@greppleai/grip 0.0.0-stage → 0.0.1

package/dist/core/sandbox/docker.js

@@ -0,0 +1,633 @@
+import { createHash, randomBytes } from "node:crypto";
+import { open, readFile, stat, unlink } from "node:fs/promises";
+import { createConnection, createServer } from "node:net";
+import { tmpdir } from "node:os";
+import { basename, join, resolve } from "node:path";
+import { VERSION } from "../../config.js";
+import { DAEMON_WEBSOCKET_PATH } from "../../daemon/config.js";
+import { spawnProcess } from "../../utils/child-process.js";
+export const DEFAULT_SANDBOX_IMAGE = "ghcr.io/greppleai/grip-sandbox:latest";
+export const DEFAULT_SANDBOX_WORKSPACE_MOUNT = "/workspace";
+export const DEFAULT_SANDBOX_DAEMON_PORT = 8787;
+export const DEFAULT_SANDBOX_DOCKER_BINARY = "docker";
+export const DEFAULT_SANDBOX_LIMA_BINARY = "limactl";
+export const DEFAULT_SANDBOX_LIMA_TEMPLATE = "template:docker-rootful";
+export const SANDBOX_LABEL_PREFIX = "ai.greppleai.grip";
+export const SANDBOX_LABEL_ENABLED = `${SANDBOX_LABEL_PREFIX}.sandbox`;
+export const SANDBOX_LABEL_WORKSPACE_HASH = `${SANDBOX_LABEL_PREFIX}.workspace-hash`;
+export const SANDBOX_LABEL_WORKSPACE_MOUNT = `${SANDBOX_LABEL_PREFIX}.workspace-mount`;
+export const SANDBOX_LABEL_DAEMON_PORT = `${SANDBOX_LABEL_PREFIX}.daemon-port`;
+export const SANDBOX_LABEL_OWNER_UID = `${SANDBOX_LABEL_PREFIX}.owner-uid`;
+export const SANDBOX_LABEL_VERSION = `${SANDBOX_LABEL_PREFIX}.version`;
+export const SANDBOX_LABEL_SESSION = `${SANDBOX_LABEL_PREFIX}.session`;
+const reservedSandboxDaemonPorts = new Set();
+const sandboxPortLockPath = join(tmpdir(), `greppleai-grip-sandbox-port-${process.getuid?.() ?? "user"}.lock`);
+let sandboxStartQueue = Promise.resolve();
+function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error instanceof Error && "code" in error && error.code === "EPERM";
+    }
+}
+async function isSandboxPortLockStale() {
+    try {
+        const owner = JSON.parse(await readFile(sandboxPortLockPath, "utf8"));
+        return typeof owner.pid === "number" && !isProcessAlive(owner.pid);
+    }
+    catch {
+        try {
+            return Date.now() - (await stat(sandboxPortLockPath)).mtimeMs > 10_000;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+async function acquireSandboxPortLock() {
+    const token = `${process.pid}:${randomBytes(16).toString("hex")}`;
+    const deadline = Date.now() + 30_000;
+    while (Date.now() < deadline) {
+        try {
+            const handle = await open(sandboxPortLockPath, "wx", 0o600);
+            await handle.writeFile(JSON.stringify({ pid: process.pid, token }));
+            return async () => {
+                await handle.close();
+                try {
+                    const current = JSON.parse(await readFile(sandboxPortLockPath, "utf8"));
+                    if (current.token === token)
+                        await unlink(sandboxPortLockPath);
+                }
+                catch { }
+            };
+        }
+        catch (error) {
+            if (!(error instanceof Error && "code" in error && error.code === "EEXIST"))
+                throw error;
+            const stale = await isSandboxPortLockStale();
+            if (stale) {
+                await unlink(sandboxPortLockPath).catch(() => undefined);
+                continue;
+            }
+            await new Promise((resolveDelay) => setTimeout(resolveDelay, 50));
+        }
+    }
+    throw new Error("Timed out waiting for the sandbox daemon port allocation lock");
+}
+async function withSandboxStartLock(operation) {
+    const previous = sandboxStartQueue;
+    let release;
+    sandboxStartQueue = new Promise((resolveQueue) => {
+        release = resolveQueue;
+    });
+    await previous;
+    let releaseFileLock;
