@greppleai/grip 0.0.0-stage → 0.0.1

package/dist/core/sandbox/docker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../../src/core/sandbox/docker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,uCAAuC,CAAC;AAC7E,MAAM,CAAC,MAAM,+BAA+B,GAAG,YAAY,CAAC;AAC5D,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,6BAA6B,GAAG,QAAQ,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC;AACrD,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AACxD,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,oBAAoB,UAAU,CAAC;AACvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,oBAAoB,iBAAiB,CAAC;AACrF,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,oBAAoB,kBAAkB,CAAC;AACvF,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,oBAAoB,cAAc,CAAC;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,oBAAoB,YAAY,CAAC;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,oBAAoB,UAAU,CAAC;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,oBAAoB,UAAU,CAAC;AAEvE,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAAU,CAAC;AACrD,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,+BAA+B,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC;AAC/G,IAAI,iBAAiB,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;AAEzD,SAAS,cAAc,CAAC,GAAW,EAAW;IAC7C,IAAI,CAAC;QACJ,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;IAC5E,CAAC;AAAA,CACD;AACD,KAAK,UAAU,sBAAsB,GAAqB;IACzD,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAsB,CAAC;QAC3F,OAAO,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACR,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;AAAA,CACD;AAED,KAAK,UAAU,sBAAsB,GAAiC;IACrE,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YACpE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACJ,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAwB,CAAC;oBAC/F,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;wBAAE,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;gBAChE,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YAAA,CACV,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzF,MAAM,KAAK,GAAG,MAAM,sBAAsB,EAAE,CAAC;YAC7C,IAAI,KAAK,EAAE,CAAC;gBACX,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACzD,SAAS;YACV,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;AAAA,CACjF;AAED,KAAK,UAAU,oBAAoB,CAAI,SAA2B,EAAc;IAC/E,MAAM,QAAQ,GAAG,iBAAiB,CAAC;IACnC,IAAI,OAAoB,CAAC;IACzB,iBAAiB,GAAG,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QACvD,OAAO,GAAG,YAAY,CAAC;IAAA,CACvB,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC;IACf,IAAI,eAAkD,CAAC;IACvD,IAAI,CAAC;QACJ,eAAe,GAAG,MAAM,sBAAsB,EAAE,CAAC;QACjD,OAAO,MAAM,SAAS,EAAE,CAAC;IAC1B,CAAC;YAAS,CAAC;QACV,IAAI,CAAC;YACJ,MAAM,eAAe,EAAE,EAAE,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACV,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;AAAA,CACD;AAkLD,MAAM,mBAAmB;IACxB,GAAG,CAAC,OAAe,EAAE,IAAc,EAAE,OAAO,GAAyB,EAAE,EAAgC;QACtG,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE;gBACzC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;aACvC,CAAC,CAAC;YACH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAA,CACjC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAA,CACjC,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAAA,CAChF,CAAC,CAAC;IAAA,CACH;CACD;AAED,SAAS,QAAQ,CAAC,KAAyB,EAAsB;IAChE,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CACrC;AAED,SAAS,YAAY,CAAC,KAAyB,EAAE,WAAmB,EAA8B;IACjG,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,IAAI,KAAK,CAAC,WAAW,WAAW,2BAA2B,CAAC,CAAC;AAAA,CACnE;AAED,SAAS,oBAAoB,CAAC,KAAkC,EAAE,WAAmB,EAAsB;IAC1G,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,WAAW,8BAA8B,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,KAAK,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,WAAW,WAAW,mCAAmC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,YAAY,CAAC,KAAyB,EAAE,WAAmB,EAAsC;IACzG,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,IAAI,KAAK,CAAC,WAAW,WAAW,2BAA2B,CAAC,CAAC;AAAA,CACnE;AAED,SAAS,WAAW,CAAC,IAAwB,EAA0B;IACtE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,SAAS,KAAK,CAAC,CAAC;YAAE,SAAS;QAC/B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,mBAAmB,CAAC,KAAa,EAAU;IACnD,MAAM,SAAS,GAAG,KAAK;SACrB,WAAW,EAAE;SACb,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC1B,OAAO,SAAS,IAAI,WAAW,CAAC;AAAA,CAChC;AAED,SAAS,gBAAgB,CAAC,aAAqB,EAAU;IACxD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAAA,CACtF;AAED,SAAS,WAAW,GAAuB;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAAA,CACnD;AAED,SAAS,aAAa,GAAW;IAChC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAAA,CAC7C;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,IAAY,EAA+B;IACtF,OAAO,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,YAAY,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACvF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;QAAA,CAC9C,CAAC,CAAC;IAAA,CACH,CAAC,CAAC;AAAA,CACH;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAAY,EAAE,aAAqB,EAAmB;IACrG,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;IACnG,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY,EAAoB;IACvE,OAAO,IAAI,OAAO,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,SAAkB,EAAQ,EAAE,CAAC;YAC5C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAAA,CAC7B,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAAA,CAC1C,CAAC,CAAC;AAAA,CACH;AAED,KAAK,UAAU,wBAAwB,CAAC,IAAY,EAAE,IAAY,EAAiB;IAClF,MAAM,WAAW,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC9B,IAAI,MAAM,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC;YAAE,OAAO;QAChD,MAAM,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,WAAW,IAAI,IAAI,oBAAoB,CAAC,CAAC;AAAA,CACxF;AAED,SAAS,gBAAgB,CAAC,MAA2B,EAAE,IAAc,EAAQ;IAC5E,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,aAAa,MAAM,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;IAC3G,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,iCAAiC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;AAAA,CAC7F;AAED,SAAS,cAAc,CAAI,IAAY,EAAO;IAC7C,OAAO,IAAI;SACT,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC,CAAC;AAAA,CACvC;AAED,SAAS,cAAc,CAAI,IAAY,EAAO;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;IAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAc,CAAC,CAAC,CAAC,CAAC,MAAW,CAAC,CAAC;AAAA,CAC/D;AAED,SAAS,oBAAoB,CAC5B,KAAoE,EACpE,UAAkB,EACG;IACrB,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,GAAG,UAAU,MAAM,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,QAAQ;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC;IACjE,OAAO,QAAQ,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,GAAG,qBAAqB,EAAE,CAAC;AAAA,CAC3E;AAED,MAAM,UAAU,aAAa,CAAC,KAAa,EAAU;IACpD,OAAO,KAAK;SACV,OAAO,CAAC,+BAA+B,EAAE,cAAc,CAAC;SACxD,OAAO,CAAC,6BAA6B,EAAE,cAAc,CAAC;SACtD,OAAO,CAAC,wCAAwC,EAAE,cAAc,CAAC;SACjE,OAAO,CAAC,uBAAuB,EAAE,cAAc,CAAC,CAAC;AAAA,CACnD;AAED,MAAM,UAAU,oBAAoB,CACnC,QAAqC,EACrC,GAAG,GAAuB,EAAE,EAC5B,SAAS,GAA2B,EAAE,EACtB;IAChB,MAAM,OAAO,GACZ,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC;QAClD,YAAY,CAAC,GAAG,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;QAC9D,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC;QAClD,QAAQ,CAAC;IACV,MAAM,KAAK,GACV,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;QACzB,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAChC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;QACzB,qBAAqB,CAAC;IACvB,MAAM,YAAY,GACjB,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC;QAChC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACjC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;QAChC,6BAA6B,CAAC;IAC/B,MAAM,UAAU,GACf,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC;QAC9B,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC/B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC9B,2BAA2B,CAAC;IAC7B,MAAM,YAAY,GACjB,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC;QAChC,QAAQ,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACxC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;QAChC,6BAA6B,CAAC;IAC/B,MAAM,sBAAsB,GAC3B,QAAQ,CAAC,SAAS,CAAC,sBAAsB,CAAC;QAC1C,QAAQ,CAAC,GAAG,CAAC,iCAAiC,CAAC;QAC/C,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;QAC1C,cAAc,CAAC;IAChB,MAAM,kBAAkB,GACvB,QAAQ,CAAC,SAAS,CAAC,kBAAkB,CAAC;QACtC,QAAQ,CAAC,GAAG,CAAC,4BAA4B,CAAC;QAC1C,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QACtC,+BAA+B,CAAC;IACjC,MAAM,mBAAmB,GACxB,QAAQ,CAAC,SAAS,CAAC,mBAAmB,CAAC;QACvC,QAAQ,CAAC,GAAG,CAAC,6BAA6B,CAAC;QAC3C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;QACvC,cAAc,CAAC;IAChB,MAAM,UAAU,GACf,SAAS,CAAC,UAAU;QACpB,oBAAoB,CAAC,GAAG,CAAC,wBAAwB,EAAE,0BAA0B,CAAC;QAC9E,oBAAoB,CAAC,QAAQ,EAAE,UAAU,EAAE,oBAAoB,CAAC;QAChE,2BAA2B,CAAC;IAC7B,MAAM,cAAc,GACnB,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC;QAClC,QAAQ,CAAC,GAAG,CAAC,6BAA6B,CAAC;QAC3C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;QAClC,WAAW,CAAC;IACb,MAAM,OAAO,GACZ,SAAS,CAAC,OAAO;QACjB,YAAY,CAAC,GAAG,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;QAC9D,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC;QAClD,MAAM,CAAC;IACR,OAAO;QACN,OAAO;QACP,KAAK;QACL,YAAY;QACZ,UAAU;QACV,YAAY;QACZ,sBAAsB;QACtB,kBAAkB;QAClB,mBAAmB;QACnB,UAAU;QACV,cAAc;QACd,OAAO;QACP,QAAQ,EAAE,WAAW,EAAE;KACvB,CAAC;AAAA,CACF;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAU;IAChD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,CACxE;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAU;IACnD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAC3C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,SAAS,OAAO,CAAC,IAAY,EAAU;IACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,CACxE;AAED,MAAM,UAAU,mBAAmB,CAClC,MAAqB,EACrB,aAAqB,EACrB,SAAiB,EACQ;IACzB,MAAM,MAAM,GAA2B;QACtC,CAAC,qBAAqB,CAAC,EAAE,MAAM;QAC/B,CAAC,4BAA4B,CAAC,EAAE,gBAAgB,CAAC,aAAa,CAAC;QAC/D,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAC,kBAAkB;QAC1D,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;QACtD,CAAC,qBAAqB,CAAC,EAAE,OAAO;QAChC,CAAC,qBAAqB,CAAC,EAAE,SAAS;KAClC,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;IACvE,OAAO,MAAM,CAAC;AAAA,CACd;AAED,MAAM,UAAU,0BAA0B,CACzC,MAAqB,EACrB,aAAqB,EACrB,SAAiB,EACjB,UAAmB,EACV;IACT,MAAM,IAAI,GAAG,GAAG,mBAAmB,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,aAAa,CAAC,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC7M,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,CACpF;AAED,MAAM,UAAU,wBAAwB,CACvC,MAAqB,EACrB,OAA4B,EAC5B,KAAK,GAAW,aAAa,EAAE,EACT;IACtB,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IACrE,MAAM,aAAa,GAAG,0BAA0B,CAC/C,MAAM,EACN,aAAa,EACb,SAAS,EACT,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAChD,CAAC;IACF,MAAM,IAAI,GAAG;QACZ,KAAK;QACL,UAAU;QACV,WAAW;QACX,QAAQ;QACR,WAAW;QACX,GAAG,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,EAAE;QACvF,QAAQ;QACR,aAAa;QACb,WAAW;QACX,MAAM,CAAC,kBAAkB;QACzB,SAAS;QACT,oBAAoB,aAAa,WAAW,MAAM,CAAC,kBAAkB,EAAE;QACvE,OAAO;QACP,mBAAmB;KACnB,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,IAAI,CACR,MAAM,CAAC,KAAK,EACZ,MAAM,EACN,UAAU,EACV,eAAe,EACf,SAAS,EACT,mCAAmC,EACnC,eAAe,EACf,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EACzB,cAAc,EACd,MAAM,CAAC,kBAAkB,EACzB,qBAAqB,EACrB,6BAA6B,CAC7B,CAAC;IACF,OAAO;QACN,OAAO,EAAE,MAAM,CAAC,YAAY;QAC5B,IAAI;QACJ,GAAG,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;QACjC,KAAK;QACL,aAAa;QACb,MAAM;QACN,aAAa;QACb,aAAa,EAAE,MAAM,CAAC,4BAA4B,CAAC;KACnD,CAAC;AAAA,CACF;AAED,MAAM,OAAO,oBAAoB;IACf,eAAe,CAA0D;IACzE,GAAG,CAAqB;IACxB,MAAM,CAAe;IACrB,cAAc,CAAe;IAC7B,aAAa,CAA2D;IACxE,eAAe,CAAgD;IAC/D,iBAAiB,CAAuC;IAEzE,YAAY,OAAO,GAAgC,EAAE,EAAE;QACtD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;QAC1D,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,aAAa,CAAC;QAC9D,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,yBAAyB,CAAC;QACxE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,wBAAwB,CAAC;QAC3E,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,GAAG,EAAE,CAAC;IAAA,CAChE;IAED,aAAa,CAAC,SAAS,GAA2B,EAAE,EAAiB;QACpE,OAAO,oBAAoB,CAAC,IAAI,CAAC,eAAe,EAAE,kBAAkB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAAA,CAC7F;IAED,oBAAoB,CAAC,OAA4B,EAAuB;QACvE,OAAO,wBAAwB,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAAA,CAC7F;IAED,KAAK,CAAC,oBAAoB,CAAC,MAAM,GAAkB,IAAI,CAAC,aAAa,EAAE,EAAiB;QACvF,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC5D,IAAI,CAAC;YACJ,gBAAgB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,KAAK,CACd,aAAa,CAAC,8CAA8C,MAAM,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC,CAC9F,CAAC;QACH,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,iBAAiB,CAAC,MAAqB,EAAmB;QACvE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;YAC/C,MAAM,aAAa,GAAG,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;YAChG,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;YACjF,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QAClE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAAA,CAClE;IAEO,KAAK,CAAC,qBAAqB,CAAC,MAAqB,EAAE,WAAmB,EAAiB;QAC9F,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;YACnD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAC9E,IAAI,aAAa,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,YAAY,GAAG,IAAI,KAAK,CAC7B,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,kCAAkC,CAChG,CAAC;gBACF,MAAM,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,2CAA2C,CAAC,CAAC;YAC9F,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC3C,MAAM,KAAK,CAAC;QACb,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,qBAAqB,CAAC,OAA4B,EAAE,UAAkB,EAA+B;QAClH,MAAM,gBAAgB,GAAG,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;QACtG,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE;YACvC,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,OAAO,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,QAAQ,OAAO,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,qBAAqB,EAAE,CAAC;QAC7F,OAAO;YACN,WAAW;YACX,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,SAAS;YACT,iBAAiB,EAAE,aAAa,CAAC,SAAS,CAAC;YAC3C,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,MAAM,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC;IAAA,CACF;IAEO,KAAK,CAAC,WAAW,CAAC,OAA4B,EAA+B;QACpF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC5D,0BAA0B,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC;YACJ,OAAO,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,UAAU,CAAC,EAAE,CAAC;gBACpG,0BAA0B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;IAAA,CACD;IAED,KAAK,CAAC,KAAK,CAAC,OAA4B,EAA+B;QACtE,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAAA,CAC7D;IAED,KAAK,CAAC,IAAI,CAAC,OAA2B,EAA+B;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG;YACZ,WAAW;YACX,IAAI;YACJ,OAAO;YACP,UAAU;YACV,SAAS,qBAAqB,OAAO;YACrC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,uBAAuB,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/F,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,4BAA4B,IAAI,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAChE,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,cAAc,CAAiB,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;IAAA,CAC/F;IACO,sBAAsB,CAAC,SAAiB,EAAE,aAAqB,EAAQ;QAC9E,MAAM,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC/D,IAAI,SAAS,CAAC,aAAa,KAAK,sBAAsB,IAAI,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;gBACrG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC3C,0BAA0B,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACzD,CAAC;QACF,CAAC;IAAA,CACD;IAEO,sBAAsB,CAAC,SAA2B,EAAE,aAAqB,EAAQ;QACxF,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS;YAAE,0BAA0B,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAAA,CAChG;IAED,KAAK,CAAC,IAAI,CAAC,OAA2B,EAA8B;QACnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC;YACjE,IAAI,WAAW;gBAAE,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YACjF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;QACrF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YACjF,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YAC7D,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,GAAG;YACZ,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;YAC3C,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,QAAQ,CAAC,EAAE;SACX,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACpD,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;gBAC7D,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;YAC/E,CAAC;YACD,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAAA,CAC5F;IAED,KAAK,CAAC,qBAAqB,GAAkB;QAC5C,MAAM,oBAAoB,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACpE,IAAI,CAAC;oBACJ,MAAM,IAAI,CAAC,IAAI,CAAC;wBACf,aAAa,EAAE,SAAS,CAAC,aAAa;wBACtC,MAAM,EAAE,WAAW;wBACnB,kBAAkB,EAAE,WAAW;qBAC/B,CAAC,CAAC;oBACH,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;oBAC3C,0BAA0B,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;gBACzD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC;YACF,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,2CAA2C,CAAC,CAAC;QAAA,CACzG,CAAC,CAAC;IAAA,CACH;IAEO,qBAAqB,CAAC,GAAmB,EAAoB;QACpE,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,oBAAoB,CACtC,MAAM,CAAC,GAAG,oBAAoB,cAAc,CAAC,IAAI,SAAS,EAC1D,aAAa,CACb,CAAC;QACF,OAAO;YACN,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE;YAChB,IAAI,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE;YACrB,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;YACxB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,aAAa,EAAE,SAAS;YACxB,kBAAkB,EAAE,MAAM,CAAC,6BAA6B,CAAC;YACzD,UAAU;YACV,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;YAChE,MAAM;SACN,CAAC;IAAA,CACF;CACD;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAU;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/E,OAAO,QAAQ,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,qBAAqB,EAAE,CAAC;AAAA,CACnE;AAED,MAAM,UAAU,4BAA4B,CAC3C,MAAc,EACd,UAAU,GAAG,2BAA2B,EACnB;IACrB,OAAO,cAAc,CAAsB,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,6BAA6B,CAAC,IAAI,+BAA+B,CAAC;QAC3F,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO;YACN,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE;YACnB,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;YACjC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE;YAClC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM;YAC/D,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,MAAM,CAAC,OAAO;YACpD,aAAa,EAAE,KAAK,EAAE,MAAM;YAC5B,kBAAkB,EAAE,KAAK,EAAE,WAAW,IAAI,SAAS;YACnD,UAAU;YACV,cAAc,EAAE,oBAAoB,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC;YAC/E,MAAM;SACN,CAAC;IAAA,CACF,CAAC,CAAC;AAAA,CACH;AACD,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAa,EAAW;IAChE,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAAA,CAC1E;AAED,SAAS,gBAAgB,CACxB,UAA8B,EAC9B,MAA0B,EAC1B,kBAAsC,EACP;IAC/B,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,kBAAkB,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;QACpG,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC7B,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC3D","sourcesContent":["import { createHash, randomBytes } from \"node:crypto\";\nimport { open, readFile, stat, unlink } from \"node:fs/promises\";\nimport { createConnection, createServer } from \"node:net\";\nimport { tmpdir } from \"node:os\";\nimport { basename, join, resolve } from \"node:path\";\nimport { VERSION } from \"../../config.ts\";\nimport { DAEMON_WEBSOCKET_PATH } from \"../../daemon/config.ts\";\nimport { spawnProcess } from \"../../utils/child-process.ts\";\nimport type { SandboxSettings, SettingsManager } from \"../settings-manager.ts\";\n\nexport const DEFAULT_SANDBOX_IMAGE = \"ghcr.io/greppleai/grip-sandbox:latest\";\nexport const DEFAULT_SANDBOX_WORKSPACE_MOUNT = \"/workspace\";\nexport const DEFAULT_SANDBOX_DAEMON_PORT = 8787;\nexport const DEFAULT_SANDBOX_DOCKER_BINARY = \"docker\";\nexport const DEFAULT_SANDBOX_LIMA_BINARY = \"limactl\";\nexport const DEFAULT_SANDBOX_LIMA_TEMPLATE = \"template:docker-rootful\";\nexport const SANDBOX_LABEL_PREFIX = \"ai.greppleai.grip\";\nexport const SANDBOX_LABEL_ENABLED = `${SANDBOX_LABEL_PREFIX}.sandbox`;\nexport const SANDBOX_LABEL_WORKSPACE_HASH = `${SANDBOX_LABEL_PREFIX}.workspace-hash`;\nexport const SANDBOX_LABEL_WORKSPACE_MOUNT = `${SANDBOX_LABEL_PREFIX}.workspace-mount`;\nexport const SANDBOX_LABEL_DAEMON_PORT = `${SANDBOX_LABEL_PREFIX}.daemon-port`;\nexport const SANDBOX_LABEL_OWNER_UID = `${SANDBOX_LABEL_PREFIX}.owner-uid`;\nexport const SANDBOX_LABEL_VERSION = `${SANDBOX_LABEL_PREFIX}.version`;\nexport const SANDBOX_LABEL_SESSION = `${SANDBOX_LABEL_PREFIX}.session`;\n\nconst reservedSandboxDaemonPorts = new Set<number>();\nconst sandboxPortLockPath = join(tmpdir(), `greppleai-grip-sandbox-port-${process.getuid?.() ?? \"user\"}.lock`);\nlet sandboxStartQueue: Promise<void> = Promise.resolve();\n\nfunction isProcessAlive(pid: number): boolean {\n\ttry {\n\t\tprocess.kill(pid, 0);\n\t\treturn true;\n\t} catch (error) {\n\t\treturn error instanceof Error && \"code\" in error && error.code === \"EPERM\";\n\t}\n}\nasync function isSandboxPortLockStale(): Promise<boolean> {\n\ttry {\n\t\tconst owner = JSON.parse(await readFile(sandboxPortLockPath, \"utf8\")) as { pid?: unknown };\n\t\treturn typeof owner.pid === \"number\" && !isProcessAlive(owner.pid);\n\t} catch {\n\t\ttry {\n\t\t\treturn Date.now() - (await stat(sandboxPortLockPath)).mtimeMs > 10_000;\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t}\n}\n\nasync function acquireSandboxPortLock(): Promise<() => Promise<void>> {\n\tconst token = `${process.pid}:${randomBytes(16).toString(\"hex\")}`;\n\tconst deadline = Date.now() + 30_000;\n\twhile (Date.now() < deadline) {\n\t\ttry {\n\t\t\tconst handle = await open(sandboxPortLockPath, \"wx\", 0o600);\n\t\t\tawait handle.writeFile(JSON.stringify({ pid: process.pid, token }));\n\t\t\treturn async () => {\n\t\t\t\tawait handle.close();\n\t\t\t\ttry {\n\t\t\t\t\tconst current = JSON.parse(await readFile(sandboxPortLockPath, \"utf8\")) as { token?: unknown };\n\t\t\t\t\tif (current.token === token) await unlink(sandboxPortLockPath);\n\t\t\t\t} catch {}\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof Error && \"code\" in error && error.code === \"EEXIST\")) throw error;\n\t\t\tconst stale = await isSandboxPortLockStale();\n\t\t\tif (stale) {\n\t\t\t\tawait unlink(sandboxPortLockPath).catch(() => undefined);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tawait new Promise((resolveDelay) => setTimeout(resolveDelay, 50));\n\t\t}\n\t}\n\tthrow new Error(\"Timed out waiting for the sandbox daemon port allocation lock\");\n}\n\nasync function withSandboxStartLock<T>(operation: () => Promise<T>): Promise<T> {\n\tconst previous = sandboxStartQueue;\n\tlet release!: () => void;\n\tsandboxStartQueue = new Promise<void>((resolveQueue) => {\n\t\trelease = resolveQueue;\n\t});\n\tawait previous;\n\tlet releaseFileLock: (() => Promise<void>) | undefined;\n\ttry {\n\t\treleaseFileLock = await acquireSandboxPortLock();\n\t\treturn await operation();\n\t} finally {\n\t\ttry {\n\t\t\tawait releaseFileLock?.