@gentbajko/slopify 1.5.0 → 2.0.0

package/dist/edge/docker-projects/recover.js

@@ -0,0 +1,100 @@
+import { join } from "node:path";
+import { readCommittedJournal } from "./committed.js";
+import { selectProjects, writeState, } from "./state.js";
+import { assertIdentity, assertWritableTree, identity, isMissing, treeDigest } from "./tree.js";
+export async function assertSourceIdentity(j) {
+    if (j.sourceBind === null)
+        return;
+    if (!j.sourceIdentity)
+        throw new Error("Original project bind identity is missing.");
+    await assertIdentity(j.sourceBind, j.sourceIdentity);
+}
+export async function recoverInstallation(c, j, receipt, e) {
+    const directory = join(c.directory, j.id);
+    if (j.name !== c.name || j.volume !== c.volume)
+        throw new Error("Journal installation conflict.");
+    if (receipt?.transaction === j.id) {
+        const current = await e.inspect(c.name);
+        await selectProjects({ ...c, projectsOverride: null }, receipt, current);
+        await assertWritableTree(receipt.projects, c.uid);
+        j = await readCommittedJournal(c, receipt, current);
+        await e.writers(c.volume, [receipt.projects], current ? [current.id] : []);
+        await writeState(join(directory, "activation.json"), {
+            version: 1,
+            token: j.token,
+            committed: true,
+        });
+        if (current && current.installation === j.installation && current.signature === j.signature) {
+            await e.command(["update", "--restart=always", current.id]);
+            if (!current.running)
+                await e.command(["start", current.id]);
+        }
+        const finished = { ...j, phase: "committed" };
+        await writeState(join(c.directory, "journal.json"), finished);
+        return finished;
+    }
+    if (j.phase === "rolled-back")
+        return j;
+    await assertSourceIdentity(j);
+    const occupant = await e.inspect(c.name);
+    if (j.phase === "verified" && j.stagingIdentity && j.sourceDigest) {
+        const found = await identity(j.destination).catch((error) => {
+            if (isMissing(error))
+                return null;
+            throw error;
+        });
+        if (found?.dev === j.stagingIdentity.dev &&
+            found.ino === j.stagingIdentity.ino &&
+            (await treeDigest(j.destination)).hash === j.sourceDigest.hash) {
+            j = { ...j, publishedIdentity: found };
+        }
+    }
+    const possible = j.candidate ? await e.inspect(j.candidate) : occupant;
+    if (occupant && occupant.id !== j.previous?.id && occupant.id !== possible?.id)
+        throw new Error("Recovery name is occupied by an unrelated container.");
+    if (possible && possible.id !== j.previous?.id) {
+        const transaction = await e.command([
+            "inspect",
+            "--format",
+            '{{index .Config.Labels "io.slopify.transaction"}}',
+            possible.id,
+        ]);
+        if (transaction !== j.id ||
+            possible.installation !== j.installation ||
+            possible.signature !== j.signature)
+            throw new Error("Recovery name is occupied by an unrelated container.");
+        if (j.candidate !== possible.id) {
+            j = { ...j, candidate: possible.id };
+            await writeState(join(c.directory, "journal.json"), j);
+            await writeState(join(directory, "journal.json"), j);
+        }
+        await e.stop(possible);
+        const failedName = `${c.name}-failed-${j.id}`;
+        if (possible.name !== failedName)
+            await e.command(["rename", possible.id, failedName]);
+    }
+    if (j.phase !== "restored") {
+        if (j.backupDigest) {
+            await e.writers(c.volume, [j.destination, ...(j.sourceBind ? [j.sourceBind] : [])], []);
+            await e.restore(j);
+        }
+        j = { ...j, phase: "restored" };
+        await writeState(join(c.directory, "journal.json"), j);
+        await writeState(join(directory, "journal.json"), j);
+    }
+    if (j.previous) {
+        const old = await e.inspect(j.previous.id);
+        if (!old || old.mounts.find((m) => m.destination === "/data")?.name !== c.volume)
