@geminixiang/mikan 1.3.0 → 1.4.0

package/dist/sandbox/container.js

@@ -1,14 +1,14 @@
-import { randomUUID } from "node:crypto";
-import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { SandboxError, createMountedRuntimePathContext, execReadFile, execReadFileBase64, execSimple, execWriteFile, shellEscape, } from "./utils.js";
-import { HostExecutor } from "./host.js";
-import { GUEST_WORKSPACE_ROOT } from "./layout.js";
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { promisify } from "node:util";
+import { ExecutionError, FileError, err } from "@earendil-works/pi-durable/env";
+import { Connection, RemoteExecutionEnv, packagedDaemon } from "@earendil-works/pi-env";
+import { SandboxError, execSimple } from "./utils.js";
+import { containerEngine } from "./engine.js";
 import { errorMessage } from "../unknown-values.js";
 import * as log from "../log.js";
-const PRIVATE_DIR_MODE = 0o700;
-const PRIVATE_FILE_MODE = 0o600;
+const execFileAsync = promisify(execFile);
 function parseContainerSandboxArg(value) {
     if (!value.startsWith("container:")) {
         return undefined;
@@ -20,14 +20,15 @@ function parseContainerSandboxArg(value) {
     return { type: "container", container };
 }
 async function validateContainerSandbox(config) {
+    const engine = containerEngine();
     try {
-        await execSimple("docker", ["--version"]);
+        await execSimple(engine, ["--version"]);
     }
     catch {
-        throw new SandboxError("Error: Docker is not installed or not in PATH");
+        throw new SandboxError(`Error: no container engine found; install nerdctl, Podman, or Docker (tried '${engine}')`);
     }
     try {
-        const result = await execSimple("docker", [
+        const result = await execSimple(engine, [
             "inspect",
             "-f",
             "{{.State.Running}}",
@@ -35,7 +36,7 @@ async function validateContainerSandbox(config) {
         ]);
         if (result.trim() !== "true") {
             throw new SandboxError(`Error: Container '${config.container}' is not running.`, [
-                `Start it with: docker start ${config.container}`,
+                `Start it with: ${engine} start ${config.container}`,
             ]);
         }
     }
@@ -44,49 +45,10 @@ async function validateContainerSandbox(config) {
             throw error;
         }
         throw new SandboxError(`Error: Container '${config.container}' does not exist.`, [
-            `Create it with: docker run -d --name ${config.container} -v <workspace>:/workspace alpine:latest sleep infinity`,
+            `Create it with: ${engine} run -d --name ${config.container} -v <workspace>:/workspace docker.io/library/alpine:latest sleep infinity`,
         ]);
     }
-    console.log(`  Container '${config.container}' is running.`);
-}
-const GROUP_FILE_PREFIX = "/tmp/mikan-exec-";
-const RUN_IN_PROCESS_GROUP = [
-    "if command -v setsid >/dev/null 2>&1; then",
-    `setsid sh -c 'echo "$$ $(cut -d" " -f22 /proc/$$/stat)" > "$1"; exec sh -c "$2"' _ "$1" "$2" & wait $!;`,
-    'status=$?; rm -f "$1"; exit $status;',
-    'fi; exec sh -c "$2"',
-].join(" ");
-const STOP_RECORDED_GROUP = [
-    'stop_group() { read group start < "$1" 2>/dev/null || return 0; rm -f "$1";',
-    '[ "$group" -gt 1 ] 2>/dev/null || return 0;',
-    '[ "$(cut -d" " -f22 /proc/$group/stat 2>/dev/null)" = "$start" ] || return 0;',
-    'kill -s KILL -- -"$group" 2>/dev/null || kill -s KILL -"$group" 2>/dev/null; return 0; };',
-].join(" ");
-const KILL_PROCESS_GROUP = [
-    STOP_RECORDED_GROUP,
-    'i=0; while [ ! -s "$1" ] && [ $i -lt 10 ]; do sleep 0.1; i=$((i+1)); done;',
-    'stop_group "$1"; exit 0',
-].join(" ");
-const SWEEP_PROCESS_GROUPS = [
-    STOP_RECORDED_GROUP,
-    `for file in ${GROUP_FILE_PREFIX}*; do [ -f "$file" ] && stop_group "$file"; done; exit 0`,
-].join(" ");
-export async function sweepOrphanedCommands(containerName, execFile) {
-    try {
-        await execFile("docker", ["exec", containerName, "sh", "-c", SWEEP_PROCESS_GROUPS]);
-    }
-    catch (error) {
-        log.logWarning(`Could not end leftover commands in ${containerName}`, errorMessage(error));
-    }
-}
-function buildContainerExecCommand(container, command, groupFile, envFilePath, cwd) {
-    const envPart = envFilePath ? `--env-file ${shellEscape(envFilePath)} ` : "";
-    const workdir = cwd === undefined ? GUEST_WORKSPACE_ROOT : shellEscape(cwd);
-    const script = `${shellEscape(RUN_IN_PROCESS_GROUP)} _ ${shellEscape(groupFile)} ${shellEscape(command)}`;
-    return `docker exec ${envPart}-w ${workdir} ${container} sh -c ${script}`;
-}
-function buildKillProcessGroupCommand(container, groupFile) {
-    return `docker exec ${container} sh -c ${shellEscape(KILL_PROCESS_GROUP)} _ ${shellEscape(groupFile)}`;
+    console.log(`  Container '${config.container}' is running (engine: ${engine}).`);
 }
 const GITHUB_CREDENTIAL_KEY = "credential.https://github.com.helper";
 function withGitHubCredentialHelper(env) {
@@ -105,62 +67,95 @@ function withGitHubCredentialHelper(env) {
 function hasGitHubToken(env) {
     return Boolean(env.GH_TOKEN || env.GITHUB_TOKEN);
 }
-export class ContainerExecutor {
-    constructor(container, env, ensureReady) {
-        this.container = container;
-        this.env = env;
-        this.ensureReady = ensureReady;
-        this.hostExecutor = new HostExecutor();
-    }
-    async exec(command, options) {
-        if (this.ensureReady) {
-            await this.ensureReady();
-        }
-        else {
-            await ensureContainerRunning(this.container);
-        }
-        const env = withGitHubCredentialHelper(this.env);
-        const temp = env ? createSecureEnvFile(env) : undefined;
-        const groupFile = `${GROUP_FILE_PREFIX}${randomUUID()}`;
-        try {
-            const dockerCmd = buildContainerExecCommand(this.container, command, groupFile, temp?.envFilePath, options?.cwd);
-            const { cwd: _cwd, ...hostOptions } = options ?? {};
-            return await this.hostExecutor.exec(dockerCmd, options ? hostOptions : undefined);
-        }
-        catch (error) {
-            await this.killProcessGroup(groupFile);
+const DAEMON_ARCH = {
+    x86_64: "x64",
+    amd64: "x64",
+    aarch64: "arm64",
+    arm64: "arm64",
+};
+const INSTALL_DAEMON = '[ -x "$1" ] && exit 0; cat > "$1.$$" && chmod 755 "$1.$$" && mv -f "$1.$$" "$1"';