();\n\t\t} finally {\n\t\t\trelease();\n\t\t}\n\t}\n}\n\nexport type SandboxCleanupBehavior = \"stop\" | \"remove\";\nexport type SandboxRuntime = \"docker\" | \"lima\";\n\nexport interface SandboxConfig {\n\truntime: SandboxRuntime;\n\timage: string;\n\tdockerBinary: string;\n\tlimaBinary: string;\n\tlimaTemplate: string;\n\tlimaInstanceNamePrefix: string;\n\tworkspaceMountPath: string;\n\tcontainerNamePrefix: string;\n\tdaemonPort: number;\n\tdaemonHostBind: string;\n\tcleanup: SandboxCleanupBehavior;\n\townerUid: string | undefined;\n}\n\nexport type SandboxConfigOverrides = SandboxSettings;\n\nexport interface SandboxEnvironment {\n\tGRIP_SANDBOX_RUNTIME?: string;\n\tGRIP_SANDBOX_IMAGE?: string;\n\tGRIP_SANDBOX_DOCKER?: string;\n\tGRIP_SANDBOX_LIMA?: string;\n\tGRIP_SANDBOX_LIMA_TEMPLATE?: string;\n\tGRIP_SANDBOX_LIMA_INSTANCE_PREFIX?: string;\n\tGRIP_SANDBOX_WORKSPACE_MOUNT?: string;\n\tGRIP_SANDBOX_CONTAINER_PREFIX?: string;\n\tGRIP_SANDBOX_DAEMON_PORT?: string;\n\tGRIP_SANDBOX_DAEMON_HOST_BIND?: string;\n\tGRIP_SANDBOX_CLEANUP?: string;\n}\n\nexport interface SandboxStartOptions extends SandboxConfigOverrides {\n\tworkspaceRoot: string;\n\tsessionId?: string;\n\tname?: string;\n}\n\nexport interface SandboxListOptions {\n\tworkspaceRoot: string;\n\tallWorkspaces?: boolean;\n}\n\nexport interface SandboxStopOptions {\n\tworkspaceRoot: string;\n\ttarget?: string;\n\tcurrentContainerId?: string;\n}\n\nexport interface DockerRunInvocation {\n\tcommand: string;\n\targs: string[];\n\tenv: Record<string, string>;\n\ttoken: string;\n\tcontainerName: string;\n\tlabels: Record<string, string>;\n\tworkspaceRoot: string;\n\tworkspaceHash: string;\n}\n\nexport interface SandboxContainer {\n\tid: string;\n\tname: string;\n\timage: string;\n\tstatus: string;\n\tstate: string | undefined;\n\tcreatedAt: string | undefined;\n\tworkspaceRoot: string | undefined;\n\tworkspaceMountPath: string | undefined;\n\tdaemonPort: number | undefined;\n\tdaemonEndpoint: string | undefined;\n\tlabels: Record<string, string>;\n}\n\nexport interface SandboxStartResult {\n\tcontainerId: string;\n\tcontainerName: string;\n\tworkspaceRoot: string;\n\tworkspaceMountPath: string;\n\tdaemonUrl: string;\n\tdaemonUrlRedacted: string;\n\ttoken: string;\n\tlabels: Record<string, string>;\n}\n\nexport type SandboxStopResult =\n\t| { status: \"stopped\"; container: SandboxContainer }\n\t| { status: \"removed\"; container: SandboxContainer }\n\t| { status: \"already-stopped\"; container: SandboxContainer }\n\t| { status: \"not-found\"; message: string };\n\nexport interface SandboxService {\n\tresolveConfig(overrides?: SandboxConfigOverrides): SandboxConfig;\n\tstart(options: SandboxStartOptions): Promise<SandboxStartResult>;\n\tlist(options: SandboxListOptions): Promise<SandboxContainer[]>;\n\tstop(options: SandboxStopOptions): Promise<SandboxStopResult>;\n}\n\nexport interface DockerCommandResult {\n\texitCode: number | null;\n\tstdout: string;\n\tstderr: string;\n}\n\nexport interface DockerCommandOptions {\n\tenv?: Record<string, string>;\n}\n\nexport interface DockerRunner {\n\trun(command: string, args: string[], options?: DockerCommandOptions): Promise<DockerCommandResult>;\n}\nexport interface ManagedSandboxContainer {\n\tworkspaceRoot: string;\n\tdaemonPort: number;\n\townerId?: string;\n}\n\nexport interface DockerSandboxServiceOptions {\n\tsettingsManager?: Pick<SettingsManager, \"getSandboxSettings\">;\n\tenv?: SandboxEnvironment;\n\trunner?: DockerRunner;\n\ttokenGenerator?: () => string;\n\tportAllocator?: (host: string, preferredPort: number) => Promise<number>;\n\treadinessWaiter?: (host: string, port: number) => Promise<void>;\n\tmanagedContainers?: Map<string, ManagedSandboxContainer>;\n}\n\ninterface DockerPsRecord {\n\tID?: string;\n\tNames?: string;\n\tImage?: string;\n\tStatus?: string;\n\tState?: string;\n\tCreatedAt?: string;\n\tLabels?: string;\n\tPorts?: string;\n}\n\ninterface DockerInspectMount {\n\tType?: string;\n\tSource?: string;\n\tDestination?: string;\n}\n\ninterface DockerInspectPortBinding {\n\tHostIp?: string;\n\tHostPort?: string;\n}\n\ninterface DockerInspectConfig {\n\tImage?: string;\n\tLabels?: Record<string, string>;\n}\n\ninterface DockerInspectState {\n\tStatus?: string;\n\tRunning?: boolean;\n\tStartedAt?: string;\n}\n\ninterface DockerInspectNetworkSettings {\n\tPorts?: Record<string, DockerInspectPortBinding[] | null>;\n}\n\ninterface DockerInspectRecord {\n\tId?: string;\n\tName?: string;\n\tConfig?: DockerInspectConfig;\n\tState?: DockerInspectState;\n\tCreated?: string;\n\tMounts?: DockerInspectMount[];\n\tNetworkSettings?: DockerInspectNetworkSettings;\n}\n\nclass ProcessDockerRunner implements DockerRunner {\n\trun(command: string, args: string[], options: DockerCommandOptions = {}): Promise<DockerCommandResult> {\n\t\treturn new Promise((resolveCommand, reject) => {\n\t\t\tconst child = spawnProcess(command, args, {\n\t\t\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\n\t\t\t\tenv: { ...process.env, ...options.env },\n\t\t\t});\n\t\t\tlet stdout = \"\";\n\t\t\tlet stderr = \"\";\n\t\t\tchild.stdout?.on(\"data\", (chunk: Buffer) => {\n\t\t\t\tstdout += chunk.toString(\"utf8\");\n\t\t\t});\n\t\t\tchild.stderr?.on(\"data\", (chunk: Buffer) => {\n\t\t\t\tstderr += chunk.toString(\"utf8\");\n\t\t\t});\n\t\t\tchild.once(\"error\", reject);\n\t\t\tchild.once(\"close\", (exitCode) => resolveCommand({ exitCode, stdout, stderr }));\n\t\t});\n\t}\n}\n\nfunction nonEmpty(value: string | undefined): string | undefined {\n\tconst trimmed = value?.trim();\n\treturn trimmed ? trimmed : undefined;\n}\n\nfunction parseRuntime(value: string | undefined, settingName: string): SandboxRuntime | undefined {\n\tif (value === undefined) return undefined;\n\tif (value === \"docker\" || value === \"lima\") return value;\n\tthrow new Error(`Invalid ${settingName}: expected docker or lima`);\n}\n\nfunction parsePositiveInteger(value: string | number | undefined, settingName: string): number | undefined {\n\tif (value === undefined) return undefined;\n\tconst text = String(value).trim();\n\tif (!/^\\d+$/.test(text)) throw new Error(`Invalid ${settingName}: expected a decimal integer`);\n\tconst parsed = Number(text);\n\tif (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > 65535) {\n\t\tthrow new Error(`Invalid ${settingName}: expected a port from 1 to 65535`);\n\t}\n\treturn parsed;\n}\n\nfunction parseCleanup(value: string | undefined, settingName: string): SandboxCleanupBehavior | undefined {\n\tif (value === undefined) return undefined;\n\tif (value === \"stop\" || value === \"remove\") return value;\n\tthrow new Error(`Invalid ${settingName}: expected stop or remove`);\n}\n\nfunction parseLabels(text: string | undefined): Record<string, string> {\n\tconst labels: Record<string, string> = {};\n\tif (!text) return labels;\n\tfor (const entry of text.split(\",\")) {\n\t\tconst separator = entry.indexOf(\"=\");\n\t\tif (separator === -1) continue;\n\t\tlabels[entry.slice(0, separator)] = entry.slice(separator + 1);\n\t}\n\treturn labels;\n}\n\nfunction sanitizeNameSegment(value: string): string {\n\tconst sanitized = value\n\t\t.toLowerCase()\n\t\t.replace(/[^a-z0-9_.-]+/g, \"-\")\n\t\t.replace(/^-+|-+$/g, \"\");\n\treturn sanitized || \"workspace\";\n}\n\nfunction getWorkspaceHash(workspaceRoot: string): string {\n\treturn createHash(\"sha256\").update(resolve(workspaceRoot)).digest(\"hex\").slice(0, 16);\n}\n\nfunction getOwnerUid(): string | undefined {\n\tconst uid = process.getuid?.();\n\treturn uid === undefined ? undefined : String(uid);\n}\n\nfunction generateToken(): string {\n\treturn randomBytes(32).toString(\"base64url\");\n}\n\nasync function tryReservePort(host: string, port: number): Promise<number | undefined> {\n\treturn new Promise((resolvePort) => {\n\t\tconst server = createServer();\n\t\tserver.unref();\n\t\tserver.once(\"error\", () => resolvePort(undefined));\n\t\tserver.listen({ host, port, exclusive: true }, () => {\n\t\t\tconst address = server.address();\n\t\t\tconst selectedPort = typeof address === \"object\" && address ? address.port : undefined;\n\t\t\tserver.close(() => resolvePort(selectedPort));\n\t\t});\n\t});\n}\n\nexport async function allocateSandboxDaemonPort(host: string, preferredPort: number): Promise<number> {\n\tconst preferred = await tryReservePort(host, preferredPort);\n\tif (preferred !== undefined) return preferred;\n\tconst fallback = await tryReservePort(host, 0);\n\tif (fallback === undefined) throw new Error(`Unable to allocate a sandbox daemon port on ${host}`);\n\treturn fallback;\n}\n\nasync function canConnect(host: string, port: number): Promise<boolean> {\n\treturn new Promise((resolveConnection) => {\n\t\tconst socket = createConnection({ host, port });\n\t\tlet settled = false;\n\t\tconst finish = (connected: boolean): void => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tsocket.destroy();\n\t\t\tresolveConnection(connected);\n\t\t};\n\t\tsocket.setTimeout(250, () => finish(false));\n\t\tsocket.once(\"connect\", () => finish(true));\n\t\tsocket.once(\"error\", () => finish(false));\n\t});\n}\n\nasync function waitForSandboxDaemonPort(host: string, port: number): Promise<void> {\n\tconst connectHost = host === \"0.0.0.0\" ? \"127.0.0.1\" : host;\n\tconst deadline = Date.now() + 15_000;\n\twhile (Date.now() < deadline) {\n\t\tif (await canConnect(connectHost, port)) return;\n\t\tawait new Promise((resolveDelay) => setTimeout(resolveDelay, 100));\n\t}\n\tthrow new Error(`Sandbox daemon did not bind ${connectHost}:${port} within 15 seconds`);\n}\n\nfunction ensureSuccessful(result: DockerCommandResult, args: string[]): void {\n\tif (result.exitCode === 0) return;\n\tconst detail = result.stderr.trim() || result.stdout.trim() || `exit code ${result.exitCode ?? \"unknown\"}`;\n\tthrow new Error(redactSecrets(`Docker command failed: docker ${args.join(\" \")}: ${detail}`));\n}\n\nfunction parseJsonLines<T>(text: string): T[] {\n\treturn text\n\t\t.split(/\\r?\\n/)\n\t\t.map((line) => line.trim())\n\t\t.filter((line) => line.length > 0)\n\t\t.map((line) => JSON.parse(line) as T);\n}\n\nfunction parseJsonArray<T>(text: string): T[] {\n\tconst trimmed = text.trim();\n\tif (!trimmed) return [];\n\tconst parsed = JSON.parse(trimmed) as unknown;\n\treturn Array.isArray(parsed) ? (parsed as T[]) : [parsed as T];\n}\n\nfunction getEndpointFromPorts(\n\tports: Record<string, DockerInspectPortBinding[] | null> | undefined,\n\tdaemonPort: number,\n): string | undefined {\n\tconst bindings = ports?.