+    try {
+        releaseFileLock = await acquireSandboxPortLock();
+        return await operation();
+    }
+    finally {
+        try {
+            await releaseFileLock?.();
+        }
+        finally {
+            release();
+        }
+    }
+}
+class ProcessDockerRunner {
+    run(command, args, options = {}) {
+        return new Promise((resolveCommand, reject) => {
+            const child = spawnProcess(command, args, {
+                stdio: ["ignore", "pipe", "pipe"],
+                env: { ...process.env, ...options.env },
+            });
+            let stdout = "";
+            let stderr = "";
+            child.stdout?.on("data", (chunk) => {
+                stdout += chunk.toString("utf8");
+            });
+            child.stderr?.on("data", (chunk) => {
+                stderr += chunk.toString("utf8");
+            });
+            child.once("error", reject);
+            child.once("close", (exitCode) => resolveCommand({ exitCode, stdout, stderr }));
+        });
+    }
+}
+function nonEmpty(value) {
+    const trimmed = value?.trim();
+    return trimmed ? trimmed : undefined;
+}
+function parseRuntime(value, settingName) {
+    if (value === undefined)
+        return undefined;
+    if (value === "docker" || value === "lima")
+        return value;
+    throw new Error(`Invalid ${settingName}: expected docker or lima`);
+}
+function parsePositiveInteger(value, settingName) {
+    if (value === undefined)
+        return undefined;
+    const text = String(value).trim();
+    if (!/^\d+$/.test(text))
+        throw new Error(`Invalid ${settingName}: expected a decimal integer`);
+    const parsed = Number(text);
+    if (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > 65535) {
+        throw new Error(`Invalid ${settingName}: expected a port from 1 to 65535`);
+    }
+    return parsed;
+}
+function parseCleanup(value, settingName) {
+    if (value === undefined)
+        return undefined;
+    if (value === "stop" || value === "remove")
+        return value;
+    throw new Error(`Invalid ${settingName}: expected stop or remove`);
+}
+function parseLabels(text) {
+    const labels = {};
+    if (!text)
+        return labels;
+    for (const entry of text.split(",")) {
+        const separator = entry.indexOf("=");
+        if (separator === -1)
+            continue;
+        labels[entry.slice(0, separator)] = entry.slice(separator + 1);
+    }
+    return labels;
+}
+function sanitizeNameSegment(value) {
+    const sanitized = value
+        .toLowerCase()
+        .replace(/[^a-z0-9_.-]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    return sanitized || "workspace";
+}
+function getWorkspaceHash(workspaceRoot) {
+    return createHash("sha256").update(resolve(workspaceRoot)).digest("hex").slice(0, 16);
+}
+function getOwnerUid() {
+    const uid = process.getuid?.();
+    return uid === undefined ? undefined : String(uid);
+}
+function generateToken() {
+    return randomBytes(32).toString("base64url");
+}
+async function tryReservePort(host, port) {
+    return new Promise((resolvePort) => {
+        const server = createServer();
+        server.unref();
+        server.once("error", () => resolvePort(undefined));
+        server.listen({ host, port, exclusive: true }, () => {
+            const address = server.address();
+            const selectedPort = typeof address === "object" && address ? address.port : undefined;
+            server.close(() => resolvePort(selectedPort));
+        });
+    });
+}
+export async function allocateSandboxDaemonPort(host, preferredPort) {
+    const preferred = await tryReservePort(host, preferredPort);
+    if (preferred !== undefined)
+        return preferred;