+async function deployDaemon(engine, container) {
+    const { stdout } = await execFileAsync(engine, ["exec", container, "uname", "-m"]);
+    const arch = DAEMON_ARCH[stdout.trim()];
+    if (!arch)
+        throw new Error(`No pi-env daemon for ${stdout.trim()} in container ${container}`);
+    const binary = readFileSync(packagedDaemon({ platform: "linux", arch }));
+    const digest = createHash("sha256").update(binary).digest("hex").slice(0, 16);
+    const path = `/tmp/mikan-pi-env-${digest}`;
+    await new Promise((resolve, reject) => {
+        const child = execFile(engine, ["exec", "-i", container, "sh", "-c", INSTALL_DAEMON, "sh", path], (error) => (error ? reject(error) : resolve()));
+        child.stdin?.on("error", () => { });
+        child.stdin?.end(binary);
+    });
+    return path;
+}
+const connections = new Map();
+function containerConnection(configuredEngine, container, ensureReady) {
+    const key = `${configuredEngine ?? ""}\0${container}`;
+    const existing = connections.get(key);
+    if (existing) {
+        existing.ensureReady = ensureReady;
+        return existing.connection;
+    }
+    const entry = {
+        ensureReady,
+        connection: new Connection({
+            command: async () => {
+                await entry.ensureReady();
+                const engine = configuredEngine ?? containerEngine();
+                return [engine, "exec", "-i", container, await deployDaemon(engine, container)];
+            },
+            onLog: (text) => log.logWarning(`Sandbox ${container}`, text.trim()),
+        }),
+    };
+    connections.set(key, entry);
+    return entry.connection;
+}
+const PATH_ONLY = new Set(["absolutePath", "joinPath"]);
+function readiedEnv(env, ensureReady, markUsed) {
+    let ready;
+    const before = async () => {
+        ready ??= ensureReady().catch((error) => {
+            ready = undefined;
             throw error;
-        }
-        finally {
-            temp?.cleanup();
-        }
-    }
-    async killProcessGroup(groupFile) {
-        try {
-            await this.hostExecutor.exec(buildKillProcessGroupCommand(this.container, groupFile));
-        }
-        catch (error) {
-            log.logWarning(`Could not stop a command in container ${this.container}`, errorMessage(error));
-        }
-    }
-    readFile(path, options) {
-        return execReadFile(this, path, options);
-    }
-    readFileBase64(path, options) {
-        return execReadFileBase64(this, path, options);
-    }
-    writeFile(path, content, options) {
-        return execWriteFile(this, path, content, options);
-    }
-    getWorkspacePath(_hostPath) {
-        return GUEST_WORKSPACE_ROOT;
-    }
-    getPathContext(hostWorkspaceRoot) {
-        return createMountedRuntimePathContext(hostWorkspaceRoot, GUEST_WORKSPACE_ROOT);
-    }
-    getSandboxConfig() {
-        return { type: "container", container: this.container };
-    }
+        });
+        await ready;
+        markUsed();
+    };
+    return new Proxy(env, {
+        get(target, property, receiver) {
+            const value = Reflect.get(target, property, receiver);
+            if (typeof value !== "function")
+                return value;
+            if (PATH_ONLY.has(property))
+                return value.bind(target);
+            return async (...args) => {
+                try {
+                    await before();
+                }
+                catch (error) {
+                    const message = errorMessage(error);
+                    if (property === "cleanup")
+                        return undefined;
+                    return err(property === "exec"
+                        ? new ExecutionError("unknown", message)
+                        : new FileError("unknown", message));
+                }
+                return Reflect.apply(value, target, args);
+            };
+        },
+    });
+}
+export function createContainerExecutionEnv(options) {
+    const ensureReady = options.ensureReady ??
+        (() => ensureContainerRunning(options.container, options.engine ?? containerEngine()));
+    const env = new RemoteExecutionEnv({
+        connection: containerConnection(options.engine, options.container, ensureReady),
+        id: `container:${options.container}`,
+        cwd: options.cwd,
+        shellEnv: withGitHubCredentialHelper(options.env),
+    });
+    return readiedEnv(env, ensureReady, options.markUsed ?? (() => { }));
 }
 export const containerSandboxAdapter = {
     type: "container",
@@ -168,15 +163,15 @@ export const containerSandboxAdapter = {
     workspace: { managedProjection: false },
     parse: parseContainerSandboxArg,
     validate: validateContainerSandbox,
-    createExecutor: (config, env, ensureReady) => new ContainerExecutor(config.container, env, ensureReady),
+    createEnv: (config, options) => createContainerExecutionEnv({ ...options, container: config.container }),
 };
-async function ensureContainerRunning(container) {
+async function ensureContainerRunning(container, engine) {
     try {
-        const running = await execSimple("docker", ["inspect", "-f", "{{.State.Running}}", container]);
+        const running = await execSimple(engine, ["inspect", "-f", "{{.State.Running}}", container]);
         if (running.trim() === "true") {
             return;
         }
-        await execSimple("docker", ["start", container]);
+        await execSimple(engine, ["start", container]);
     }
     catch (error) {
         const details = errorMessage(error);
@@ -184,20 +179,4 @@ async function ensureContainerRunning(container) {
             `Expected a pre-existing container or image provisioning to keep it running.\n${details}`.trim(), { cause: error });
     }
 }
-function createSecureEnvFile(env) {
-    const tempDir = mkdtempSync(join(tmpdir(), "mikan-docker-env-"));
-    chmodSync(tempDir, PRIVATE_DIR_MODE);
-    const envFilePath = join(tempDir, "env.list");
-    const content = Object.entries(env)
-        .map(([key, value]) => `${key}=${value.replace(/\r?\n/g, "")}`)
-        .join("\n") + "\n";
-    writeFileSync(envFilePath, content, { encoding: "utf-8", mode: PRIVATE_FILE_MODE });
-    chmodSync(envFilePath, PRIVATE_FILE_MODE);
-    return {
-        envFilePath,
-        cleanup: () => {
-            rmSync(tempDir, { recursive: true, force: true });
-        },
-    };
-}
 //# sourceMappingURL=container.js.map

