    ]);\n    if (result.trim() !== \"true\") {\n      throw new SandboxError(`Error: Container '${config.container}' is not running.`, [\n        `Start it with: docker start ${config.container}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    throw new SandboxError(`Error: Container '${config.container}' does not exist.`, [\n      `Create it with: docker run -d --name ${config.container} -v <workspace>:/workspace alpine:latest sleep infinity`,\n    ]);\n  }\n\n  console.log(`  Container '${config.container}' is running.`);\n}\n\nconst GROUP_FILE_PREFIX = \"/tmp/mikan-exec-\";\n\nconst RUN_IN_PROCESS_GROUP = [\n  \"if command -v setsid >/dev/null 2>&1; then\",\n  `setsid sh -c 'echo \"$$ $(cut -d\" \" -f22 /proc/$$/stat)\" > \"$1\"; exec sh -c \"$2\"' _ \"$1\" \"$2\" & wait $!;`,\n  'status=$?; rm -f \"$1\"; exit $status;',\n  'fi; exec sh -c \"$2\"',\n].join(\" \");\n\nconst STOP_RECORDED_GROUP = [\n  'stop_group() { read group start < \"$1\" 2>/dev/null || return 0; rm -f \"$1\";',\n  '[ \"$group\" -gt 1 ] 2>/dev/null || return 0;',\n  '[ \"$(cut -d\" \" -f22 /proc/$group/stat 2>/dev/null)\" = \"$start\" ] || return 0;',\n  'kill -s KILL -- -\"$group\" 2>/dev/null || kill -s KILL -\"$group\" 2>/dev/null; return 0; };',\n].join(\" \");\n\nconst KILL_PROCESS_GROUP = [\n  STOP_RECORDED_GROUP,\n  'i=0; while [ ! -s \"$1\" ] && [ $i -lt 10 ]; do sleep 0.1; i=$((i+1)); done;',\n  'stop_group \"$1\"; exit 0',\n].join(\" \");\n\nconst SWEEP_PROCESS_GROUPS = [\n  STOP_RECORDED_GROUP,\n  `for file in ${GROUP_FILE_PREFIX}*; do [ -f \"$file\" ] && stop_group \"$file\"; done; exit 0`,\n].join(\" \");\n\nexport async function sweepOrphanedCommands(\n  containerName: string,\n  execFile: DockerExecFile,\n): Promise<void> {\n  try {\n    await execFile(\"docker\", [\"exec\", containerName, \"sh\", \"-c\", SWEEP_PROCESS_GROUPS]);\n  } catch (error) {\n    log.logWarning(`Could not end leftover commands in ${containerName}`, errorMessage(error));\n  }\n}\n\nfunction buildContainerExecCommand(\n  container: string,\n  command: string,\n  groupFile: string,\n  envFilePath?: string,\n  cwd?: string,\n): string {\n  const envPart = envFilePath ? `--env-file ${shellEscape(envFilePath)} ` : \"\";\n  const workdir = cwd === undefined ? GUEST_WORKSPACE_ROOT : shellEscape(cwd);\n  const script = `${shellEscape(RUN_IN_PROCESS_GROUP)} _ ${shellEscape(groupFile)} ${shellEscape(command)}`;\n  return `docker exec ${envPart}-w ${workdir} ${container} sh -c ${script}`;\n}\n\nfunction buildKillProcessGroupCommand(container: string, groupFile: string): string {\n  return `docker exec ${container} sh -c ${shellEscape(KILL_PROCESS_GROUP)} _ ${shellEscape(groupFile)}`;\n}\n\nconst GITHUB_CREDENTIAL_KEY = \"credential.https://github.com.helper\";\n\nfunction withGitHubCredentialHelper(\n  env?: Record<string, string>,\n): Record<string, string> | undefined {\n  if (!env || !hasGitHubToken(env) || env.GIT_CONFIG_COUNT !== undefined) {\n    return env;\n  }\n  return {\n    ...env,\n    GIT_CONFIG_COUNT: \"2\",\n    GIT_CONFIG_KEY_0: GITHUB_CREDENTIAL_KEY,\n    GIT_CONFIG_VALUE_0: \"\",\n    GIT_CONFIG_KEY_1: GITHUB_CREDENTIAL_KEY,\n    GIT_CONFIG_VALUE_1: \"!gh auth git-credential\",\n  };\n}\n\nfunction hasGitHubToken(env: Record<string, string>): boolean {\n  return Boolean(env.GH_TOKEN || env.GITHUB_TOKEN);\n}\n\nexport class ContainerExecutor implements Executor {\n  private readonly hostExecutor = new HostExecutor();\n\n  constructor(\n    private container: string,\n    private env?: Record<string, string>,\n    private ensureReady?: () => Promise<void>,\n  ) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    if (this.ensureReady) {\n      await this.ensureReady();\n    } else {\n      await ensureContainerRunning(this.container);\n    }\n\n    const env = withGitHubCredentialHelper(this.env);\n    const temp = env ? createSecureEnvFile(env) : undefined;\n    const groupFile = `${GROUP_FILE_PREFIX}${randomUUID()}`;\n    try {\n      const dockerCmd = buildContainerExecCommand(\n        this.container,\n        command,\n        groupFile,\n        temp?.envFilePath,\n        options?.cwd,\n      );\n      const { cwd: _cwd, ...hostOptions } = options ?? {};\n      return await this.hostExecutor.exec(dockerCmd, options ? hostOptions : undefined);\n    } catch (error) {\n      await this.killProcessGroup(groupFile);\n      throw error;\n    } finally {\n      temp?.cleanup();\n    }\n  }\n\n  private async killProcessGroup(groupFile: string): Promise<void> {\n    try {\n      await this.hostExecutor.exec(buildKillProcessGroupCommand(this.container, groupFile));\n    } catch (error) {\n      log.logWarning(\n        `Could not stop a command in container ${this.container}`,\n        errorMessage(error),\n      );\n    }\n  }\n\n  readFile(path: string, options?: ExecOptions): Promise<string> {\n    return execReadFile(this, path, options);\n  }\n\n  readFileBase64(path: string, options?: ExecOptions): Promise<string> {\n    return execReadFileBase64(this, path, options);\n  }\n\n  writeFile(path: string, content: string, options?: ExecOptions): Promise<void> {\n    return execWriteFile(this, path, content, options);\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return GUEST_WORKSPACE_ROOT;\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, GUEST_WORKSPACE_ROOT);\n  }\n\n  getSandboxConfig(): ContainerSandboxConfig {\n    return { type: \"container\", container: this.container };\n  }\n}\n\nexport const containerSandboxAdapter: SandboxAdapter<ContainerSandboxConfig> = {\n  type: \"container\",\n  credentials: { env: true, fileMounts: false },\n  workspace: { managedProjection: false },\n  parse: parseContainerSandboxArg,\n  validate: validateContainerSandbox,\n  createExecutor: (config, env, ensureReady) =>\n    new ContainerExecutor(config.container, env, ensureReady),\n};\n\nasync function ensureContainerRunning(container: string): Promise<void> {\n  try {\n    const running = await execSimple(\"docker\", [\"inspect\", \"-f\", \"{{.State.Running}}\", container]);\n    if (running.trim() === \"true\") {\n      return;\n    }\n    await execSimple(\"docker\", [\"start\", container]);\n  } catch (error) {\n    const details = errorMessage(error);\n    throw new Error(\n      `Container \"${container}\" is not available. ` +\n        `Expected a pre-existing container or image provisioning to keep it running.\\n${details}`.trim(),\n      { cause: error },\n    );\n  }\n}\n\nfunction createSecureEnvFile(env: Record<string, string>): {\n  envFilePath: string;\n  cleanup: () => void;\n} {\n  const tempDir = mkdtempSync(join(tmpdir(), \"mikan-docker-env-\"));\n  chmodSync(tempDir, PRIVATE_DIR_MODE);\n  const envFilePath = join(tempDir, \"env.list\");\n  const content =\n    Object.entries(env)\n      .map(([key, value]) => `${key}=${value.replace(/\\r?\\n/g, \"\")}`)\n      .join(\"\\n\") + \"\\n\";\n  writeFileSync(envFilePath, content, { encoding: \"utf-8\", mode: PRIVATE_FILE_MODE });\n  chmodSync(envFilePath, PRIVATE_FILE_MODE);\n\n  return {\n    envFilePath,\n    cleanup: () => {\n      rmSync(tempDir, { recursive: true, force: true });\n    },\n  };\n}\n"]}

package/dist/sandbox/provisioner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../../src/sandbox/provisioner.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAEV,6BAA6B,EAC7B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAIrB,qBAAa,sBAAsB;IAiB/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAhBxB,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,SAAS,CAAuC;IACxD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAwB;IAC7D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAyB;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAoB;IAC9D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAE5E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAiB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqC;IACpE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiB;IAE9C,YACmB,KAAK,EAAE,MAAM,EAC9B,OAAO,GAAE,6BAAkC,EAK5C;IAED,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjD;IAED,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/C;IAED,OAAO,CAAC,SAAS;IAWX,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAWrF;YAEa,cAAc;IAgCtB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAY7D;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQzF;IAED,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAGvD;IAED,gBAAgB,IAAI,cAAc,GAAG,SAAS,CAE7C;IAED,cAAc,IAAI,cAAc,GAAG,SAAS,CAE3C;IAED,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAExC;YAEa,SAAS;IAavB,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;YAEa,WAAW;IAyBnB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/C;IAEK,SAAS,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BpD;IAED,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,UAAU;YAIJ,YAAY;IAkD1B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;YAUX,mBAAmB;YA2BnB,YAAY;IAa1B,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,SAAS;YAQH,sBAAsB;IAgBpC,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,sBAAsB;YAYhB,iBAAiB;YAqBjB,aAAa;YAYb,YAAY;YAeZ,gBAAgB;YAehB,mBAAmB;YAWnB,aAAa;YAwBb,aAAa;YAeb,yBAAyB;IAmBvC,OAAO,CAAC,cAAc;YAOR,uBAAuB;IAuBrC,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,6BAA6B;YAOvB,oBAAoB;CAgBnC"}
