@greppleai/grip 0.0.1 → 0.1.4

package/dist/core/sandbox/docker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../../src/core/sandbox/docker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,uCAAuC,CAAC;AAC7E,MAAM,CAAC,MAAM,+BAA+B,GAAG,YAAY,CAAC;AAC5D,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,6BAA6B,GAAG,QAAQ,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC;AACrD,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AACxD,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,oBAAoB,UAAU,CAAC;AACvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,oBAAoB,iBAAiB,CAAC;AACrF,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,oBAAoB,kBAAkB,CAAC;AACvF,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,oBAAoB,cAAc,CAAC;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,oBAAoB,YAAY,CAAC;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,oBAAoB,UAAU,CAAC;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,oBAAoB,UAAU,CAAC;AAEvE,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAAU,CAAC;AACrD,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,+BAA+B,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,MAAM,OAAO,CAAC,CAAC;AAC/G,IAAI,iBAAiB,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;AAEzD,SAAS,cAAc,CAAC,GAAW,EAAW;IAC7C,IAAI,CAAC;QACJ,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;IAC5E,CAAC;AAAA,CACD;AACD,KAAK,UAAU,sBAAsB,GAAqB;IACzD,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAsB,CAAC;QAC3F,OAAO,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACR,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;AAAA,CACD;AAED,KAAK,UAAU,sBAAsB,GAAiC;IACrE,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YACpE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACJ,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAwB,CAAC;oBAC/F,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;wBAAE,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;gBAChE,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YAAA,CACV,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzF,MAAM,KAAK,GAAG,MAAM,sBAAsB,EAAE,CAAC;YAC7C,IAAI,KAAK,EAAE,CAAC;gBACX,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACzD,SAAS;YACV,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;AAAA,CACjF;AAED,KAAK,UAAU,oBAAoB,CAAI,SAA2B,EAAc;IAC/E,MAAM,QAAQ,GAAG,iBAAiB,CAAC;IACnC,IAAI,OAAoB,CAAC;IACzB,iBAAiB,GAAG,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QACvD,OAAO,GAAG,YAAY,CAAC;IAAA,CACvB,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC;IACf,IAAI,eAAkD,CAAC;IACvD,IAAI,CAAC;QACJ,eAAe,GAAG,MAAM,sBAAsB,EAAE,CAAC;QACjD,OAAO,MAAM,SAAS,EAAE,CAAC;IAC1B,CAAC;YAAS,CAAC;QACV,IAAI,CAAC;YACJ,MAAM,eAAe,EAAE,EAAE,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACV,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;AAAA,CACD;AAkLD,MAAM,mBAAmB;IACxB,GAAG,CAAC,OAAe,EAAE,IAAc,EAAE,OAAO,GAAyB,EAAE,EAAgC;QACtG,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE;gBACzC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;aACvC,CAAC,CAAC;YACH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAA,CACjC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAA,CACjC,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAAA,CAChF,CAAC,CAAC;IAAA,CACH;CACD;AAED,SAAS,QAAQ,CAAC,KAAyB,EAAsB;IAChE,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CACrC;AAED,SAAS,YAAY,CAAC,KAAyB,EAAE,WAAmB,EAA8B;IACjG,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,IAAI,KAAK,CAAC,WAAW,WAAW,2BAA2B,CAAC,CAAC;AAAA,CACnE;AAED,SAAS,oBAAoB,CAAC,KAAkC,EAAE,WAAmB,EAAsB;IAC1G,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,WAAW,8BAA8B,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,KAAK,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,WAAW,WAAW,mCAAmC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,YAAY,CAAC,KAAyB,EAAE,WAAmB,EAAsC;IACzG,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,IAAI,KAAK,CAAC,WAAW,WAAW,2BAA2B,CAAC,CAAC;AAAA,CACnE;AAED,SAAS,WAAW,CAAC,IAAwB,EAA0B;IACtE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,SAAS,KAAK,CAAC,CAAC;YAAE,SAAS;QAC/B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,mBAAmB,CAAC,KAAa,EAAU;IACnD,MAAM,SAAS,GAAG,KAAK;SACrB,WAAW,EAAE;SACb,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC1B,OAAO,SAAS,IAAI,WAAW,CAAC;AAAA,CAChC;AAED,SAAS,gBAAgB,CAAC,aAAqB,EAAU;IACxD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAAA,CACtF;AAED,SAAS,WAAW,GAAuB;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAAA,CACnD;AAED,SAAS,aAAa,GAAW;IAChC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAAA,CAC7C;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,IAAY,EAA+B;IACtF,OAAO,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,YAAY,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACvF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;QAAA,CAC9C,CAAC,CAAC;IAAA,CACH,CAAC,CAAC;AAAA,CACH;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAAY,EAAE,aAAqB,EAAmB;IACrG,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;IACnG,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY,EAAoB;IACvE,OAAO,IAAI,OAAO,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,SAAkB,EAAQ,EAAE,CAAC;YAC5C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAAA,CAC7B,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAAA,CAC1C,CAAC,CAAC;AAAA,CACH;AAED,KAAK,UAAU,wBAAwB,CAAC,IAAY,EAAE,IAAY,EAAiB;IAClF,MAAM,WAAW,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC9B,IAAI,MAAM,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC;YAAE,OAAO;QAChD,MAAM,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,WAAW,IAAI,IAAI,oBAAoB,CAAC,CAAC;AAAA,CACxF;AAED,SAAS,gBAAgB,CAAC,MAA2B,EAAE,IAAc,EAAQ;IAC5E,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,aAAa,MAAM,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;IAC3G,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,iCAAiC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;AAAA,CAC7F;AAED,SAAS,cAAc,CAAI,IAAY,EAAO;IAC7C,OAAO,IAAI;SACT,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC,CAAC;AAAA,CACvC;AAED,SAAS,cAAc,CAAI,IAAY,EAAO;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;IAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAc,CAAC,CAAC,CAAC,CAAC,MAAW,CAAC,CAAC;AAAA,CAC/D;AAED,SAAS,oBAAoB,CAC5B,KAAoE,EACpE,UAAkB,EACG;IACrB,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,GAAG,UAAU,MAAM,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,QAAQ;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC;IACjE,OAAO,QAAQ,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,GAAG,qBAAqB,EAAE,CAAC;AAAA,CAC3E;AAED,MAAM,UAAU,aAAa,CAAC,KAAa,EAAU;IACpD,OAAO,KAAK;SACV,OAAO,CAAC,+BAA+B,EAAE,cAAc,CAAC;SACxD,OAAO,CAAC,6BAA6B,EAAE,cAAc,CAAC;SACtD,OAAO,CAAC,wCAAwC,EAAE,cAAc,CAAC;SACjE,OAAO,CAAC,uBAAuB,EAAE,cAAc,CAAC,CAAC;AAAA,CACnD;AAED,MAAM,UAAU,oBAAoB,CACnC,QAAqC,EACrC,GAAG,GAAuB,EAAE,EAC5B,SAAS,GAA2B,EAAE,EACtB;IAChB,MAAM,OAAO,GACZ,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC;QAClD,YAAY,CAAC,GAAG,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;QAC9D,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC;QAClD,QAAQ,CAAC;IACV,MAAM,KAAK,GACV,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;QACzB,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAChC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;QACzB,qBAAqB,CAAC;IACvB,MAAM,YAAY,GACjB,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC;QAChC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACjC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;QAChC,6BAA6B,CAAC;IAC/B,MAAM,UAAU,GACf,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC;QAC9B,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC/B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC9B,2BAA2B,CAAC;IAC7B,MAAM,YAAY,GACjB,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC;QAChC,QAAQ,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACxC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;QAChC,6BAA6B,CAAC;IAC/B,MAAM,sBAAsB,GAC3B,QAAQ,CAAC,SAAS,CAAC,sBAAsB,CAAC;QAC1C,QAAQ,CAAC,GAAG,CAAC,iCAAiC,CAAC;QAC/C,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;QAC1C,cAAc,CAAC;IAChB,MAAM,kBAAkB,GACvB,QAAQ,CAAC,SAAS,CAAC,kBAAkB,CAAC;QACtC,QAAQ,CAAC,GAAG,CAAC,4BAA4B,CAAC;QAC1C,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QACtC,+BAA+B,CAAC;IACjC,MAAM,mBAAmB,GACxB,QAAQ,CAAC,SAAS,CAAC,mBAAmB,CAAC;QACvC,QAAQ,CAAC,GAAG,CAAC,6BAA6B,CAAC;QAC3C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;QACvC,cAAc,CAAC;IAChB,MAAM,UAAU,GACf,SAAS,CAAC,UAAU;QACpB,oBAAoB,CAAC,GAAG,CAAC,wBAAwB,EAAE,0BAA0B,CAAC;QAC9E,oBAAoB,CAAC,QAAQ,EAAE,UAAU,EAAE,oBAAoB,CAAC;QAChE,2BAA2B,CAAC;IAC7B,MAAM,cAAc,GACnB,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC;QAClC,QAAQ,CAAC,GAAG,CAAC,6BAA6B,CAAC;QAC3C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;QAClC,WAAW,CAAC;IACb,MAAM,OAAO,GACZ,SAAS,CAAC,OAAO;QACjB,YAAY,CAAC,GAAG,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;QAC9D,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC;QAClD,MAAM,CAAC;IACR,OAAO;QACN,OAAO;QACP,KAAK;QACL,YAAY;QACZ,UAAU;QACV,YAAY;QACZ,sBAAsB;QACtB,kBAAkB;QAClB,mBAAmB;QACnB,UAAU;QACV,cAAc;QACd,OAAO;QACP,QAAQ,EAAE,WAAW,EAAE;KACvB,CAAC;AAAA,CACF;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAU;IAChD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,CACxE;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAU;IACnD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAC3C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,SAAS,OAAO,CAAC,IAAY,EAAU;IACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,CACxE;AAED,MAAM,UAAU,mBAAmB,CAClC,MAAqB,EACrB,aAAqB,EACrB,SAAiB,EACQ;IACzB,MAAM,MAAM,GAA2B;QACtC,CAAC,qBAAqB,CAAC,EAAE,MAAM;QAC/B,CAAC,4BAA4B,CAAC,EAAE,gBAAgB,CAAC,aAAa,CAAC;QAC/D,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAC,kBAAkB;QAC1D,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;QACtD,CAAC,qBAAqB,CAAC,EAAE,OAAO;QAChC,CAAC,qBAAqB,CAAC,EAAE,SAAS;KAClC,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;IACvE,OAAO,MAAM,CAAC;AAAA,CACd;AAED,MAAM,UAAU,0BAA0B,CACzC,MAAqB,EACrB,aAAqB,EACrB,SAAiB,EACjB,UAAmB,EACV;IACT,MAAM,IAAI,GAAG,GAAG,mBAAmB,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,aAAa,CAAC,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC7M,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,CACpF;AAED,MAAM,UAAU,wBAAwB,CACvC,MAAqB,EACrB,OAA4B,EAC5B,KAAK,GAAW,aAAa,EAAE,EACT;IACtB,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IACrE,MAAM,aAAa,GAAG,0BAA0B,CAC/C,MAAM,EACN,aAAa,EACb,SAAS,EACT,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAChD,CAAC;IACF,MAAM,IAAI,GAAG;QACZ,KAAK;QACL,UAAU;QACV,WAAW;QACX,QAAQ;QACR,WAAW;QACX,GAAG,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,EAAE;QACvF,QAAQ;QACR,aAAa;QACb,WAAW;QACX,MAAM,CAAC,kBAAkB;QACzB,SAAS;QACT,oBAAoB,aAAa,WAAW,MAAM,CAAC,kBAAkB,EAAE;QACvE,OAAO;QACP,mBAAmB;KACnB,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,IAAI,CACR,MAAM,CAAC,KAAK,EACZ,MAAM,EACN,UAAU,EACV,eAAe,EACf,SAAS,EACT,mCAAmC,EACnC,eAAe,EACf,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EACzB,cAAc,EACd,MAAM,CAAC,kBAAkB,EACzB,qBAAqB,EACrB,6BAA6B,CAC7B,CAAC;IACF,OAAO;QACN,OAAO,EAAE,MAAM,CAAC,YAAY;QAC5B,IAAI;QACJ,GAAG,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;QACjC,KAAK;QACL,aAAa;QACb,MAAM;QACN,aAAa;QACb,aAAa,EAAE,MAAM,CAAC,4BAA4B,CAAC;KACnD,CAAC;AAAA,CACF;AAED,MAAM,OAAO,oBAAoB;IACf,eAAe,CAA0D;IACzE,GAAG,CAAqB;IACxB,MAAM,CAAe;IACrB,cAAc,CAAe;IAC7B,aAAa,CAA2D;IACxE,eAAe,CAAgD;IAC/D,iBAAiB,CAAuC;IAEzE,YAAY,OAAO,GAAgC,EAAE,EAAE;QACtD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;QAC1D,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,aAAa,CAAC;QAC9D,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,yBAAyB,CAAC;QACxE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,wBAAwB,CAAC;QAC3E,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,GAAG,EAAE,CAAC;IAAA,CAChE;IAED,aAAa,CAAC,SAAS,GAA2B,EAAE,EAAiB;QACpE,OAAO,oBAAoB,CAAC,IAAI,CAAC,eAAe,EAAE,kBAAkB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAAA,CAC7F;IAED,oBAAoB,CAAC,OAA4B,EAAuB;QACvE,OAAO,wBAAwB,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAAA,CAC7F;IAED,KAAK,CAAC,oBAAoB,CAAC,MAAM,GAAkB,IAAI,CAAC,aAAa,EAAE,EAAiB;QACvF,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC5D,IAAI,CAAC;YACJ,gBAAgB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,KAAK,CACd,aAAa,CAAC,8CAA8C,MAAM,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC,CAC9F,CAAC;QACH,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,iBAAiB,CAAC,MAAqB,EAAmB;QACvE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