[`${daemonPort}/tcp`];\n\tconst binding = bindings?.[0];\n\tif (!binding?.HostPort) return undefined;\n\tconst host = daemonConnectionHost(binding.HostIp || \"127.0.0.1\");\n\treturn `ws://${urlHost(host)}:${binding.HostPort}${DAEMON_WEBSOCKET_PATH}`;\n}\n\nexport function redactSecrets(value: string): string {\n\treturn value\n\t\t.replace(/(GRIP_DAEMON_TOKEN=)[^\\s,;]+/g, \"$1[REDACTED]\")\n\t\t.replace(/(PI_DAEMON_TOKEN=)[^\\s,;]+/g, \"$1[REDACTED]\")\n\t\t.replace(/(Authorization:\\s*Bearer\\s+)[^\\s,;]+/gi, \"$1[REDACTED]\")\n\t\t.replace(/([?&]token=)[^\\s&]+/gi, \"$1[REDACTED]\");\n}\n\nexport function resolveSandboxConfig(\n\tsettings: SandboxSettings | undefined,\n\tenv: SandboxEnvironment = {},\n\toverrides: SandboxConfigOverrides = {},\n): SandboxConfig {\n\tconst runtime =\n\t\tparseRuntime(overrides.runtime, \"sandbox.runtime\") ??\n\t\tparseRuntime(env.GRIP_SANDBOX_RUNTIME, \"GRIP_SANDBOX_RUNTIME\") ??\n\t\tparseRuntime(settings?.runtime, \"sandbox.runtime\") ??\n\t\t\"docker\";\n\tconst image =\n\t\tnonEmpty(overrides.image) ??\n\t\tnonEmpty(env.GRIP_SANDBOX_IMAGE) ??\n\t\tnonEmpty(settings?.image) ??\n\t\tDEFAULT_SANDBOX_IMAGE;\n\tconst dockerBinary =\n\t\tnonEmpty(overrides.dockerBinary) ??\n\t\tnonEmpty(env.GRIP_SANDBOX_DOCKER) ??\n\t\tnonEmpty(settings?.dockerBinary) ??\n\t\tDEFAULT_SANDBOX_DOCKER_BINARY;\n\tconst limaBinary =\n\t\tnonEmpty(overrides.limaBinary) ??\n\t\tnonEmpty(env.GRIP_SANDBOX_LIMA) ??\n\t\tnonEmpty(settings?.limaBinary) ??\n\t\tDEFAULT_SANDBOX_LIMA_BINARY;\n\tconst limaTemplate =\n\t\tnonEmpty(overrides.limaTemplate) ??\n\t\tnonEmpty(env.GRIP_SANDBOX_LIMA_TEMPLATE) ??\n\t\tnonEmpty(settings?.limaTemplate) ??\n\t\tDEFAULT_SANDBOX_LIMA_TEMPLATE;\n\tconst limaInstanceNamePrefix =\n\t\tnonEmpty(overrides.limaInstanceNamePrefix) ??\n\t\tnonEmpty(env.GRIP_SANDBOX_LIMA_INSTANCE_PREFIX) ??\n\t\tnonEmpty(settings?.limaInstanceNamePrefix) ??\n\t\t\"grip-sandbox\";\n\tconst workspaceMountPath =\n\t\tnonEmpty(overrides.workspaceMountPath) ??\n\t\tnonEmpty(env.GRIP_SANDBOX_WORKSPACE_MOUNT) ??\n\t\tnonEmpty(settings?.workspaceMountPath) ??\n\t\tDEFAULT_SANDBOX_WORKSPACE_MOUNT;\n\tconst containerNamePrefix =\n\t\tnonEmpty(overrides.containerNamePrefix) ??\n\t\tnonEmpty(env.GRIP_SANDBOX_CONTAINER_PREFIX) ??\n\t\tnonEmpty(settings?.containerNamePrefix) ??\n\t\t\"grip-sandbox\";\n\tconst daemonPort =\n\t\toverrides.daemonPort ??\n\t\tparsePositiveInteger(env.GRIP_SANDBOX_DAEMON_PORT, \"GRIP_SANDBOX_DAEMON_PORT\") ??\n\t\tparsePositiveInteger(settings?.daemonPort, \"sandbox.daemonPort\") ??\n\t\tDEFAULT_SANDBOX_DAEMON_PORT;\n\tconst daemonHostBind =\n\t\tnonEmpty(overrides.daemonHostBind) ??\n\t\tnonEmpty(env.GRIP_SANDBOX_DAEMON_HOST_BIND) ??\n\t\tnonEmpty(settings?.daemonHostBind) ??\n\t\t\"127.0.0.1\";\n\tconst cleanup =\n\t\toverrides.cleanup ??\n\t\tparseCleanup(env.GRIP_SANDBOX_CLEANUP, \"GRIP_SANDBOX_CLEANUP\") ??\n\t\tparseCleanup(settings?.cleanup, \"sandbox.cleanup\") ??\n\t\t\"stop\";\n\treturn {\n\t\truntime,\n\t\timage,\n\t\tdockerBinary,\n\t\tlimaBinary,\n\t\tlimaTemplate,\n\t\tlimaInstanceNamePrefix,\n\t\tworkspaceMountPath,\n\t\tcontainerNamePrefix,\n\t\tdaemonPort,\n\t\tdaemonHostBind,\n\t\tcleanup,\n\t\townerUid: getOwnerUid(),\n\t};\n}\n\nfunction dockerPublishHost(host: string): string {\n\treturn host.includes(\":\") && !host.startsWith(\"[\") ? `[${host}]` : host;\n}\n\nfunction daemonConnectionHost(host: string): string {\n\tif (host === \"0.0.0.0\") return \"127.0.0.1\";\n\tif (host === \"::\") return \"::1\";\n\treturn host;\n}\n\nfunction urlHost(host: string): string {\n\treturn host.includes(\":\") && !host.startsWith(\"[\") ? `[${host}]` : host;\n}\n\nexport function createSandboxLabels(\n\tconfig: SandboxConfig,\n\tworkspaceRoot: string,\n\tsessionId: string,\n): Record<string, string> {\n\tconst labels: Record<string, string> = {\n\t\t[SANDBOX_LABEL_ENABLED]: \"true\",\n\t\t[SANDBOX_LABEL_WORKSPACE_HASH]: getWorkspaceHash(workspaceRoot),\n\t\t[SANDBOX_LABEL_WORKSPACE_MOUNT]: config.workspaceMountPath,\n\t\t[SANDBOX_LABEL_DAEMON_PORT]: String(config.daemonPort),\n\t\t[SANDBOX_LABEL_VERSION]: VERSION,\n\t\t[SANDBOX_LABEL_SESSION]: sessionId,\n\t};\n\tif (config.ownerUid) labels[SANDBOX_LABEL_OWNER_UID] = config.ownerUid;\n\treturn labels;\n}\n\nexport function createSandboxContainerName(\n\tconfig: SandboxConfig,\n\tworkspaceRoot: string,\n\tsessionId: string,\n\tinstanceId?: string,\n): string {\n\tconst base = `${sanitizeNameSegment(config.containerNamePrefix)}-${sanitizeNameSegment(basename(resolve(workspaceRoot)))}-${getWorkspaceHash(workspaceRoot)}-${sanitizeNameSegment(sessionId).slice(0, 16)}`;\n\treturn instanceId ? `${base}-${sanitizeNameSegment(instanceId).slice(0, 8)}` : base;\n}\n\nexport function buildDockerRunInvocation(\n\tconfig: SandboxConfig,\n\toptions: SandboxStartOptions,\n\ttoken: string = generateToken(),\n): DockerRunInvocation {\n\tconst workspaceRoot = resolve(options.workspaceRoot);\n\tconst sessionId = options.sessionId ?? randomBytes(8).toString(\"hex\");\n\tconst labels = createSandboxLabels(config, workspaceRoot, sessionId);\n\tconst containerName = createSandboxContainerName(\n\t\tconfig,\n\t\tworkspaceRoot,\n\t\tsessionId,\n\t\tcreateHash(\"sha256\").update(token).digest(\"hex\"),\n\t);\n\tconst args = [\n\t\t\"run\",\n\t\t\"--detach\",\n\t\t\"--network\",\n\t\t\"bridge\",\n\t\t\"--publish\",\n\t\t`${dockerPublishHost(config.daemonHostBind)}:${config.daemonPort}:${config.daemonPort}`,\n\t\t\"--name\",\n\t\tcontainerName,\n\t\t\"--workdir\",\n\t\tconfig.workspaceMountPath,\n\t\t\"--mount\",\n\t\t`type=bind,source=${workspaceRoot},target=${config.workspaceMountPath}`,\n\t\t\"--env\",\n\t\t\"GRIP_DAEMON_TOKEN\",\n\t];\n\tfor (const [key, value] of Object.entries(labels)) args.push(\"--label\", `${key}=${value}`);\n\targs.push(\n\t\tconfig.image,\n\t\t\"grip\",\n\t\t\"--daemon\",\n\t\t\"--daemon-host\",\n\t\t\"0.0.0.0\",\n\t\t\"--daemon-allow-insecure-transport\",\n\t\t\"--daemon-port\",\n\t\tString(config.daemonPort),\n\t\t\"--daemon-cwd\",\n\t\tconfig.workspaceMountPath,\n\t\t\"--daemon-allow-root\",\n\t\t\"--daemon-allow-process-exec\",\n\t);\n\treturn {\n\t\tcommand: config.dockerBinary,\n\t\targs,\n\t\tenv: { GRIP_DAEMON_TOKEN: token },\n\t\ttoken,\n\t\tcontainerName,\n\t\tlabels,\n\t\tworkspaceRoot,\n\t\tworkspaceHash: labels[SANDBOX_LABEL_WORKSPACE_HASH],\n\t};\n}\n\nexport class DockerSandboxService {\n\tprivate readonly settingsManager: Pick<SettingsManager, \"getSandboxSettings\"> | undefined;\n\tprivate readonly env: SandboxEnvironment;\n\tprivate readonly runner: DockerRunner;\n\tprivate readonly tokenGenerator: () => string;\n\tprivate readonly portAllocator: (host: string, preferredPort: number) => Promise<number>;\n\tprivate readonly readinessWaiter: (host: string, port: number) => Promise<void>;\n\tprivate readonly managedContainers: Map<string, ManagedSandboxContainer>;\n\n\tconstructor(options: DockerSandboxServiceOptions = {}) {\n\t\tthis.settingsManager = options.settingsManager;\n\t\tthis.env = options.env ?? process.env;\n\t\tthis.runner = options.runner ?? new ProcessDockerRunner();\n\t\tthis.tokenGenerator = options.tokenGenerator ?? generateToken;\n\t\tthis.portAllocator = options.portAllocator ?? allocateSandboxDaemonPort;\n\t\tthis.readinessWaiter = options.readinessWaiter ?? waitForSandboxDaemonPort;\n\t\tthis.managedContainers = options.managedContainers ?? new Map();\n\t}\n\n\tresolveConfig(overrides: SandboxConfigOverrides = {}): SandboxConfig {\n\t\treturn resolveSandboxConfig(this.settingsManager?.getSandboxSettings(), this.env, overrides);\n\t}\n\n\tbuildStartInvocation(options: SandboxStartOptions): DockerRunInvocation {\n\t\treturn buildDockerRunInvocation(this.resolveConfig(options), options, this.tokenGenerator());\n\t}\n\n\tasync checkDockerAvailable(config: SandboxConfig = this.resolveConfig()): Promise<void> {\n\t\tconst args = [\"version\", \"--format\", \"{{.Server.Version}}\"];\n\t\ttry {\n\t\t\tensureSuccessful(await this.runner.run(config.dockerBinary, args), args);\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(\n\t\t\t\tredactSecrets(`Docker is unavailable or not reachable via ${config.dockerBinary}: ${message}`),\n\t\t\t);\n\t\t}\n\t}\n\n\tprivate async reserveDaemonPort(config: SandboxConfig): Promise<number> {\n\t\tfor (let attempt = 0; attempt < 16; attempt++) {\n\t\t\tconst preferredPort = reservedSandboxDaemonPorts.has(config.daemonPort) ? 0 : config.daemonPort;\n\t\t\tconst candidate = await this.portAllocator(config.daemonHostBind, preferredPort);\n\t\t\tif (!reservedSandboxDaemonPorts.has(candidate)) return candidate;\n\t\t}\n\t\tthrow new Error(\"Unable to reserve a unique sandbox daemon port\");\n\t}\n\n\tprivate async waitForStartedSandbox(config: SandboxConfig, containerId: string): Promise<void> {\n\t\ttry {\n\t\t\tawait this.readinessWaiter(config.daemonHostBind, config.daemonPort);\n\t\t} catch (error) {\n\t\t\tconst cleanupArgs = [\"rm\", \"--force\", containerId];\n\t\t\tconst cleanupResult = await this.runner.run(config.dockerBinary, cleanupArgs);\n\t\t\tif (cleanupResult.exitCode !== 0) {\n\t\t\t\tconst cleanupError = new Error(\n\t\t\t\t\tcleanupResult.stderr.trim() || cleanupResult.stdout.trim() || \"Failed to remove unready sandbox\",\n\t\t\t\t);\n\t\t\t\tthrow new AggregateError([error, cleanupError], \"Sandbox readiness and cleanup both failed\");\n\t\t\t}\n\t\t\tthis.managedContainers.delete(containerId);\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tprivate async startWithReservedPort(options: SandboxStartOptions, daemonPort: number): Promise<SandboxStartResult> {\n\t\tconst effectiveOptions = { ...options, daemonPort };\n\t\tconst config = this.resolveConfig(effectiveOptions);\n\t\tconst invocation = buildDockerRunInvocation(config, effectiveOptions, this.tokenGenerator());\n\t\tawait this.checkDockerAvailable(config);\n\t\tconst runResult = await this.runner.run(invocation.command, invocation.args, { env: invocation.env });\n\t\tensureSuccessful(runResult, invocation.args);\n\t\tconst containerId = runResult.stdout.trim();\n\t\tthis.managedContainers.set(containerId, {\n\t\t\tworkspaceRoot: invocation.workspaceRoot,\n\t\t\tdaemonPort: config.daemonPort,\n\t\t\townerId: options.sessionId,\n\t\t});\n\t\tawait this.waitForStartedSandbox(config, containerId);\n\t\tconst daemonHost = daemonConnectionHost(config.daemonHostBind);\n\t\tconst daemonUrl = `ws://${urlHost(daemonHost)}:${config.daemonPort}${DAEMON_WEBSOCKET_PATH}`;\n\t\treturn {\n\t\t\tcontainerId,\n\t\t\tcontainerName: invocation.containerName,\n\t\t\tworkspaceRoot: invocation.workspaceRoot,\n\t\t\tworkspaceMountPath: config.workspaceMountPath,\n\t\t\tdaemonUrl,\n\t\t\tdaemonUrlRedacted: redactSecrets(daemonUrl),\n\t\t\ttoken: invocation.token,\n\t\t\tlabels: invocation.labels,\n\t\t};\n\t}\n\n\tprivate async startLocked(options: SandboxStartOptions): Promise<SandboxStartResult> {\n\t\tconst configured = this.resolveConfig(options);\n\t\tconst daemonPort = await this.reserveDaemonPort(configured);\n\t\treservedSandboxDaemonPorts.add(daemonPort);\n\t\ttry {\n\t\t\treturn await this.startWithReservedPort(options, daemonPort);\n\t\t} catch (error) {\n\t\t\tif (![...this.managedContainers.values()].some((container) => container.daemonPort === daemonPort)) {\n\t\t\t\treservedSandboxDaemonPorts.delete(daemonPort);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync start(options: SandboxStartOptions): Promise<SandboxStartResult> {\n\t\treturn withSandboxStartLock(() => this.startLocked(options));\n\t}\n\n\tasync list(options: SandboxListOptions): Promise<SandboxContainer[]> {\n\t\tconst config = this.resolveConfig();\n\t\tconst args = [\n\t\t\t\"container\",\n\t\t\t\"ls\",\n\t\t\t\"--all\",\n\t\t\t\"--filter\",\n\t\t\t`label=${SANDBOX_LABEL_ENABLED}=true`,\n\t\t\t...