+            throw new Error("Original container/storage is missing; automatic rollback is unsafe.");
+        if (j.previousReceipt)
+            await selectProjects({ ...c, projectsOverride: null }, j.previousReceipt, old);
+        if (j.sourceBind !== null)
+            await assertWritableTree(j.sourceBind, c.uid);
+        await e.writers(c.volume, [j.destination, ...(j.sourceBind ? [j.sourceBind] : [])], [old.id]);
+        await e.restart(j.previous);
+    }
+    const rolledBack = { ...j, phase: "rolled-back" };
+    await writeState(join(c.directory, "journal.json"), rolledBack);
+    await writeState(join(directory, "journal.json"), rolledBack);
+    return rolledBack;
+}

package/dist/edge/docker-projects/state.js

@@ -0,0 +1,221 @@
+import { lstat, mkdir, readdir } from "node:fs/promises";
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { z } from "zod";
+import { privateRead, privateWrite } from "../../host-cli/service.js";
+import { assertIdentity, contains, isMissing, safePath, syncDirectory, treeDigest, } from "./tree.js";
+const identifier = z
+    .string()
+    .min(1)
+    .max(128)
+    .regex(/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/);
+const absolute = z
+    .string()
+    .min(1)
+    .max(4096)
+    .refine((p) => isAbsolute(p) && resolve(p) === p && !/[\p{Cc},]/u.test(p));
+export const identitySchema = z.object({ dev: z.string(), ino: z.string() }).strict();
+export const digestSchema = z
+    .object({
+    hash: z.string().regex(/^[a-f0-9]{64}$/),
+    files: z.number().int().nonnegative(),
+    bytes: z.number().int().nonnegative(),
+})
+    .strict();
+export const containerSchema = z
+    .object({
+    id: z.string(),
+    name: z.string(),
+    image: z.string(),
+    user: z.string(),
+    running: z.boolean(),
+    restart: z.object({ Name: z.string(), MaximumRetryCount: z.number().int() }),
+    signature: z.string().nullable(),
+    installation: z.string().nullable(),
+    mounts: z.array(z.object({
+        type: z.string(),
+        name: z.string(),
+        source: z.string(),
+        destination: z.string(),
+        rw: z.boolean(),
+    })),
+    port: z.string().nullable(),
+})
+    .strict();
+export const receiptSchema = z
+    .object({
+    version: z.literal(1),
+    installation: z.string().uuid(),
+    daemon: z.string(),
+    name: identifier,
+    volume: identifier,
+    volumeIdentity: z.string(),
+    projects: absolute,
+    directoryIdentity: identitySchema,
+    user: z.string(),
+    image: z.string(),
+    signature: z.string(),
+    transaction: z.string().uuid(),
+})
+    .strict();
+export const phases = [
+    "prepared",
+    "stopping",
+    "stopped",
+    "snapshot",
+    "copying",
+    "verified",
+    "published",
+    "starting",
+    "healthy",
+    "committed",
+    "restored",
+    "rolled-back",
+];
+export const journalSchema = z
+    .object({
+    version: z.literal(1),
+    id: z.string().uuid(),
+    installation: z.string().uuid(),
+    daemon: z.string(),
+    name: identifier,
+    volume: identifier,
+    volumeIdentity: z.string().nullable(),
+    image: z.string(),
+    user: z.string(),
+    signature: z.string(),
+    phase: z.enum(phases),
+    previous: containerSchema.nullable(),
+    previousReceipt: receiptSchema.nullable(),
+    sourceBind: absolute.nullable(),
+    sourceIdentity: identitySchema.nullable().default(null),
+    destination: absolute,
+    destinationBefore: identitySchema.nullable(),
+    staging: absolute,
+    stagingIdentity: identitySchema.nullable(),
+    publishedIdentity: identitySchema.nullable(),
+    sourceDigest: digestSchema.nullable(),
+    sourceAbsent: z.boolean().default(false),
+    backup: z
+        .string()
+        .max(174)
+        .regex(/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/),
+    backupDigest: digestSchema.nullable(),
+    candidate: z.string().nullable(),
+    token: z.string().regex(/^[a-f0-9]{64}$/),
+})
+    .strict();
+export function dockerConfig(env, home, cwd, uid, gid) {
+    const name = identifier.parse(env.SLOPIFY_DOCKER_NAME || "slopify");
+    const volume = identifier.parse(env.SLOPIFY_DOCKER_VOLUME || "slopify-data");