;YAC/C,MAAM,aAAa,GAAG,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;YAChG,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;YACjF,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QAClE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAAA,CAClE;IAEO,KAAK,CAAC,qBAAqB,CAAC,MAAqB,EAAE,WAAmB,EAAiB;QAC9F,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;YACnD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAC9E,IAAI,aAAa,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,YAAY,GAAG,IAAI,KAAK,CAC7B,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,kCAAkC,CAChG,CAAC;gBACF,MAAM,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,2CAA2C,CAAC,CAAC;YAC9F,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC3C,MAAM,KAAK,CAAC;QACb,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,qBAAqB,CAAC,OAA4B,EAAE,UAAkB,EAA+B;QAClH,MAAM,gBAAgB,GAAG,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;QACtG,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE;YACvC,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,OAAO,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,QAAQ,OAAO,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,qBAAqB,EAAE,CAAC;QAC7F,OAAO;YACN,WAAW;YACX,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,SAAS;YACT,iBAAiB,EAAE,aAAa,CAAC,SAAS,CAAC;YAC3C,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,MAAM,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC;IAAA,CACF;IAEO,KAAK,CAAC,WAAW,CAAC,OAA4B,EAA+B;QACpF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC5D,0BAA0B,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC;YACJ,OAAO,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,UAAU,CAAC,EAAE,CAAC;gBACpG,0BAA0B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;IAAA,CACD;IAED,KAAK,CAAC,KAAK,CAAC,OAA4B,EAA+B;QACtE,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAAA,CAC7D;IAED,KAAK,CAAC,IAAI,CAAC,OAA2B,EAA+B;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG;YACZ,WAAW;YACX,IAAI;YACJ,OAAO;YACP,UAAU;YACV,SAAS,qBAAqB,OAAO;YACrC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,uBAAuB,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/F,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,4BAA4B,IAAI,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAChE,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,cAAc,CAAiB,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;IAAA,CAC/F;IACO,sBAAsB,CAAC,SAAiB,EAAE,aAAqB,EAAQ;QAC9E,MAAM,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC/D,IAAI,SAAS,CAAC,aAAa,KAAK,sBAAsB,IAAI,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;gBACrG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC3C,0BAA0B,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACzD,CAAC;QACF,CAAC;IAAA,CACD;IAEO,sBAAsB,CAAC,SAA2B,EAAE,aAAqB,EAAQ;QACxF,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS;YAAE,0BAA0B,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAAA,CAChG;IAED,KAAK,CAAC,IAAI,CAAC,OAA2B,EAA8B;QACnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC;YACjE,IAAI,WAAW;gBAAE,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YACjF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;QACrF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YACjF,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YAC7D,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,GAAG;YACZ,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;YAC3C,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,QAAQ,CAAC,EAAE;SACX,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACpD,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;gBAC7D,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;YAC/E,CAAC;YACD,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAAA,CAC5F;IAED,KAAK,CAAC,qBAAqB,GAAkB;QAC5C,MAAM,oBAAoB,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACpE,IAAI,CAAC;oBACJ,MAAM,IAAI,CAAC,IAAI,CAAC;wBACf,aAAa,EAAE,SAAS,CAAC,aAAa;wBACtC,MAAM,EAAE,WAAW;wBACnB,kBAAkB,EAAE,WAAW;qBAC/B,CAAC,CAAC;oBACH,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;oBAC3C,0BAA0B,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;gBACzD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC;YACF,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,2CAA2C,CAAC,CAAC;QAAA,CACzG,CAAC,CAAC;IAAA,CACH;IAEO,qBAAqB,CAAC,GAAmB,EAAoB;QACpE,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,oBAAoB,CACtC,MAAM,CAAC,GAAG,oBAAoB,cAAc,CAAC,IAAI,SAAS,EAC1D,aAAa,CACb,CAAC;QACF,OAAO;YACN,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE;YAChB,IAAI,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE;YACrB,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;YACxB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,aAAa,EAAE,SAAS;YACxB,kBAAkB,EAAE,MAAM,CAAC,6BAA6B,CAAC;YACzD,UAAU;YACV,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;YAChE,MAAM;SACN,CAAC;IAAA,CACF;CACD;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAU;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/E,OAAO,QAAQ,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,qBAAqB,EAAE,CAAC;AAAA,CACnE;AAED,MAAM,UAAU,4BAA4B,CAC3C,MAAc,EACd,UAAU,GAAG,2BAA2B,EACnB;IACrB,OAAO,cAAc,CAAsB,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,6BAA6B,CAAC,IAAI,+BAA+B,CAAC;QAC3F,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO;YACN,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE;YACnB,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;YACjC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE;YAClC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM;YAC/D,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,MAAM,CAAC,OAAO;YACpD,aAAa,EAAE,KAAK,EAAE,MAAM;YAC5B,kBAAkB,EAAE,KAAK,EAAE,WAAW,IAAI,SAAS;YACnD,UAAU;YACV,cAAc,EAAE,oBAAoB,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC;YAC/E,MAAM;SACN,CAAC;IAAA,CACF,CAAC,CAAC;AAAA,CACH;AACD,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAa,EAAW;IAChE,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAAA,CAC1E;AAED,SAAS,gBAAgB,CACxB,UAA8B,EAC9B,MAA0B,EAC1B,kBAAsC,EACP;IAC/B,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,kBAAkB,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;QACpG,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC7B,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC3D","sourcesContent":["import { createHash, randomBytes } from \"node:crypto\";\nimport { open, readFile, stat, unlink } from \"node:fs/promises\";\nimport { createConnection, createServer } from \"node:net\";\nimport { tmpdir } from \"node:os\";\nimport { basename, join, resolve } from \"node:path\";\nimport { VERSION } from \"../../config.ts\";\nimport { DAEMON_WEBSOCKET_PATH } from \"../../daemon/config.ts\";\nimport { spawnProcess } from \"../../utils/child-process.ts\";\nimport type { SandboxSettings, SettingsManager } from \"../settings-manager.ts\";\n\nexport const DEFAULT_SANDBOX_IMAGE = \"ghcr.io/greppleai/grip-sandbox:latest\";\nexport const DEFAULT_SANDBOX_WORKSPACE_MOUNT = \"/workspace\";\nexport const DEFAULT_SANDBOX_DAEMON_PORT = 8787;\nexport const DEFAULT_SANDBOX_DOCKER_BINARY = \"docker\";\nexport const DEFAULT_SANDBOX_LIMA_BINARY = \"limactl\";\nexport const DEFAULT_SANDBOX_LIMA_TEMPLATE = \"template:docker-rootful\";\nexport const SANDBOX_LABEL_PREFIX = \"ai.greppleai.grip\";\nexport const SANDBOX_LABEL_ENABLED = `${SANDBOX_LABEL_PREFIX}.sandbox`;\nexport const SANDBOX_LABEL_WORKSPACE_HASH = `${SANDBOX_LABEL_PREFIX}.workspace-hash`;\nexport const SANDBOX_LABEL_WORKSPACE_MOUNT = `${SANDBOX_LABEL_PREFIX}.workspace-mount`;\nexport const SANDBOX_LABEL_DAEMON_PORT = `${SANDBOX_LABEL_PREFIX}.daemon-port`;\nexport const SANDBOX_LABEL_OWNER_UID = `${SANDBOX_LABEL_PREFIX}.owner-uid`;\nexport const SANDBOX_LABEL_VERSION = `${SANDBOX_LABEL_PREFIX}.version`;\nexport const SANDBOX_LABEL_SESSION = `${SANDBOX_LABEL_PREFIX}.session`;\n\nconst reservedSandboxDaemonPorts = new Set<number>();\nconst sandboxPortLockPath = join(tmpdir(), `greppleai-grip-sandbox-port-${process.getuid?.() ?? \"user\"}.lock`);\nlet sandboxStartQueue: Promise<void> = Promise.resolve();\n\nfunction isProcessAlive(pid: number): boolean {\n\ttry {\n\t\tprocess.kill(pid, 0);\n\t\treturn true;\n\t} catch (error) {\n\t\treturn error instanceof Error && \"code\" in error && error.code === \"EPERM\";\n\t}\n}\nasync function isSandboxPortLockStale(): Promise<boolean> {\n\ttry {\n\t\tconst owner = JSON.parse(await readFile(sandboxPortLockPath, \"utf8\")) as { pid?: unknown };\n\t\treturn typeof owner.pid === \"number\" && !isProcessAlive(owner.pid);\n\t} catch {\n\t\ttry {\n\t\t\treturn Date.now() - (await stat(sandboxPortLockPath)).mtimeMs > 10_000;\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t}\n}\n\nasync function acquireSandboxPortLock(): Promise<() => Promise<void>> {\n\tconst token = `${process.pid}:${randomBytes(16).toString(\"hex\")}`;\n\tconst deadline = Date.now() + 30_000;\n\twhile (Date.now() < deadline) {\n\t\ttry {\n\t\t\tconst handle = await open(sandboxPortLockPath, \"wx\", 0o600);\n\t\t\tawait handle.writeFile(JSON.stringify({ pid: process.pid, token }));\n\t\t\treturn async () => {\n\t\t\t\tawait handle.close();\n\t\t\t\ttry {\n\t\t\t\t\tconst current = JSON.parse(await readFile(sandboxPortLockPath, \"utf8\")) as { token?: unknown };\n\t\t\t\t\tif (current.token === token) await unlink(sandboxPortLockPath);\n\t\t\t\t} catch {}\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof Error && \"code\" in error && error.code === \"EEXIST\")) throw error;\n\t\t\tconst stale = await isSandboxPortLockStale();\n\t\t\tif (stale) {\n\t\t\t\tawait unlink(sandboxPortLockPath).catch(() => undefined);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tawait new Promise((resolveDelay) => setTimeout(resolveDelay, 50));\n\t\t}\n\t}\n\tthrow new Error(\"Timed out waiting for the sandbox daemon port allocation lock\");\n}\n\nasync function withSandboxStartLock<T>(operation: () => Promise<T>): Promise<T> {\n\tconst previous = sandboxStartQueue;\n\tlet release!: () => void;\n\tsandboxStartQueue = new Promise<void>((resolveQueue) => {\n\t\trelease = resolveQueue;\n\t});\n\tawait previous;\n\tlet releaseFileLock: (() => Promise<void>) | undefined;\n\ttry {\n\t\treleaseFileLock = await acquireSandboxPortLock();\n\t\treturn await operation();\n\t} finally {\n\t\ttry {\n\t\t\tawait releaseFileLock?.();\n\t\t} finally {\n\t\t\trelease();\n\t\t}\n\t}\n}\n\nexport type SandboxCleanupBehavior = \"stop\" | \"remove\";\nexport type SandboxRuntime = \"docker\" | \"lima\";\n\nexport interface SandboxConfig {\n\truntime: SandboxRuntime;\n\timage: string;\n\tdockerBinary: string;\n\tlimaBinary: string;\n\tlimaTemplate: string;\n\tlimaInstanceNamePrefix: string;\n\tworkspaceMountPath: string;\n\tcontainerNamePrefix: string;\n\tdaemonPort: number;\n\tdaemonHostBind: string;\n\tcleanup: SandboxCleanupBehavior;\n\townerUid: string | undefined;\n}\n\nexport type SandboxConfigOverrides = SandboxSettings;\n\nexport interface SandboxEnvironment {\n\tGRIP_SANDBOX_RUNTIME?: string;\n\tGRIP_SANDBOX_IMAGE?: string;\n\tGRIP_SANDBOX_DOCKER?: string;\n\tGRIP_SANDBOX_LIMA?: string;\n\tGRIP_SANDBOX_LIMA_TEMPLATE?: string;\n\tGRIP_SANDBOX_LIMA_INSTANCE_PREFIX?: string;\n\tGRIP_SANDBOX_WORKSPACE_MOUNT?: string;\n\tGRIP_SANDBOX_CONTAINER_PREFIX?: string;\n\tGRIP_SANDBOX_DAEMON_PORT?: string;\n\tGRIP_SANDBOX_DAEMON_HOST_BIND?: string;\n\tGRIP_SANDBOX_CLEANUP?: string;\n}\n\nexport interface SandboxStartOptions extends SandboxConfigOverrides {\n\tworkspaceRoot: string;\n\tsessionId?: string;\n\tname?: string;\n}\n\nexport interface SandboxListOptions {\n\tworkspaceRoot: string;\n\tallWorkspaces?: boolean;\n}\n\nexport interface SandboxStopOptions {\n\tworkspaceRoot: string;\n\ttarget?: string;\n\tcurrentContainerId?: string;\n}\n\nexport interface DockerRunInvocation {\n\tcommand: string;\n\targs: string[];\n\tenv: Record<string, string>;\n\ttoken: string;\n\tcontainerName: string;\n\tlabels: Record<string, string>;\n\tworkspaceRoot: string;\n\tworkspaceHash: string;\n}\n\nexport interface SandboxContainer {\n\tid: string;\n\tname: string;\n\timage: string;\n\tstatus: string;\n\tstate: string | undefined;\n\tcreatedAt: string | undefined;\n\tworkspaceRoot: string | undefined;\n\tworkspaceMountPath: string | undefined;\n\tdaemonPort: number | undefined;\n\tdaemonEndpoint: string | undefined;\n\tlabels: Record<string, string>;\n}\n\nexport interface SandboxStartResult {\n\tcontainerId: string;\n\tcontainerName: string;\n\tworkspaceRoot: string;\n\tworkspaceMountPath: string;\n\tdaemonUrl: string;\n\tdaemonUrlRedacted: string;\n\ttoken: string;\n\tlabels: Record<string, string>;\n}\n\nexport type SandboxStopResult =\n\t| { status: \"stopped\"; container: SandboxContainer }\n\t| { status: \"removed\"; container: SandboxContainer }\n\t| { status: \"already-stopped\"; container: SandboxContainer }\n\t| { status: \"not-found\"; message: string };\n\nexport interface SandboxService {\n\tresolveConfig(overrides?: SandboxConfigOverrides): SandboxConfig;\n\tstart(options: SandboxStartOptions): Promise<SandboxStartResult>;\n\tlist(options: SandboxListOptions): Promise<SandboxContainer[]>;\n\tstop(options: SandboxStopOptions): Promise<SandboxStopResult>;\n}\n\nexport interface DockerCommandResult {\n\texitCode: number | null;\n\tstdout: string;\n\tstderr: string;\n}\n\nexport interface DockerCommandOptions {\n\tenv?: Record<string, string>;\n}\n\nexport interface DockerRunner {\n\trun(command: string, args: string[], options?: DockerCommandOptions): Promise<DockerCommandResult>;\n}\nexport interface ManagedSandboxContainer {\n\tworkspaceRoot: string;\n\tdaemonPort: number;\n\townerId?: string;\n}\n\nexport interface DockerSandboxServiceOptions {\n\tsettingsManager?: Pick<SettingsManager, \"getSandboxSettings\">;\n\tenv?: SandboxEnvironment;\n\trunner?: DockerRunner;\n\ttokenGenerator?: () => string;\n\tportAllocator?: (host: string, preferredPort: number) => Promise<number>;\n\treadinessWaiter?: (host: string, port: number) => Promise<void>;\n\tmanagedContainers?: Map<string, ManagedSandboxContainer>;\n}\n\ninterface DockerPsRecord {\n\tID?: string;\n\tNames?: string;\n\tImage?: string;\n\tStatus?: string;\n\tState?: string;\n\tCreatedAt?: string;\n\tLabels?: string;\n\tPorts?: string;\n}\n\ninterface DockerInspectMount {\n\tType?: string;\n\tSource?: string;\n\tDestination?: string;\n}\n\ninterface DockerInspectPortBinding {\n\tHostIp?: string;\n\tHostPort?: string;\n}\n\ninterface DockerInspectConfig {\n\tImage?: string;\n\tLabels?: Record<string, string>;\n}\n\ninterface DockerInspectState {\n\tStatus?: string;\n\tRunning?: boolean;\n\tStartedAt?: string;\n}\n\ninterface DockerInspectNetworkSettings {\n\tPorts?: Record<string, DockerInspectPortBinding[] | null>;\n}\n\ninterface DockerInspectRecord {\n\tId?: string;\n\tName?: string;\n\tConfig?: DockerInspectConfig;\n\tState?: DockerInspectState;\n\tCreated?: string;\n\tMounts?: DockerInspectMount[];\n\tNetworkSettings?: DockerInspectNetworkSettings;\n}\n\nclass ProcessDockerRunner implements DockerRunner {\n\trun(command: string, args: string[], options: DockerCommandOptions = {}): Promise<DockerCommandResult> {\n\t\treturn new Promise((resolveCommand, reject) => {\n\t\t\tconst child = spawnProcess(command, args, {\n\t\t\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\n\t\t\t\tenv: { ...process.env, ...options.env },\n\t\t\t});\n\t\t\tlet stdout = \"\";\n\t\t\tlet stderr = \"\";\n\t\t\tchild.stdout?.on(\"data\", (chunk: Buffer) => {\n\t\t\t\tstdout += chunk.toString(\"utf8\");\n\t\t\t});\n\t\t\tchild.stderr?.on(\"data\", (chunk: Buffer) => {\n\t\t\t\tstderr += chunk.toString(\"utf8\");\n\t\t\t});\n\t\t\tchild.once(\"error\", reject);\n\t\t\tchild.once(\"close\", (exitCode) => resolveCommand({ exitCode, stdout, stderr }));\n\t\t});\n\t}\n}\n\nfunction nonEmpty(value: string | undefined): string | undefined {\n\tconst trimmed = value?.trim();\n\treturn trimmed ? trimmed : undefined;\n}\n\nfunction parseRuntime(value: string | undefined, settingName: string): SandboxRuntime | undefined {\n\tif (value === undefined) return undefined;\n\tif (value === \"docker\" || value === \"lima\") return value;\n\tthrow new Error(`Invalid ${settingName}: expected docker or lima`);\n}\n\nfunction parsePositiveInteger(value: string | number | undefined, settingName: string): number | undefined {\n\tif (value === undefined) return undefined;\n\tconst text = String(value).trim();\n\tif (!/^\\d+$/.test(text)) throw new Error(`Invalid ${settingName}: expected a decimal integer`);\n\tconst parsed = Number(text);\n\tif (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > 65535) {\n\t\tthrow new Error(`Invalid ${settingName}: expected a port from 1 to 65535`);\n\t}\n\treturn parsed;\n}\n\nfunction parseCleanup(value: string | undefined, settingName: string): SandboxCleanupBehavior | undefined {\n\tif (value === undefined) return undefined;\n\tif (value === \"stop\" || value === \"remove\") return value;\n\tthrow new Error(`Invalid ${settingName}: expected stop or remove`);\n}\n\nfunction parseLabels(text: string | undefined): Record<string, string> {\n\tconst labels: Record<string, string> = {};\n\tif (!text) return labels;\n\tfor (const entry of text.split(\",\")) {\n\t\tconst separator = entry.indexOf(\"=\");\n\t\tif (separator === -1) continue;\n\t\tlabels[entry.slice(0, separator)] = entry.slice(separator + 1);\n\t}\n\treturn labels;\n}\n\nfunction sanitizeNameSegment(value: string): string {\n\tconst sanitized = value\n\t\t.toLowerCase()\n\t\t.replace(/[^a-z0-9_.-]+/g, \"-\")\n\t\t.replace(/^-+|-+$/g, \"\");\n\treturn sanitized || \"workspace\";\n}\n\nfunction getWorkspaceHash(workspaceRoot: string): string {\n\treturn createHash(\"sha256\").update(resolve(workspaceRoot)).digest(\"hex\").slice(0, 16);\n}\n\nfunction getOwnerUid(): string | undefined {\n\tconst uid = process.getuid?.();\n\treturn uid === undefined ? undefined : String(uid);\n}\n\nfunction generateToken(): string {\n\treturn randomBytes(32).toString(\"base64url\");\n}\n\nasync function tryReservePort(host: string, port: number): Promise<number | undefined> {\n\treturn new Promise((resolvePort) => {\n\t\tconst server = createServer();\n\t\tserver.unref();\n\t\tserver.once(\"error\", () => resolvePort(undefined));\n\t\tserver.listen({ host, port, exclusive: true }, () => {\n\t\t\tconst address = server.address();\n\t\t\tconst selectedPort = typeof address === \"object\" && address ? address.port : undefined;\n\t\t\tserver.close(() => resolvePort(selectedPort));\n\t\t});\n\t});\n}\n\nexport async function allocateSandboxDaemonPort(host: string, preferredPort: number): Promise<number> {\n\tconst preferred = await tryReservePort(host, preferredPort);\n\tif (preferred !