(config.ownerUid ? [\"--filter\", `label=${SANDBOX_LABEL_OWNER_UID}=${config.ownerUid}`] : []),\n\t\t];\n\t\tif (!options.allWorkspaces) {\n\t\t\targs.push(\"--filter\", `label=${SANDBOX_LABEL_WORKSPACE_HASH}=${getWorkspaceHash(options.workspaceRoot)}`);\n\t\t}\n\t\targs.push(\"--format\", \"{{json .}}\");\n\t\tconst result = await this.runner.run(config.dockerBinary, args);\n\t\tensureSuccessful(result, args);\n\t\tconst rows = parseJsonLines<DockerPsRecord>(result.stdout);\n\t\treturn rows.filter((row) => row.ID || row.Names).map((row) => this.containerFromPsRecord(row));\n\t}\n\tprivate forgetManagedContainer(reference: string, workspaceRoot: string): void {\n\t\tconst canonicalWorkspaceRoot = resolve(workspaceRoot);\n\t\tfor (const [containerId, container] of this.managedContainers) {\n\t\t\tif (container.workspaceRoot === canonicalWorkspaceRoot && containerIdsMatch(containerId, reference)) {\n\t\t\t\tthis.managedContainers.delete(containerId);\n\t\t\t\treservedSandboxDaemonPorts.delete(container.daemonPort);\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate forgetStoppedContainer(container: SandboxContainer, workspaceRoot: string): void {\n\t\tthis.forgetManagedContainer(container.id, workspaceRoot);\n\t\tif (container.daemonPort !== undefined) reservedSandboxDaemonPorts.delete(container.daemonPort);\n\t}\n\n\tasync stop(options: SandboxStopOptions): Promise<SandboxStopResult> {\n\t\tconst containers = await this.list({ workspaceRoot: options.workspaceRoot });\n\t\tconst selected = selectStopTarget(containers, options.target, options.currentContainerId);\n\t\tif (!selected) {\n\t\t\tconst requestedId = options.currentContainerId ?? options.target;\n\t\t\tif (requestedId) this.forgetManagedContainer(requestedId, options.workspaceRoot);\n\t\t\treturn { status: \"not-found\", message: \"No matching Grip sandbox container found\" };\n\t\t}\n\t\tconst config = this.resolveConfig();\n\t\tif (selected.state && selected.state !== \"running\" && config.cleanup === \"stop\") {\n\t\t\tthis.forgetStoppedContainer(selected, options.workspaceRoot);\n\t\t\treturn { status: \"already-stopped\", container: selected };\n\t\t}\n\t\tconst args = [\n\t\t\tconfig.cleanup === \"remove\" ? \"rm\" : \"stop\",\n\t\t\t...(config.cleanup === \"remove\" ? [\"--force\"] : []),\n\t\t\tselected.id,\n\t\t];\n\t\tconst result = await this.runner.run(config.dockerBinary, args);\n\t\tif (result.exitCode !== 0) {\n\t\t\tconst output = `${result.stderr}\\n${result.stdout}`;\n\t\t\tif (/No such container|not found/i.test(output)) {\n\t\t\t\tthis.forgetStoppedContainer(selected, options.workspaceRoot);\n\t\t\t\treturn { status: \"not-found\", message: \"Sandbox container no longer exists\" };\n\t\t\t}\n\t\t\tensureSuccessful(result, args);\n\t\t}\n\t\tthis.forgetStoppedContainer(selected, options.workspaceRoot);\n\t\treturn { status: config.cleanup === \"remove\" ? \"removed\" : \"stopped\", container: selected };\n\t}\n\n\tasync stopManagedContainers(): Promise<void> {\n\t\tawait withSandboxStartLock(async () => {\n\t\t\tconst failures: unknown[] = [];\n\t\t\tfor (const [containerId, container] of [...this.managedContainers]) {\n\t\t\t\ttry {\n\t\t\t\t\tawait this.stop({\n\t\t\t\t\t\tworkspaceRoot: container.workspaceRoot,\n\t\t\t\t\t\ttarget: containerId,\n\t\t\t\t\t\tcurrentContainerId: containerId,\n\t\t\t\t\t});\n\t\t\t\t\tthis.managedContainers.delete(containerId);\n\t\t\t\t\treservedSandboxDaemonPorts.delete(container.daemonPort);\n\t\t\t\t} catch (error) {\n\t\t\t\t\tfailures.push(error);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (failures.length > 0) throw new AggregateError(failures, \"Failed to stop managed sandbox containers\");\n\t\t});\n\t}\n\n\tprivate containerFromPsRecord(row: DockerPsRecord): SandboxContainer {\n\t\tconst labels = parseLabels(row.Labels);\n\t\tconst daemonPort = parsePositiveInteger(\n\t\t\tlabels[`${SANDBOX_LABEL_PREFIX}.daemon-port`] ?? undefined,\n\t\t\t\"daemon port\",\n\t\t);\n\t\treturn {\n\t\t\tid: row.ID ?? \"\",\n\t\t\tname: row.Names ?? \"\",\n\t\t\timage: row.Image ?? \"\",\n\t\t\tstatus: row.Status ?? \"\",\n\t\t\tstate: row.State,\n\t\t\tcreatedAt: row.CreatedAt,\n\t\t\tworkspaceRoot: undefined,\n\t\t\tworkspaceMountPath: labels[SANDBOX_LABEL_WORKSPACE_MOUNT],\n\t\t\tdaemonPort,\n\t\t\tdaemonEndpoint: row.Ports ? redactSecrets(row.Ports) : undefined,\n\t\t\tlabels,\n\t\t};\n\t}\n}\n\nexport function parseDockerPortOutput(output: string): string {\n\tconst firstLine = output.trim().split(/\\r?\\n/)[0];\n\tconst match = firstLine?.match(/^(?<host>.+):(?<port>\\d+)$/);\n\tif (!match?.groups) throw new Error(`Unable to parse Docker daemon port output: ${output.trim()}`);\n\tconst host = match.groups.host === \"0.0.0.0\" ? \"127.0.0.1\" : match.groups.host;\n\treturn `ws://${host}:${match.groups.port}${DAEMON_WEBSOCKET_PATH}`;\n}\n\nexport function parseDockerInspectContainers(\n\toutput: string,\n\tdaemonPort = DEFAULT_SANDBOX_DAEMON_PORT,\n): SandboxContainer[] {\n\treturn parseJsonArray<DockerInspectRecord>(output).map((record) => {\n\t\tconst labels = record.Config?.Labels ?? {};\n\t\tconst mountPath = labels[SANDBOX_LABEL_WORKSPACE_MOUNT] ?? DEFAULT_SANDBOX_WORKSPACE_MOUNT;\n\t\tconst mount = record.Mounts?.find((candidate) => candidate.Destination === mountPath);\n\t\tconst name = record.Name?.replace(/^\\//, \"\") ?? \"\";\n\t\treturn {\n\t\t\tid: record.Id ?? \"\",\n\t\t\tname,\n\t\t\timage: record.Config?.Image ?? \"\",\n\t\t\tstatus: record.State?.Status ?? \"\",\n\t\t\tstate: record.State?.Running ? \"running\" : record.State?.Status,\n\t\t\tcreatedAt: record.State?.StartedAt ?? record.Created,\n\t\t\tworkspaceRoot: mount?.Source,\n\t\t\tworkspaceMountPath: mount?.Destination ?? mountPath,\n\t\t\tdaemonPort,\n\t\t\tdaemonEndpoint: getEndpointFromPorts(record.NetworkSettings?.Ports, daemonPort),\n\t\t\tlabels,\n\t\t};\n\t});\n}\nfunction containerIdsMatch(left: string, right: string): boolean {\n\treturn left === right || left.startsWith(right) || right.startsWith(left);\n}\n\nfunction selectStopTarget(\n\tcontainers: SandboxContainer[],\n\ttarget: string | undefined,\n\tcurrentContainerId: string | undefined,\n): SandboxContainer | undefined {\n\tif (target) {\n\t\treturn containers.find((container) => containerIdsMatch(container.id, target) || container.name === target);\n\t}\n\tif (currentContainerId) {\n\t\tconst current = containers.find((container) => containerIdsMatch(container.id, currentContainerId));\n\t\tif (current) return current;\n\t}\n\treturn containers.length === 1 ? containers[0] : undefined;\n}\n"]}

package/dist/core/sandbox/lima.d.ts

@@ -0,0 +1,38 @@
+import type { SettingsManager } from "../settings-manager.ts";
+import type { DockerRunner, SandboxConfig, SandboxConfigOverrides, SandboxContainer, SandboxListOptions, SandboxStartOptions, SandboxStartResult, SandboxStopOptions, SandboxStopResult } from "./docker.ts";
+export interface ManagedLimaInstance {
+    workspaceRoot: string;
+    daemonPort: number;
+    ownerId?: string;
+    managed: boolean;
+}
+export interface LimaSandboxServiceOptions {
+    settingsManager?: Pick<SettingsManager, "getSandboxSettings">;
+    env?: NodeJS.ProcessEnv;
+    runner?: DockerRunner;
+    portAllocator?: (host: string, preferredPort: number) => Promise<number>;
+    readinessWaiter?: (host: string, port: number) => Promise<void>;
+    managedInstances?: Map<string, ManagedLimaInstance>;
+}
+export declare class LimaSandboxService {
+    private readonly settingsManager;
+    private readonly env;
+    private readonly runner;
+    private readonly portAllocator;
+    private readonly readinessWaiter;
+    private readonly managedInstances;
+    constructor(options?: LimaSandboxServiceOptions);
+    resolveConfig(overrides?: SandboxConfigOverrides): SandboxConfig;
+    private listRecords;
+    private startInstance;
+    private ensureGrip;
+    private startDaemon;
+    private prepareExistingInstance;
+    start(options: SandboxStartOptions): Promise<SandboxStartResult>;
+    list(options: SandboxListOptions): Promise<SandboxContainer[]>;
+    private stopDaemon;
+    private removeInstance;
+    stop(options: SandboxStopOptions): Promise<SandboxStopResult>;
+    stopManagedInstances(): Promise<void>;
+}
+//# sourceMappingURL=lima.d.ts.map

package/dist/core/sandbox/lima.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lima.d.ts","sourceRoot":"","sources":["../../../src/core/sandbox/lima.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAGX,YAAY,EACZ,aAAa,EACb,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,mBAAmB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACzC,eAAe,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CACpD;AAqKD,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0D;IAC1F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2D;IACzF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgD;IAChF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmC;IAEpE,YAAY,OAAO,GAAE,yBAA8B,EAOlD;IAED,aAAa,CAAC,SAAS,GAAE,sBAA2B,GAAG,aAAa,CAEnE;YAEa,WAAW;YAmBX,aAAa;YAuBb,UAAU;YAaV,WAAW;YAoBX,uBAAuB;IAiB/B,KAAK,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAyCrE;IAEK,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAQnE;YAEa,UAAU;YAOV,cAAc;IAKtB,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuBlE;IAEK,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAU1C;CACD","sourcesContent":["import { createHash, randomBytes } from \"node:crypto\";\nimport { createConnection } from \"node:net\";\nimport { basename, resolve } from \"node:path\";\nimport { VERSION } from \"../../config.ts\";\nimport { DAEMON_WEBSOCKET_PATH } from \"../../daemon/config.ts\";\nimport { spawnProcess } from \"../../utils/child-process.ts\";\nimport type { SettingsManager } from \"../settings-manager.ts\";\nimport type {\n\tDockerCommandOptions,\n\tDockerCommandResult,\n\tDockerRunner,\n\tSandboxConfig,\n\tSandboxConfigOverrides,\n\tSandboxContainer,\n\tSandboxListOptions,\n\tSandboxStartOptions,\n\tSandboxStartResult,\n\tSandboxStopOptions,\n\tSandboxStopResult,\n} from \"./docker.ts\";\nimport { allocateSandboxDaemonPort, redactSecrets, resolveSandboxConfig, SANDBOX_LABEL_PREFIX } from \"./docker.ts\";\nexport interface ManagedLimaInstance {\n\tworkspaceRoot: string;\n\tdaemonPort: number;\n\townerId?: string;\n\tmanaged: boolean;\n}\n\nexport interface LimaSandboxServiceOptions {\n\tsettingsManager?: Pick<SettingsManager, \"getSandboxSettings\">;\n\tenv?: NodeJS.ProcessEnv;\n\trunner?: DockerRunner;\n\tportAllocator?: (host: string, preferredPort: number) => Promise<number>;\n\treadinessWaiter?: (host: string, port: number) => Promise<void>;\n\tmanagedInstances?: Map<string, ManagedLimaInstance>;\n}\n\ninterface LimaMount {\n\tlocation?: string;\n\tmountPoint?: string;\n\twritable?: boolean;\n}\n\ninterface LimaPortForward {\n\tguestPort?: number;\n\thostPort?: number;\n\thostIP?: string;\n}\n\ninterface LimaConfig {\n\tmounts?: LimaMount[];\n\tportForwards?: LimaPortForward[];\n}\n\ninterface LimaListRecord {\n\tname?: string;\n\tstatus?: string;\n\tarch?: string;\n\tvmType?: string;\n\tdir?: string;\n\tconfig?: LimaConfig;\n}\n\nclass ProcessLimaRunner implements DockerRunner {\n\trun(command: string, args: string[], options: DockerCommandOptions = {}): Promise<DockerCommandResult> {\n\t\treturn new Promise((resolveCommand, reject) => {\n\t\t\tconst child = spawnProcess(command, args, {\n\t\t\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\n\t\t\t\tenv: { ...process.env, ...options.env },\n\t\t\t});\n\t\t\tlet stdout = \"\";\n\t\t\tlet stderr = \"\";\n\t\t\tchild.stdout?.on(\"data\", (chunk: Buffer) => {\n\t\t\t\tstdout += chunk.toString(\"utf8\");\n\t\t\t});\n\t\t\tchild.stderr?.on(\"data\", (chunk: Buffer) => {\n\t\t\t\tstderr += chunk.toString(\"utf8\");\n\t\t\t});\n\t\t\tchild.once(\"error\", reject);\n\t\t\tchild.once(\"close\", (exitCode) => resolveCommand({ exitCode, stdout, stderr }));\n\t\t});\n\t}\n}\n\nfunction shellQuote(value: string): string {\n\treturn `'${value.replaceAll(\"'\", `'\"'\"'`)}'`;\n}\n\nfunction parseLimaRecords(output: string): LimaListRecord[] {\n\tconst text = output.trim();\n\tif (!text) return [];\n\ttry {\n\t\tconst parsed = JSON.parse(text) as unknown;\n\t\treturn Array.isArray(parsed) ? (parsed as LimaListRecord[]) : [parsed as LimaListRecord];\n\t} catch {\n\t\treturn text\n\t\t\t.split(/\\r?\\n/)\n\t\t\t.filter(Boolean)\n\t\t\t.map((line) => JSON.parse(line) as LimaListRecord);\n\t}\n}\n\nfunction ensureLimaSuccessful(binary: string, result: DockerCommandResult, args: string[]): void {\n\tif (result.exitCode === 0) return;\n\tconst detail = result.stderr.trim() || result.stdout.trim() || `exit code ${result.exitCode ?? \"unknown\"}`;\n\tthrow new Error(redactSecrets(`Lima command failed: ${binary} ${args.join(\" \")}: ${detail}`));\n}\n\nfunction daemonConnectionHost(host: string): string {\n\tif (host === \"0.0.0.0\") return \"127.0.0.1\";\n\tif (host === \"::\") return \"::1\";\n\treturn host;\n}\n\nfunction urlHost(host: string): string {\n\treturn host.includes(\":\") && !host.startsWith(\"[\") ? `[${host}]` : host;\n}\n\nasync function canConnect(host: string, port: number): Promise<boolean> {\n\treturn new Promise((resolveConnection) => {\n\t\tconst socket = createConnection({ host, port });\n\t\tlet settled = false;\n\t\tconst finish = (connected: boolean): void => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tsocket.destroy();\n\t\t\tresolveConnection(connected);\n\t\t};\n\t\tsocket.setTimeout(250, () => finish(false));\n\t\tsocket.once(\"connect\", () => finish(true));\n\t\tsocket.once(\"error\", () => finish(false));\n\t});\n}\n\nasync function waitForLimaDaemon(host: string, port: number): Promise<void> {\n\tconst deadline = Date.now() + 30_000;\n\twhile (Date.now() < deadline) {\n\t\tif (await canConnect(daemonConnectionHost(host), port)) return;\n\t\tawait new Promise((resolveDelay) => setTimeout(resolveDelay, 100));\n\t}\n\tthrow new Error(`Lima sandbox daemon did not become reachable on ${daemonConnectionHost(host)}:${port}`);\n}\n\nfunction createInstanceName(\n\tconfig: SandboxConfig,\n\tworkspaceRoot: string,\n\tsessionId: string,\n\tdaemonPort: number,\n): string {\n\tconst clean = (value: string): string =>\n\t\tvalue\n\t\t\t.toLowerCase()\n\t\t\t.replace(/[^a-z0-9-]+/g, \"-\")\n\t\t\t.replace(/^-+|-+$/g, \"\") || \"workspace\";\n\tconst hash = createHash(\"sha256\").update(resolve(workspaceRoot)).digest(\"hex\").slice(0, 12);\n\treturn `${clean(config.limaInstanceNamePrefix)}-${clean(basename(resolve(workspaceRoot)))}-${hash}-${clean(sessionId).slice(0, 8).replace(/-+$/, \"\")}-p${daemonPort}-${randomBytes(4).toString(\"hex\")}`;\n}\n\nfunction findWorkspaceMount(record: LimaListRecord, workspaceMountPath: string): LimaMount | undefined {\n\treturn record.config?.mounts?.find((mount) => mount.mountPoint === workspaceMountPath);\n}\n\nfunction findDaemonForward(record: LimaListRecord, preferredPort?: number): LimaPortForward | undefined {\n\tconst namePort = Number(record.name?.match(/-p(\\d+)-[a-f0-9]+$/)?.[1]);\n\tconst daemonPort = Number.isInteger(namePort) && namePort > 0 ? namePort : preferredPort;\n\tconst forwards = record.config?.portForwards?.filter(\n\t\t(forward) => forward.guestPort === forward.hostPort && forward.hostPort !== undefined,\n\t);\n\treturn (\n\t\tforwards?.find((forward) => forward.guestPort === daemonPort) ??\n\t\t(forwards?.length === 1 ? forwards[0] : undefined)\n\t);\n}\n\nfunction toSandboxContainer(record: LimaListRecord, workspaceMountPath: string): SandboxContainer {\n\tconst mount = findWorkspaceMount(record, workspaceMountPath);\n\tconst forward = findDaemonForward(record);\n\tconst daemonEndpoint = forward?.hostPort\n\t\t? `ws://${urlHost(daemonConnectionHost(forward.hostIP || \"127.0.0.1\"))}:${forward.hostPort}${DAEMON_WEBSOCKET_PATH}`\n\t\t: undefined;\n\treturn {\n\t\tid: record.name ?? \"\",\n\t\tname: record.name ?? \"\",\n\t\timage: `lima:${record.vmType ?? \"vm\"}/${record.arch ?? \"unknown\"}`,\n\t\tstatus: record.status ?? \"\",\n\t\tstate: record.status?.toLowerCase(),\n\t\tcreatedAt: undefined,\n\t\tworkspaceRoot: mount?.location ? resolve(mount.location) : undefined,\n\t\tworkspaceMountPath: mount?.mountPoint,\n\t\tdaemonPort: forward?.guestPort,\n\t\tdaemonEndpoint,\n\t\tlabels: { [`${SANDBOX_LABEL_PREFIX}.runtime`]: \"lima\", [`${SANDBOX_LABEL_PREFIX}.version`]: VERSION },\n\t};\n}\n\nfunction selectLimaSandbox(instances: SandboxContainer[], target: string | undefined): SandboxContainer | undefined {\n\tif (!target) return instances.length === 1 ? instances[0] : undefined;\n\treturn instances.find((instance) => instance.name === target || instance.id.startsWith(target));\n}\n\nexport class LimaSandboxService {\n\tprivate readonly settingsManager: Pick<SettingsManager, \"getSandboxSettings\"> | undefined;\n\tprivate readonly env: NodeJS.ProcessEnv;\n\tprivate readonly runner: DockerRunner;\n\tprivate readonly portAllocator: (host: string, preferredPort: number) => Promise<number>;\n\tprivate readonly readinessWaiter: (host: string, port: number) => Promise<void>;\n\tprivate readonly managedInstances: Map<string, ManagedLimaInstance>;\n\n\tconstructor(options: LimaSandboxServiceOptions = {}) {\n\t\tthis.settingsManager = options.settingsManager;\n\t\tthis.env = options.env ?? process.env;\n\t\tthis.runner = options.runner ?? new ProcessLimaRunner();\n\t\tthis.portAllocator = options.portAllocator ?? allocateSandboxDaemonPort;\n\t\tthis.readinessWaiter = options.readinessWaiter ?? waitForLimaDaemon;\n\t\tthis.managedInstances = options.managedInstances ?? new Map();\n\t}\n\n\tresolveConfig(overrides: SandboxConfigOverrides = {}): SandboxConfig {\n\t\treturn resolveSandboxConfig(this.settingsManager?.getSandboxSettings(), this.env, overrides);\n\t}\n\n\tprivate async listRecords(config: SandboxConfig, name?: string): Promise<LimaListRecord[]> {\n\t\tconst args = [\"list\", \"--json\", ...(name ? [name] : [])];\n\t\ttry {\n\t\t\tconst result = await this.runner.run(config.limaBinary, args);\n\t\t\tif (\n\t\t\t\tname &&\n\t\t\t\tresult.exitCode !== 0 &&\n\t\t\t\t/unmatched|not found|does not exist/i.test(`${result.stderr}\\n${result.stdout}`)\n\t\t\t) {\n\t\t\t\treturn [];\n\t\t\t}\n\t\t\tensureLimaSuccessful(config.limaBinary, result, args);\n\t\t\treturn parseLimaRecords(result.stdout);\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(redactSecrets(`Lima is unavailable or not reachable via ${config.limaBinary}: ${message}`));\n\t\t}\n\t}\n\n\tprivate async startInstance(\n\t\tconfig: SandboxConfig,\n\t\tworkspaceRoot: string,\n\t\tname: string,\n\t\tdaemonPort: number,\n\t): Promise<void> {\n\t\tconst mountExpression = `.mounts = [{\"location\":${JSON.stringify(workspaceRoot)},\"mountPoint\":${JSON.stringify(config.workspaceMountPath)},\"writable\":true}]`;\n\t\tconst forwardExpression = `.portForwards += [{\"guestPort\":${daemonPort},\"hostPort\":${daemonPort},\"hostIP\":${JSON.stringify(config.daemonHostBind)}}]`;\n\t\tconst args = [\n\t\t\t\"start\",\n\t\t\t\"--tty=false\",\n\t\t\t\"--name\",\n\t\t\tname,\n\t\t\t\"--mount-none\",\n\t\t\t\"--set\",\n\t\t\tmountExpression,\n\t\t\t\"--set\",\n\t\t\tforwardExpression,\n\t\t\tconfig.limaTemplate,\n\t\t];\n\t\tensureLimaSuccessful(config.limaBinary, await this.runner.run(config.limaBinary, args), args);\n\t}\n\n\tprivate async ensureGrip(config: SandboxConfig, name: string, managed: boolean): Promise<void> {\n\t\tconst checkArgs = [\"shell\", \"--tty=false\", name, \"sh\", \"-lc\", \"command -v grip >/dev/null\"];\n\t\tconst check = await this.runner.run(config.limaBinary, checkArgs);\n\t\tif (check.exitCode === 0) return;\n\t\tif (!managed) {\n\t\t\tthrow new Error(`Lima instance ${name} does not provide grip; install @greppleai/grip in the VM first`);\n\t\t}\n\t\tconst packageSpec = `@greppleai/grip@${VERSION}`;\n\t\tconst script = `set -eu; sudo apt-get update; sudo DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs npm; sudo npm install -g ${shellQuote(packageSpec)}`;\n\t\tconst args = [\"shell\", \"--tty=false\", name, \"sh\", \"-lc\", script];\n\t\tensureLimaSuccessful(config.limaBinary, await this.runner.run(config.limaBinary, args), args);\n\t}\n\n\tprivate async startDaemon(config: SandboxConfig, name: string): Promise<string> {\n\t\tconst pidFile = `.cache/grip/sandbox-daemon-${config.daemonPort}.pid`;\n\t\tconst logFile = `.cache/grip/sandbox-daemon-${config.daemonPort}.log`;\n\t\tconst script = [\n\t\t\t\"set -eu\",\n\t\t\t`mkdir -p \"$HOME/.cache/grip\"`,\n\t\t\t`if test -f \"$HOME/${pidFile}\"; then old_pid=\"$(cat \"$HOME/${pidFile}\")\"; kill \"$old_pid\" 2>/dev/null || true; fi`,\n\t\t\t`token=\"$(head -c 32 /dev/urandom | base64 | tr -d '\\\\n')\"`,\n\t\t\t`nohup env GRIP_DAEMON_TOKEN=\"$token\" grip --daemon --daemon-host 127.0.0.1 --daemon-allow-insecure-transport --daemon-port ${config.daemonPort} --daemon-cwd ${shellQuote(config.workspaceMountPath)} --daemon-allow-root --daemon-allow-process-exec >\"$HOME/${logFile}\" 2>&1 </dev/null &`,\n\t\t\t`echo $! >\"$HOME/${pidFile}\"`,\n\t\t\t`printf 'GRIP_SANDBOX_TOKEN=%s\\\\n' \"$token\"`,\n\t\t].join(\"\\n\");\n\t\tconst args = [\"shell\", \"--tty=false\", \"--workdir\", config.workspaceMountPath, name, \"sh\", \"-lc\", script];\n\t\tconst result = await this.runner.run(config.limaBinary, args);\n\t\tensureLimaSuccessful(config.limaBinary, result, args);\n\t\tconst token = result.stdout.match(/(?:^|\\n)GRIP_SANDBOX_TOKEN=([^\\r\\n]+)/)?.