package/dist/sandbox/container.js.map

@@ -1 +1 @@
-{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAUjC,OAAO,EACL,YAAY,EACZ,+BAA+B,EAC/B,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAEjC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,SAAS,wBAAwB,CAAC,KAAa;IAC7C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,MAA8B;IACpE,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE;YACxC,SAAS;YACT,IAAI;YACJ,oBAAoB;YACpB,MAAM,CAAC,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;gBAC/E,+BAA+B,MAAM,CAAC,SAAS,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;YAC/E,wCAAwC,MAAM,CAAC,SAAS,yDAAyD;SAClH,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAE7C,MAAM,oBAAoB,GAAG;IAC3B,4CAA4C;IAC5C,yGAAyG;IACzG,sCAAsC;IACtC,qBAAqB;CACtB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,MAAM,mBAAmB,GAAG;IAC1B,6EAA6E;IAC7E,6CAA6C;IAC7C,+EAA+E;IAC/E,2FAA2F;CAC5F,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,MAAM,kBAAkB,GAAG;IACzB,mBAAmB;IACnB,4EAA4E;IAC5E,yBAAyB;CAC1B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,MAAM,oBAAoB,GAAG;IAC3B,mBAAmB;IACnB,eAAe,iBAAiB,0DAA0D;CAC3F,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAqB,EACrB,QAAwB;IAExB,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,UAAU,CAAC,sCAAsC,aAAa,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,SAAiB,EACjB,OAAe,EACf,SAAiB,EACjB,WAAoB,EACpB,GAAY;IAEZ,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,cAAc,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,GAAG,WAAW,CAAC,oBAAoB,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1G,OAAO,eAAe,OAAO,MAAM,OAAO,IAAI,SAAS,UAAU,MAAM,EAAE,CAAC;AAC5E,CAAC;AAED,SAAS,4BAA4B,CAAC,SAAiB,EAAE,SAAiB;IACxE,OAAO,eAAe,SAAS,UAAU,WAAW,CAAC,kBAAkB,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;AACzG,CAAC;AAED,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AAErE,SAAS,0BAA0B,CACjC,GAA4B;IAE5B,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACvE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO;QACL,GAAG,GAAG;QACN,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,qBAAqB;QACvC,kBAAkB,EAAE,EAAE;QACtB,gBAAgB,EAAE,qBAAqB;QACvC,kBAAkB,EAAE,yBAAyB;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAA2B;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,OAAO,iBAAiB;IAG5B,YACU,SAAiB,EACjB,GAA4B,EAC5B,WAAiC;QAFjC,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAyB;QAC5B,gBAAW,GAAX,WAAW,CAAsB;QAL1B,iBAAY,GAAG,IAAI,YAAY,EAAE,CAAC;IAMhD,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,MAAM,SAAS,GAAG,GAAG,iBAAiB,GAAG,UAAU,EAAE,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,yBAAyB,CACzC,IAAI,CAAC,SAAS,EACd,OAAO,EACP,SAAS,EACT,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,GAAG,CACb,CAAC;YACF,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;YACpD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,OAAO,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,UAAU,CACZ,yCAAyC,IAAI,CAAC,SAAS,EAAE,EACzD,YAAY,CAAC,KAAK,CAAC,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,OAAqB;QAC1C,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,IAAY,EAAE,OAAqB;QAChD,OAAO,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,OAAe,EAAE,OAAqB;QAC5D,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAClF,CAAC;IAED,gBAAgB;QACd,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1D,CAAC;CACF;AAED,MAAM,CAAC,MAAM,uBAAuB,GAA2C;IAC7E,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE;IAC7C,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACvC,KAAK,EAAE,wBAAwB;IAC/B,QAAQ,EAAE,wBAAwB;IAClC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,CAC3C,IAAI,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC;CAC5D,CAAC;AAEF,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IACrD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/F,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,sBAAsB;YAC3C,gFAAgF,OAAO,EAAE,CAAC,IAAI,EAAE,EAClG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAA2B;IAItD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACjE,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;SAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvB,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACpF,SAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAE1C,OAAO;QACL,WAAW;QACX,OAAO,EAAE,GAAG,EAAE;YACZ,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { chmodSync, mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type {\n  ContainerSandboxConfig,\n  DockerExecFile,\n  ExecOptions,\n  ExecResult,\n  Executor,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport {\n  SandboxError,\n  createMountedRuntimePathContext,\n  execReadFile,\n  execReadFileBase64,\n  execSimple,\n  execWriteFile,\n  shellEscape,\n} from \"./utils.js\";\nimport { HostExecutor } from \"./host.js\";\nimport { GUEST_WORKSPACE_ROOT } from \"./layout.js\";\nimport { errorMessage } from \"../unknown-values.js\";\nimport * as log from \"../log.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\n\nfunction parseContainerSandboxArg(value: string): ContainerSandboxConfig | undefined {\n  if (!value.startsWith(\"container:\")) {\n    return undefined;\n  }\n\n  const container = value.slice(\"container:\".length);\n  if (!container) {\n    throw new SandboxError(\n      \"Error: container sandbox requires container name (e.g., container:mikan-sandbox)\",\n    );\n  }\n  return { type: \"container\", container };\n}\n\nasync function validateContainerSandbox(config: ContainerSandboxConfig): Promise<void> {\n  try {\n    await execSimple(\"docker\", [\"--version\"]);\n  } catch {\n    throw new SandboxError(\"Error: Docker is not installed or not in PATH\");\n  }\n\n  try {\n    const result = await execSimple(\"docker\", [\n      \"inspect\",\n      \"-f\",\n      \"{{.State.Running}}\",\n      config.container,\n    ]);\n    if (result.trim() !== \"true\") {\n      throw new SandboxError(`Error: Container '${config.container}' is not running.`, [\n        `Start it with: docker start ${config.container}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    throw new SandboxError(`Error: Container '${config.container}' does not exist.`, [\n      `Create it with: docker run -d --name ${config.container} -v <workspace>:/workspace alpine:latest sleep infinity`,\n    ]);\n  }\n\n  console.log(`  Container '${config.container}' is running.`);\n}\n\nconst GROUP_FILE_PREFIX = \"/tmp/mikan-exec-\";\n\nconst RUN_IN_PROCESS_GROUP = [\n  \"if command -v setsid >/dev/null 2>&1; then\",\n  `setsid sh -c 'echo \"$$ $(cut -d\" \" -f22 /proc/$$/stat)\" > \"$1\"; exec sh -c \"$2\"' _ \"$1\" \"$2\" & wait $!;`,\n  'status=$?; rm -f \"$1\"; exit $status;',\n  'fi; exec sh -c \"$2\"',\n].join(\" \");\n\nconst STOP_RECORDED_GROUP = [\n  'stop_group() { read group start < \"$1\" 2>/dev/null || return 0; rm -f \"$1\";',\n  '[ \"$group\" -gt 1 ] 2>/dev/null || return 0;',\n  '[ \"$(cut -d\" \" -f22 /proc/$group/stat 2>/dev/null)\" = \"$start\" ] || return 0;',\n  'kill -s KILL -- -\"$group\" 2>/dev/null || kill -s KILL -\"$group\" 2>/dev/null; return 0; };',\n].join(\" \");\n\nconst KILL_PROCESS_GROUP = [\n  STOP_RECORDED_GROUP,\n  'i=0; while [ ! -s \"$1\" ] && [ $i -lt 10 ]; do sleep 0.1; i=$((i+1)); done;',\n  'stop_group \"$1\"; exit 0',\n].join(\" \");\n\nconst SWEEP_PROCESS_GROUPS = [\n  STOP_RECORDED_GROUP,\n  `for file in ${GROUP_FILE_PREFIX}*; do [ -f \"$file\" ] && stop_group \"$file\"; done; exit 0`,\n].join(\" \");\n\nexport async function sweepOrphanedCommands(\n  containerName: string,\n  execFile: DockerExecFile,\n): Promise<void> {\n  try {\n    await execFile(\"docker\", [\"exec\", containerName, \"sh\", \"-c\", SWEEP_PROCESS_GROUPS]);\n  } catch (error) {\n    log.logWarning(`Could not end leftover commands in ${containerName}`, errorMessage(error));\n  }\n}\n\nfunction buildContainerExecCommand(\n  container: string,\n  command: string,\n  groupFile: string,\n  envFilePath?: string,\n  cwd?: string,\n): string {\n  const envPart = envFilePath ? `--env-file ${shellEscape(envFilePath)} ` : \"\";\n  const workdir = cwd === undefined ? GUEST_WORKSPACE_ROOT : shellEscape(cwd);\n  const script = `${shellEscape(RUN_IN_PROCESS_GROUP)} _ ${shellEscape(groupFile)} ${shellEscape(command)}`;\n  return `docker exec ${envPart}-w ${workdir} ${container} sh -c ${script}`;\n}\n\nfunction buildKillProcessGroupCommand(container: string, groupFile: string): string {\n  return `docker exec ${container} sh -c ${shellEscape(KILL_PROCESS_GROUP)} _ ${shellEscape(groupFile)}`;\n}\n\nconst GITHUB_CREDENTIAL_KEY = \"credential.https://github.com.helper\";\n\nfunction withGitHubCredentialHelper(\n  env?: Record<string, string>,\n): Record<string, string> | undefined {\n  if (!env || !hasGitHubToken(env) || env.GIT_CONFIG_COUNT !