+    const fallback = await tryReservePort(host, 0);
+    if (fallback === undefined)
+        throw new Error(`Unable to allocate a sandbox daemon port on ${host}`);
+    return fallback;
+}
+async function canConnect(host, port) {
+    return new Promise((resolveConnection) => {
+        const socket = createConnection({ host, port });
+        let settled = false;
+        const finish = (connected) => {
+            if (settled)
+                return;
+            settled = true;
+            socket.destroy();
+            resolveConnection(connected);
+        };
+        socket.setTimeout(250, () => finish(false));
+        socket.once("connect", () => finish(true));
+        socket.once("error", () => finish(false));
+    });
+}
+async function waitForSandboxDaemonPort(host, port) {
+    const connectHost = host === "0.0.0.0" ? "127.0.0.1" : host;
+    const deadline = Date.now() + 15_000;
+    while (Date.now() < deadline) {
+        if (await canConnect(connectHost, port))
+            return;
+        await new Promise((resolveDelay) => setTimeout(resolveDelay, 100));
+    }
+    throw new Error(`Sandbox daemon did not bind ${connectHost}:${port} within 15 seconds`);
+}
+function ensureSuccessful(result, args) {
+    if (result.exitCode === 0)
+        return;
+    const detail = result.stderr.trim() || result.stdout.trim() || `exit code ${result.exitCode ?? "unknown"}`;
+    throw new Error(redactSecrets(`Docker command failed: docker ${args.join(" ")}: ${detail}`));
+}
+function parseJsonLines(text) {
+    return text
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0)
+        .map((line) => JSON.parse(line));
+}
+function parseJsonArray(text) {
+    const trimmed = text.trim();
+    if (!trimmed)
+        return [];
+    const parsed = JSON.parse(trimmed);
+    return Array.isArray(parsed) ? parsed : [parsed];
+}
+function getEndpointFromPorts(ports, daemonPort) {
+    const bindings = ports?.[`${daemonPort}/tcp`];
+    const binding = bindings?.[0];
+    if (!binding?.HostPort)
+        return undefined;
+    const host = daemonConnectionHost(binding.HostIp || "127.0.0.1");
+    return `ws://${urlHost(host)}:${binding.HostPort}${DAEMON_WEBSOCKET_PATH}`;
+}
+export function redactSecrets(value) {
+    return value
+        .replace(/(GRIP_DAEMON_TOKEN=)[^\s,;]+/g, "$1[REDACTED]")
+        .replace(/(PI_DAEMON_TOKEN=)[^\s,;]+/g, "$1[REDACTED]")
+        .replace(/(Authorization:\s*Bearer\s+)[^\s,;]+/gi, "$1[REDACTED]")
+        .replace(/([?&]token=)[^\s&]+/gi, "$1[REDACTED]");
+}
+export function resolveSandboxConfig(settings, env = {}, overrides = {}) {
+    const runtime = parseRuntime(overrides.runtime, "sandbox.runtime") ??
+        parseRuntime(env.GRIP_SANDBOX_RUNTIME, "GRIP_SANDBOX_RUNTIME") ??
+        parseRuntime(settings?.runtime, "sandbox.runtime") ??
+        "docker";
+    const image = nonEmpty(overrides.image) ??
+        nonEmpty(env.GRIP_SANDBOX_IMAGE) ??
+        nonEmpty(settings?.image) ??
+        DEFAULT_SANDBOX_IMAGE;
+    const dockerBinary = nonEmpty(overrides.dockerBinary) ??
+        nonEmpty(env.GRIP_SANDBOX_DOCKER) ??
+        nonEmpty(settings?.dockerBinary) ??
+        DEFAULT_SANDBOX_DOCKER_BINARY;
+    const limaBinary = nonEmpty(overrides.limaBinary) ??
+        nonEmpty(env.GRIP_SANDBOX_LIMA) ??
+        nonEmpty(settings?.limaBinary) ??
+        DEFAULT_SANDBOX_LIMA_BINARY;
+    const limaTemplate = nonEmpty(overrides.limaTemplate) ??
+        nonEmpty(env.GRIP_SANDBOX_LIMA_TEMPLATE) ??
+        nonEmpty(settings?.limaTemplate) ??
+        DEFAULT_SANDBOX_LIMA_TEMPLATE;
+    const limaInstanceNamePrefix = nonEmpty(overrides.limaInstanceNamePrefix) ??
+        nonEmpty(env.GRIP_SANDBOX_LIMA_INSTANCE_PREFIX) ??
+        nonEmpty(settings?.limaInstanceNamePrefix) ??