== undefined) return preferred;\n\tconst fallback = await tryReservePort(host, 0);\n\tif (fallback === undefined) throw new Error(`Unable to allocate a sandbox daemon port on ${host}`);\n\treturn fallback;\n}\n\nasync function canConnect(host: string, port: number): Promise<boolean> {\n\treturn new Promise((resolveConnection) => {\n\t\tconst socket = createConnection({ host, port });\n\t\tlet settled = false;\n\t\tconst finish = (connected: boolean): void => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tsocket.destroy();\n\t\t\tresolveConnection(connected);\n\t\t};\n\t\tsocket.setTimeout(250, () => finish(false));\n\t\tsocket.once(\"connect\", () => finish(true));\n\t\tsocket.once(\"error\", () => finish(false));\n\t});\n}\n\nasync function waitForSandboxDaemonPort(host: string, port: number): Promise<void> {\n\tconst connectHost = host === \"0.0.0.0\" ? \"127.0.0.1\" : host;\n\tconst deadline = Date.now() + 15_000;\n\twhile (Date.now() < deadline) {\n\t\tif (await canConnect(connectHost, port)) return;\n\t\tawait new Promise((resolveDelay) => setTimeout(resolveDelay, 100));\n\t}\n\tthrow new Error(`Sandbox daemon did not bind ${connectHost}:${port} within 15 seconds`);\n}\n\nfunction ensureSuccessful(result: DockerCommandResult, args: string[]): void {\n\tif (result.exitCode === 0) return;\n\tconst detail = result.stderr.trim() || result.stdout.trim() || `exit code ${result.exitCode ?? \"unknown\"}`;\n\tthrow new Error(redactSecrets(`Docker command failed: docker ${args.join(\" \")}: ${detail}`));\n}\n\nfunction parseJsonLines<T>(text: string): T[] {\n\treturn text\n\t\t.split(/\\r?\\n/)\n\t\t.map((line) => line.trim())\n\t\t.filter((line) => line.length > 0)\n\t\t.map((line) => JSON.parse(line) as T);\n}\n\nfunction parseJsonArray<T>(text: string): T[] {\n\tconst trimmed = text.trim();\n\tif (!trimmed) return [];\n\tconst parsed = JSON.parse(trimmed) as unknown;\n\treturn Array.isArray(parsed) ? (parsed as T[]) : [parsed as T];\n}\n\nfunction getEndpointFromPorts(\n\tports: Record<string, DockerInspectPortBinding[] | null> | undefined,\n\tdaemonPort: number,\n): string | undefined {\n\tconst bindings = ports?.[`${daemonPort}/tcp`];\n\tconst binding = bindings?.[0];\n\tif (!binding?.HostPort) return undefined;\n\tconst host = daemonConnectionHost(binding.HostIp || \"127.0.0.1\");\n\treturn `ws://${urlHost(host)}:${binding.HostPort}${DAEMON_WEBSOCKET_PATH}`;\n}\n\nexport function redactSecrets(value: string): string {\n\treturn value\n\t\t.replace(/(GRIP_DAEMON_TOKEN=)[^\\s,;]+/g, \"$1[REDACTED]\")\n\t\t.replace(/(PI_DAEMON_TOKEN=)[^\\s,;]+/g, \"$1[REDACTED]\")\n\t\t.replace(/(Authorization:\\s*Bearer\\s+)[^\\s,;]+/gi, \"$1[REDACTED]\")\n\t\t.replace(/([?&]token=)[^\\s&]+/gi, \"$1[REDACTED]\");\n}\n\nexport function resolveSandboxConfig(\n\tsettings: SandboxSettings | undefined,\n\tenv: SandboxEnvironment = {},\n\toverrides: SandboxConfigOverrides = {},\n): SandboxConfig {\n\tconst runtime =\n\t\tparseRuntime(overrides.runtime, \"sandbox.runtime\") ??\n\t\tparseRuntime(env.GRIP_SANDBOX_RUNTIME, \"GRIP_SANDBOX_RUNTIME\") ??\n\t\tparseRuntime(settings?.runtime, \"sandbox.runtime\") ??\n\t\t\"docker\";\n\tconst image =\n\t\tnonEmpty(overrides.image) ??\n\t\tnonEmpty(env.GRIP_SANDBOX_IMAGE) ??\n\t\tnonEmpty(settings?.image) ??\n\t\tDEFAULT_SANDBOX_IMAGE;\n\tconst dockerBinary =\n\t\tnonEmpty(overrides.dockerBinary) ??\n\t\tnonEmpty(env.GRIP_SANDBOX_DOCKER) ??\n\t\tnonEmpty(settings?.dockerBinary) ??\n\t\tDEFAULT_SANDBOX_DOCKER_BINARY;\n\tconst limaBinary =\n\t\tnonEmpty(overrides.limaBinary) ??\n\t\tnonEmpty(env.GRIP_SANDBOX_LIMA) ??\n\t\tnonEmpty(settings?.limaBinary) ??\n\t\tDEFAULT_SANDBOX_LIMA_BINARY;\n\tconst limaTemplate =\n\t\tnonEmpty(overrides.limaTemplate) ??\n\t\tnonEmpty(env.GRIP_SANDBOX_LIMA_TEMPLATE) ??\n\t\tnonEmpty(settings?.limaTemplate) ??\n\t\tDEFAULT_SANDBOX_LIMA_TEMPLATE;\n\tconst limaInstanceNamePrefix =\n\t\tnonEmpty(overrides.limaInstanceNamePrefix) ??\n\t\tnonEmpty(env.GRIP_SANDBOX_LIMA_INSTANCE_PREFIX) ??\n\t\tnonEmpty(settings?.limaInstanceNamePrefix) ??\n\t\t\"grip-sandbox\";\n\tconst workspaceMountPath =\n\t\tnonEmpty(overrides.workspaceMountPath) ??\n\t\tnonEmpty(env.GRIP_SANDBOX_WORKSPACE_MOUNT) ??\n\t\tnonEmpty(settings?.workspaceMountPath) ??\n\t\tDEFAULT_SANDBOX_WORKSPACE_MOUNT;\n\tconst containerNamePrefix =\n\t\tnonEmpty(overrides.containerNamePrefix) ??\n\t\tnonEmpty(env.GRIP_SANDBOX_CONTAINER_PREFIX) ??\n\t\tnonEmpty(settings?.containerNamePrefix) ??\n\t\t\"grip-sandbox\";\n\tconst daemonPort =\n\t\toverrides.daemonPort ??\n\t\tparsePositiveInteger(env.GRIP_SANDBOX_DAEMON_PORT, \"GRIP_SANDBOX_DAEMON_PORT\") ??\n\t\tparsePositiveInteger(settings?.daemonPort, \"sandbox.daemonPort\") ??\n\t\tDEFAULT_SANDBOX_DAEMON_PORT;\n\tconst daemonHostBind =\n\t\tnonEmpty(overrides.daemonHostBind) ??\n\t\tnonEmpty(env.GRIP_SANDBOX_DAEMON_HOST_BIND) ??\n\t\tnonEmpty(settings?.daemonHostBind) ??\n\t\t\"127.0.0.1\";\n\tconst cleanup =\n\t\toverrides.cleanup ??\n\t\tparseCleanup(env.GRIP_SANDBOX_CLEANUP, \"GRIP_SANDBOX_CLEANUP\") ??\n\t\tparseCleanup(settings?.cleanup, \"sandbox.cleanup\") ??\n\t\t\"stop\";\n\treturn {\n\t\truntime,\n\t\timage,\n\t\tdockerBinary,\n\t\tlimaBinary,\n\t\tlimaTemplate,\n\t\tlimaInstanceNamePrefix,\n\t\tworkspaceMountPath,\n\t\tcontainerNamePrefix,\n\t\tdaemonPort,\n\t\tdaemonHostBind,\n\t\tcleanup,\n\t\townerUid: getOwnerUid(),\n\t};\n}\n\nfunction dockerPublishHost(host: string): string {\n\treturn host.includes(\":\") && !host.startsWith(\"[\") ? `[${host}]` : host;\n}\n\nfunction daemonConnectionHost(host: string): string {\n\tif (host === \"0.0.0.0\") return \"127.0.0.1\";\n\tif (host === \"::\") return \"::1\";\n\treturn host;\n}\n\nfunction urlHost(host: string): string {\n\treturn host.includes(\":\") && !host.startsWith(\"[\") ? `[${host}]` : host;\n}\n\nexport function createSandboxLabels(\n\tconfig: SandboxConfig,\n\tworkspaceRoot: string,\n\tsessionId: string,\n): Record<string, string> {\n\tconst labels: Record<string, string> = {\n\t\t[SANDBOX_LABEL_ENABLED]: \"true\",\n\t\t[SANDBOX_LABEL_WORKSPACE_HASH]: getWorkspaceHash(workspaceRoot),\n\t\t[SANDBOX_LABEL_WORKSPACE_MOUNT]: config.workspaceMountPath,\n\t\t[SANDBOX_LABEL_DAEMON_PORT]: String(config.daemonPort),\n\t\t[SANDBOX_LABEL_VERSION]: VERSION,\n\t\t[SANDBOX_LABEL_SESSION]: sessionId,\n\t};\n\tif (config.ownerUid) labels[SANDBOX_LABEL_OWNER_UID] = config.ownerUid;\n\treturn labels;\n}\n\nexport function createSandboxContainerName(\n\tconfig: SandboxConfig,\n\tworkspaceRoot: string,\n\tsessionId: string,\n\tinstanceId?: string,\n): string {\n\tconst base = `${sanitizeNameSegment(config.containerNamePrefix)}-${sanitizeNameSegment(basename(resolve(workspaceRoot)))}-${getWorkspaceHash(workspaceRoot)}-${sanitizeNameSegment(sessionId).slice(0, 16)}`;\n\treturn instanceId ? `${base}-${sanitizeNameSegment(instanceId).slice(0, 8)}` : base;\n}\n\nexport function buildDockerRunInvocation(\n\tconfig: SandboxConfig,\n\toptions: SandboxStartOptions,\n\ttoken: string = generateToken(),\n): DockerRunInvocation {\n\tconst workspaceRoot = resolve(options.workspaceRoot);\n\tconst sessionId = options.sessionId ?? randomBytes(8).toString(\"hex\");\n\tconst labels = createSandboxLabels(config, workspaceRoot, sessionId);\n\tconst containerName = createSandboxContainerName(\n\t\tconfig,\n\t\tworkspaceRoot,\n\t\tsessionId,\n\t\tcreateHash(\"sha256\").update(token).digest(\"hex\"),\n\t);\n\tconst args = [\n\t\t\"run\",\n\t\t\"--detach\",\n\t\t\"--network\",\n\t\t\"bridge\",\n\t\t\"--publish\",\n\t\t`${dockerPublishHost(config.daemonHostBind)}:${config.daemonPort}:${config.daemonPort}`,\n\t\t\"--name\",\n\t\tcontainerName,\n\t\t\"--workdir\",\n\t\tconfig.workspaceMountPath,\n\t\t\"--mount\",\n\t\t`type=bind,source=${workspaceRoot},target=${config.workspaceMountPath}`,\n\t\t\"--env\",\n\t\t\"GRIP_DAEMON_TOKEN\",\n\t];\n\tfor (const [key, value] of Object.entries(labels)) args.push(\"--label\", `${key}=${value}`);\n\targs.push(\n\t\tconfig.image,\n\t\t\"grip\",\n\t\t\"--daemon\",\n\t\t\"--daemon-host\",\n\t\t\"0.0.0.0\",\n\t\t\"--daemon-allow-insecure-transport\",\n\t\t\"--daemon-port\",\n\t\tString(config.daemonPort),\n\t\t\"--daemon-cwd\",\n\t\tconfig.workspaceMountPath,\n\t\t\"--daemon-allow-root\",\n\t\t\"--daemon-allow-process-exec\",\n\t);\n\treturn {\n\t\tcommand: config.dockerBinary,\n\t\targs,\n\t\tenv: { GRIP_DAEMON_TOKEN: token },\n\t\ttoken,\n\t\tcontainerName,\n\t\tlabels,\n\t\tworkspaceRoot,\n\t\tworkspaceHash: labels[SANDBOX_LABEL_WORKSPACE_HASH],\n\t};\n}\n\nexport class DockerSandboxService {\n\tprivate readonly settingsManager: Pick<SettingsManager, \"getSandboxSettings\"> | undefined;\n\tprivate readonly env: SandboxEnvironment;\n\tprivate readonly runner: DockerRunner;\n\tprivate readonly tokenGenerator: () => string;\n\tprivate readonly portAllocator: (host: string, preferredPort: number) => Promise<number>;\n\tprivate readonly readinessWaiter: (host: string, port: number) => Promise<void>;\n\tprivate readonly managedContainers: Map<string, ManagedSandboxContainer>;\n\n\tconstructor(options: DockerSandboxServiceOptions = {}) {\n\t\tthis.settingsManager = options.settingsManager;\n\t\tthis.env = options.env ?? process.env;\n\t\tthis.runner = options.runner ?? new ProcessDockerRunner();\n\t\tthis.tokenGenerator = options.tokenGenerator ?? generateToken;\n\t\tthis.portAllocator = options.portAllocator ?? allocateSandboxDaemonPort;\n\t\tthis.readinessWaiter = options.readinessWaiter ?? waitForSandboxDaemonPort;\n\t\tthis.managedContainers = options.managedContainers ?? new Map();\n\t}\n\n\tresolveConfig(overrides: SandboxConfigOverrides = {}): SandboxConfig {\n\t\treturn resolveSandboxConfig(this.settingsManager?.getSandboxSettings(), this.env, overrides);\n\t}\n\n\tbuildStartInvocation(options: SandboxStartOptions): DockerRunInvocation {\n\t\treturn buildDockerRunInvocation(this.resolveConfig(options), options, this.tokenGenerator());\n\t}\n\n\tasync checkDockerAvailable(config: SandboxConfig = this.resolveConfig()): Promise<void> {\n\t\tconst args = [\"version\", \"--format\", \"{{.Server.Version}}\"];\n\t\ttry {\n\t\t\tensureSuccessful(await this.runner.run(config.dockerBinary, args), args);\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(\n\t\t\t\tredactSecrets(`Docker is unavailable or not reachable via ${config.dockerBinary}: ${message}`),\n\t\t\t);\n\t\t}\n\t}\n\n\tprivate async reserveDaemonPort(config: SandboxConfig): Promise<number> {\n\t\tfor (let attempt = 0; attempt < 16; attempt++) {\n\t\t\tconst preferredPort = reservedSandboxDaemonPorts.has(config.daemonPort) ? 0 : config.daemonPort;\n\t\t\tconst candidate = await this.portAllocator(config.daemonHostBind, preferredPort);\n\t\t\tif (!reservedSandboxDaemonPorts.has(candidate)) return candidate;\n\t\t}\n\t\tthrow new Error(\"Unable to reserve a unique sandbox daemon port\");\n\t}\n\n\tprivate async waitForStartedSandbox(config: SandboxConfig, containerId: string): Promise<void> {\n\t\ttry {\n\t\t\tawait this.readinessWaiter(config.daemonHostBind, config.daemonPort);\n\t\t} catch (error) {\n\t\t\tconst cleanupArgs = [\"rm\", \"--force\", containerId];\n\t\t\tconst cleanupResult = await this.runner.run(config.dockerBinary, cleanupArgs);\n\t\t\tif (cleanupResult.exitCode !== 0) {\n\t\t\t\tconst cleanupError = new Error(\n\t\t\t\t\tcleanupResult.stderr.trim() || cleanupResult.stdout.trim() || \"Failed to remove unready sandbox\",\n\t\t\t\t);\n\t\t\t\tthrow new AggregateError([error, cleanupError], \"Sandbox readiness and cleanup both failed\");\n\t\t\t}\n\t\t\tthis.managedContainers.delete(containerId);\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tprivate async startWithReservedPort(options: SandboxStartOptions, daemonPort: number): Promise<SandboxStartResult> {\n\t\tconst effectiveOptions = { ...options, daemonPort };\n\t\tconst config = this.resolveConfig(effectiveOptions);\n\t\tconst invocation = buildDockerRunInvocation(config, effectiveOptions, this.tokenGenerator());\n\t\tawait this.checkDockerAvailable(config);\n\t\tconst runResult = await this.runner.run(invocation.command, invocation.args, { env: invocation.env });\n\t\tensureSuccessful(runResult, invocation.args);\n\t\tconst containerId = runResult.stdout.trim();\n\t\tthis.managedContainers.set(containerId, {\n\t\t\tworkspaceRoot: invocation.workspaceRoot,\n\t\t\tdaemonPort: config.daemonPort,\n\t\t\townerId: options.sessionId,\n\t\t});\n\t\tawait this.waitForStartedSandbox(config, containerId);\n\t\tconst daemonHost = daemonConnectionHost(config.daemonHostBind);\n\t\tconst