== undefined) {\n    return env;\n  }\n  return {\n    ...env,\n    GIT_CONFIG_COUNT: \"2\",\n    GIT_CONFIG_KEY_0: GITHUB_CREDENTIAL_KEY,\n    GIT_CONFIG_VALUE_0: \"\",\n    GIT_CONFIG_KEY_1: GITHUB_CREDENTIAL_KEY,\n    GIT_CONFIG_VALUE_1: \"!gh auth git-credential\",\n  };\n}\n\nfunction hasGitHubToken(env: Record<string, string>): boolean {\n  return Boolean(env.GH_TOKEN || env.GITHUB_TOKEN);\n}\n\nexport class ContainerExecutor implements Executor {\n  private readonly hostExecutor = new HostExecutor();\n\n  constructor(\n    private container: string,\n    private env?: Record<string, string>,\n    private ensureReady?: () => Promise<void>,\n  ) {}\n\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    if (this.ensureReady) {\n      await this.ensureReady();\n    } else {\n      await ensureContainerRunning(this.container);\n    }\n\n    const env = withGitHubCredentialHelper(this.env);\n    const temp = env ? createSecureEnvFile(env) : undefined;\n    const groupFile = `${GROUP_FILE_PREFIX}${randomUUID()}`;\n    try {\n      const dockerCmd = buildContainerExecCommand(\n        this.container,\n        command,\n        groupFile,\n        temp?.envFilePath,\n        options?.cwd,\n      );\n      const { cwd: _cwd, ...hostOptions } = options ?? {};\n      return await this.hostExecutor.exec(dockerCmd, options ? hostOptions : undefined);\n    } catch (error) {\n      await this.killProcessGroup(groupFile);\n      throw error;\n    } finally {\n      temp?.cleanup();\n    }\n  }\n\n  private async killProcessGroup(groupFile: string): Promise<void> {\n    try {\n      await this.hostExecutor.exec(buildKillProcessGroupCommand(this.container, groupFile));\n    } catch (error) {\n      log.logWarning(\n        `Could not stop a command in container ${this.container}`,\n        errorMessage(error),\n      );\n    }\n  }\n\n  readFile(path: string, options?: ExecOptions): Promise<string> {\n    return execReadFile(this, path, options);\n  }\n\n  readFileBase64(path: string, options?: ExecOptions): Promise<string> {\n    return execReadFileBase64(this, path, options);\n  }\n\n  writeFile(path: string, content: string, options?: ExecOptions): Promise<void> {\n    return execWriteFile(this, path, content, options);\n  }\n\n  getWorkspacePath(_hostPath: string): string {\n    return GUEST_WORKSPACE_ROOT;\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, GUEST_WORKSPACE_ROOT);\n  }\n\n  getSandboxConfig(): ContainerSandboxConfig {\n    return { type: \"container\", container: this.container };\n  }\n}\n\nexport const containerSandboxAdapter: SandboxAdapter<ContainerSandboxConfig> = {\n  type: \"container\",\n  credentials: { env: true, fileMounts: false },\n  workspace: { managedProjection: false },\n  parse: parseContainerSandboxArg,\n  validate: validateContainerSandbox,\n  createExecutor: (config, env, ensureReady) =>\n    new ContainerExecutor(config.container, env, ensureReady),\n};\n\nasync function ensureContainerRunning(container: string): Promise<void> {\n  try {\n    const running = await execSimple(\"docker\", [\"inspect\", \"-f\", \"{{.State.Running}}\", container]);\n    if (running.trim() === \"true\") {\n      return;\n    }\n    await execSimple(\"docker\", [\"start\", container]);\n  } catch (error) {\n    const details = errorMessage(error);\n    throw new Error(\n      `Container \"${container}\" is not available. ` +\n        `Expected a pre-existing container or image provisioning to keep it running.\\n${details}`.trim(),\n      { cause: error },\n    );\n  }\n}\n\nfunction createSecureEnvFile(env: Record<string, string>): {\n  envFilePath: string;\n  cleanup: () => void;\n} {\n  const tempDir = mkdtempSync(join(tmpdir(), \"mikan-docker-env-\"));\n  chmodSync(tempDir, PRIVATE_DIR_MODE);\n  const envFilePath = join(tempDir, \"env.list\");\n  const content =\n    Object.entries(env)\n      .map(([key, value]) => `${key}=${value.replace(/\\r?\\n/g, \"\")}`)\n      .join(\"\\n\") + \"\\n\";\n  writeFileSync(envFilePath, content, { encoding: \"utf-8\", mode: PRIVATE_FILE_MODE });\n  chmodSync(envFilePath, PRIVATE_FILE_MODE);\n\n  return {\n    envFilePath,\n    cleanup: () => {\n      rmSync(tempDir, { recursive: true, force: true });\n    },\n  };\n}\n"]}
+{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/sandbox/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,EAAqB,MAAM,gCAAgC,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAMxF,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAEjC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,SAAS,wBAAwB,CAAC,KAAa;IAC7C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,MAA8B;IACpE,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CACpB,gFAAgF,MAAM,IAAI,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE;YACtC,SAAS;YACT,IAAI;YACJ,oBAAoB;YACpB,MAAM,CAAC,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;gBAC/E,kBAAkB,MAAM,UAAU,MAAM,CAAC,SAAS,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,qBAAqB,MAAM,CAAC,SAAS,mBAAmB,EAAE;YAC/E,mBAAmB,MAAM,kBAAkB,MAAM,CAAC,SAAS,2EAA2E;SACvI,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,yBAAyB,MAAM,IAAI,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AAErE,SAAS,0BAA0B,CACjC,GAA4B;IAE5B,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACvE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO;QACL,GAAG,GAAG;QACN,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,qBAAqB;QACvC,kBAAkB,EAAE,EAAE;QACtB,gBAAgB,EAAE,qBAAqB;QACvC,kBAAkB,EAAE,yBAAyB;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAA2B;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,WAAW,GAAoC;IACnD,MAAM,EAAE,KAAK;IACb,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,OAAO;CACf,CAAC;AAEF,MAAM,cAAc,GAClB,iFAAiF,CAAC;AAEpF,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,SAAiB;IAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,IAAI,EAAE,iBAAiB,SAAS,EAAE,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,qBAAqB,MAAM,EAAE,CAAC;IAC3C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,QAAQ,CACpB,MAAM,EACN,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,EACjE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAC/C,CAAC;QACF,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,MAAM,WAAW,GAAG,IAAI,GAAG,EAA+B,CAAC;AAE3D,SAAS,mBAAmB,CAC1B,gBAAoC,EACpC,SAAiB,EACjB,WAAgC;IAEhC,MAAM,GAAG,GAAG,GAAG,gBAAgB,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAC;QACnC,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAwB;QACjC,WAAW;QACX,UAAU,EAAE,IAAI,UAAU,CAAC;YACzB,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,gBAAgB,IAAI,eAAe,EAAE,CAAC;gBACrD,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;YAClF,CAAC;YACD,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,SAAS,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;SACrE,CAAC;KACH,CAAC;IACF,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAc,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;AAErE,SAAS,UAAU,CACjB,GAAuB,EACvB,WAAgC,EAChC,QAAoB;IAEpB,IAAI,KAAgC,CAAC;IACrC,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,KAAK,KAAK,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC/C,KAAK,GAAG,SAAS,CAAC;YAClB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;QACZ,QAAQ,EAAE,CAAC;IACb,CAAC,CAAC;IACF,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE;QACpB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ;YAC5B,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC/D,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAC9C,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvD,OAAO,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;gBAClC,IAAI,CAAC;oBACH,MAAM,MAAM,EAAE,CAAC;gBACjB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpC,IAAI,QAAQ,KAAK,SAAS;wBAAE,OAAO,SAAS,CAAC;oBAC7C,OAAO,GAAG,CACR,QAAQ,KAAK,MAAM;wBACjB,CAAC,CAAC,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC;wBACxC,CAAC,CAAC,IAAI,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CACtC,CAAC;gBACJ,CAAC;gBACD,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAAqC;IAC/E,MAAM,WAAW,GACf,OAAO,CAAC,WAAW;QACnB,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,IAAI,kBAAkB,CAAC;QACjC,UAAU,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC;QAC/E,EAAE,EAAE,aAAa,OAAO,CAAC,SAAS,EAAE;QACpC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,0BAA0B,CAAC,OAAO,CAAC,GAAG,CAAC;KAClD,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAA2C;IAC7E,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE;IAC7C,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACvC,KAAK,EAAE,wBAAwB;IAC/B,QAAQ,EAAE,wBAAwB;IAClC,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAC7B,2BAA2B,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;CAC3E,CAAC;AAEF,KAAK,UAAU,sBAAsB,CAAC,SAAiB,EAAE,MAAc;IACrE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7F,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,sBAAsB;YAC3C,gFAAgF,OAAO,EAAE,CAAC,IAAI,EAAE,EAClG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { createHash } from \"node:crypto\";\nimport { readFileSync } from \"node:fs\";\nimport { promisify } from \"node:util\";\nimport { ExecutionError, FileError, err, type ExecutionEnv } from \"@earendil-works/pi-durable/env\";\nimport { Connection, RemoteExecutionEnv, packagedDaemon } from \"@earendil-works/pi-env\";\nimport type {\n  ContainerExecutionEnvOptions,\n  ContainerSandboxConfig,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { SandboxError, execSimple } from \"./utils.js\";\nimport { containerEngine } from \"./engine.js\";\nimport { errorMessage } from \"../unknown-values.js\";\nimport * as log from \"../log.js\";\n\nconst execFileAsync = promisify(execFile);\n\nfunction parseContainerSandboxArg(value: string): ContainerSandboxConfig | undefined {\n  if (!value.startsWith(\"container:\")) {\n    return undefined;\n  }\n\n  const container = value.slice(\"container:\".length);\n  if (!container) {\n    throw new SandboxError(\n      \"Error: container sandbox requires container name (e.g., container:mikan-sandbox)\",\n    );\n  }\n  return { type: \"container\", container };\n}\n\nasync function validateContainerSandbox(config: ContainerSandboxConfig): Promise<void> {\n  const engine = containerEngine();\n  try {\n    await execSimple(engine, [\"--version\"]);\n  } catch {\n    throw new SandboxError(\n      `Error: no container engine found; install nerdctl, Podman, or Docker (tried '${engine}')`,\n    );\n  }\n\n  try {\n    const result = await execSimple(engine, [\n      \"inspect\",\n      \"-f\",\n      \"{{.State.Running}}\",\n      config.container,\n    ]);\n    if (result.trim() !== \"true\") {\n      throw new SandboxError(`Error: Container '${config.container}' is not running.`, [\n        `Start it with: ${engine} start ${config.container}`,\n      ]);\n    }\n  } catch (error) {\n    if (error instanceof SandboxError) {\n      throw error;\n    }\n    throw new SandboxError(`Error: Container '${config.container}' does not exist.`, [\n      `Create it with: ${engine} run -d --name ${config.container} -v <workspace>:/workspace docker.io/library/alpine:latest sleep infinity`,\n    ]);\n  }\n\n  console.log(`  Container '${config.container}' is running (engine: ${engine}).`);\n}\n\nconst GITHUB_CREDENTIAL_KEY = \"credential.https://github.com.helper\";\n\nfunction withGitHubCredentialHelper(\n  env?: Record<string, string>,\n): Record<string, string> | undefined {\n  if (!env || !hasGitHubToken(env) || env.GIT_CONFIG_COUNT !== undefined) {\n    return env;\n  }\n  return {\n    ...env,\n    GIT_CONFIG_COUNT: \"2\",\n    GIT_CONFIG_KEY_0: GITHUB_CREDENTIAL_KEY,\n    GIT_CONFIG_VALUE_0: \"\",\n    GIT_CONFIG_KEY_1: GITHUB_CREDENTIAL_KEY,\n    GIT_CONFIG_VALUE_1: \"!gh auth git-credential\",\n  };\n}\n\nfunction hasGitHubToken(env: Record<string, string>): boolean {\n  return Boolean(env.GH_TOKEN || env.GITHUB_TOKEN);\n}\n\nconst DAEMON_ARCH: Record<string, \"x64\" | \"arm64\"> = {\n  x86_64: \"x64\",\n  amd64: \"x64\",\n  aarch64: \"arm64\",\n  arm64: \"arm64\",\n};\n\nconst INSTALL_DAEMON =\n  '[ -x \"$1\" ] && exit 0; cat > \"$1.$$\" && chmod 755 \"$1.$$\" && mv -f \"$1.$$\" \"$1\"';\n\nasync function deployDaemon(engine: string, container: string): Promise<string> {\n  const { stdout } = await execFileAsync(engine, [\"exec\", container, \"uname\", \"-m\"]);\n  const arch = DAEMON_ARCH[stdout.trim()];\n  if (!arch) throw new Error(`No pi-env daemon for ${stdout.trim()} in container ${container}`);\n  const binary = readFileSync(packagedDaemon({ platform: \"linux\", arch }));\n  const digest = createHash(\"sha256\").update(binary).digest(\"hex\").slice(0, 16);\n  const path = `/tmp/mikan-pi-env-${digest}`;\n  await new Promise<void>((resolve, reject) => {\n    const child = execFile(\n      engine,\n      [\"exec\", \"-i\", container, \"sh\", \"-c\", INSTALL_DAEMON, \"sh\", path],\n      (error) => (error ? reject(error) : resolve()),\n    );\n    child.stdin?.on(\"error\", () => {});\n    child.stdin?.end(binary);\n  });\n  return path;\n}\n\ninterface ContainerConnection {\n  connection: Connection;\n  ensureReady: () => Promise<void>;\n}\n\nconst connections = new Map<string, ContainerConnection>();\n\nfunction containerConnection(\n  configuredEngine: string | undefined,\n  container: string,\n  ensureReady: () => Promise<void>,\n): Connection {\n  const key = `${configuredEngine ?? \"\"}\\0${container}`;\n  const existing = connections.get(key);\n  if (existing) {\n    existing.ensureReady = ensureReady;\n    return existing.connection;\n  }\n  const entry: ContainerConnection = {\n    ensureReady,\n    connection: new Connection({\n      command: async () => {\n        await entry.ensureReady();\n        const engine = configuredEngine ?? containerEngine();\n        return [engine, \"exec\", \"-i\", container, await deployDaemon(engine, container)];\n      },\n      onLog: (text) => log.logWarning(`Sandbox ${container}`, text.trim()),\n    }),\n  };\n  connections.set(key, entry);\n  return entry.connection;\n}\n\nconst PATH_ONLY = new Set<PropertyKey>([\"absolutePath\", \"joinPath\"]);\n\nfunction readiedEnv(\n  env: RemoteExecutionEnv,\n  ensureReady: () => Promise<void>,\n  markUsed: () => void,\n): ExecutionEnv {\n  let ready: Promise<void> | undefined;\n  const before = async () => {\n    ready ??= ensureReady().catch((error: unknown) => {\n      ready = undefined;\n      throw error;\n    });\n    await ready;\n    markUsed();\n  };\n  return new Proxy(env, {\n    get(target, property, receiver) {\n      const value: unknown = Reflect.get(target, property, receiver);\n      if (typeof value !== \"function\") return value;\n      if (PATH_ONLY.has(property)) return value.bind(target);\n      return async (...args: unknown[]) => {\n        try {\n          await before();\n        } catch (error) {\n          const message = errorMessage(error);\n          if (property === \"cleanup\") return undefined;\n          return err(\n            property === \"exec\"\n              ? new ExecutionError(\"unknown\", message)\n              : new FileError(\"unknown\", message),\n          );\n        }\n        return Reflect.apply(value, target, args);\n      };\n    },\n  });\n}\n\nexport function createContainerExecutionEnv(options: ContainerExecutionEnvOptions): ExecutionEnv {\n  const ensureReady =\n    options.ensureReady ??\n    (() => ensureContainerRunning(options.container, options.engine ?? containerEngine()));\n  const env = new RemoteExecutionEnv({\n    connection: containerConnection(options.engine, options.container, ensureReady),\n    id: `container:${options.container}`,\n    cwd: options.cwd,\n    shellEnv: withGitHubCredentialHelper(options.env),\n  });\n  return readiedEnv(env, ensureReady, options.markUsed ?? (() => {}));\n}\n\nexport const containerSandboxAdapter: SandboxAdapter<ContainerSandboxConfig> = {\n  type: \"container\",\n  credentials: { env: true, fileMounts: false },\n  workspace: { managedProjection: false },\n  parse: parseContainerSandboxArg,\n  validate: validateContainerSandbox,\n  createEnv: (config, options) =>\n    createContainerExecutionEnv({ ...options, container: config.container }),\n};\n\nasync function ensureContainerRunning(container: string, engine: string): Promise<void> {\n  try {\n    const running = await execSimple(engine, [\"inspect\", \"-f\", \"{{.State.Running}}\", container]);\n    if (running.trim() === \"true\") {\n      return;\n    }\n    await execSimple(engine, [\"start\", container]);\n  } catch (error) {\n    const details = errorMessage(error);\n    throw new Error(\n      `Container \"${container}\" is not available. ` +\n        `Expected a pre-existing container or image provisioning to keep it running.\\n${details}`.trim(),\n      { cause: error },\n    );\n  }\n}\n"]}