+    const root = join(absolute.parse(env.XDG_DATA_HOME || join(home, ".local/share")), "slopify/docker");
+    const raw = env.SLOPIFY_DOCKER_PROJECTS_DIR || null;
+    const projectsOverride = raw === null ? null : resolve(cwd, raw.startsWith("~/") ? join(home, raw.slice(2)) : raw);
+    const portText = env.SLOPIFY_DOCKER_HOST_PORT || "6969";
+    if (!/^\d{1,5}$/.test(portText) || Number(portText) > 65535)
+        throw new Error("Docker host port must be from 0 to 65535.");
+    return {
+        home,
+        uid,
+        gid,
+        root,
+        directory: join(root, name),
+        name,
+        volume,
+        image: z
+            .string()
+            .min(1)
+            .refine((s) => !/[\p{Cc}]/u.test(s))
+            .parse(env.SLOPIFY_DOCKER_IMAGE || "ghcr.io/gentbajko/slopify:latest"),
+        port: Number(portText),
+        projectsOverride,
+        bridge: env.SLOPIFY_HOST_CLI_DIR || null,
+    };
+}
+export async function privateDirectory(path, uid) {
+    absolute.parse(path);
+    let current = sep;
+    for (const name of path.split(sep).filter(Boolean)) {
+        current = join(current, name);
+        await mkdir(current, { mode: 0o700 }).catch((error) => {
+            if (!(typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST"))
+                throw error;
+        });
+        const s = await lstat(current);
+        if (!s.isDirectory() ||
+            s.isSymbolicLink() ||
+            ((s.mode & 0o022) !== 0 && (s.mode & 0o1000) === 0))
+            throw new Error("Unsafe private state ancestor.");
+    }
+    const s = await lstat(path);
+    if (s.uid !== uid || (s.mode & 0o077) !== 0)
+        throw new Error("Installation state must be private and owned by the installing user.");
+}
+export async function readState(path, schema, uid) {
+    const s = await lstat(path).catch((error) => {
+        if (isMissing(error))
+            return undefined;
+        throw error;
+    });
+    if (s === undefined)
+        return null;
+    if (!s.isFile() || s.isSymbolicLink() || s.nlink !== 1 || s.uid !== uid || (s.mode & 0o077) !== 0)
+        throw new Error("Unsafe private installation record.");
+    const text = await privateRead(path, uid);
+    if (text === undefined)
+        throw new Error("Installation record changed while reading.");
+    return schema.parse(JSON.parse(text));
+}
+export async function writeState(path, value) {
+    const text = JSON.stringify(value);
+    if (Buffer.byteLength(text) > 64 * 1024)
+        throw new Error("Installation control record exceeds 64 KiB.");
+    await privateWrite(path, text);
+    await syncDirectory(dirname(path));
+}
+export async function selectProjects(c, receipt, old, retry = null) {
+    const data = old?.mounts.find((m) => m.destination === "/data");
+    const bind = old?.mounts.find((m) => m.destination === "/data/projects");
+    if (old && (data?.type !== "volume" || data.name !== c.volume))
+        throw new Error("Existing container uses a different data volume.");
+    if (bind && (bind.type !== "bind" || !bind.rw))
+        throw new Error("Unsupported existing projects mount.");
+    if (old?.mounts.some((m) => m.destination.startsWith("/data/") && m.destination !== "/data/projects"))
+        throw new Error("Unexpected nested data mount; use the existing installation for recovery.");
+    if (receipt) {
+        if (receipt.name !== c.name || receipt.volume !== c.volume)
+            throw new Error("Receipt selects a different installation or volume.");
+        await safePath(receipt.projects, c.home, c.root, false);
+        await assertIdentity(receipt.projects, receipt.directoryIdentity).catch((cause) => {
+            throw new Error(`Remembered project folder is missing or replaced: ${receipt.projects}`, {
+                cause,
+            });
+        });
+        if (old && (bind?.source !== receipt.projects || old.installation !== receipt.installation))
+            throw new Error("Actual container mounts/installation disagree with its receipt.");
+    }
+    const chosen = c.projectsOverride ??
+        receipt?.projects ??
+        bind?.source ??