+{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../../src/sandbox/provisioner.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAEV,6BAA6B,EAC7B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAKrB,qBAAa,sBAAsB;IAiB/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAhBxB,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,SAAS,CAAuC;IACxD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAwB;IAC7D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAyB;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAoB;IAC9D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAE5E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAiB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqC;IACpE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiB;IAE9C,YACmB,KAAK,EAAE,MAAM,EAC9B,OAAO,GAAE,6BAAkC,EAK5C;IAED,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjD;IAED,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/C;IAED,OAAO,CAAC,SAAS;IAWX,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAWrF;YAEa,cAAc;IAgCtB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAY7D;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQzF;IAED,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAGvD;IAED,gBAAgB,IAAI,cAAc,GAAG,SAAS,CAE7C;IAED,cAAc,IAAI,cAAc,GAAG,SAAS,CAE3C;IAED,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAExC;YAEa,SAAS;IAavB,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;YAEa,WAAW;IAyBnB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/C;IAEK,SAAS,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkCpD;IAED,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,UAAU;YAIJ,YAAY;IAkD1B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;YAUX,mBAAmB;YA2BnB,YAAY;IAa1B,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,SAAS;YAQH,sBAAsB;IAgBpC,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,sBAAsB;YAYhB,iBAAiB;YAqBjB,aAAa;YAYb,YAAY;YAeZ,gBAAgB;YAehB,mBAAmB;YAWnB,aAAa;YAwBb,aAAa;YAeb,yBAAyB;IAmBvC,OAAO,CAAC,cAAc;YAOR,uBAAuB;IAuBrC,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,6BAA6B;YAOvB,oBAAoB;CAgBnC"}

package/dist/sandbox/provisioner.js

@@ -20,6 +20,7 @@ function isDockerNotFoundError(err) {
         /error: no such [^\n]+/.test(haystack));
 }
 import { errorMessage } from "../unknown-values.js";
+import { sweepOrphanedCommands } from "./container.js";
 export class DockerContainerManager {
     static { this.MANAGED_LABEL = "mikan.managed=true"; }
     static { this.IMAGE_MODE_LABEL = "mikan.sandbox=image"; }
@@ -191,6 +192,9 @@ export class DockerContainerManager {
             const lastUsed = details.startedAtMs ?? Date.now();
             this.state.set(containerKey, { status, lastUsed, containerName });
         }
+        await Promise.all(Array.from(this.state.values())
+            .filter((state) => state.status === "running")
+            .map((state) => sweepOrphanedCommands(state.containerName, this.execFileImpl)));
         const running = Array.from(this.state.values()).filter((s) => s.status === "running").length;
         const stopped = this.state.size - running;
         log.logInfo(`Reconciled ${this.state.size} managed containers (running=${running}, stopped=${stopped})`);

package/dist/sandbox/provisioner.js.map

@@ -1 +1 @@
-{"version":3,"file":"provisioner.js","sourceRoot":"","sources":["../../src/sandbox/provisioner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAK1C,SAAS,qBAAqB,CAAC,GAAY;IACzC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,MAAM,OAAO,GAAI,GAA6B,CAAC,OAAO,CAAC;IACvD,MAAM,QAAQ,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAC1D,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAC1C,EAAE,CAAC,WAAW,EAAE,CAAC;IACjB,OAAO,CACL,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACpC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACtC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACnC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACtC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;QACzC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CACvC,CAAC;AACJ,CAAC;AAeD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,MAAM,OAAO,sBAAsB;aAIT,kBAAa,GAAG,oBAAoB,AAAvB,CAAwB;aACrC,qBAAgB,GAAG,qBAAqB,AAAxB,CAAyB;aACzC,uBAAkB,GAAG,gBAAgB,AAAnB,CAAoB;aACtC,8BAAyB,GAAG,uBAAuB,AAA1B,CAA2B;aACpD,8BAAyB,GAAG,uBAAuB,AAA1B,CAA2B;IAQ5E,YACmB,KAAa,EAC9B,OAAO,GAAkC,EAAE;QAD1B,UAAK,GAAL,KAAK,CAAQ;QAhBxB,UAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;QAC1C,aAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;QAC9C,cAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;QASvC,gBAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,mBAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;QAOlE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,aAAa,CAAC;IAC5D,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,YAAoB;QACvC,OAAO,iBAAiB,YAAY,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,YAAoB;QACrC,OAAO,qBAAqB,YAAY,EAAE,CAAC;IAC7C,CAAC;IAEO,SAAS,CAAI,YAAoB,EAAE,IAAsB;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC1C,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE;YACrB,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,OAAO;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,OAAO,GAAqB,EAAE;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,CAChD,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,CAC3C,CAAC,OAAO,CAAC,GAAG,EAAE;YACb,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,YAAoB,EAAE,OAAyB;QAC1E,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,KAAK,GACT,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3E,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,oBAAoB,KAAK,wBAAwB,CAAC,CAAC;gBACzF,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC1E,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,wBAAwB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9E,CAAC;iBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;gBAC5D,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,UAAU,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBACtE,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,UAAU,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAChC,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,YAAoB;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,MAAsB;QAC1D,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,YAAoB;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;IACjE,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,YAAoB;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,YAAoB;QAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YACtD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,iBAAiB,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,4BAA4B,aAAa,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,MAAM,CAAC,YAAoB;QACzB,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5E,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,YAAoB;QAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,sBAAsB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC7C,aAAa,EACb,aAAa,aAAa,UAAU,EACpC,8BAA8B,aAAa,EAAE,CAC9C,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,aAAa,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,WAAW,WAAW,UAAU,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,4BAA4B,WAAW,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACxD,IAAI,cAAc,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,GAAG,cAAc,CAAC,QAAQ,GAAG,SAAS,EAAE,CAAC;gBACrF,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,aAAqB;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAEnB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;YAClC,aAAa;YACb,OAAO,EAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC;SAC3D,CAAC,CAAC,CACJ,CAAC;QAEF,KAAK,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;YACnD,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC;gBAAE,SAAS;YAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,CAAC,aAAa,CAAC,CAAC;YACvE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,GAAG,CAAC,UAAU,CAAC,0DAA0D,EAAE,aAAa,CAAC,CAAC;gBAC1F,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAoB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACnD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;QAC7F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;QAC1C,GAAG,CAAC,OAAO,CACT,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,gCAAgC,OAAO,aAAa,OAAO,GAAG,CAC5F,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,YAAoB,EAAE,MAAuB,EAAE,aAAqB;QACnF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAChF,CAAC;IAEO,gBAAgB,CAAC,YAAoB;QAC3C,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,aAAa;YAC3C,sBAAsB,CAAC,aAAa,CAAC,YAAY,CAAC,CACnD,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,MAAwB;QACxC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAEO,UAAU,CAAC,KAAqB;QACtC,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzE,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,YAAoB,EACpB,aAAqB,EACrB,MAAwB,EACxB,OAAyB;QAEzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,sBAAsB,aAAa,eAAe,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG;YACb,SAAS;YACT,sBAAsB,CAAC,aAAa;YACpC,SAAS;YACT,sBAAsB,CAAC,gBAAgB;YACvC,SAAS;YACT,GAAG,sBAAsB,CAAC,kBAAkB,IAAI,YAAY,EAAE;SAC/D,CAAC;QACF,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CACT,SAAS,EACT,GAAG,sBAAsB,CAAC,yBAAyB,IAAI,OAAO,CAAC,cAAc,EAAE,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CACT,SAAS,EACT,GAAG,sBAAsB,CAAC,yBAAyB,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CACrF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YAChC,KAAK;YACL,IAAI;YACJ,QAAQ;YACR,aAAa;YACb,WAAW;YACX,WAAW;YACX,YAAY;YACZ,KAAK;YACL,gBAAgB;YAChB,mBAAmB;YACnB,cAAc;YACd,MAAM;YACN,GAAG,MAAM;YACT,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAC7D,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YACzB,IAAI,CAAC,KAAK;YACV,OAAO;YACP,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,YAAoB;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QAC5D,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;IAEO,iBAAiB,CAAC,MAAkC;QAC1D,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,MAAM,EAAE,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,YAAoB,EAAE,aAAqB;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;QAC7E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACnC,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,SAAS,EAAE,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,gDAAgD,aAAa,EAAE,EAC/D,YAAY,CAAC,GAAG,CAAC,CAClB,CAAC;YACF,qBAAqB,CAAC,GAAG,EAAE;gBACzB,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,mBAAmB;gBAC5B,SAAS,EAAE,uBAAuB;gBAClC,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE;oBACP,WAAW,EAAE,OAAO;oBACpB,YAAY;oBACZ,aAAa;oBACb,aAAa,EAAE,SAAS,CAAC,MAAM;oBAC/B,KAAK,EAAE,KAAK;iBACb;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,YAAoB,EACpB,aAAqB,EACrB,MAAwB,EACxB,MAAuB;QAEvB,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAE,OAAO,OAAO,CAAC;QAChG,IAAI,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,EAAE,MAAM,CAAC;YAAE,OAAO,eAAe,CAAC;QACrF,IAAI,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC;YAAE,OAAO,SAAS,CAAC;QAClF,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC;QACtF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,iBAAiB,CAAC,KAAwB,EAAE,MAAwB;QAC1E,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,aAAa,CAAC,MAAwB;QAC5C,OAAO,MAAM;