package/dist/sandbox/engine.d.ts

@@ -0,0 +1,4 @@
+export type EngineState = "running" | "installed" | "missing";
+export declare function detectContainerEngine(probe?: (engine: string) => EngineState): string;
+export declare function containerEngine(): string;
+//# sourceMappingURL=engine.d.ts.map

package/dist/sandbox/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/sandbox/engine.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAQ9D,wBAAgB,qBAAqB,CACnC,KAAK,GAAE,CAAC,MAAM,EAAE,MAAM,KAAK,WAAyB,GACnD,MAAM,CAQR;AAID,wBAAgB,eAAe,IAAI,MAAM,CAKxC"}

package/dist/sandbox/engine.js

@@ -0,0 +1,30 @@
+import { spawnSync } from "node:child_process";
+import { readEnv } from "../env-manifest.js";
+const CONTAINER_ENGINE_PRIORITY = ["nerdctl", "podman", "docker"];
+const ENGINE_PROBE_TIMEOUT_MS = 15_000;
+function probeEngine(engine) {
+    const result = spawnSync(engine, ["info"], { stdio: "ignore", timeout: ENGINE_PROBE_TIMEOUT_MS });
+    if (result.error && "code" in result.error && result.error.code === "ENOENT")
+        return "missing";
+    return result.status === 0 ? "running" : "installed";
+}
+export function detectContainerEngine(probe = probeEngine) {
+    let firstInstalled;
+    for (const engine of CONTAINER_ENGINE_PRIORITY) {
+        const state = probe(engine);
+        if (state === "running")
+            return engine;
+        if (state === "installed")
+            firstInstalled ??= engine;
+    }
+    return firstInstalled ?? "docker";
+}
+let detected;
+export function containerEngine() {
+    const configured = readEnv("CONTAINER_ENGINE");
+    if (configured)
+        return configured;
+    detected ??= detectContainerEngine();
+    return detected;
+}
+//# sourceMappingURL=engine.js.map

package/dist/sandbox/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/sandbox/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,MAAM,yBAAyB,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAE3E,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAIvC,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAClG,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/F,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAK,GAAoC,WAAW;IAEpD,IAAI,cAAkC,CAAC;IACvC,KAAK,MAAM,MAAM,IAAI,yBAAyB,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACvC,IAAI,KAAK,KAAK,WAAW;YAAE,cAAc,KAAK,MAAM,CAAC;IACvD,CAAC;IACD,OAAO,cAAc,IAAI,QAAQ,CAAC;AACpC,CAAC;AAED,IAAI,QAA4B,CAAC;AAEjC,MAAM,UAAU,eAAe;IAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;IACrC,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import { spawnSync } from \"node:child_process\";\nimport { readEnv } from \"../env-manifest.js\";\n\nconst CONTAINER_ENGINE_PRIORITY = [\"nerdctl\", \"podman\", \"docker\"] as const;\n\nconst ENGINE_PROBE_TIMEOUT_MS = 15_000;\n\nexport type EngineState = \"running\" | \"installed\" | \"missing\";\n\nfunction probeEngine(engine: string): EngineState {\n  const result = spawnSync(engine, [\"info\"], { stdio: \"ignore\", timeout: ENGINE_PROBE_TIMEOUT_MS });\n  if (result.error && \"code\" in result.error && result.error.code === \"ENOENT\") return \"missing\";\n  return result.status === 0 ? \"running\" : \"installed\";\n}\n\nexport function detectContainerEngine(\n  probe: (engine: string) => EngineState = probeEngine,\n): string {\n  let firstInstalled: string | undefined;\n  for (const engine of CONTAINER_ENGINE_PRIORITY) {\n    const state = probe(engine);\n    if (state === \"running\") return engine;\n    if (state === \"installed\") firstInstalled ??= engine;\n  }\n  return firstInstalled ?? \"docker\";\n}\n\nlet detected: string | undefined;\n\nexport function containerEngine(): string {\n  const configured = readEnv(\"CONTAINER_ENGINE\");\n  if (configured) return configured;\n  detected ??= detectContainerEngine();\n  return detected;\n}\n"]}

package/dist/sandbox/host.d.ts

@@ -1,12 +1,3 @@
-import type { ExecOptions, ExecResult, Executor, HostSandboxConfig, RuntimePathContext, SandboxAdapter } from "./types.js";
-export declare class HostExecutor implements Executor {
-    exec(command: string, options?: ExecOptions): Promise<ExecResult>;
-    readFile(path: string): Promise<string>;
-    readFileBase64(path: string): Promise<string>;
-    writeFile(path: string, content: string): Promise<void>;
-    getWorkspacePath(hostPath: string): string;
-    getPathContext(hostWorkspaceRoot: string): RuntimePathContext;
-    getSandboxConfig(): HostSandboxConfig;
-}
+import type { HostSandboxConfig, SandboxAdapter } from "./types.js";
 export declare const hostSandboxAdapter: SandboxAdapter<HostSandboxConfig>;
 //# sourceMappingURL=host.d.ts.map

package/dist/sandbox/host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/sandbox/host.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACf,MAAM,YAAY,CAAC;AAiBpB,qBAAa,YAAa,YAAW,QAAQ;IACrC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAsCtE;IAEK,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE5C;IAEK,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAElD;IAEK,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5D;IAED,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzC;IAED,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,kBAAkB,CAE5D;IAED,gBAAgB,IAAI,iBAAiB,CAEpC;CACF;AAsBD,eAAO,MAAM,kBAAkB,EAAE,cAAc,CAAC,iBAAiB,CAMhE,CAAC"}
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/sandbox/host.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AASpE,eAAO,MAAM,kBAAkB,EAAE,cAAc,CAAC,iBAAiB,CAMhE,CAAC"}