+        (c.name === "slopify"
+            ? join(c.home, "Slopify/Projects")
+            : join(c.home, "Slopify", c.name, "Projects"));
+    await safePath(chosen, c.home, c.root, true);
+    const source = receipt?.projects ?? bind?.source;
+    if (source && source !== chosen && (contains(source, chosen) || contains(chosen, source)))
+        throw new Error("Source and destination project folders cannot contain each other.");
+    if (chosen !== source) {
+        const entries = await readdir(chosen).catch((error) => {
+            if (isMissing(error))
+                return [];
+            throw error;
+        });
+        if (entries.length > 0) {
+            if (retry?.destination !== chosen || !retry.publishedIdentity || !retry.sourceDigest)
+                throw new Error(`Unrelated populated destination: ${chosen}`);
+            await assertIdentity(chosen, retry.publishedIdentity);
+            if ((await treeDigest(chosen)).hash !== retry.sourceDigest.hash)
+                throw new Error(`Published retry destination changed: ${chosen}`);
+        }
+    }
+    return chosen;
+}

package/dist/edge/docker-projects/tree.js

@@ -0,0 +1,170 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { chmod, lchown, lstat, mkdir, open, readdir, readlink } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+export async function identity(path) {
+    const s = await lstat(path, { bigint: true });
+    if (!s.isDirectory() || s.isSymbolicLink())
+        throw new Error("Unsafe directory identity.");
+    return { dev: String(s.dev), ino: String(s.ino) };
+}
+export async function assertIdentity(path, expected) {
+    const actual = await identity(path);
+    if (actual.dev !== expected.dev || actual.ino !== expected.ino)
+        throw new Error(`Directory identity changed: ${path}`);
+}
+export function contains(root, path) {
+    const r = relative(root, path);
+    return r === "" || (r !== ".." && !r.startsWith(`..${sep}`) && !isAbsolute(r));
+}
+export async function safePath(path, home, stateRoot, createParents) {
+    if (!isAbsolute(path) || resolve(path) !== path || /[\p{Cc},]/u.test(path))
+        throw new Error("Project directory must be a normal absolute path without commas/control characters.");
+    const forbidden = [
+        "/",
+        "/home",
+        "/root",
+        "/tmp",
+        "/var",
+        "/srv",
+        "/mnt",
+        "/media",
+        home,
+        join(home, "Slopify"),
+    ];
+    if (forbidden.includes(path) ||
+        contains(stateRoot, path) ||
+        contains(path, stateRoot) ||
+        ["/proc", "/sys", "/dev", "/etc", "/usr", "/bin", "/sbin", "/lib", "/var/lib/docker"].some((p) => contains(p, path)))
+        throw new Error("Unsafe broad or private project directory.");
+    const parts = path.split(sep).filter(Boolean);
+    let current = sep;
+    for (const [i, part] of parts.entries()) {
+        current = join(current, part);
+        let s = await lstat(current).catch((error) => {
+            if (isMissing(error))
+                return undefined;
+            throw error;
+        });
+        if (s === undefined && i < parts.length - 1 && createParents) {
+            await mkdir(current, { mode: 0o700 });
+            s = await lstat(current);
+        }
+        if (s === undefined)
+            continue;
+        if (!s.isDirectory() || s.isSymbolicLink())
+            throw new Error(`Unsafe path component: ${current}`);
+        if (i === parts.length - 1 && (s.uid !== process.getuid?.() || (s.mode & 0o022) !== 0))
+            throw new Error("Project directory must belong to the installing user and must not be publicly writable.");
+        if (i < parts.length - 1 && (s.mode & 0o022) !== 0 && (s.mode & 0o1000) === 0)
+            throw new Error(`Writable project ancestor: ${current}`);
+    }
+}
+export function isMissing(error) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+export async function syncDirectory(path) {
+    const fd = await open(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    try {
+        await fd.sync();
+    }
+    finally {
+        await fd.close();
+    }
+}
+export async function treeDigest(root, metadata = false, omitProjects = false) {
+    const hash = createHash("sha256");
+    let files = 0;
+    let bytes = 0;
+    async function walk(path, name) {
+        const before = await lstat(path, { bigint: true });
+        const meta = metadata
+            ? [String(before.uid), String(before.gid), Number(before.mode & 4095n)]
+            : [];