[1];\n\t\tif (!token) throw new Error(`Lima instance ${name} started the daemon without returning an authentication token`);\n\t\treturn token;\n\t}\n\n\tprivate async prepareExistingInstance(\n\t\tconfig: SandboxConfig,\n\t\trecord: LimaListRecord,\n\t\tname: string,\n\t\tworkspaceRoot: string,\n\t): Promise<void> {\n\t\tconst mount = findWorkspaceMount(record, config.workspaceMountPath);\n\t\tif (!mount || resolve(mount.location ?? \"\") !== workspaceRoot || !mount.writable) {\n\t\t\tthrow new Error(\n\t\t\t\t`Lima instance ${name} must mount ${workspaceRoot} read-write at ${config.workspaceMountPath}`,\n\t\t\t);\n\t\t}\n\t\tif (record.status?.toLowerCase() === \"running\") return;\n\t\tconst args = [\"start\", \"--tty=false\", name];\n\t\tensureLimaSuccessful(config.limaBinary, await this.runner.run(config.limaBinary, args), args);\n\t}\n\n\tasync start(options: SandboxStartOptions): Promise<SandboxStartResult> {\n\t\tif (options.image) throw new Error(\"Docker images are not supported by the Lima sandbox runtime\");\n\t\tconst workspaceRoot = resolve(options.workspaceRoot);\n\t\tconst config = this.resolveConfig(options);\n\t\tconst requestedName = options.name?.trim();\n\t\tconst records = requestedName ? await this.listRecords(config, requestedName) : [];\n\t\tconst managed = !requestedName;\n\t\tconst existing = records[0];\n\t\tif (existing) await this.prepareExistingInstance(config, existing, requestedName!, workspaceRoot);\n\t\tconst configuredForward = existing ? findDaemonForward(existing, config.daemonPort) : undefined;\n\t\tif (configuredForward && configuredForward.guestPort !== configuredForward.hostPort) {\n\t\t\tthrow new Error(\n\t\t\t\t`Lima instance ${requestedName} must forward the sandbox daemon on the same guest and host port`,\n\t\t\t);\n\t\t}\n\t\tconst daemonPort =\n\t\t\tconfiguredForward?.hostPort ?? (await this.portAllocator(config.daemonHostBind, config.daemonPort));\n\t\tconst name =\n\t\t\trequestedName ?? createInstanceName(config, workspaceRoot, options.sessionId ?? \"session\", daemonPort);\n\t\tconst effectiveConfig = { ...config, daemonPort };\n\t\tif (!existing) await this.startInstance(effectiveConfig, workspaceRoot, name, daemonPort);\n\t\ttry {\n\t\t\tawait this.ensureGrip(effectiveConfig, name, !existing);\n\t\t\tconst token = await this.startDaemon(effectiveConfig, name);\n\t\t\tthis.managedInstances.set(name, { workspaceRoot, daemonPort, ownerId: options.sessionId, managed });\n\t\t\tawait this.readinessWaiter(config.daemonHostBind, daemonPort);\n\t\t\tconst daemonUrl = `ws://${urlHost(daemonConnectionHost(config.daemonHostBind))}:${daemonPort}${DAEMON_WEBSOCKET_PATH}`;\n\t\t\treturn {\n\t\t\t\tcontainerId: name,\n\t\t\t\tcontainerName: name,\n\t\t\t\tworkspaceRoot,\n\t\t\t\tworkspaceMountPath: config.workspaceMountPath,\n\t\t\t\tdaemonUrl,\n\t\t\t\tdaemonUrlRedacted: daemonUrl,\n\t\t\t\ttoken,\n\t\t\t\tlabels: { [`${SANDBOX_LABEL_PREFIX}.runtime`]: \"lima\", [`${SANDBOX_LABEL_PREFIX}.version`]: VERSION },\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tif (!existing) await this.removeInstance(effectiveConfig, name).catch(() => undefined);\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync list(options: SandboxListOptions): Promise<SandboxContainer[]> {\n\t\tconst config = this.resolveConfig();\n\t\tconst workspaceRoot = resolve(options.workspaceRoot);\n\t\treturn (await this.listRecords(config))\n\t\t\t.map((record) => toSandboxContainer(record, config.workspaceMountPath))\n\t\t\t.filter(\n\t\t\t\t(instance) => instance.workspaceRoot && (options.allWorkspaces || instance.workspaceRoot === workspaceRoot),\n\t\t\t);\n\t}\n\n\tprivate async stopDaemon(config: SandboxConfig, name: string, daemonPort: number): Promise<void> {\n\t\tconst pidFile = `.cache/grip/sandbox-daemon-${daemonPort}.pid`;\n\t\tconst script = `if test -f \"$HOME/${pidFile}\"; then pid=\"$(cat \"$HOME/${pidFile}\")\"; kill \"$pid\" 2>/dev/null || true; rm -f \"$HOME/${pidFile}\"; fi`;\n\t\tconst args = [\"shell\", \"--tty=false\", name, \"sh\", \"-lc\", script];\n\t\tensureLimaSuccessful(config.limaBinary, await this.runner.run(config.limaBinary, args), args);\n\t}\n\n\tprivate async removeInstance(config: SandboxConfig, name: string): Promise<void> {\n\t\tconst args = [\"delete\", \"--force\", name];\n\t\tensureLimaSuccessful(config.limaBinary, await this.runner.run(config.limaBinary, args), args);\n\t}\n\n\tasync stop(options: SandboxStopOptions): Promise<SandboxStopResult> {\n\t\tconst config = this.resolveConfig();\n\t\tconst instances = await this.list({ workspaceRoot: options.workspaceRoot });\n\t\tconst selected = selectLimaSandbox(instances, options.target ?? options.currentContainerId);\n\t\tif (!selected) return { status: \"not-found\", message: \"No matching Grip Lima sandbox found\" };\n\t\tconst tracked = this.managedInstances.get(selected.name);\n\t\tconst ownsInstance = tracked?.managed ?? selected.name.startsWith(`${config.limaInstanceNamePrefix}-`);\n\t\tif (selected.state !== \"running\") {\n\t\t\tif (ownsInstance && config.cleanup === \"remove\") {\n\t\t\t\tawait this.removeInstance(config, selected.name);\n\t\t\t\tthis.managedInstances.delete(selected.name);\n\t\t\t\treturn { status: \"removed\", container: selected };\n\t\t\t}\n\t\t\tthis.managedInstances.delete(selected.name);\n\t\t\treturn { status: \"already-stopped\", container: selected };\n\t\t}\n\t\tawait this.stopDaemon(config, selected.name, tracked?.daemonPort ?? selected.daemonPort ?? config.daemonPort);\n\t\tif (ownsInstance) {\n\t\t\tconst args = config.cleanup === \"remove\" ? [\"delete\", \"--force\", selected.name] : [\"stop\", selected.name];\n\t\t\tensureLimaSuccessful(config.limaBinary, await this.runner.run(config.limaBinary, args), args);\n\t\t}\n\t\tthis.managedInstances.delete(selected.name);\n\t\treturn { status: ownsInstance && config.cleanup === \"remove\" ? \"removed\" : \"stopped\", container: selected };\n\t}\n\n\tasync stopManagedInstances(): Promise<void> {\n\t\tconst failures: unknown[] = [];\n\t\tfor (const [name, instance] of [...this.managedInstances]) {\n\t\t\ttry {\n\t\t\t\tawait this.stop({ workspaceRoot: instance.workspaceRoot, target: name, currentContainerId: name });\n\t\t\t} catch (error) {\n\t\t\t\tfailures.push(error);\n\t\t\t}\n\t\t}\n\t\tif (failures.length > 0) throw new AggregateError(failures, \"Failed to stop managed Lima sandbox instances\");\n\t}\n}\n"]}

package/dist/core/sandbox/lima.js

@@ -0,0 +1,324 @@
+import { createHash, randomBytes } from "node:crypto";
+import { createConnection } from "node:net";
+import { basename, resolve } from "node:path";
+import { VERSION } from "../../config.js";
+import { DAEMON_WEBSOCKET_PATH } from "../../daemon/config.js";
+import { spawnProcess } from "../../utils/child-process.js";
+import { allocateSandboxDaemonPort, redactSecrets, resolveSandboxConfig, SANDBOX_LABEL_PREFIX } from "./docker.js";
+class ProcessLimaRunner {
+    run(command, args, options = {}) {
+        return new Promise((resolveCommand, reject) => {
+            const child = spawnProcess(command, args, {
+                stdio: ["ignore", "pipe", "pipe"],
+                env: { ...process.env, ...options.env },
+            });
+            let stdout = "";
+            let stderr = "";
+            child.stdout?.on("data", (chunk) => {
+                stdout += chunk.toString("utf8");
+            });
+            child.stderr?.on("data", (chunk) => {
+                stderr += chunk.toString("utf8");
+            });
+            child.once("error", reject);
+            child.once("close", (exitCode) => resolveCommand({ exitCode, stdout, stderr }));
+        });
+    }
+}
+function shellQuote(value) {
+    return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function parseLimaRecords(output) {
+    const text = output.trim();
+    if (!text)
+        return [];
+    try {
+        const parsed = JSON.parse(text);
+        return Array.isArray(parsed) ? parsed : [parsed];
+    }
+    catch {
+        return text
+            .split(/\r?\n/)
+            .filter(Boolean)
+            .map((line) => JSON.parse(line));
+    }
+}
+function ensureLimaSuccessful(binary, result, args) {
+    if (result.exitCode === 0)
+        return;
+    const detail = result.stderr.trim() || result.stdout.trim() || `exit code ${result.exitCode ?? "unknown"}`;
+    throw new Error(redactSecrets(`Lima command failed: ${binary} ${args.join(" ")}: ${detail}`));
+}
+function daemonConnectionHost(host) {
+    if (host === "0.0.0.0")
+        return "127.0.0.1";
+    if (host === "::")
+        return "::1";
+    return host;
+}
+function urlHost(host) {
+    return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+}
+async function canConnect(host, port) {
+    return new Promise((resolveConnection) => {
+        const socket = createConnection({ host, port });
+        let settled = false;
+        const finish = (connected) => {
+            if (settled)
+                return;
+            settled = true;
+            socket.destroy();
+            resolveConnection(connected);
+        };
+        socket.setTimeout(250, () => finish(false));
+        socket.once("connect", () => finish(true));
+        socket.once("error", () => finish(false));
+    });
+}
+async function waitForLimaDaemon(host, port) {
+    const deadline = Date.now() + 30_000;
+    while (Date.now() < deadline) {
+        if (await canConnect(daemonConnectionHost(host), port))
+            return;
+        await new Promise((resolveDelay) => setTimeout(resolveDelay, 100));
+    }
+    throw new Error(`Lima sandbox daemon did not become reachable on ${daemonConnectionHost(host)}:${port}`);
+}
+function createInstanceName(config, workspaceRoot, sessionId, daemonPort) {
+    const clean = (value) => value
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, "-")
+        .replace(/^-+|-+$/g, "") || "workspace";
+    const hash = createHash("sha256").update(resolve(workspaceRoot)).digest("hex").slice(0, 12);
+    return `${clean(config.limaInstanceNamePrefix)}-${clean(basename(resolve(workspaceRoot)))}-${hash}-${clean(sessionId).slice(0, 8).replace(/-+$/, "")}-p${daemonPort}-${randomBytes(4).toString("hex")}`;
+}
+function findWorkspaceMount(record, workspaceMountPath) {
+    return record.config?.mounts?.find((mount) => mount.mountPoint === workspaceMountPath);
+}
+function findDaemonForward(record, preferredPort) {
+    const namePort = Number(record.name?.match(/-p(\d+)-[a-f0-9]+$/)?.[1]);
+    const daemonPort = Number.isInteger(namePort) && namePort > 0 ? namePort : preferredPort;
+    const forwards = record.config?.portForwards?.filter((forward) => forward.guestPort === forward.hostPort && forward.hostPort !== undefined);
+    return (forwards?.find((forward) => forward.guestPort === daemonPort) ??