package/dist/sandbox/host.js

@@ -1,92 +1,15 @@
-import { spawn } from "node:child_process";
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
-import { createMountedRuntimePathContext, killProcessTree, linkAbortSignal } from "./utils.js";
-const MAX_CAPTURE_CHARS = 10 * 1024 * 1024;
+import { NodeExecutionEnv } from "@earendil-works/pi-durable/env/node";
 function parseHostSandboxArg(value) {
     if (value === "host") {
         return { type: "host" };
     }
     return undefined;
 }
-export class HostExecutor {
-    async exec(command, options) {
-        return new Promise((resolve, reject) => {
-            const child = spawnShell(command, options?.cwd);
-            const capture = captureOutput(child);
-            let timedOut = false;
-            const timeoutHandle = options?.timeout && options.timeout > 0
-                ? setTimeout(() => {
-                    timedOut = true;
-                    killProcessTree(child.pid);
-                }, options.timeout * 1000)
-                : undefined;
-            const unlinkSignal = linkAbortSignal(options?.signal, () => {
-                if (child.pid)
-                    killProcessTree(child.pid);
-            });
-            child.on("close", (code) => {
-                if (timeoutHandle)
-                    clearTimeout(timeoutHandle);
-                unlinkSignal();
-                const { stdout, stderr } = capture;
-                if (options?.signal?.aborted) {
-                    reject(new Error(`${stdout}\n${stderr}\nCommand aborted`.trim()));
-                    return;
-                }
-                if (timedOut) {
-                    reject(new Error(`${stdout}\n${stderr}\nCommand timed out after ${options?.timeout} seconds`.trim()));
-                    return;
-                }
-                resolve({ stdout, stderr, code: code ?? 0 });
-            });
-        });
-    }
-    async readFile(path) {
-        return readFile(path, "utf-8");
-    }
-    async readFileBase64(path) {
-        return (await readFile(path)).toString("base64");
-    }
-    async writeFile(path, content) {
-        await mkdir(dirname(path), { recursive: true });
-        const stage = `${path}.mikan-stage`;
-        await writeFile(stage, content, "utf-8");
-        await rename(stage, path);
-    }
-    getWorkspacePath(hostPath) {
-        return hostPath;
-    }
-    getPathContext(hostWorkspaceRoot) {
-        return createMountedRuntimePathContext(hostWorkspaceRoot, hostWorkspaceRoot);
-    }
-    getSandboxConfig() {
-        return { type: "host" };
-    }
-}
-function spawnShell(command, cwd) {
-    const isWindows = process.platform === "win32";
-    return spawn(isWindows ? "cmd" : "sh", [isWindows ? "/c" : "-c", command], {
-        detached: true,
-        stdio: ["ignore", "pipe", "pipe"],
-        cwd: cwd ? cwd : undefined,
-    });
-}
-function captureOutput(child) {
-    const capture = { stdout: "", stderr: "" };
-    for (const stream of ["stdout", "stderr"]) {
-        child[stream]?.setEncoding("utf8");
-        child[stream]?.on("data", (chunk) => {
-            capture[stream] = (capture[stream] + chunk).slice(0, MAX_CAPTURE_CHARS);
-        });
-    }
-    return capture;
-}
 export const hostSandboxAdapter = {
     type: "host",
     credentials: { env: false, fileMounts: false },
     workspace: { managedProjection: false },
     parse: parseHostSandboxArg,
-    createExecutor: () => new HostExecutor(),
+    createEnv: (_config, options) => new NodeExecutionEnv({ cwd: options.cwd }),
 };
 //# sourceMappingURL=host.js.map

package/dist/sandbox/host.js.map

@@ -1 +1 @@
-{"version":3,"file":"host.js","sourceRoot":"","sources":["../../src/sandbox/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,OAAO,EAAE,+BAA+B,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE/F,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAO3C,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,YAAY;IACvB,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqB;QAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,aAAa,GACjB,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC;gBACrC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;oBACd,QAAQ,GAAG,IAAI,CAAC;oBAChB,eAAe,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;gBAC9B,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC5B,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE;gBACzD,IAAI,KAAK,CAAC,GAAG;oBAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC/C,YAAY,EAAE,CAAC;gBAEf,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;gBACnC,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,KAAK,MAAM,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAClE,OAAO;gBACT,CAAC;gBACD,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,MAAM,KAAK,MAAM,6BAA6B,OAAO,EAAE,OAAO,UAAU,CAAC,IAAI,EAAE,CACnF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QAC3C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,GAAG,IAAI,cAAc,CAAC;QACpC,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,cAAc,CAAC,iBAAyB;QACtC,OAAO,+BAA+B,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAC/E,CAAC;IAED,gBAAgB;QACd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;CACF;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,GAAY;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC/C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;QACzE,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAmB;IACxC,MAAM,OAAO,GAAY,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpD,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACnD,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC1C,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAsC;IACnE,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;IAC9C,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACvC,KAAK,EAAE,mBAAmB;IAC1B,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,EAAE;CACzC,CAAC","sourcesContent":["import { type ChildProcess, spawn } from \"node:child_process\";\nimport { mkdir, readFile, rename, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport type {\n  ExecOptions,\n  ExecResult,\n  Executor,\n  HostSandboxConfig,\n  RuntimePathContext,\n  SandboxAdapter,\n} from \"./types.js\";\nimport { createMountedRuntimePathContext, killProcessTree, linkAbortSignal } from \"./utils.js\";\n\nconst MAX_CAPTURE_CHARS = 10 * 1024 * 1024;\n\ninterface Capture {\n  stdout: string;\n  stderr: string;\n}\n\nfunction parseHostSandboxArg(value: string): HostSandboxConfig | undefined {\n  if (value === \"host\") {\n    return { type: \"host\" };\n  }\n  return undefined;\n}\n\nexport class HostExecutor implements Executor {\n  async exec(command: string, options?: ExecOptions): Promise<ExecResult> {\n    return new Promise((resolve, reject) => {\n      const child = spawnShell(command, options?.cwd);\n      const capture = captureOutput(child);\n      let timedOut = false;\n\n      const timeoutHandle =\n        options?.timeout && options.timeout > 0\n          ? setTimeout(() => {\n              timedOut = true;\n              killProcessTree(child.pid!);\n            }, options.timeout * 1000)\n          : undefined;\n\n      const unlinkSignal = linkAbortSignal(options?.signal, () => {\n        if (child.pid) killProcessTree(child.pid);\n      });\n\n      child.on(\"close\", (code) => {\n        if (timeoutHandle) clearTimeout(timeoutHandle);\n        unlinkSignal();\n\n        const { stdout, stderr } = capture;\n        if (options?.signal?.aborted) {\n          reject(new Error(`${stdout}\\n${stderr}\\nCommand aborted`.trim()));\n          return;\n        }\n        if (timedOut) {\n          reject(\n            new Error(\n              `${stdout}\\n${stderr}\\nCommand timed out after ${options?.timeout} seconds`.trim(),\n            ),\n          );\n          return;\n        }\n        resolve({ stdout, stderr, code: code ?? 0 });\n      });\n    });\n  }\n\n  async readFile(path: string): Promise<string> {\n    return readFile(path, \"utf-8\");\n  }\n\n  async readFileBase64(path: string): Promise<string> {\n    return (await readFile(path)).toString(\"base64\");\n  }\n\n  async writeFile(path: string, content: string): Promise<void> {\n    await mkdir(dirname(path), { recursive: true });\n    const stage = `${path}.mikan-stage`;\n    await writeFile(stage, content, \"utf-8\");\n    await rename(stage, path);\n  }\n\n  getWorkspacePath(hostPath: string): string {\n    return hostPath;\n  }\n\n  getPathContext(hostWorkspaceRoot: string): RuntimePathContext {\n    return createMountedRuntimePathContext(hostWorkspaceRoot, hostWorkspaceRoot);\n  }\n\n  getSandboxConfig(): HostSandboxConfig {\n    return { type: \"host\" };\n  }\n}\n\nfunction spawnShell(command: string, cwd?: string): ChildProcess {\n  const isWindows = process.platform === \"win32\";\n  return spawn(isWindows ? \"cmd\" : \"sh\", [isWindows ? \"/c\" : \"-c\", command], {\n    detached: true,\n    stdio: [\"ignore\", \"pipe\", \"pipe\"],\n    cwd: cwd ? cwd : undefined,\n  });\n}\n\nfunction captureOutput(child: ChildProcess): Capture {\n  const capture: Capture = { stdout: \"\", stderr: \"\" };\n  for (const stream of [\"stdout\", \"stderr\"] as const) {\n    child[stream]?.setEncoding(\"utf8\");\n    child[stream]?.on(\"data\", (chunk: string) => {\n      capture[stream] = (capture[stream] + chunk).slice(0, MAX_CAPTURE_CHARS);\n    });\n  }\n  return capture;\n}\n\nexport const hostSandboxAdapter: SandboxAdapter<HostSandboxConfig> = {\n  type: \"host\",\n  credentials: { env: false, fileMounts: false },\n  workspace: { managedProjection: false },\n  parse: parseHostSandboxArg,\n  createExecutor: () => new HostExecutor(),\n};\n"]}
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../src/sandbox/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAGvE,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAsC;IACnE,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;IAC9C,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACvC,KAAK,EAAE,mBAAmB;IAC1B,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;CAC5E,CAAC","sourcesContent":["import { NodeExecutionEnv } from \"@earendil-works/pi-durable/env/node\";\nimport type { HostSandboxConfig, SandboxAdapter } from \"./types.js\";\n\nfunction parseHostSandboxArg(value: string): HostSandboxConfig | undefined {\n  if (value === \"host\") {\n    return { type: \"host\" };\n  }\n  return undefined;\n}\n\nexport const hostSandboxAdapter: SandboxAdapter<HostSandboxConfig> = {\n  type: \"host\",\n  credentials: { env: false, fileMounts: false },\n  workspace: { managedProjection: false },\n  parse: parseHostSandboxArg,\n  createEnv: (_config, options) => new NodeExecutionEnv({ cwd: options.cwd }),\n};\n"]}