+        if (before.isDirectory()) {
+            hash.update(`${JSON.stringify([name, "directory", ...meta])}\n`);
+            for (const entry of (await readdir(path)).sort()) {
+                if (omitProjects && name === "" && entry === "projects")
+                    continue;
+                await walk(join(path, entry), name === "" ? entry : `${name}/${entry}`);
+            }
+        }
+        else if (before.isSymbolicLink() && metadata) {
+            hash.update(`${JSON.stringify([name, "symlink", await readlink(path), ...meta])}\n`);
+        }
+        else if (before.isFile() && (metadata || before.nlink === 1n)) {
+            const fd = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+            const content = createHash("sha256");
+            try {
+                const opened = await fd.stat({ bigint: true });
+                if (opened.dev !== before.dev || opened.ino !== before.ino)
+                    throw new Error("Source changed during verification.");
+                const buffer = Buffer.alloc(1024 * 1024);
+                let length = 0;
+                for (;;) {
+                    const result = await fd.read(buffer, 0, buffer.length, null);
+                    if (result.bytesRead === 0)
+                        break;
+                    length += result.bytesRead;
+                    content.update(buffer.subarray(0, result.bytesRead));
+                }
+                const after = await fd.stat({ bigint: true });
+                if (after.size !== before.size ||
+                    after.mtimeNs !== before.mtimeNs ||
+                    BigInt(length) !== before.size)
+                    throw new Error("Source changed during verification.");
+                files++;
+                bytes += length;
+                hash.update(`${JSON.stringify([name, "file", length, content.digest("hex"), ...meta])}\n`);
+            }
+            finally {
+                await fd.close();
+            }
+        }
+        else
+            throw new Error(`Unsafe project entry: ${name}`);
+        const after = await lstat(path, { bigint: true });
+        if (after.dev !== before.dev || after.ino !== before.ino || after.mtimeNs !== before.mtimeNs)
+            throw new Error("Source changed during verification.");
+    }
+    await walk(root, "");
+    return { hash: hash.digest("hex"), files, bytes };
+}
+export async function assertWritableTree(root, uid) {
+    const s = await lstat(root);
+    if (s.isSymbolicLink() ||
+        (!s.isDirectory() && !s.isFile()) ||
+        (s.isFile() && s.nlink !== 1) ||
+        s.uid !== uid ||
+        (s.mode & (s.isDirectory() ? 0o700 : 0o600)) !== (s.isDirectory() ? 0o700 : 0o600))
+        throw new Error(`Existing project permissions are incompatible with this host user: ${root}`);
+    if (s.isDirectory())
+        for (const name of await readdir(root))
+            await assertWritableTree(join(root, name), uid);
+}
+export async function privateTree(root, uid, gid) {
+    async function visit(path) {
+        const s = await lstat(path);
+        if (s.isSymbolicLink() || (!s.isDirectory() && !s.isFile()) || (s.isFile() && s.nlink !== 1))
+            throw new Error("Unsafe project entry during ownership setup.");
+        if (s.uid !== uid || s.gid !== gid)
+            await lchown(path, uid, gid);
+        await chmod(path, s.isDirectory() ? 0o700 : 0o600);
+        if (s.isDirectory()) {
+            for (const name of await readdir(path))
+                await visit(join(path, name));
+            await syncDirectory(path);
+        }
+        else {
+            const fd = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+            try {
+                await fd.sync();
+            }
+            finally {
+                await fd.close();
+            }
+        }
+    }
+    await visit(root);
+    await syncDirectory(dirname(root));
+}

package/dist/edge/docker-projects/volume.js

@@ -0,0 +1,95 @@
+import { execFileSync } from "node:child_process";
+import { chmod, lchown, lstat, mkdir, readdir, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { isMissing, syncDirectory, treeDigest } from "./tree.js";
+export async function volumeOperation(args) {
+    const [operation, user = "0:0"] = args;
+    if (operation === "projects") {
+        const present = await lstat("/source/projects").catch((e) => {
+            if (isMissing(e))
+                return null;
+            throw e;
+        });
+        if (present === null)
+            return { exists: false };