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;aACtC,KAAK,EAAE;aACP,QAAQ,EAAE,CAAC;IAChB,CAAC;IAEO,SAAS,CAAC,QAAkB,EAAE,MAAgB;QACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,aAAqB,EACrB,MAAwB;QAExB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,2BAA2B,sBAAsB,CAAC,yBAAyB,KAAK;YAChF,aAAa;SACd,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,MAAM,KAAK,QAAQ,CAAC;IAC7B,CAAC;IAEO,cAAc,CAAC,MAAwB;QAC7C,MAAM,OAAO,GAAG,MAAM;aACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACf,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC;SACvD,CAAC,CAAC;aACF,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxB,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CACnF,CAAC;QACJ,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IAEO,sBAAsB,CAAC,MAAc;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,aAAqB;QACnD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,4BAA4B;YAC5B,aAAa;SACd,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAY,CAAC;QAE5E,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,uDAAuD,aAAa,GAAG,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,aAAqB;QAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,YAAY;YACZ,aAAa;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,OAAO;gBACP,SAAS;gBACT,IAAI;gBACJ,SAAS;gBACT,IAAI,CAAC,KAAK;aACX,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,YAAoB,EACpB,aAAqB,EACrB,MAAwB,EACxB,OAAyB;QAEzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC7C,aAAa,EACb,aAAa,aAAa,0BAA0B,EACpD,8BAA8B,aAAa,kBAAkB,CAC9D,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,aAAa,kBAAkB,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,YAAoB,EAAE,aAAqB;QAC3E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAClE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,6BAA6B;YAC7B,aAAa;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,YAAoB;QAC9C,MAAM,WAAW,GAAG,sBAAsB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YACvE,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;QAC7C,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YAChC,SAAS;YACT,QAAQ;YACR,UAAU;YACV,QAAQ;YACR,SAAS;YACT,sBAAsB,CAAC,aAAa;YACpC,SAAS;YACT,sBAAsB,CAAC,gBAAgB;YACvC,SAAS;YACT,GAAG,sBAAsB,CAAC,kBAAkB,IAAI,YAAY,EAAE;YAC9D,WAAW;SACZ,CAAC,CAAC;QACH,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,aAAqB;QAC/C,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,SAAS;gBACT,IAAI;gBACJ,oBAAoB;gBACpB,aAAa;aACd,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,qBAAqB,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB;QACrC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,IAAI;gBACJ,IAAI;gBACJ,UAAU;gBACV,SAAS,sBAAsB,CAAC,aAAa,EAAE;gBAC/C,UAAU;gBACV,SAAS,sBAAsB,CAAC,gBAAgB,EAAE;gBAClD,UAAU;gBACV,YAAY;aACb,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,2CAA2C,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/E,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,OAAO,MAAM;aACV,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,aAAqB;QAErB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,SAAS;gBACT,IAAI;gBACJ,sEAAsE;gBACtE,aAAa;aACd,CAAC,CAAC;YACH,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvE,MAAM,OAAO,GAAG,UAAU,KAAK,MAAM,CAAC;YACtC,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,+BAA+B,aAAa,mBAAmB,EAC/D,YAAY,CAAC,GAAG,CAAC,CAClB,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QACvD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACnD,CAAC;IAEO,6BAA6B,CAAC,aAAqB;QACzD,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,aAAqB,EACrB,UAAkB,EAClB,UAAkB;QAElB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;YAC/D,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;SAC1C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,YAAY,CAAC,OAA0B,EAAE,IAAY;IAC5D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { createHash } from \"node:crypto\";\nimport { readFileSync, statSync } from \"node:fs\";\nimport { isAbsolute, relative } from \"node:path\";\nimport { promisify } from \"node:util\";\nimport * as log from \"../log.js\";\nimport { reportUserFacingError } from \"../observability/index.js\";\n\nconst execFileAsync = promisify(execFile);\n\ntype ContainerStatus = \"running\" | \"stopped\" | \"missing\";\ntype DriftReason = \"binds\" | \"mount-content\" | \"network\" | \"image\";\n\nfunction isDockerNotFoundError(err: unknown): boolean {\n  if (!err || typeof err !== \"object\") return false;\n  const stderr = (err as { stderr?: unknown }).stderr;\n  const message = (err as { message?: unknown }).message;\n  const haystack = `${typeof stderr === \"string\" ? stderr : \"\"}\\n${\n    typeof message === \"string\" ? message : \"\"\n  }`.toLowerCase();\n  return (\n    haystack.includes(\"no such network\") ||\n    haystack.includes(\"no such container\") ||\n    haystack.includes(\"no such object\") ||\n    haystack.includes(\"network not found\") ||\n    /network [^\\n]+ not found/.test(haystack) ||\n    /error: no such [^\\n]+/.test(haystack)\n  );\n}\n\ninterface ContainerState {\n  status: ContainerStatus;\n  lastUsed: number;\n  containerName: string;\n}\n\nimport type {\n  ContainerMount,\n  DockerContainerManagerOptions,\n  ProvisionOptions,\n  ResourceLimits,\n  SandboxLimitStatus,\n} from \"../types.js\";\nimport { errorMessage } from \"../unknown-values.js\";\nimport type { DockerExecFile } from \"./types.js\";\n\nexport class DockerContainerManager {\n  private state = new Map<string, ContainerState>();\n  private inflight = new Map<string, Promise<string>>();\n  private keyQueues = new Map<string, Promise<unknown>>();\n  private static readonly MANAGED_LABEL = \"mikan.managed=true\";\n  private static readonly IMAGE_MODE_LABEL = \"mikan.sandbox=image\";\n  private static readonly VAULT_ID_LABEL_KEY = \"mikan.vault-id\";\n  private static readonly CONVERSATION_ID_LABEL_KEY = \"mikan.conversation-id\";\n  private static readonly MOUNT_SIGNATURE_LABEL_KEY = \"mikan.mount-signature\";\n\n  private readonly limits?: ResourceLimits;\n  private readonly boostLimits?: ResourceLimits;\n  private readonly boostedKeys = new Set<string>();\n  private readonly overrideLimits = new Map<string, ResourceLimits>();\n  private readonly execFileImpl: DockerExecFile;\n\n  constructor(\n    private readonly image: string,\n    options: DockerContainerManagerOptions = {},\n  ) {\n    this.limits = options.limits;\n    this.boostLimits = options.boostLimits;\n    this.execFileImpl = options.execFileImpl ?? execFileAsync;\n  }\n\n  static containerName(containerKey: string): string {\n    return `mikan-sandbox-${containerKey}`;\n  }\n\n  static networkName(containerKey: string): string {\n    return `mikan-sandbox-net-${containerKey}`;\n  }\n\n  private serialize<T>(containerKey: string, task: () => Promise<T>): Promise<T> {\n    const previous = this.keyQueues.get(containerKey) ?? Promise.resolve();\n    const next = previous.then(task, task);\n    const settled = next.catch(() => undefined);\n    this.keyQueues.set(containerKey, settled);\n    void settled.then(() => {\n      if (this.keyQueues.get(containerKey) === settled) this.keyQueues.delete(containerKey);\n    });\n    return next;\n  }\n\n  async provision(containerKey: string, options: ProvisionOptions = {}): Promise<string> {\n    const existing = this.inflight.get(containerKey);\n    if (existing) return existing;\n\n    const pending = this.serialize(containerKey, () =>\n      this.provisionInner(containerKey, options),\n    ).finally(() => {\n      this.inflight.delete(containerKey);\n    });\n    this.inflight.set(containerKey, pending);\n    return pending;\n  }\n\n  private async provisionInner(containerKey: string, options: ProvisionOptions): Promise<string> {\n    const containerName =\n      options.containerName ?? DockerContainerManager.containerName(containerKey);\n    const mounts = options.mounts ?? [];\n    const status = await this.inspectStatus(containerName);\n\n    try {\n      const drift =\n        status === \"missing\"\n          ? undefined\n          : await this.runtimeDrift(containerKey, containerName, mounts, status);\n      if (drift) {\n        log.logInfo(`Container ${containerName} is out of date (${drift}); replacing container`);\n        await this.replaceContainer(containerKey, containerName, mounts, options);\n        log.logInfo(`Container ${containerName} replaced from image ${this.image}`);\n      } else if (status === \"stopped\") {\n        await this.execFileImpl(\"docker\", [\"start\", containerName]);\n        log.logInfo(`Container ${containerName} started`);\n      } else if (status === \"missing\") {\n        await this.runContainer(containerKey, containerName, mounts, options);\n        log.logInfo(`Container ${containerName} created`);\n      }\n    } catch (err) {\n      this.state.delete(containerKey);\n      throw err;\n    }\n\n    this.setState(containerKey, \"running\", containerName);\n    await this.applyResourceLimits(containerKey, containerName);\n    return containerName;\n  }\n\n  async boost(containerKey: string): Promise<SandboxLimitStatus> {\n    if (!this.boostLimits?.cpus && !this.boostLimits?.memory) {\n      return this.getLimitStatus(containerKey);\n    }\n\n    this.overrideLimits.delete(containerKey);\n    this.boostedKeys.add(containerKey);\n    const state = this.state.get(containerKey);\n    if (state?.status === \"running\") {\n      await this.applyResourceLimits(containerKey, state.containerName);\n    }\n    return this.getLimitStatus(containerKey);\n  }\n\n  async setLimits(containerKey: string, limits: ResourceLimits): Promise<SandboxLimitStatus> {\n    this.boostedKeys.delete(containerKey);\n    this.overrideLimits.set(containerKey, { ...this.limits, ...limits });\n    const state = this.state.get(containerKey);\n    if (state?.status === \"running\") {\n      await this.applyResourceLimits(containerKey, state.containerName);\n    }\n    return this.getLimitStatus(containerKey);\n  }\n\n  getLimitStatus(containerKey: string): SandboxLimitStatus {\n    const boosted = this.boostedKeys.has(containerKey);\n    return { limits: this.effectiveLimits(containerKey), boosted };\n  }\n\n  getDefaultLimits(): ResourceLimits | undefined {\n    return this.limits;\n  }\n\n  getBoostLimits(): ResourceLimits | undefined {\n    return this.boostLimits;\n  }\n\n  stop(containerKey: string): Promise<void> {\n    