package/dist/sandbox/provisioner.d.ts

@@ -9,12 +9,19 @@ export declare class DockerContainerManager {
     private static readonly VAULT_ID_LABEL_KEY;
     private static readonly CONVERSATION_ID_LABEL_KEY;
     private static readonly MOUNT_SIGNATURE_LABEL_KEY;
+    private static readonly NETWORK_LABEL_KEY;
+    private static readonly IMAGE_ID_LABEL_KEY;
     private readonly limits?;
     private readonly boostLimits?;
     private readonly boostedKeys;
     private readonly overrideLimits;
     private readonly execFileImpl;
+    private readonly configuredEngine;
+    private readonly timeZone;
+    private imagePull?;
     constructor(image: string, options?: DockerContainerManagerOptions);
+    private get engine();
+    private run;
     static containerName(containerKey: string): string;
     static networkName(containerKey: string): string;
     private serialize;
@@ -25,6 +32,7 @@ export declare class DockerContainerManager {
     getLimitStatus(containerKey: string): SandboxLimitStatus;
     getDefaultLimits(): ResourceLimits | undefined;
     getBoostLimits(): ResourceLimits | undefined;
+    markUsed(containerKey: string): void;
     stop(containerKey: string): Promise<void>;
     private stopInner;
     remove(containerKey: string): Promise<void>;
@@ -46,18 +54,25 @@ export declare class DockerContainerManager {
     private hasMountSignatureDrift;
     private mountSignature;
     private mountSourceFingerprint;
+    private label;
     private inspectBindMounts;
     private hasImageDrift;
     private localImageId;
+    prepareImage(): Promise<void>;
+    private pullImage;
+    private imageLeftBehind;
+    private isUnnamedImage;
+    private removeImageIfUnused;
+    private pulledImageId;
     private replaceContainer;
     private hasNetworkModeDrift;
     private ensureNetwork;
+    private containerExists;
     private inspectStatus;
     private listContainerNamesByLabel;
     private parseNameLines;
     private inspectContainerDetails;
     private normalizeDockerValue;
-    private parseDockerTimestamp;
     private containerKeyFromContainerName;
     private forceRemoveContainer;
 }

package/dist/sandbox/provisioner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../../src/sandbox/provisioner.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAEV,6BAA6B,EAC7B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAKrB,qBAAa,sBAAsB;IAiB/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAhBxB,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,SAAS,CAAuC;IACxD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAwB;IAC7D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAyB;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAoB;IAC9D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAE5E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAiB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqC;IACpE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiB;IAE9C,YACmB,KAAK,EAAE,MAAM,EAC9B,OAAO,GAAE,6BAAkC,EAK5C;IAED,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjD;IAED,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/C;IAED,OAAO,CAAC,SAAS;IAWX,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAWrF;YAEa,cAAc;IAgCtB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAY7D;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQzF;IAED,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAGvD;IAED,gBAAgB,IAAI,cAAc,GAAG,SAAS,CAE7C;IAED,cAAc,IAAI,cAAc,GAAG,SAAS,CAE3C;IAED,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAExC;YAEa,SAAS;IAavB,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;YAEa,WAAW;IAyBnB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/C;IAEK,SAAS,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkCpD;IAED,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,UAAU;YAIJ,YAAY;IAkD1B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;YAUX,mBAAmB;YA2BnB,YAAY;IAa1B,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,SAAS;YAQH,sBAAsB;IAgBpC,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,sBAAsB;YAYhB,iBAAiB;YAqBjB,aAAa;YAYb,YAAY;YAeZ,gBAAgB;YAehB,mBAAmB;YAWnB,aAAa;YAwBb,aAAa;YAeb,yBAAyB;IAmBvC,OAAO,CAAC,cAAc;YAOR,uBAAuB;IAuBrC,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,6BAA6B;YAOvB,oBAAoB;CAgBnC"}
+{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../../src/sandbox/provisioner.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAEV,6BAA6B,EAC7B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAKrB,qBAAa,sBAAsB;IAsB/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IArBxB,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,SAAS,CAAuC;IACxD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAwB;IAC7D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAyB;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAoB;IAC9D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAA2B;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAmB;IAC5D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAoB;IAE9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAiB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqC;IACpE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiB;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,SAAS,CAAC,CAAgB;IAElC,YACmB,KAAK,EAAE,MAAM,EAC9B,OAAO,GAAE,6BAAkC,EAO5C;IAED,OAAO,KAAK,MAAM,GAEjB;IAED,OAAO,CAAC,GAAG;IAIX,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjD;IAED,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/C;IAED,OAAO,CAAC,SAAS;IAWX,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAWrF;YAEa,cAAc;IAkCtB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAY7D;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQzF;IAED,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAGvD;IAED,gBAAgB,IAAI,cAAc,GAAG,SAAS,CAE7C;IAED,cAAc,IAAI,cAAc,GAAG,SAAS,CAE3C;IAED,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAGnC;IAED,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAExC;YAEa,SAAS;IAavB,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;YAEa,WAAW;IAyBnB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/C;IAEK,SAAS,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BpD;IAED,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,UAAU;YAIJ,YAAY;IAyD1B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;YAUX,mBAAmB;YA2BnB,YAAY;IAa1B,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,SAAS;YAQH,sBAAsB;IAYpC,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,sBAAsB;YAYhB,KAAK;YAUL,iBAAiB;YAOjB,aAAa;YAMb,YAAY;IAS1B,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAG5B;YAEa,SAAS;YAYT,eAAe;YAef,cAAc;YASd,mBAAmB;YASnB,aAAa;YAUb,gBAAgB;YAehB,mBAAmB;YAKnB,aAAa;YA2Bb,eAAe;YAYf,aAAa;YAMb,yBAAyB;IAmBvC,OAAO,CAAC,cAAc;YAOR,uBAAuB;IA0BrC,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,6BAA6B;YAOvB,oBAAoB;CAiBnC"}