+        "grip-sandbox";
+    const workspaceMountPath = nonEmpty(overrides.workspaceMountPath) ??
+        nonEmpty(env.GRIP_SANDBOX_WORKSPACE_MOUNT) ??
+        nonEmpty(settings?.workspaceMountPath) ??
+        DEFAULT_SANDBOX_WORKSPACE_MOUNT;
+    const containerNamePrefix = nonEmpty(overrides.containerNamePrefix) ??
+        nonEmpty(env.GRIP_SANDBOX_CONTAINER_PREFIX) ??
+        nonEmpty(settings?.containerNamePrefix) ??
+        "grip-sandbox";
+    const daemonPort = overrides.daemonPort ??
+        parsePositiveInteger(env.GRIP_SANDBOX_DAEMON_PORT, "GRIP_SANDBOX_DAEMON_PORT") ??
+        parsePositiveInteger(settings?.daemonPort, "sandbox.daemonPort") ??
+        DEFAULT_SANDBOX_DAEMON_PORT;
+    const daemonHostBind = nonEmpty(overrides.daemonHostBind) ??
+        nonEmpty(env.GRIP_SANDBOX_DAEMON_HOST_BIND) ??
+        nonEmpty(settings?.daemonHostBind) ??
+        "127.0.0.1";
+    const cleanup = overrides.cleanup ??
+        parseCleanup(env.GRIP_SANDBOX_CLEANUP, "GRIP_SANDBOX_CLEANUP") ??
+        parseCleanup(settings?.cleanup, "sandbox.cleanup") ??
+        "stop";
+    return {
+        runtime,
+        image,
+        dockerBinary,
+        limaBinary,
+        limaTemplate,
+        limaInstanceNamePrefix,
+        workspaceMountPath,
+        containerNamePrefix,
+        daemonPort,
+        daemonHostBind,
+        cleanup,
+        ownerUid: getOwnerUid(),
+    };
+}
+function dockerPublishHost(host) {
+    return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+}
+function daemonConnectionHost(host) {
+    if (host === "0.0.0.0")
+        return "127.0.0.1";
+    if (host === "::")
+        return "::1";
+    return host;
+}
+function urlHost(host) {
+    return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+}
+export function createSandboxLabels(config, workspaceRoot, sessionId) {
+    const labels = {
+        [SANDBOX_LABEL_ENABLED]: "true",
+        [SANDBOX_LABEL_WORKSPACE_HASH]: getWorkspaceHash(workspaceRoot),
+        [SANDBOX_LABEL_WORKSPACE_MOUNT]: config.workspaceMountPath,
+        [SANDBOX_LABEL_DAEMON_PORT]: String(config.daemonPort),
+        [SANDBOX_LABEL_VERSION]: VERSION,
+        [SANDBOX_LABEL_SESSION]: sessionId,
+    };
+    if (config.ownerUid)
+        labels[SANDBOX_LABEL_OWNER_UID] = config.ownerUid;
+    return labels;
+}
+export function createSandboxContainerName(config, workspaceRoot, sessionId, instanceId) {
+    const base = `${sanitizeNameSegment(config.containerNamePrefix)}-${sanitizeNameSegment(basename(resolve(workspaceRoot)))}-${getWorkspaceHash(workspaceRoot)}-${sanitizeNameSegment(sessionId).slice(0, 16)}`;
+    return instanceId ? `${base}-${sanitizeNameSegment(instanceId).slice(0, 8)}` : base;
+}
+export function buildDockerRunInvocation(config, options, token = generateToken()) {
+    const workspaceRoot = resolve(options.workspaceRoot);
+    const sessionId = options.sessionId ?? randomBytes(8).toString("hex");
+    const labels = createSandboxLabels(config, workspaceRoot, sessionId);
+    const containerName = createSandboxContainerName(config, workspaceRoot, sessionId, createHash("sha256").update(token).digest("hex"));
+    const args = [
+        "run",
+        "--detach",
+        "--network",
+        "bridge",
+        "--publish",
+        `${dockerPublishHost(config.daemonHostBind)}:${config.daemonPort}:${config.daemonPort}`,
+        "--name",
+        containerName,
+        "--workdir",
+        config.workspaceMountPath,
+        "--mount",
+        `type=bind,source=${workspaceRoot},target=${config.workspaceMountPath}`,
+        "--env",
+        "GRIP_DAEMON_TOKEN",
+    ];
+    for (const [key, value] of Object.entries(labels))
+        args.push("--label", `${key}=${value}`);
+    args.push(config.image, "grip", "--daemon", "--daemon-host", "0.0.0.0", "--daemon-allow-insecure-transport", "--daemon-port", String(config.daemonPort), "--daemon-cwd", config.workspaceMountPath, "--daemon-allow-root", "--daemon-allow-process-exec");
+    return {