return this.serialize(containerKey, () => this.stopInner(containerKey));\n  }\n\n  private async stopInner(containerKey: string): Promise<void> {\n    const containerName = this.getContainerName(containerKey);\n    try {\n      await this.execFileImpl(\"docker\", [\"stop\", containerName]);\n      this.setState(containerKey, \"stopped\", containerName);\n      this.boostedKeys.delete(containerKey);\n      this.overrideLimits.delete(containerKey);\n      log.logInfo(`Container ${containerName} stopped (idle)`);\n    } catch (err) {\n      log.logWarning(`Failed to stop container ${containerName}`, errorMessage(err));\n    }\n  }\n\n  remove(containerKey: string): Promise<void> {\n    return this.serialize(containerKey, () => this.removeInner(containerKey));\n  }\n\n  private async removeInner(containerKey: string): Promise<void> {\n    const containerName = this.getContainerName(containerKey);\n    const networkName = DockerContainerManager.networkName(containerKey);\n\n    const removed = await this.forceRemoveContainer(\n      containerName,\n      `Container ${containerName} removed`,\n      `Failed to remove container ${containerName}`,\n    );\n    if (!removed) {\n      throw new Error(`Failed to remove container ${containerName}`);\n    }\n\n    try {\n      await this.execFileImpl(\"docker\", [\"network\", \"rm\", networkName]);\n      log.logInfo(`Network ${networkName} removed`);\n    } catch (err) {\n      log.logWarning(`Failed to remove network ${networkName}`, errorMessage(err));\n    }\n\n    this.state.delete(containerKey);\n    this.boostedKeys.delete(containerKey);\n    this.overrideLimits.delete(containerKey);\n  }\n\n  async stopIdle(maxIdleMs: number): Promise<void> {\n    const now = Date.now();\n    const toStop: string[] = [];\n    for (const [containerKey, containerState] of this.state) {\n      if (containerState.status === \"running\" && now - containerState.lastUsed > maxIdleMs) {\n        toStop.push(containerKey);\n      }\n    }\n    await Promise.all(toStop.map((containerKey) => this.stop(containerKey)));\n  }\n\n  async reconcile(workspaceRoot: string): Promise<void> {\n    const names = await this.listContainerNamesByLabel();\n    this.state.clear();\n\n    const inspected = await Promise.all(\n      names.map(async (containerName) => ({\n        containerName,\n        details: await this.inspectContainerDetails(containerName),\n      })),\n    );\n\n    for (const { containerName, details } of inspected) {\n      if (!details || !mountsWithin(details.bindSources, workspaceRoot)) continue;\n      const containerKey = this.containerKeyFromContainerName(containerName);\n      if (!containerKey) {\n        log.logWarning(`Skipping unmanaged-style container without container key`, containerName);\n        continue;\n      }\n      const status: ContainerStatus = details.running ? \"running\" : \"stopped\";\n      const lastUsed = details.startedAtMs ?? Date.now();\n      this.state.set(containerKey, { status, lastUsed, containerName });\n    }\n\n    const running = Array.from(this.state.values()).filter((s) => s.status === \"running\").length;\n    const stopped = this.state.size - running;\n    log.logInfo(\n      `Reconciled ${this.state.size} managed containers (running=${running}, stopped=${stopped})`,\n    );\n  }\n\n  private setState(containerKey: string, status: ContainerStatus, containerName: string): void {\n    this.state.set(containerKey, { status, lastUsed: Date.now(), containerName });\n  }\n\n  private getContainerName(containerKey: string): string {\n    return (\n      this.state.get(containerKey)?.containerName ??\n      DockerContainerManager.containerName(containerKey)\n    );\n  }\n\n  private mountArgs(mounts: ContainerMount[]): string[] {\n    return mounts.flatMap((mount) => [\"-v\", this.toBindSpec(mount)]);\n  }\n\n  private toBindSpec(mount: ContainerMount): string {\n    return `${mount.source}:${mount.target}${mount.readOnly ? \":ro\" : \"\"}`;\n  }\n\n  private async runContainer(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n    options: ProvisionOptions,\n  ): Promise<void> {\n    const networkName = await this.ensureNetwork(containerKey);\n    log.logInfo(`Creating container ${containerName} from image ${this.image}`);\n    const labels = [\n      \"--label\",\n      DockerContainerManager.MANAGED_LABEL,\n      \"--label\",\n      DockerContainerManager.IMAGE_MODE_LABEL,\n      \"--label\",\n      `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,\n    ];\n    if (options.conversationId) {\n      labels.push(\n        \"--label\",\n        `${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}=${options.conversationId}`,\n      );\n    }\n    if (mounts.length > 0) {\n      labels.push(\n        \"--label\",\n        `${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}=${this.mountSignature(mounts)}`,\n      );\n    }\n    await this.execFileImpl(\"docker\", [\n      \"run\",\n      \"-d\",\n      \"--name\",\n      containerName,\n      \"--network\",\n      networkName,\n      \"--cap-drop\",\n      \"ALL\",\n      \"--security-opt\",\n      \"no-new-privileges\",\n      \"--pids-limit\",\n      \"1024\",\n      ...labels,\n      ...this.resourceLimitArgs(this.effectiveLimits(containerKey)),\n      ...this.mountArgs(mounts),\n      this.image,\n      \"sleep\",\n      \"infinity\",\n    ]);\n  }\n\n  private effectiveLimits(containerKey: string): ResourceLimits | undefined {\n    const override = this.overrideLimits.get(containerKey);\n    if (override) return override;\n    if (!this.boostedKeys.has(containerKey)) return this.limits;\n    return { ...this.limits, ...this.boostLimits };\n  }\n\n  private resourceLimitArgs(limits: ResourceLimits | undefined): string[] {\n    const args: string[] = [];\n    if (limits?.cpus) args.push(\"--cpus\", limits.cpus);\n    if (limits?.memory) {\n      args.push(\"--memory\", limits.memory);\n      args.push(\"--memory-swap\", limits.memory);\n    }\n    return args;\n  }\n\n  private async applyResourceLimits(containerKey: string, containerName: string): Promise<void> {\n    const limitArgs = this.resourceLimitArgs(this.effectiveLimits(containerKey));\n    if (limitArgs.length === 0) return;\n    const args = [\"update\", ...limitArgs, containerName];\n    try {\n      await this.execFileImpl(\"docker\", args);\n    } catch (err) {\n      log.logWarning(\n        `Failed to apply resource limits to container ${containerName}`,\n        errorMessage(err),\n      );\n      reportUserFacingError(err, {\n        domain: \"sandbox\",\n        surface: \"sandbox_provision\",\n        operation: \"apply_resource_limits\",\n        severity: \"warning\",\n        context: {\n          sandboxType: \"image\",\n          containerKey,\n          containerName,\n          limitArgCount: limitArgs.length,\n          fatal: false,\n        },\n      });\n    }\n  }\n\n  private async runtimeDrift(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n    status: ContainerStatus,\n  ): Promise<DriftReason | undefined> {\n    if (this.hasBindMountDrift(await this.inspectBindMounts(containerName), mounts)) return \"binds\";\n    if (await this.hasMountSignatureDrift(containerName, mounts)) return \"mount-content\";\n    if (await this.hasNetworkModeDrift(containerKey, containerName)) return \"network\";\n    if (status === \"stopped\" && (await this.hasImageDrift(containerName))) return \"image\";\n    return undefined;\n  }\n\n  private hasBindMountDrift(binds: readonly string[], mounts: ContainerMount[]): boolean {\n    return !this.sameBinds(this.expectedBinds(mounts), [...binds]);\n  }\n\n  private expectedBinds(mounts: ContainerMount[]): string[] {\n    return mounts\n      .map((mount) => this.toBindSpec(mount))\n      .slice()\n      .toSorted();\n  }\n\n  private sameBinds(expected: string[], actual: string[]): boolean {\n    if (expected.length !== actual.length) {\n      return false;\n    }\n\n    return expected.every((bind, index) => bind === actual[index]);\n  }\n\n  private async hasMountSignatureDrift(\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<boolean> {\n    if (mounts.length === 0) return false;\n    const expected = this.mountSignature(mounts);\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      `{{index .Config.Labels \"${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}\"}}`,\n      containerName,\n    ]);\n    const actual = this.normalizeDockerValue(stdout.trim());\n    return actual !== expected;\n  }\n\n  private mountSignature(mounts: ContainerMount[]): string {\n    const payload = mounts\n      .map((mount) => ({\n        source: mount.source,\n        target: mount.target,\n        fingerprint: this.mountSourceFingerprint(mount.source),\n      }))\n      .toSorted((left, right) =>\n        `${left.target}\\0${left.source}`.localeCompare(`${right.target}\\0${right.source}`),\n      );\n    return createHash(\"sha256\").update(JSON.stringify(payload)).digest(\"hex\");\n  }\n\n  private mountSourceFingerprint(source: string): string {\n    try {\n      const stat = statSync(source);\n      if (stat.isFile()) {\n        return createHash(\"sha256\").update(readFileSync(source)).digest(\"hex\");\n      }\n      return `${stat.isDirectory() ? \"dir\" : \"other\"}:${stat.dev}:${stat.ino}:${stat.birthtimeMs}`;\n    } catch {\n      return \"missing\";\n    }\n  }\n\n  private async inspectBindMounts(containerName: string): Promise<string[]> {\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{json .HostConfig.Binds}}\",\n      containerName,\n    ]);\n    const payload = stdout.trim();\n    const parsed = JSON.parse(payload.length > 0 ? payload : \"null\") as unknown;\n\n    if (parsed === null) {\n      return [];\n    }\n\n    if (!Array.isArray(parsed) || parsed.some((bind) => typeof bind !== \"string\")) {\n      throw new Error(`Unexpected docker bind mount payload for container \"${containerName}\"`);\n    }\n\n    return [...parsed].toSorted();\n  }\n\n  private async hasImageDrift(containerName: string): Promise<boolean> {\n    const desired = await this.localImageId();\n    if (!desired) return false;\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.Image}}\",\n      containerName,\n    ]);\n    return stdout.trim() !