@getmonoceros/workbench 1.27.0 → 1.29.0

package/dist/bin.js

@@ -2278,7 +2278,7 @@ var init_catalog = __esm({
     override = process.env.MONOCEROS_BASE_IMAGE_OVERRIDE?.trim();
     BASE_IMAGE = override && override.length > 0 ? override : DEFAULT_BASE_IMAGE;
     RUNTIME_IMAGE_REPO = "ghcr.io/getmonoceros/monoceros-runtime";
-    DEFAULT_RUNTIME_VERSION = true ? "1.2.0" : readFileSync3(
+    DEFAULT_RUNTIME_VERSION = true ? "1.3.2" : readFileSync3(
       fileURLToPath2(
         new URL("../../../../images/runtime/VERSION", import.meta.url)
       ),
@@ -2964,6 +2964,35 @@ function ideStateVolumes(name) {
       volume: `monoceros-${name}-vscodium-userdata`,
       target: "/home/node/.vscodium-server/data/User",
       minRuntime: "1.2.0"
+    },
+    // JetBrains (ADR 0022). Only the backend DISTRIBUTION
+    // (`~/.cache/JetBrains/RemoteDev/dist`, ~3 GB, identical across
+    // containers) is shared machine-wide - downloaded once. The sibling
+    // RemoteDev state (`active/`, `recent/`, `remote-dev-worker/`) is
+    // per-user session state and stays per-container, inside the
+    // per-container `~/.cache/JetBrains` volume; sharing it pooled every
+    // container's recent-projects/active-sessions (the "wild" Gateway
+    // list). The shared `dist` mount nests two levels into that volume.
+    {
+      volume: "monoceros-jetbrains-dist",
+      target: "/home/node/.cache/JetBrains/RemoteDev/dist",
+      minRuntime: "1.3.2",
+      shared: true
+    },
+    {
+      volume: `monoceros-${name}-jetbrains-cache`,
+      target: "/home/node/.cache/JetBrains",
+      minRuntime: "1.3.0"
+    },
+    {
+      volume: `monoceros-${name}-jetbrains-config`,
+      target: "/home/node/.config/JetBrains",
+      minRuntime: "1.3.0"
+    },
+    {
+      volume: `monoceros-${name}-jetbrains-data`,
+      target: "/home/node/.local/share/JetBrains",
+      minRuntime: "1.3.0"
     }
   ];
 }
@@ -5146,7 +5175,7 @@ var init_transform = __esm({
 // src/devcontainer/ssh-attach.ts
 import { spawn as spawn4 } from "child_process";
 import { promises as fs10 } from "fs";
-import { existsSync as existsSync8 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync4 } from "fs";
 import os2 from "os";
 import path13 from "path";
 function sshHomeDir(home) {
@@ -5246,6 +5275,155 @@ ${existing}` : prefix;
   await fs10.chmod(configPath, 384).catch(() => {
   });
 }
+function runCapture(cmd, args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn4(cmd, args, {
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    let stdout = "";
+    child.stdout.on("data", (c) => {
+      stdout += c.toString();
+    });
+    child.on("error", reject);
+    child.on("exit", (code) => resolve({ stdout, exitCode: code ?? 0 }));
+  });
+}
+function realIsWsl() {
+  try {
+    if (process.env.WSL_DISTRO_NAME) return true;
+    const rel = readFileSync4(
+      "/proc/sys/kernel/osrelease",
+      "utf8"
+    ).toLowerCase();
+    return rel.includes("microsoft") || rel.includes("wsl");
+  } catch {
+    return false;
+  }
+}
+async function realResolveWindowsProfile() {
+  try {
+    const r = await runCapture("cmd.exe", ["/c", "echo %USERPROFILE%"]);
+    const homeWin = r.stdout.replace(/\r/g, "").trim();
+    if (r.exitCode !== 0 || !homeWin || homeWin.includes("%USERPROFILE%")) {
+      return null;
+    }
+    const w = await runCapture("wslpath", ["-u", homeWin]);
+    const homeWsl = w.stdout.trim();
+    const user = homeWin.split("\\").pop() ?? "";
+    if (w.exitCode !== 0 || !homeWsl || !user) return null;
+    return { homeWsl, homeWin, user };
+  } catch {
+    return null;
+  }
+}
+async function realLockWindowsKey(winKeyPath, user) {
+  await runCapture("icacls.exe", [
+    winKeyPath,
+    "/inheritance:r",
+    "/grant:r",
+    `${user}:R`
+  ]);
+}
+function resolveWindowsDeps(d) {
+  return {
+    isWsl: d?.isWsl ?? realIsWsl,
+    resolveProfile: d?.resolveProfile ?? realResolveWindowsProfile,
+    lockKey: d?.lockKey ?? realLockWindowsKey
+  };
+}
+function windowsHostBlock(hostAlias, keyWin) {