+        command: config.dockerBinary,
+        args,
+        env: { GRIP_DAEMON_TOKEN: token },
+        token,
+        containerName,
+        labels,
+        workspaceRoot,
+        workspaceHash: labels[SANDBOX_LABEL_WORKSPACE_HASH],
+    };
+}
+export class DockerSandboxService {
+    settingsManager;
+    env;
+    runner;
+    tokenGenerator;
+    portAllocator;
+    readinessWaiter;
+    managedContainers;
+    constructor(options = {}) {
+        this.settingsManager = options.settingsManager;
+        this.env = options.env ?? process.env;
+        this.runner = options.runner ?? new ProcessDockerRunner();
+        this.tokenGenerator = options.tokenGenerator ?? generateToken;
+        this.portAllocator = options.portAllocator ?? allocateSandboxDaemonPort;
+        this.readinessWaiter = options.readinessWaiter ?? waitForSandboxDaemonPort;
+        this.managedContainers = options.managedContainers ?? new Map();
+    }
+    resolveConfig(overrides = {}) {
+        return resolveSandboxConfig(this.settingsManager?.getSandboxSettings(), this.env, overrides);
+    }
+    buildStartInvocation(options) {
+        return buildDockerRunInvocation(this.resolveConfig(options), options, this.tokenGenerator());
+    }
+    async checkDockerAvailable(config = this.resolveConfig()) {
+        const args = ["version", "--format", "{{.Server.Version}}"];
+        try {
+            ensureSuccessful(await this.runner.run(config.dockerBinary, args), args);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            throw new Error(redactSecrets(`Docker is unavailable or not reachable via ${config.dockerBinary}: ${message}`));
+        }
+    }
+    async reserveDaemonPort(config) {
+        for (let attempt = 0; attempt < 16; attempt++) {
+            const preferredPort = reservedSandboxDaemonPorts.has(config.daemonPort) ? 0 : config.daemonPort;
+            const candidate = await this.portAllocator(config.daemonHostBind, preferredPort);
+            if (!reservedSandboxDaemonPorts.has(candidate))
+                return candidate;
+        }
+        throw new Error("Unable to reserve a unique sandbox daemon port");
+    }
+    async waitForStartedSandbox(config, containerId) {
+        try {
+            await this.readinessWaiter(config.daemonHostBind, config.daemonPort);
+        }
+        catch (error) {
+            const cleanupArgs = ["rm", "--force", containerId];
+            const cleanupResult = await this.runner.run(config.dockerBinary, cleanupArgs);
+            if (cleanupResult.exitCode !== 0) {
+                const cleanupError = new Error(cleanupResult.stderr.trim() || cleanupResult.stdout.trim() || "Failed to remove unready sandbox");
+                throw new AggregateError([error, cleanupError], "Sandbox readiness and cleanup both failed");
+            }
+            this.managedContainers.delete(containerId);
+            throw error;
+        }
+    }
+    async startWithReservedPort(options, daemonPort) {
+        const effectiveOptions = { ...options, daemonPort };
+        const config = this.resolveConfig(effectiveOptions);
+        const invocation = buildDockerRunInvocation(config, effectiveOptions, this.tokenGenerator());
+        await this.checkDockerAvailable(config);
+        const runResult = await this.runner.run(invocation.command, invocation.args, { env: invocation.env });
+        ensureSuccessful(runResult, invocation.args);
+        const containerId = runResult.stdout.trim();
+        this.managedContainers.set(containerId, {
+            workspaceRoot: invocation.workspaceRoot,
+            daemonPort: config.daemonPort,
+            ownerId: options.sessionId,
+        });
+        await this.waitForStartedSandbox(config, containerId);
+        const daemonHost = daemonConnectionHost(config.daemonHostBind);
+        const daemonUrl = `ws://${urlHost(daemonHost)}:${config.daemonPort}${DAEMON_WEBSOCKET_PATH}`;
+        return {
+            containerId,