== desired;\n  }\n\n  private async localImageId(): Promise<string | undefined> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"image\",\n        \"inspect\",\n        \"-f\",\n        \"{{.Id}}\",\n        this.image,\n      ]);\n      return this.normalizeDockerValue(stdout.trim());\n    } catch {\n      return undefined;\n    }\n  }\n\n  private async replaceContainer(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n    options: ProvisionOptions,\n  ): Promise<void> {\n    const removed = await this.forceRemoveContainer(\n      containerName,\n      `Container ${containerName} removed for replacement`,\n      `Failed to remove container ${containerName} for replacement`,\n    );\n    if (!removed) throw new Error(`Failed to remove container ${containerName} for replacement`);\n    await this.runContainer(containerKey, containerName, mounts, options);\n  }\n\n  private async hasNetworkModeDrift(containerKey: string, containerName: string): Promise<boolean> {\n    const expected = DockerContainerManager.networkName(containerKey);\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.HostConfig.NetworkMode}}\",\n      containerName,\n    ]);\n    return stdout.trim() !== expected;\n  }\n\n  private async ensureNetwork(containerKey: string): Promise<string> {\n    const networkName = DockerContainerManager.networkName(containerKey);\n    try {\n      await this.execFileImpl(\"docker\", [\"network\", \"inspect\", networkName]);\n      return networkName;\n    } catch (err) {\n      if (!isDockerNotFoundError(err)) throw err;\n    }\n    await this.execFileImpl(\"docker\", [\n      \"network\",\n      \"create\",\n      \"--driver\",\n      \"bridge\",\n      \"--label\",\n      DockerContainerManager.MANAGED_LABEL,\n      \"--label\",\n      DockerContainerManager.IMAGE_MODE_LABEL,\n      \"--label\",\n      `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,\n      networkName,\n    ]);\n    return networkName;\n  }\n\n  private async inspectStatus(containerName: string): Promise<ContainerStatus> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"inspect\",\n        \"-f\",\n        \"{{.State.Running}}\",\n        containerName,\n      ]);\n      return stdout.trim() === \"true\" ? \"running\" : \"stopped\";\n    } catch (err) {\n      if (isDockerNotFoundError(err)) return \"missing\";\n      throw err;\n    }\n  }\n\n  private async listContainerNamesByLabel(): Promise<string[]> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"ps\",\n        \"-a\",\n        \"--filter\",\n        `label=${DockerContainerManager.MANAGED_LABEL}`,\n        \"--filter\",\n        `label=${DockerContainerManager.IMAGE_MODE_LABEL}`,\n        \"--format\",\n        \"{{.Names}}\",\n      ]);\n      return this.parseNameLines(stdout);\n    } catch (err) {\n      log.logWarning(\"Failed to list labeled managed containers\", errorMessage(err));\n      return [];\n    }\n  }\n\n  private parseNameLines(stdout: string): string[] {\n    return stdout\n      .split(\"\\n\")\n      .map((line) => line.trim())\n      .filter((line) => line.length > 0);\n  }\n\n  private async inspectContainerDetails(\n    containerName: string,\n  ): Promise<{ running: boolean; startedAtMs?: number; bindSources: string[] } | undefined> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"inspect\",\n        \"-f\",\n        `{{.State.Running}}\\t{{.State.StartedAt}}\\t{{json .HostConfig.Binds}}`,\n        containerName,\n      ]);\n      const [runningRaw, startedAtRaw, bindsRaw] = stdout.trim().split(\"\\t\");\n      const running = runningRaw === \"true\";\n      const startedAtMs = this.parseDockerTimestamp(startedAtRaw);\n      return { running, startedAtMs, bindSources: parseBindSources(bindsRaw) };\n    } catch (err) {\n      log.logWarning(\n        `Failed to inspect container ${containerName} during reconcile`,\n        errorMessage(err),\n      );\n      return undefined;\n    }\n  }\n\n  private normalizeDockerValue(value?: string): string | undefined {\n    if (!value || value === \"<no value>\") return undefined;\n    const trimmed = value.trim();\n    return trimmed.length > 0 ? trimmed : undefined;\n  }\n\n  private parseDockerTimestamp(value?: string): number | undefined {\n    const normalized = this.normalizeDockerValue(value);\n    if (!normalized || normalized.startsWith(\"0001-\")) return undefined;\n    const parsed = Date.parse(normalized);\n    return Number.isNaN(parsed) ? undefined : parsed;\n  }\n\n  private containerKeyFromContainerName(containerName: string): string | undefined {\n    const prefix = DockerContainerManager.containerName(\"\");\n    if (!containerName.startsWith(prefix)) return undefined;\n    const containerKey = containerName.slice(prefix.length);\n    return containerKey.length > 0 ? containerKey : undefined;\n  }\n\n  private async forceRemoveContainer(\n    containerName: string,\n    successLog: string,\n    failureLog: string,\n  ): Promise<boolean> {\n    try {\n      await this.execFileImpl(\"docker\", [\"rm\", \"-f\", containerName]);\n      log.logInfo(successLog);\n      return true;\n    } catch (err) {\n      const message = errorMessage(err);\n      if (/no such container/i.test(message)) return true;\n      log.logWarning(failureLog, message);\n      return false;\n    }\n  }\n}\n\nfunction parseBindSources(raw: string | undefined): string[] {\n  const parsed: unknown = JSON.parse(raw && raw.length > 0 ? raw : \"null\");\n  if (!Array.isArray(parsed)) return [];\n  return parsed\n    .filter((bind) => typeof bind === \"string\")\n    .map((bind) => bind.split(\":\", 1)[0] ?? bind);\n}\n\nfunction mountsWithin(sources: readonly string[], root: string): boolean {\n  return sources.some((source) => {\n    const path = relative(root, source);\n    return path !== \"\" && !path.startsWith(\"..\") && !isAbsolute(path);\n  });\n}\n"]}
+{"version":3,"file":"provisioner.js","sourceRoot":"","sources":["../../src/sandbox/provisioner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAK1C,SAAS,qBAAqB,CAAC,GAAY;IACzC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,MAAM,OAAO,GAAI,GAA6B,CAAC,OAAO,CAAC;IACvD,MAAM,QAAQ,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAC1D,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAC1C,EAAE,CAAC,WAAW,EAAE,CAAC;IACjB,OAAO,CACL,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACpC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACtC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACnC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACtC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;QACzC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CACvC,CAAC;AACJ,CAAC;AAeD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,OAAO,sBAAsB;aAIT,kBAAa,GAAG,oBAAoB,AAAvB,CAAwB;aACrC,qBAAgB,GAAG,qBAAqB,AAAxB,CAAyB;aACzC,uBAAkB,GAAG,gBAAgB,AAAnB,CAAoB;aACtC,8BAAyB,GAAG,uBAAuB,AAA1B,CAA2B;aACpD,8BAAyB,GAAG,uBAAuB,AAA1B,CAA2B;IAQ5E,YACmB,KAAa,EAC9B,OAAO,GAAkC,EAAE;QAD1B,UAAK,GAAL,KAAK,CAAQ;QAhBxB,UAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;QAC1C,aAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;QAC9C,cAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;QASvC,gBAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,mBAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;QAOlE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,aAAa,CAAC;IAC5D,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,YAAoB;QACvC,OAAO,iBAAiB,YAAY,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,YAAoB;QACrC,OAAO,qBAAqB,YAAY,EAAE,CAAC;IAC7C,CAAC;IAEO,SAAS,CAAI,YAAoB,EAAE,IAAsB;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC1C,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE;YACrB,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,OAAO;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,OAAO,GAAqB,EAAE;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,CAChD,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,CAC3C,CAAC,OAAO,CAAC,GAAG,EAAE;YACb,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,YAAoB,EAAE,OAAyB;QAC1E,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,KAAK,GACT,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3E,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,oBAAoB,KAAK,wBAAwB,CAAC,CAAC;gBACzF,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC1E,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,wBAAwB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9E,CAAC;iBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;gBAC5D,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,UAAU,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBACtE,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,UAAU,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAChC,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,YAAoB;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,MAAsB;QAC1D,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,YAAoB;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;IACjE,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,YAAoB;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,YAAoB;QAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YACtD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,aAAa,aAAa,iBAAiB,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,4BAA4B,aAAa,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,MAAM,CAAC,YAAoB;QACzB,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5E,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,YAAoB;QAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,sBAAsB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC7C,aAAa,EACb,aAAa,aAAa,UAAU,EACpC,8BAA8B,aAAa,EAAE,CAC9C,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,aAAa,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,WAAW,WAAW,UAAU,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,4BAA4B,WAAW,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACxD,IAAI,cAAc,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,GAAG,cAAc,CAAC,QAAQ,GAAG,SAAS,EAAE,CAAC;gBACrF,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,aAAqB;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAEnB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;YAClC,aAAa;YACb,OAAO,EAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC;SAC3D,CAAC,CAAC,CACJ,CAAC;QAEF,KAAK,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