+  return [
+    `Host ${hostAlias}`,
+    `    User node`,
+    `    IdentityFile ${keyWin}`,
+    `    IdentitiesOnly yes`,
+    `    StrictHostKeyChecking no`,
+    `    UserKnownHostsFile NUL`,
+    `    ProxyCommand docker exec -i ${hostAlias} socat - TCP:127.0.0.1:22`
+  ].join("\n");
+}
+function escapeRegExp2(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function blockMarkers(hostAlias) {
+  return {
+    begin: `# >>> monoceros ${hostAlias} >>>`,
+    end: `# <<< monoceros ${hostAlias} <<<`
+  };
+}
+async function upsertMarkedBlock(configPath, hostAlias, body) {
+  const { begin, end } = blockMarkers(hostAlias);
+  const section = `${begin}
+${body}
+${end}`;
+  await fs10.mkdir(path13.dirname(configPath), { recursive: true });
+  let existing = "";
+  try {
+    existing = await fs10.readFile(configPath, "utf8");
+  } catch {
+    existing = "";
+  }
+  const re = new RegExp(`${escapeRegExp2(begin)}[\\s\\S]*?${escapeRegExp2(end)}`);
+  if (re.test(existing)) {
+    await fs10.writeFile(configPath, existing.replace(re, section));
+    return;
+  }
+  const sep = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
+  await fs10.writeFile(configPath, `${existing}${sep}${section}
+`);
+}
+async function removeMarkedBlock(configPath, hostAlias) {
+  let existing = "";
+  try {
+    existing = await fs10.readFile(configPath, "utf8");
+  } catch {
+    return;
+  }
+  const { begin, end } = blockMarkers(hostAlias);
+  const re = new RegExp(
+    `\\n?${escapeRegExp2(begin)}[\\s\\S]*?${escapeRegExp2(end)}\\n?`,
+    "g"
+  );
+  await fs10.writeFile(
+    configPath,
+    existing.replace(re, "\n").replace(/\n{3,}/g, "\n\n")
+  );
+}
+async function setupWindowsBridge(name, hostAlias, privateKey, deps, logger) {
+  if (!deps.isWsl()) return;
+  const profile = await deps.resolveProfile();
+  if (!profile) {
+    logger.warn(
+      "WSL detected but the Windows user profile could not be resolved; skipping the Windows SSH bridge."
+    );
+    return;
+  }
+  const monoDir = path13.join(profile.homeWsl, ".ssh", "monoceros");
+  await fs10.mkdir(monoDir, { recursive: true });
+  await fs10.copyFile(privateKey, path13.join(monoDir, name));
+  const keyWin = `${profile.homeWin}\\.ssh\\monoceros\\${name}`;
+  await upsertMarkedBlock(
+    path13.join(profile.homeWsl, ".ssh", "config"),
+    hostAlias,
+    windowsHostBlock(hostAlias, keyWin)
+  );
+  await deps.lockKey(keyWin, profile.user);
+  logger.info(
+    `Windows SSH bridge ready: \`ssh ${hostAlias}\` (Codium/Gateway too).`
+  );
+}
+async function removeWindowsBridge(name, hostAlias, deps) {
+  if (!deps.isWsl()) return;
+  const profile = await deps.resolveProfile();
+  if (!profile) return;
+  await fs10.rm(path13.join(profile.homeWsl, ".ssh", "monoceros", name), {
+    force: true
+  });
+  await removeMarkedBlock(
+    path13.join(profile.homeWsl, ".ssh", "config"),
+    hostAlias
+  );
+}
 async function setupSshAttach(opts) {
   const hostAlias = `monoceros-${opts.name}`;
   const logger = opts.logger ?? { info: () => {
@@ -5271,11 +5449,32 @@ async function setupSshAttach(opts) {
     configEntryContent(opts.name, hostAlias, keys.privateKey, proxyScript)
   );
   await ensureInclude(userSshDir, opts.home);
+  try {
+    await setupWindowsBridge(
+      opts.name,
+      hostAlias,
+      keys.privateKey,
+      resolveWindowsDeps(opts.windows),
+      logger
+    );
+  } catch (err) {
+    logger.warn(
+      `Windows SSH bridge skipped: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
   return { hostAlias, configured: true };
 }
-async function removeSshAttach(home, name) {
+async function removeSshAttach(home, name, windows) {
   await fs10.rm(sshProxyScriptPath(home, name), { force: true });
   await fs10.rm(sshConfigEntryPath(home, name), { force: true });
+  try {
+    await removeWindowsBridge(
+      name,
+      `monoceros-${name}`,
+      resolveWindowsDeps(windows)
+    );
+  } catch {
+  }
 }
 var realKeygen;
 var init_ssh_attach = __esm({
@@ -6352,13 +6551,13 @@ var init_runtime_pull_hint = __esm({
 