+            containerName: invocation.containerName,
+            workspaceRoot: invocation.workspaceRoot,
+            workspaceMountPath: config.workspaceMountPath,
+            daemonUrl,
+            daemonUrlRedacted: redactSecrets(daemonUrl),
+            token: invocation.token,
+            labels: invocation.labels,
+        };
+    }
+    async startLocked(options) {
+        const configured = this.resolveConfig(options);
+        const daemonPort = await this.reserveDaemonPort(configured);
+        reservedSandboxDaemonPorts.add(daemonPort);
+        try {
+            return await this.startWithReservedPort(options, daemonPort);
+        }
+        catch (error) {
+            if (![...this.managedContainers.values()].some((container) => container.daemonPort === daemonPort)) {
+                reservedSandboxDaemonPorts.delete(daemonPort);
+            }
+            throw error;
+        }
+    }
+    async start(options) {
+        return withSandboxStartLock(() => this.startLocked(options));
+    }
+    async list(options) {
+        const config = this.resolveConfig();
+        const args = [
+            "container",
+            "ls",
+            "--all",
+            "--filter",
+            `label=${SANDBOX_LABEL_ENABLED}=true`,
+            ...(config.ownerUid ? ["--filter", `label=${SANDBOX_LABEL_OWNER_UID}=${config.ownerUid}`] : []),
+        ];
+        if (!options.allWorkspaces) {
+            args.push("--filter", `label=${SANDBOX_LABEL_WORKSPACE_HASH}=${getWorkspaceHash(options.workspaceRoot)}`);
+        }
+        args.push("--format", "{{json .}}");
+        const result = await this.runner.run(config.dockerBinary, args);
+        ensureSuccessful(result, args);
+        const rows = parseJsonLines(result.stdout);
+        return rows.filter((row) => row.ID || row.Names).map((row) => this.containerFromPsRecord(row));
+    }
+    forgetManagedContainer(reference, workspaceRoot) {
+        const canonicalWorkspaceRoot = resolve(workspaceRoot);
+        for (const [containerId, container] of this.managedContainers) {
+            if (container.workspaceRoot === canonicalWorkspaceRoot && containerIdsMatch(containerId, reference)) {
+                this.managedContainers.delete(containerId);
+                reservedSandboxDaemonPorts.delete(container.daemonPort);
+            }
+        }
+    }
+    forgetStoppedContainer(container, workspaceRoot) {
+        this.forgetManagedContainer(container.id, workspaceRoot);
+        if (container.daemonPort !== undefined)
+            reservedSandboxDaemonPorts.delete(container.daemonPort);
+    }
+    async stop(options) {
+        const containers = await this.list({ workspaceRoot: options.workspaceRoot });
+        const selected = selectStopTarget(containers, options.target, options.currentContainerId);
+        if (!selected) {
+            const requestedId = options.currentContainerId ?? options.target;
+            if (requestedId)
+                this.forgetManagedContainer(requestedId, options.workspaceRoot);
+            return { status: "not-found", message: "No matching Grip sandbox container found" };
+        }
+        const config = this.resolveConfig();
+        if (selected.state && selected.state !== "running" && config.cleanup === "stop") {
+            this.forgetStoppedContainer(selected, options.workspaceRoot);
+            return { status: "already-stopped", container: selected };
+        }
+        const args = [
+            config.cleanup === "remove" ? "rm" : "stop",
+            ...(config.cleanup === "remove" ? ["--force"] : []),
+            selected.id,
+        ];
+        const result = await this.runner.run(config.dockerBinary, args);
+        if (result.exitCode !== 0) {
+            const output = `${result.stderr}\n${result.stdout}`;
+            if (/No such container|not found/i.test(output)) {
+                this.forgetStoppedContainer(selected, options.workspaceRoot);
+                return { status: "not-found", message: "Sandbox container no longer exists" };