+        (forwards?.length === 1 ? forwards[0] : undefined));
+}
+function toSandboxContainer(record, workspaceMountPath) {
+    const mount = findWorkspaceMount(record, workspaceMountPath);
+    const forward = findDaemonForward(record);
+    const daemonEndpoint = forward?.hostPort
+        ? `ws://${urlHost(daemonConnectionHost(forward.hostIP || "127.0.0.1"))}:${forward.hostPort}${DAEMON_WEBSOCKET_PATH}`
+        : undefined;
+    return {
+        id: record.name ?? "",
+        name: record.name ?? "",
+        image: `lima:${record.vmType ?? "vm"}/${record.arch ?? "unknown"}`,
+        status: record.status ?? "",
+        state: record.status?.toLowerCase(),
+        createdAt: undefined,
+        workspaceRoot: mount?.location ? resolve(mount.location) : undefined,
+        workspaceMountPath: mount?.mountPoint,
+        daemonPort: forward?.guestPort,
+        daemonEndpoint,
+        labels: { [`${SANDBOX_LABEL_PREFIX}.runtime`]: "lima", [`${SANDBOX_LABEL_PREFIX}.version`]: VERSION },
+    };
+}
+function selectLimaSandbox(instances, target) {
+    if (!target)
+        return instances.length === 1 ? instances[0] : undefined;
+    return instances.find((instance) => instance.name === target || instance.id.startsWith(target));
+}
+export class LimaSandboxService {
+    settingsManager;
+    env;
+    runner;
+    portAllocator;
+    readinessWaiter;
+    managedInstances;
+    constructor(options = {}) {
+        this.settingsManager = options.settingsManager;
+        this.env = options.env ?? process.env;
+        this.runner = options.runner ?? new ProcessLimaRunner();
+        this.portAllocator = options.portAllocator ?? allocateSandboxDaemonPort;
+        this.readinessWaiter = options.readinessWaiter ?? waitForLimaDaemon;
+        this.managedInstances = options.managedInstances ?? new Map();
+    }
+    resolveConfig(overrides = {}) {
+        return resolveSandboxConfig(this.settingsManager?.getSandboxSettings(), this.env, overrides);
+    }
+    async listRecords(config, name) {
+        const args = ["list", "--json", ...(name ? [name] : [])];
+        try {
+            const result = await this.runner.run(config.limaBinary, args);
+            if (name &&
+                result.exitCode !== 0 &&
+                /unmatched|not found|does not exist/i.test(`${result.stderr}\n${result.stdout}`)) {
+                return [];
+            }
+            ensureLimaSuccessful(config.limaBinary, result, args);
+            return parseLimaRecords(result.stdout);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            throw new Error(redactSecrets(`Lima is unavailable or not reachable via ${config.limaBinary}: ${message}`));
+        }
+    }
+    async startInstance(config, workspaceRoot, name, daemonPort) {
+        const mountExpression = `.mounts = [{"location":${JSON.stringify(workspaceRoot)},"mountPoint":${JSON.stringify(config.workspaceMountPath)},"writable":true}]`;
+        const forwardExpression = `.portForwards += [{"guestPort":${daemonPort},"hostPort":${daemonPort},"hostIP":${JSON.stringify(config.daemonHostBind)}}]`;
+        const args = [
+            "start",
+            "--tty=false",
+            "--name",
+            name,
+            "--mount-none",
+            "--set",
+            mountExpression,
+            "--set",
+            forwardExpression,
+            config.limaTemplate,
+        ];
+        ensureLimaSuccessful(config.limaBinary, await this.runner.run(config.limaBinary, args), args);
+    }
+    async ensureGrip(config, name, managed) {
+        const checkArgs = ["shell", "--tty=false", name, "sh", "-lc", "command -v grip >/dev/null"];
+        const check = await this.runner.run(config.limaBinary, checkArgs);
+        if (check.exitCode === 0)
+            return;
+        if (!managed) {
+            throw new Error(`Lima instance ${name} does not provide grip; install @greppleai/grip in the VM first`);
+        }
+        const packageSpec = `@greppleai/grip@${VERSION}`;
+        const script = `set -eu; sudo apt-get update; sudo DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs npm; sudo npm install -g ${shellQuote(packageSpec)}`;
+        const args = ["shell", "--tty=false", name, "sh", "-lc", script];
+        ensureLimaSuccessful(config.limaBinary, await this.runner.run(config.limaBinary, args), args);
+    }
+    async startDaemon(config, name) {
+        const pidFile = `.cache/grip/sandbox-daemon-${config.daemonPort}.pid`;
+        const logFile = `.cache/grip/sandbox-daemon-${config.daemonPort}.log`;
+        const script = [
+            "set -eu",
+            `mkdir -p "$HOME/.cache/grip"`,
+            `if test -f "$HOME/${pidFile}"; then old_pid="$(cat "$HOME/${pidFile}")"; kill "$old_pid" 2>/dev/null || true; fi`,
+            `token="$(head -c 32 /dev/urandom | base64 | tr -d '\\n')"`,
+            `nohup env GRIP_DAEMON_TOKEN="$token" grip --daemon --daemon-host 127.0.0.1 --daemon-allow-insecure-transport --daemon-port ${config.daemonPort} --daemon-cwd ${shellQuote(config.workspaceMountPath)} --daemon-allow-root --daemon-allow-process-exec >"$HOME/${logFile}" 2>&1 </dev/null &`,
+            `echo $! >"$HOME/${pidFile}"`,
+            `printf 'GRIP_SANDBOX_TOKEN=%s\\n' "$token"`,
+        ].join("\n");
+        const args = ["shell", "--tty=false", "--workdir", config.workspaceMountPath, name, "sh", "-lc", script];
+        const result = await this.runner.run(config.limaBinary, args);
+        ensureLimaSuccessful(config.limaBinary, result, args);
+        const token = result.stdout.match(/(?:^|\n)GRIP_SANDBOX_TOKEN=([^\r\n]+)/)?.[1];
+        if (!token)
+            throw new Error(`Lima instance ${name} started the daemon without returning an authentication token`);
+        return token;
+    }
+    async prepareExistingInstance(config, record, name, workspaceRoot) {
+        const mount = findWorkspaceMount(record, config.workspaceMountPath);
+        if (!mount || resolve(mount.location ?? "") !== workspaceRoot || !mount.writable) {
+            throw new Error(`Lima instance ${name} must mount ${workspaceRoot} read-write at ${config.workspaceMountPath}`);
+        }
+        if (record.status?.toLowerCase() === "running")
+            return;
+        const args = ["start", "--tty=false", name];
+        ensureLimaSuccessful(config.limaBinary, await this.runner.run(config.limaBinary, args), args);
+    }
+    async start(options) {
+        if (options.image)
+            throw new Error("Docker images are not supported by the Lima sandbox runtime");
+        const workspaceRoot = resolve(options.workspaceRoot);
+        const config = this.resolveConfig(options);
+        const requestedName = options.name?.trim();
+        const records = requestedName ? await this.listRecords(config, requestedName) : [];
+        const managed = !requestedName;
+        const existing = records[0];
+        if (existing)
+            await this.prepareExistingInstance(config, existing, requestedName, workspaceRoot);
+        const configuredForward = existing ? findDaemonForward(existing, config.daemonPort) : undefined;
+        if (configuredForward && configuredForward.guestPort !== configuredForward.hostPort) {
+            throw new Error(`Lima instance ${requestedName} must forward the sandbox daemon on the same guest and host port`);
+        }
+        const daemonPort = configuredForward?.hostPort ?? (await this.portAllocator(config.daemonHostBind, config.daemonPort));
+        const name = requestedName ?? createInstanceName(config, workspaceRoot, options.sessionId ?? "session", daemonPort);
+        const effectiveConfig = { ...config, daemonPort };
+        if (!existing)
+            await this.startInstance(effectiveConfig, workspaceRoot, name, daemonPort);
+        try {
+            await this.ensureGrip(effectiveConfig, name, !existing);
+            const token = await this.startDaemon(effectiveConfig, name);
+            this.managedInstances.set(name, { workspaceRoot, daemonPort, ownerId: options.sessionId, managed });
+            await this.readinessWaiter(config.daemonHostBind, daemonPort);
+            const daemonUrl = `ws://${urlHost(daemonConnectionHost(config.daemonHostBind))}:${daemonPort}${DAEMON_WEBSOCKET_PATH}`;
+            return {
+                containerId: name,
+                containerName: name,
+                workspaceRoot,
+                workspaceMountPath: config.workspaceMountPath,
+                daemonUrl,
+                daemonUrlRedacted: daemonUrl,
+                token,
+                labels: { [`${SANDBOX_LABEL_PREFIX}.runtime`]: "lima", [`${SANDBOX_LABEL_PREFIX}.version`]: VERSION },
+            };
+        }
+        catch (error) {
+            if (!existing)
+                await this.removeInstance(effectiveConfig, name).catch(() => undefined);
+            throw error;
+        }
+    }
+    async list(options) {
+        const config = this.resolveConfig();
+        const workspaceRoot = resolve(options.workspaceRoot);
+        return (await this.listRecords(config))
+            .map((record) => toSandboxContainer(record, config.workspaceMountPath))
+            .filter((instance) => instance.workspaceRoot && (options.allWorkspaces || instance.workspaceRoot === workspaceRoot));
+    }
+    async stopDaemon(config, name, daemonPort) {
+        const pidFile = `.cache/grip/sandbox-daemon-${daemonPort}.pid`;
+        const script = `if test -f "$HOME/${pidFile}"; then pid="$(cat "$HOME/${pidFile}")"; kill "$pid" 2>/dev/null || true; rm -f "$HOME/${pidFile}"; fi`;
+        const args = ["shell", "--tty=false", name, "sh", "-lc", script];
+        ensureLimaSuccessful(config.limaBinary, await this.runner.run(config.limaBinary, args), args);
+    }
+    async removeInstance(config, name) {
+        const args = ["delete", "--force", name];
+        ensureLimaSuccessful(config.limaBinary, await this.runner.run(config.limaBinary, args), args);
+    }
+    async stop(options) {
+        const config = this.resolveConfig();
+        const instances = await this.list({ workspaceRoot: options.workspaceRoot });
+        const selected = selectLimaSandbox(instances, options.target ?? options.currentContainerId);
+        if (!selected)
+            return { status: "not-found", message: "No matching Grip Lima sandbox found" };
+        const tracked = this.managedInstances.get(selected.name);
+        const ownsInstance = tracked?.managed ?? selected.name.startsWith(`${config.limaInstanceNamePrefix}-`);
+        if (selected.state !== "running") {
+            if (ownsInstance && config.cleanup === "remove") {
+                await this.removeInstance(config, selected.name);
+                this.managedInstances.delete(selected.name);
+                return { status: "removed", container: selected };
+            }
+            this.managedInstances.delete(selected.name);
+            return { status: "already-stopped", container: selected };
+        }
+        await this.stopDaemon(config, selected.name, tracked?.daemonPort ?? selected.daemonPort ?? config.daemonPort);
+        if (ownsInstance) {
+            const args = config.cleanup === "remove" ? ["delete", "--force", selected.name] : ["stop", selected.name];
+            ensureLimaSuccessful(config.limaBinary, await this.runner.run(config.limaBinary, args), args);
+        }
+        this.managedInstances.delete(selected.name);
+        return { status: ownsInstance && config.cleanup === "remove" ? "removed" : "stopped", container: selected };
+    }
+    async stopManagedInstances() {
+        const failures = [];
+        for (const [name, instance] of [...this.managedInstances]) {
+            try {
+                await this.stop({ workspaceRoot: instance.workspaceRoot, target: name, currentContainerId: name });
+            }
+            catch (error) {
+                failures.push(error);
+            }
+        }
+        if (failures.length > 0)
+            throw new AggregateError(failures, "Failed to stop managed Lima sandbox instances");
+    }
+}
+//# sourceMappingURL=lima.js.map