 // src/devcontainer/cli.ts
 import { spawn as spawn5 } from "child_process";
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 import { createRequire } from "module";
 import path16 from "path";
 function devcontainerCliPath() {
   if (cachedBinaryPath) return cachedBinaryPath;
   const pkgJsonPath = require_.resolve("@devcontainers/cli/package.json");
-  const pkg = JSON.parse(readFileSync4(pkgJsonPath, "utf8"));
+  const pkg = JSON.parse(readFileSync5(pkgJsonPath, "utf8"));
   const binEntry = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.devcontainer ?? "";
   if (!binEntry) {
     throw new Error("Could not resolve @devcontainers/cli bin entry.");
@@ -7583,7 +7782,7 @@ var init_apply = __esm({
 
 // src/devcontainer/browser-bridge.ts
 import { spawn as spawn9 } from "child_process";
-import { existsSync as existsSync11, promises as fsp5, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync11, promises as fsp5, readFileSync as readFileSync6 } from "fs";
 import http from "http";
 import path20 from "path";
 function parseCallbackTarget(authUrl) {
@@ -7686,7 +7885,7 @@ exit 0
     if (!existsSync11(urlFile)) return;
     let content = "";
     try {
-      content = readFileSync5(urlFile, "utf8");
+      content = readFileSync6(urlFile, "utf8");
     } catch {
       return;
     }
@@ -7869,7 +8068,7 @@ var CLI_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    CLI_VERSION = true ? "1.27.0" : "dev";
+    CLI_VERSION = true ? "1.29.0" : "dev";
   }
 });
 
@@ -9747,7 +9946,7 @@ async function runRemove(opts) {
     logger,
     exec: dockerExec
   });
-  const ideVolumes = ideStateVolumes(opts.name).map((v) => v.volume);
+  const ideVolumes = ideStateVolumes(opts.name).filter((v) => !v.shared).map((v) => v.volume);
   await dockerExec(["volume", "rm", "-f", ...ideVolumes]);
   let backupPath = null;
   if (!opts.noBackup && (hasYml || hasContainer)) {