;YACnD,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC;gBAAE,SAAS;YAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,CAAC,aAAa,CAAC,CAAC;YACvE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,GAAG,CAAC,UAAU,CAAC,0DAA0D,EAAE,aAAa,CAAC,CAAC;gBAC1F,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAoB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACnD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;aAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;aAC7C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CACjF,CAAC;QAEF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;QAC7F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;QAC1C,GAAG,CAAC,OAAO,CACT,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,gCAAgC,OAAO,aAAa,OAAO,GAAG,CAC5F,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,YAAoB,EAAE,MAAuB,EAAE,aAAqB;QACnF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAChF,CAAC;IAEO,gBAAgB,CAAC,YAAoB;QAC3C,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,aAAa;YAC3C,sBAAsB,CAAC,aAAa,CAAC,YAAY,CAAC,CACnD,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,MAAwB;QACxC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAEO,UAAU,CAAC,KAAqB;QACtC,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzE,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,YAAoB,EACpB,aAAqB,EACrB,MAAwB,EACxB,OAAyB;QAEzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,sBAAsB,aAAa,eAAe,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG;YACb,SAAS;YACT,sBAAsB,CAAC,aAAa;YACpC,SAAS;YACT,sBAAsB,CAAC,gBAAgB;YACvC,SAAS;YACT,GAAG,sBAAsB,CAAC,kBAAkB,IAAI,YAAY,EAAE;SAC/D,CAAC;QACF,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CACT,SAAS,EACT,GAAG,sBAAsB,CAAC,yBAAyB,IAAI,OAAO,CAAC,cAAc,EAAE,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CACT,SAAS,EACT,GAAG,sBAAsB,CAAC,yBAAyB,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CACrF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YAChC,KAAK;YACL,IAAI;YACJ,QAAQ;YACR,aAAa;YACb,WAAW;YACX,WAAW;YACX,YAAY;YACZ,KAAK;YACL,gBAAgB;YAChB,mBAAmB;YACnB,cAAc;YACd,MAAM;YACN,GAAG,MAAM;YACT,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAC7D,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YACzB,IAAI,CAAC,KAAK;YACV,OAAO;YACP,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,YAAoB;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QAC5D,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;IAEO,iBAAiB,CAAC,MAAkC;QAC1D,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,MAAM,EAAE,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,YAAoB,EAAE,aAAqB;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;QAC7E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACnC,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,SAAS,EAAE,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,gDAAgD,aAAa,EAAE,EAC/D,YAAY,CAAC,GAAG,CAAC,CAClB,CAAC;YACF,qBAAqB,CAAC,GAAG,EAAE;gBACzB,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,mBAAmB;gBAC5B,SAAS,EAAE,uBAAuB;gBAClC,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE;oBACP,WAAW,EAAE,OAAO;oBACpB,YAAY;oBACZ,aAAa;oBACb,aAAa,EAAE,SAAS,CAAC,MAAM;oBAC/B,KAAK,EAAE,KAAK;iBACb;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,YAAoB,EACpB,aAAqB,EACrB,MAAwB,EACxB,MAAuB;QAEvB,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAE,OAAO,OAAO,CAAC;QAChG,IAAI,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,EAAE,MAAM,CAAC;YAAE,OAAO,eAAe,CAAC;QACrF,IAAI,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC;YAAE,OAAO,SAAS,CAAC;QAClF,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC;QACtF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,iBAAiB,CAAC,KAAwB,EAAE,MAAwB;QAC1E,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,aAAa,CAAC,MAAwB;QAC5C,OAAO,MAAM;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;aACtC,KAAK,EAAE;aACP,QAAQ,EAAE,CAAC;IAChB,CAAC;IAEO,SAAS,CAAC,QAAkB,EAAE,MAAgB;QACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,aAAqB,EACrB,MAAwB;QAExB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,2BAA2B,sBAAsB,CAAC,yBAAyB,KAAK;YAChF,aAAa;SACd,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,MAAM,KAAK,QAAQ,CAAC;IAC7B,CAAC;IAEO,cAAc,CAAC,MAAwB;QAC7C,MAAM,OAAO,GAAG,MAAM;aACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACf,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC;SACvD,CAAC,CAAC;aACF,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxB,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CACnF,CAAC;QACJ,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IAEO,sBAAsB,CAAC,MAAc;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,aAAqB;QACnD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,4BAA4B;YAC5B,aAAa;SACd,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAY,CAAC;QAE5E,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,uDAAuD,aAAa,GAAG,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,aAAqB;QAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,YAAY;YACZ,aAAa;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,OAAO;gBACP,SAAS;gBACT,IAAI;gBACJ,SAAS;gBACT,IAAI,CAAC,KAAK;aACX,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,YAAoB,EACpB,aAAqB,EACrB,MAAwB,EACxB,OAAyB;QAEzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC7C,aAAa,EACb,aAAa,aAAa,0BAA0B,EACpD,8BAA8B,aAAa,kBAAkB,CAC9D,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,aAAa,kBAAkB,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,YAAoB,EAAE,aAAqB;QAC3E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAClE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YACnD,SAAS;YACT,IAAI;YACJ,6BAA6B;YAC7B,aAAa;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,YAAoB;QAC9C,MAAM,WAAW,GAAG,sBAAsB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YACvE,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;QAC7C,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;YAChC,SAAS;YACT,QAAQ;YACR,UAAU;YACV,QAAQ;YACR,SAAS;YACT,sBAAsB,CAAC,aAAa;YACpC,SAAS;YACT,sBAAsB,CAAC,gBAAgB;YACvC,SAAS;YACT,GAAG,sBAAsB,CAAC,kBAAkB,IAAI,YAAY,EAAE;YAC9D,WAAW;SACZ,CAAC,CAAC;QACH,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,aAAqB;QAC/C,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,SAAS;gBACT,IAAI;gBACJ,oBAAoB;gBACpB,aAAa;aACd,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,qBAAqB,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB;QACrC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,IAAI;gBACJ,IAAI;gBACJ,UAAU;gBACV,SAAS,sBAAsB,CAAC,aAAa,EAAE;gBAC/C,UAAU;gBACV,SAAS,sBAAsB,CAAC,gBAAgB,EAAE;gBAClD,UAAU;gBACV,YAAY;aACb,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,2CAA2C,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/E,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,OAAO,MAAM;aACV,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,aAAqB;QAErB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBACnD,SAAS;gBACT,IAAI;gBACJ,sEAAsE;gBACtE,aAAa;aACd,CAAC,CAAC;YACH,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvE,MAAM,OAAO,GAAG,UAAU,KAAK,MAAM,CAAC;YACtC,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,+BAA+B,aAAa,mBAAmB,EAC/D,YAAY,CAAC,GAAG,CAAC,CAClB,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QACvD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACnD,CAAC;IAEO,6BAA6B,CAAC,aAAqB;QACzD,MAAM,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,aAAqB,EACrB,UAAkB,EAClB,UAAkB;QAElB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;YAC/D,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;SAC1C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,YAAY,CAAC,OAA0B,EAAE,IAAY;IAC5D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { createHash } from \"node:crypto\";\nimport { readFileSync, statSync } from \"node:fs\";\nimport { isAbsolute, relative } from \"node:path\";\nimport { promisify } from \"node:util\";\nimport * as log from \"../log.js\";\nimport { reportUserFacingError } from \"../observability/index.js\";\n\nconst execFileAsync = promisify(execFile);\n\ntype ContainerStatus = \"running\" | \"stopped\" | \"missing\";\ntype DriftReason = \"binds\" | \"mount-content\" | \"network\" | \"image\";\n\nfunction isDockerNotFoundError(err: unknown): boolean {\n  if (!err || typeof err !== \"object\") return false;\n  const stderr = (err as { stderr?: unknown }).stderr;\n  const message = (err as { message?: unknown }).message;\n  const haystack = `${typeof stderr === \"string\" ? stderr : \"\"}\\n${\n    typeof message === \"string\" ? message : \"\"\n  }`.toLowerCase();\n  return (\n    haystack.includes(\"no such network\") ||\n    haystack.includes(\"no such container\") ||\n    haystack.includes(\"no such object\") ||\n    haystack.includes(\"network not found\") ||\n    /network [^\\n]+ not found/.test(haystack) ||\n    /error: no such [^\\n]+/.test(haystack)\n  );\n}\n\ninterface ContainerState {\n  status: ContainerStatus;\n  lastUsed: number;\n  containerName: string;\n}\n\nimport type {\n  ContainerMount,\n  DockerContainerManagerOptions,\n  ProvisionOptions,\n  ResourceLimits,\n  SandboxLimitStatus,\n} from \"../types.js\";\nimport { errorMessage } from \"../unknown-values.js\";\nimport type { DockerExecFile } from \"./types.js\";\nimport { sweepOrphanedCommands } from \"./container.js\";\n\nexport class DockerContainerManager {\n  private state = new Map<string, ContainerState>();\n  private inflight = new Map<string, Promise<string>>();\n  private keyQueues = new Map<string, Promise<unknown>>();\n  private static readonly MANAGED_LABEL = \"mikan.managed=true\";\n  private static readonly IMAGE_MODE_LABEL = \"mikan.sandbox=image\";\n  private static readonly VAULT_ID_LABEL_KEY = \"mikan.vault-id\";\n  private static readonly CONVERSATION_ID_LABEL_KEY = \"mikan.conversation-id\";\n  private static readonly MOUNT_SIGNATURE_LABEL_KEY = \"mikan.mount-signature\";\n\n  private readonly limits?: ResourceLimits;\n  private readonly boostLimits?: ResourceLimits;\n  private readonly boostedKeys = new Set<string>();\n  private readonly overrideLimits = new Map<string, ResourceLimits>();\n  private readonly execFileImpl: DockerExecFile;\n\n  constructor(\n    private readonly image: string,\n    options: DockerContainerManagerOptions = {},\n  ) {\n    this.limits = options.limits;\n    this.boostLimits = options.boostLimits;\n    this.execFileImpl = options.execFileImpl ?? execFileAsync;\n  }\n\n  static