+            }
+            ensureSuccessful(result, args);
+        }
+        this.forgetStoppedContainer(selected, options.workspaceRoot);
+        return { status: config.cleanup === "remove" ? "removed" : "stopped", container: selected };
+    }
+    async stopManagedContainers() {
+        await withSandboxStartLock(async () => {
+            const failures = [];
+            for (const [containerId, container] of [...this.managedContainers]) {
+                try {
+                    await this.stop({
+                        workspaceRoot: container.workspaceRoot,
+                        target: containerId,
+                        currentContainerId: containerId,
+                    });
+                    this.managedContainers.delete(containerId);
+                    reservedSandboxDaemonPorts.delete(container.daemonPort);
+                }
+                catch (error) {
+                    failures.push(error);
+                }
+            }
+            if (failures.length > 0)
+                throw new AggregateError(failures, "Failed to stop managed sandbox containers");
+        });
+    }
+    containerFromPsRecord(row) {
+        const labels = parseLabels(row.Labels);
+        const daemonPort = parsePositiveInteger(labels[`${SANDBOX_LABEL_PREFIX}.daemon-port`] ?? undefined, "daemon port");
+        return {
+            id: row.ID ?? "",
+            name: row.Names ?? "",
+            image: row.Image ?? "",
+            status: row.Status ?? "",
+            state: row.State,
+            createdAt: row.CreatedAt,
+            workspaceRoot: undefined,
+            workspaceMountPath: labels[SANDBOX_LABEL_WORKSPACE_MOUNT],
+            daemonPort,
+            daemonEndpoint: row.Ports ? redactSecrets(row.Ports) : undefined,
+            labels,
+        };
+    }
+}
+export function parseDockerPortOutput(output) {
+    const firstLine = output.trim().split(/\r?\n/)[0];
+    const match = firstLine?.match(/^(?<host>.+):(?<port>\d+)$/);
+    if (!match?.groups)
+        throw new Error(`Unable to parse Docker daemon port output: ${output.trim()}`);
+    const host = match.groups.host === "0.0.0.0" ? "127.0.0.1" : match.groups.host;
+    return `ws://${host}:${match.groups.port}${DAEMON_WEBSOCKET_PATH}`;
+}
+export function parseDockerInspectContainers(output, daemonPort = DEFAULT_SANDBOX_DAEMON_PORT) {
+    return parseJsonArray(output).map((record) => {
+        const labels = record.Config?.Labels ?? {};
+        const mountPath = labels[SANDBOX_LABEL_WORKSPACE_MOUNT] ?? DEFAULT_SANDBOX_WORKSPACE_MOUNT;
+        const mount = record.Mounts?.find((candidate) => candidate.Destination === mountPath);
+        const name = record.Name?.replace(/^\//, "") ?? "";
+        return {
+            id: record.Id ?? "",
+            name,
+            image: record.Config?.Image ?? "",
+            status: record.State?.Status ?? "",
+            state: record.State?.Running ? "running" : record.State?.Status,
+            createdAt: record.State?.StartedAt ?? record.Created,
+            workspaceRoot: mount?.Source,
+            workspaceMountPath: mount?.Destination ?? mountPath,
+            daemonPort,
+            daemonEndpoint: getEndpointFromPorts(record.NetworkSettings?.Ports, daemonPort),
+            labels,
+        };
+    });
+}
+function containerIdsMatch(left, right) {
+    return left === right || left.startsWith(right) || right.startsWith(left);
+}
+function selectStopTarget(containers, target, currentContainerId) {
+    if (target) {
+        return containers.find((container) => containerIdsMatch(container.id, target) || container.name === target);
+    }
+    if (currentContainerId) {
+        const current = containers.find((container) => containerIdsMatch(container.id, currentContainerId));
+        if (current)
+            return current;
+    }
+    return containers.length === 1 ? containers[0] : undefined;
+}
+//# sourceMappingURL=docker.js.map