+        return { exists: true, digest: await treeDigest("/source/projects") };
+    }
+    if (operation === "private")
+        return treeDigest("/source", true, true);
+    if (operation === "snapshot") {
+        if ((await readdir("/backup")).length !== 0)
+            throw new Error("Recovery volume is not empty.");
+        const before = await treeDigest("/source", true);
+        execFileSync("cp", ["-a", "/source/.", "/backup/"], { stdio: "pipe" });
+        const copied = await treeDigest("/backup", true);
+        const after = await treeDigest("/source", true);
+        if (before.hash !== copied.hash || before.hash !== after.hash)
+            throw new Error("Private snapshot verification failed.");
+        execFileSync("sync", ["-f", "/backup"], { stdio: "pipe" });
+        await syncDirectory("/backup");
+        return treeDigest("/backup", true, true);
+    }
+    if (operation === "restore") {
+        const source = await treeDigest("/source", true, true);
+        for (const name of await readdir("/data")) {
+            if (name !== "projects")
+                await rm(join("/data", name), { recursive: true, force: true });
+        }
+        for (const name of await readdir("/source")) {
+            if (name !== "projects")
+                execFileSync("cp", ["-a", "--", join("/source", name), "/data/"], { stdio: "pipe" });
+        }
+        const root = await lstat("/source");
+        await lchown("/data", root.uid, root.gid);
+        await chmod("/data", root.mode & 0o7777);
+        execFileSync("sync", ["-f", "/data"], { stdio: "pipe" });
+        await syncDirectory("/data");
+        const restored = await treeDigest("/data", true, true);
+        if (source.hash !== restored.hash)
+            throw new Error("Private volume restore verification failed.");
+        return restored;
+    }
+    if (!/^\d+:\d+$/.test(user))
+        throw new Error("Invalid container owner.");
+    const [uid, gid] = user.split(":").map(Number);
+    if (uid === undefined || gid === undefined)
+        throw new Error("Missing container owner.");
+    if (operation === "own") {
+        const owner = { uid, gid };
+        async function own(path) {
+            const s = await lstat(path);
+            if (!s.isDirectory() && !s.isFile() && !s.isSymbolicLink())
+                throw new Error("Unsupported private-volume entry.");
+            await lchown(path, owner.uid, owner.gid);
+            if (s.isSymbolicLink())
+                return;
+            await chmod(path, s.isDirectory() ? 0o700 : 0o600 | (s.mode & 0o100));
+            if (s.isDirectory()) {
+                for (const name of await readdir(path)) {
+                    if (path === "/data" && name === "projects")
+                        continue;
+                    await own(join(path, name));
+                }
+            }
+        }
+        await own("/data");
+        await mkdir("/data/home", { recursive: true, mode: 0o700 });
+        await lchown("/data/home", uid, gid);
+        return { ok: true };
+    }
+    if (operation === "probe") {
+        await writeFile("/probe/container", "slopify ownership probe", { flag: "wx", mode: 0o600 });
+        return { uid: process.getuid?.(), gid: process.getgid?.() };
+    }
+    throw new Error("Unknown fixed Docker volume operation.");
+}
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+    try {
+        console.log(JSON.stringify(await volumeOperation(process.argv.slice(2))));
+    }
+    catch {
+        console.error("Docker volume operation failed; original recovery material is retained.");
+        process.exitCode = 1;
+    }
+}

package/dist/edge/docker.js

@@ -7,6 +7,12 @@ import { ensureBridgeToken, hasCode, prepareHostPaths } from "../host-cli/paths.
 import { ensureHostService, privateRead, privateWrite } from "../host-cli/service.js";
 import { resolveHostCommand } from "../host-cli/status.js";
 import { hostCliProtocol, hostLlmIds } from "../kernel/ports/host-cli.js";
+export function assertManagedDockerHost(platform, uid, gid) {
+    if (platform !== "linux")
+        throw new Error("The managed Docker launcher requires Linux. Native Slopify and plain API-only Docker remain available on other hosts.");
+    if (uid === undefined || gid === undefined || uid === 0)
+        throw new Error("Run the managed Docker launcher as your logged-in user, not with sudo; grant that account access to Docker.");
+}
 export async function prepareDockerHostCli(options) {
     if (options.disabled)
         return {};