containerName(containerKey: string): string {\n    return `mikan-sandbox-${containerKey}`;\n  }\n\n  static networkName(containerKey: string): string {\n    return `mikan-sandbox-net-${containerKey}`;\n  }\n\n  private serialize<T>(containerKey: string, task: () => Promise<T>): Promise<T> {\n    const previous = this.keyQueues.get(containerKey) ?? Promise.resolve();\n    const next = previous.then(task, task);\n    const settled = next.catch(() => undefined);\n    this.keyQueues.set(containerKey, settled);\n    void settled.then(() => {\n      if (this.keyQueues.get(containerKey) === settled) this.keyQueues.delete(containerKey);\n    });\n    return next;\n  }\n\n  async provision(containerKey: string, options: ProvisionOptions = {}): Promise<string> {\n    const existing = this.inflight.get(containerKey);\n    if (existing) return existing;\n\n    const pending = this.serialize(containerKey, () =>\n      this.provisionInner(containerKey, options),\n    ).finally(() => {\n      this.inflight.delete(containerKey);\n    });\n    this.inflight.set(containerKey, pending);\n    return pending;\n  }\n\n  private async provisionInner(containerKey: string, options: ProvisionOptions): Promise<string> {\n    const containerName =\n      options.containerName ?? DockerContainerManager.containerName(containerKey);\n    const mounts = options.mounts ?? [];\n    const status = await this.inspectStatus(containerName);\n\n    try {\n      const drift =\n        status === \"missing\"\n          ? undefined\n          : await this.runtimeDrift(containerKey, containerName, mounts, status);\n      if (drift) {\n        log.logInfo(`Container ${containerName} is out of date (${drift}); replacing container`);\n        await this.replaceContainer(containerKey, containerName, mounts, options);\n        log.logInfo(`Container ${containerName} replaced from image ${this.image}`);\n      } else if (status === \"stopped\") {\n        await this.execFileImpl(\"docker\", [\"start\", containerName]);\n        log.logInfo(`Container ${containerName} started`);\n      } else if (status === \"missing\") {\n        await this.runContainer(containerKey, containerName, mounts, options);\n        log.logInfo(`Container ${containerName} created`);\n      }\n    } catch (err) {\n      this.state.delete(containerKey);\n      throw err;\n    }\n\n    this.setState(containerKey, \"running\", containerName);\n    await this.applyResourceLimits(containerKey, containerName);\n    return containerName;\n  }\n\n  async boost(containerKey: string): Promise<SandboxLimitStatus> {\n    if (!this.boostLimits?.cpus && !this.boostLimits?.memory) {\n      return this.getLimitStatus(containerKey);\n    }\n\n    this.overrideLimits.delete(containerKey);\n    this.boostedKeys.add(containerKey);\n    const state = this.state.get(containerKey);\n    if (state?.status === \"running\") {\n      await this.applyResourceLimits(containerKey, state.containerName);\n    }\n    return this.getLimitStatus(containerKey);\n  }\n\n  async setLimits(containerKey: string, limits: ResourceLimits): Promise<SandboxLimitStatus> {\n    this.boostedKeys.delete(containerKey);\n    this.overrideLimits.set(containerKey, { ...this.limits, ...limits });\n    const state = this.state.get(containerKey);\n    if (state?.status === \"running\") {\n      await this.applyResourceLimits(containerKey, state.containerName);\n    }\n    return this.getLimitStatus(containerKey);\n  }\n\n  getLimitStatus(containerKey: string): SandboxLimitStatus {\n    const boosted = this.boostedKeys.has(containerKey);\n    return { limits: this.effectiveLimits(containerKey), boosted };\n  }\n\n  getDefaultLimits(): ResourceLimits | undefined {\n    return this.limits;\n  }\n\n  getBoostLimits(): ResourceLimits | undefined {\n    return this.boostLimits;\n  }\n\n  stop(containerKey: string): Promise<void> {\n    return this.serialize(containerKey, () => this.stopInner(containerKey));\n  }\n\n  private async stopInner(containerKey: string): Promise<void> {\n    const containerName = this.getContainerName(containerKey);\n    try {\n      await this.execFileImpl(\"docker\", [\"stop\", containerName]);\n      this.setState(containerKey, \"stopped\", containerName);\n      this.boostedKeys.delete(containerKey);\n      this.overrideLimits.delete(containerKey);\n      log.logInfo(`Container ${containerName} stopped (idle)`);\n    } catch (err) {\n      log.logWarning(`Failed to stop container ${containerName}`, errorMessage(err));\n    }\n  }\n\n  remove(containerKey: string): Promise<void> {\n    return this.serialize(containerKey, () => this.removeInner(containerKey));\n  }\n\n  private async removeInner(containerKey: string): Promise<void> {\n    const containerName = this.getContainerName(containerKey);\n    const networkName = DockerContainerManager.networkName(containerKey);\n\n    const removed = await this.forceRemoveContainer(\n      containerName,\n      `Container ${containerName} removed`,\n      `Failed to remove container ${containerName}`,\n    );\n    if (!removed) {\n      throw new Error(`Failed to remove container ${containerName}`);\n    }\n\n    try {\n      await this.execFileImpl(\"docker\", [\"network\", \"rm\", networkName]);\n      log.logInfo(`Network ${networkName} removed`);\n    } catch (err) {\n      log.logWarning(`Failed to remove network ${networkName}`, errorMessage(err));\n    }\n\n    this.state.delete(containerKey);\n    this.boostedKeys.delete(containerKey);\n    this.overrideLimits.delete(containerKey);\n  }\n\n  async stopIdle(maxIdleMs: number): Promise<void> {\n    const now = Date.now();\n    const toStop: string[] = [];\n    for (const [containerKey, containerState] of this.state) {\n      if (containerState.status === \"running\" && now - containerState.lastUsed > maxIdleMs) {\n        toStop.push(containerKey);\n      }\n    }\n    await Promise.all(toStop.map((containerKey) => this.stop(containerKey)));\n  }\n\n  async reconcile(workspaceRoot: string): Promise<void> {\n    const names = await this.listContainerNamesByLabel();\n    this.state.clear();\n\n    const inspected = await Promise.all(\n      names.map(async (containerName) => ({\n        containerName,\n        details: await this.inspectContainerDetails(containerName),\n      })),\n    );\n\n    for (const { containerName, details } of inspected) {\n      if (!details || !mountsWithin(details.bindSources, workspaceRoot)) continue;\n      const containerKey = this.containerKeyFromContainerName(containerName);\n      if (!containerKey) {\n        log.logWarning(`Skipping unmanaged-style container without container key`, containerName);\n        continue;\n      }\n      const status: ContainerStatus = details.running ? \"running\" : \"stopped\";\n      const lastUsed = details.startedAtMs ?? Date.now();\n      this.state.set(containerKey, { status, lastUsed, containerName });\n    }\n\n    await Promise.all(\n      Array.from(this.state.values())\n        .filter((state) => state.status === \"running\")\n        .map((state) => sweepOrphanedCommands(state.containerName, this.execFileImpl)),\n    );\n\n    const running = Array.from(this.state.values()).filter((s) => s.status === \"running\").length;\n    const stopped = this.state.size - running;\n    log.logInfo(\n      `Reconciled ${this.state.size} managed containers (running=${running}, stopped=${stopped})`,\n    );\n  }\n\n  private setState(containerKey: string, status: ContainerStatus, containerName: string): void {\n    this.state.set(containerKey, { status, lastUsed: Date.now(), containerName });\n  }\n\n  private getContainerName(containerKey: string): string {\n    return (\n      this.state.get(containerKey)?.containerName ??\n      DockerContainerManager.containerName(containerKey)\n    );\n  }\n\n  private mountArgs(mounts: ContainerMount[]): string[] {\n    return mounts.flatMap((mount) => [\"-v\", this.toBindSpec(mount)]);\n  }\n\n  private toBindSpec(mount: ContainerMount): string {\n    return `${mount.source}:${mount.target}${mount.readOnly ? \":ro\" : \"\"}`;\n  }\n\n  private async runContainer(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n    options: ProvisionOptions,\n  ): Promise<void> {\n    const networkName = await this.ensureNetwork(containerKey);\n    log.logInfo(`Creating container ${containerName} from image ${this.image}`);\n    const labels = [\n      \"--label\",\n      DockerContainerManager.MANAGED_LABEL,\n      \"--label\",\n      DockerContainerManager.IMAGE_MODE_LABEL,\n      \"--label\",\n      `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,\n    ];\n    if (options.conversationId) {\n      labels.push(\n        \"--label\",\n        `${DockerContainerManager.CONVERSATION_ID_LABEL_KEY}=${options.conversationId}`,\n      );\n    }\n    if (mounts.length > 0) {\n      labels.push(\n        \"--label\",\n        `${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}=${this.mountSignature(mounts)}`,\n      );\n    }\n    await this.execFileImpl(\"docker\", [\n      \"run\",\n      \"-d\",\n      \"--name\",\n      containerName,\n      \"--network\",\n      networkName,\n      \"--cap-drop\",\n      \"ALL\",\n      \"--security-opt\",\n      \"no-new-privileges\",\n      \"--pids-limit\",\n      \"1024\",\n      ...labels,\n      ...this.resourceLimitArgs(this.effectiveLimits(containerKey)),\n      ...this.mountArgs(mounts),\n      this.image,\n      \"sleep\",\n      \"infinity\",\n    ]);\n  }\n\n  private effectiveLimits(containerKey: string): ResourceLimits | undefined {\n    const override = this.overrideLimits.get(containerKey);\n    if (override) return override;\n    if (!this.boostedKeys.has(containerKey)) return this.limits;\n    return { ...this.limits, ...this.boostLimits };\n  }\n\n  private resourceLimitArgs(limits: ResourceLimits | undefined): string[] {\n    const args: string[] = [];\n    if (limits?.cpus) args.push(\"--cpus\", limits.cpus);\n    if (limits?.memory) {\n      args.push(\"--memory\", limits.memory);\n      args.push(\"--memory-swap\", limits.memory);\n    }\n    return args;\n  }\n\n  private async applyResourceLimits(containerKey: string, containerName: string): Promise<void> {\n    const limitArgs = this.resourceLimitArgs(this.effectiveLimits(containerKey));\n    if (limitArgs.length === 0) return;\n    const args = [\"update\", ...limitArgs, containerName];\n    try {\n      await this.execFileImpl(\"docker\", args);\n    } catch (err) {\n      log.logWarning(\n        `Failed to apply resource limits to container ${containerName}`,\n        errorMessage(err),\n      );\n      reportUserFacingError(err, {\n        domain: \"sandbox\",\n        surface: \"sandbox_provision\",\n        operation: \"apply_resource_limits\",\n        severity: \"warning\",\n        context: {\n          sandboxType: \"image\",\n          containerKey,\n          containerName,\n          limitArgCount: limitArgs.length,\n          fatal: false,\n        },\n      });\n    }\n  }\n\n  private async runtimeDrift(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n    status: ContainerStatus,\n  ): Promise<DriftReason | undefined> {\n    if (this.hasBindMountDrift(await this.inspectBindMounts(containerName), mounts)) return \"binds\";\n    if (await this.hasMountSignatureDrift(containerName, mounts)) return \"mount-content\";\n    if (await this.hasNetworkModeDrift(containerKey, containerName)) return \"network\";\n    if (status === \"stopped\" && (await this.hasImageDrift(containerName))) return \"image\";\n    return undefined;\n  }\n\n  private hasBindMountDrift(binds: readonly string[], mounts: ContainerMount[]): boolean {\n    return !this.sameBinds(this.expectedBinds(mounts), [...binds]);\n  }\n\n  private expectedBinds(mounts: ContainerMount[]): string[] {\n    return mounts\n      .map((mount) => this.toBindSpec(mount))\n      .slice()\n      .toSorted();\n  }\n\n  private sameBinds(expected: string[], actual: string[]): boolean {\n    if (expected.length !== actual.length) {\n      return false;\n    }\n\n    return expected.every((bind, index) => bind === actual[index]);\n  }\n\n  private async hasMountSignatureDrift(\n    containerName: string,\n    mounts: ContainerMount[],\n  ): Promise<boolean> {\n    if (mounts.length === 0) return false;\n    const expected = this.mountSignature(mounts);\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      `{{index .Config.Labels \"${DockerContainerManager.MOUNT_SIGNATURE_LABEL_KEY}\"}}`,\n      containerName,\n    ]);\n    const actual = this.normalizeDockerValue(stdout.trim());\n    return actual !== expected;\n  }\n\n  private mountSignature(mounts: ContainerMount[]): string {\n    const payload = mounts\n      .map((mount) => ({\n        source: mount.source,\n        target: mount.target,\n        fingerprint: this.mountSourceFingerprint(mount.source),\n      }))\n      .toSorted((left, right) =>\n        `${left.target}\\0${left.source}`.localeCompare(`${right.target}\\0${right.source}`),\n      );\n    return createHash(\"sha256\").update(JSON.stringify(payload)).digest(\"hex\");\n  }\n\n  private mountSourceFingerprint(source: string): string {\n    try {\n      const stat = statSync(source);\n      if (stat.isFile()) {\n        return createHash(\"sha256\").update(readFileSync(source)).digest(\"hex\");\n      }\n      return `${stat.isDirectory() ? \"dir\" : \"other\"}:${stat.dev}:${stat.ino}:${stat.birthtimeMs}`;\n    } catch {\n      return \"missing\";\n    }\n  }\n\n  private async inspectBindMounts(containerName: string): Promise<string[]> {\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{json .HostConfig.Binds}}\",\n      containerName,\n    ]);\n    const payload = stdout.trim();\n    const parsed = JSON.parse(payload.length > 0 ? payload : \"null\") as unknown;\n\n    if (parsed === null) {\n      return [];\n    }\n\n    if (!Array.isArray(parsed) || parsed.some((bind) => typeof bind !== \"string\")) {\n      throw new Error(`Unexpected docker bind mount payload for container \"${containerName}\"`);\n    }\n\n    return [...parsed].toSorted();\n  }\n\n  private async hasImageDrift(containerName: string): Promise<boolean> {\n    const desired = await this.localImageId();\n    if (!desired) return false;\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.Image}}\",\n      containerName,\n    ]);\n    return stdout.trim() !== desired;\n  }\n\n  private async localImageId(): Promise<string | undefined> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"image\",\n        \"inspect\",\n        \"-f\",\n        \"{{.Id}}\",\n        this.image,\n      ]);\n      return this.normalizeDockerValue(stdout.trim());\n    } catch {\n      return undefined;\n    }\n  }\n\n  private async replaceContainer(\n    containerKey: string,\n    containerName: string,\n    mounts: ContainerMount[],\n    options: ProvisionOptions,\n  ): Promise<void> {\n    const removed = await this.forceRemoveContainer(\n      containerName,\n      `Container ${containerName} removed for replacement`,\n      `Failed to remove container ${containerName} for replacement`,\n    );\n    if (!removed) throw new Error(`Failed to remove container ${containerName} for replacement`);\n    await this.runContainer(containerKey, containerName, mounts, options);\n  }\n\n  private async hasNetworkModeDrift(containerKey: string, containerName: string): Promise<boolean> {\n    const expected = DockerContainerManager.networkName(containerKey);\n    const { stdout } = await this.execFileImpl(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.HostConfig.NetworkMode}}\",\n      containerName,\n    ]);\n    return stdout.trim() !== expected;\n  }\n\n  private async ensureNetwork(containerKey: string): Promise<string> {\n    const networkName = DockerContainerManager.networkName(containerKey);\n    try {\n      await this.execFileImpl(\"docker\", [\"network\", \"inspect\", networkName]);\n      return networkName;\n    } catch (err) {\n      if (!isDockerNotFoundError(err)) throw err;\n    }\n    await this.execFileImpl(\"docker\", [\n      \"network\",\n      \"create\",\n      \"--driver\",\n      \"bridge\",\n      \"--label\",\n      DockerContainerManager.MANAGED_LABEL,\n      \"--label\",\n      DockerContainerManager.IMAGE_MODE_LABEL,\n      \"--label\",\n      `${DockerContainerManager.VAULT_ID_LABEL_KEY}=${containerKey}`,\n      networkName,\n    ]);\n    return networkName;\n  }\n\n  private async inspectStatus(containerName: string): Promise<ContainerStatus> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"inspect\",\n        \"-f\",\n        \"{{.State.Running}}\",\n        containerName,\n      ]);\n      return stdout.trim() === \"true\" ? \"running\" : \"stopped\";\n    } catch (err) {\n      if (isDockerNotFoundError(err)) return \"missing\";\n      throw err;\n    }\n  }\n\n  private async listContainerNamesByLabel(): Promise<string[]> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"ps\",\n        \"-a\",\n        \"--filter\",\n        `label=${DockerContainerManager.MANAGED_LABEL}`,\n        \"--filter\",\n        `label=${DockerContainerManager.IMAGE_MODE_LABEL}`,\n        \"--format\",\n        \"{{.Names}}\",\n      ]);\n      return this.parseNameLines(stdout);\n    } catch (err) {\n      log.logWarning(\"Failed to list labeled managed containers\", errorMessage(err));\n      return [];\n    }\n  }\n\n  private parseNameLines(stdout: string): string[] {\n    return stdout\n      .split(\"\\n\")\n      .map((line) => line.trim())\n      .filter((line) => line.length > 0);\n  }\n\n  private async inspectContainerDetails(\n    containerName: string,\n  ): Promise<{ running: boolean; startedAtMs?: number; bindSources: string[] } | undefined> {\n    try {\n      const { stdout } = await this.execFileImpl(\"docker\", [\n        \"inspect\",\n        \"-f\",\n        `{{.State.Running}}\\t{{.State.StartedAt}}\\t{{json .HostConfig.Binds}}`,\n        containerName,\n      ]);\n      const [runningRaw, startedAtRaw, bindsRaw] = stdout.trim().split(\"\\t\");\n      const running = runningRaw === \"true\";\n      const startedAtMs = this.parseDockerTimestamp(startedAtRaw);\n      return { running, startedAtMs, bindSources: parseBindSources(bindsRaw) };\n    } catch (err) {\n      log.logWarning(\n        `Failed to inspect container ${containerName} during reconcile`,\n        errorMessage(err),\n      );\n      return undefined;\n    }\n  }\n\n  private normalizeDockerValue(value?: string): string | undefined {\n    if (!value || value === \"<no value>\") return undefined;\n    const trimmed = value.trim();\n    return trimmed.length > 0 ? trimmed : undefined;\n  }\n\n  private parseDockerTimestamp(value?: string): number | undefined {\n    const normalized = this.normalizeDockerValue(value);\n    if (!normalized || normalized.startsWith(\"0001-\")) return undefined;\n    const parsed = Date.parse(normalized);\n    return Number.isNaN(parsed) ? undefined : parsed;\n  }\n\n  private containerKeyFromContainerName(containerName: string): string | undefined {\n    const prefix = DockerContainerManager.containerName(\"\");\n    if (!containerName.startsWith(prefix)) return undefined;\n    const containerKey = containerName.slice(prefix.length);\n    return containerKey.length > 0 ? containerKey : undefined;\n  }\n\n  private async forceRemoveContainer(\n    containerName: string,\n    successLog: string,\n    failureLog: string,\n  ): Promise<boolean> {\n    try {\n      await this.execFileImpl(\"docker\", [\"rm\", \"-f\", containerName]);\n      log.logInfo(successLog);\n      return true;\n    } catch (err) {\n      const message = errorMessage(err);\n      if (/no such container/i.test(message)) return true;\n      log.logWarning(failureLog, message);\n      return false;\n    }\n  }\n}\n\nfunction parseBindSources(raw: string | undefined): string[] {\n  const parsed: unknown = JSON.parse(raw && raw.length > 0 ? raw : \"null\");\n  if (!Array.isArray(parsed)) return [];\n  return parsed\n    .filter((bind) => typeof bind === \"string\")\n    .map((bind) => bind.split(\":\", 1)[0] ?? bind);\n}\n\nfunction mountsWithin(sources: readonly string[], root: string): boolean {\n  return sources.some((source) => {\n    const path = relative(root, source);\n    return path !== \"\" && !path.startsWith(\"..\") && !isAbsolute(path);\n  });\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geminixiang/mikan",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Self-hosted AI coding agent for organizations: every Slack channel and DM gets its own sandboxed workspace, credentials, and memory.",
   "keywords": [
     "agent",