daemonUrl = `ws://${urlHost(daemonHost)}:${config.daemonPort}${DAEMON_WEBSOCKET_PATH}`;\n\t\treturn {\n\t\t\tcontainerId,\n\t\t\tcontainerName: invocation.containerName,\n\t\t\tworkspaceRoot: invocation.workspaceRoot,\n\t\t\tworkspaceMountPath: config.workspaceMountPath,\n\t\t\tdaemonUrl,\n\t\t\tdaemonUrlRedacted: redactSecrets(daemonUrl),\n\t\t\ttoken: invocation.token,\n\t\t\tlabels: invocation.labels,\n\t\t};\n\t}\n\n\tprivate async startLocked(options: SandboxStartOptions): Promise<SandboxStartResult> {\n\t\tconst configured = this.resolveConfig(options);\n\t\tconst daemonPort = await this.reserveDaemonPort(configured);\n\t\treservedSandboxDaemonPorts.add(daemonPort);\n\t\ttry {\n\t\t\treturn await this.startWithReservedPort(options, daemonPort);\n\t\t} catch (error) {\n\t\t\tif (![...this.managedContainers.values()].some((container) => container.daemonPort === daemonPort)) {\n\t\t\t\treservedSandboxDaemonPorts.delete(daemonPort);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync start(options: SandboxStartOptions): Promise<SandboxStartResult> {\n\t\treturn withSandboxStartLock(() => this.startLocked(options));\n\t}\n\n\tasync list(options: SandboxListOptions): Promise<SandboxContainer[]> {\n\t\tconst config = this.resolveConfig();\n\t\tconst args = [\n\t\t\t\"container\",\n\t\t\t\"ls\",\n\t\t\t\"--all\",\n\t\t\t\"--filter\",\n\t\t\t`label=${SANDBOX_LABEL_ENABLED}=true`,\n\t\t\t...(config.ownerUid ? [\"--filter\", `label=${SANDBOX_LABEL_OWNER_UID}=${config.ownerUid}`] : []),\n\t\t];\n\t\tif (!options.allWorkspaces) {\n\t\t\targs.push(\"--filter\", `label=${SANDBOX_LABEL_WORKSPACE_HASH}=${getWorkspaceHash(options.workspaceRoot)}`);\n\t\t}\n\t\targs.push(\"--format\", \"{{json .}}\");\n\t\tconst result = await this.runner.run(config.dockerBinary, args);\n\t\tensureSuccessful(result, args);\n\t\tconst rows = parseJsonLines<DockerPsRecord>(result.stdout);\n\t\treturn rows.filter((row) => row.ID || row.Names).map((row) => this.containerFromPsRecord(row));\n\t}\n\tprivate forgetManagedContainer(reference: string, workspaceRoot: string): void {\n\t\tconst canonicalWorkspaceRoot = resolve(workspaceRoot);\n\t\tfor (const [containerId, container] of this.managedContainers) {\n\t\t\tif (container.workspaceRoot === canonicalWorkspaceRoot && containerIdsMatch(containerId, reference)) {\n\t\t\t\tthis.managedContainers.delete(containerId);\n\t\t\t\treservedSandboxDaemonPorts.delete(container.daemonPort);\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate forgetStoppedContainer(container: SandboxContainer, workspaceRoot: string): void {\n\t\tthis.forgetManagedContainer(container.id, workspaceRoot);\n\t\tif (container.daemonPort !== undefined) reservedSandboxDaemonPorts.delete(container.daemonPort);\n\t}\n\n\tasync stop(options: SandboxStopOptions): Promise<SandboxStopResult> {\n\t\tconst containers = await this.list({ workspaceRoot: options.workspaceRoot });\n\t\tconst selected = selectStopTarget(containers, options.target, options.currentContainerId);\n\t\tif (!selected) {\n\t\t\tconst requestedId = options.currentContainerId ?? options.target;\n\t\t\tif (requestedId) this.forgetManagedContainer(requestedId, options.workspaceRoot);\n\t\t\treturn { status: \"not-found\", message: \"No matching Grip sandbox container found\" };\n\t\t}\n\t\tconst config = this.resolveConfig();\n\t\tif (selected.state && selected.state !== \"running\" && config.cleanup === \"stop\") {\n\t\t\tthis.forgetStoppedContainer(selected, options.workspaceRoot);\n\t\t\treturn { status: \"already-stopped\", container: selected };\n\t\t}\n\t\tconst args = [\n\t\t\tconfig.cleanup === \"remove\" ? \"rm\" : \"stop\",\n\t\t\t...(config.cleanup === \"remove\" ? [\"--force\"] : []),\n\t\t\tselected.id,\n\t\t];\n\t\tconst result = await this.runner.run(config.dockerBinary, args);\n\t\tif (result.exitCode !== 0) {\n\t\t\tconst output = `${result.stderr}\\n${result.stdout}`;\n\t\t\tif (/No such container|not found/i.test(output)) {\n\t\t\t\tthis.forgetStoppedContainer(selected, options.workspaceRoot);\n\t\t\t\treturn { status: \"not-found\", message: \"Sandbox container no longer exists\" };\n\t\t\t}\n\t\t\tensureSuccessful(result, args);\n\t\t}\n\t\tthis.forgetStoppedContainer(selected, options.workspaceRoot);\n\t\treturn { status: config.cleanup === \"remove\" ? \"removed\" : \"stopped\", container: selected };\n\t}\n\n\tasync stopManagedContainers(): Promise<void> {\n\t\tawait withSandboxStartLock(async () => {\n\t\t\tconst failures: unknown[] = [];\n\t\t\tfor (const [containerId, container] of [...this.managedContainers]) {\n\t\t\t\ttry {\n\t\t\t\t\tawait this.stop({\n\t\t\t\t\t\tworkspaceRoot: container.workspaceRoot,\n\t\t\t\t\t\ttarget: containerId,\n\t\t\t\t\t\tcurrentContainerId: containerId,\n\t\t\t\t\t});\n\t\t\t\t\tthis.managedContainers.delete(containerId);\n\t\t\t\t\treservedSandboxDaemonPorts.delete(container.daemonPort);\n\t\t\t\t} catch (error) {\n\t\t\t\t\tfailures.push(error);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (failures.length > 0) throw new AggregateError(failures, \"Failed to stop managed sandbox containers\");\n\t\t});\n\t}\n\n\tprivate containerFromPsRecord(row: DockerPsRecord): SandboxContainer {\n\t\tconst labels = parseLabels(row.Labels);\n\t\tconst daemonPort = parsePositiveInteger(\n\t\t\tlabels[`${SANDBOX_LABEL_PREFIX}.daemon-port`] ?? undefined,\n\t\t\t\"daemon port\",\n\t\t);\n\t\treturn {\n\t\t\tid: row.ID ?? \"\",\n\t\t\tname: row.Names ?? \"\",\n\t\t\timage: row.Image ?? \"\",\n\t\t\tstatus: row.Status ?? \"\",\n\t\t\tstate: row.State,\n\t\t\tcreatedAt: row.CreatedAt,\n\t\t\tworkspaceRoot: undefined,\n\t\t\tworkspaceMountPath: labels[SANDBOX_LABEL_WORKSPACE_MOUNT],\n\t\t\tdaemonPort,\n\t\t\tdaemonEndpoint: row.Ports ? redactSecrets(row.Ports) : undefined,\n\t\t\tlabels,\n\t\t};\n\t}\n}\n\nexport function parseDockerPortOutput(output: string): string {\n\tconst firstLine = output.trim().split(/\\r?\\n/)[0];\n\tconst match = firstLine?.match(/^(?<host>.+):(?<port>\\d+)$/);\n\tif (!match?.groups) throw new Error(`Unable to parse Docker daemon port output: ${output.trim()}`);\n\tconst host = match.groups.host === \"0.0.0.0\" ? \"127.0.0.1\" : match.groups.host;\n\treturn `ws://${host}:${match.groups.port}${DAEMON_WEBSOCKET_PATH}`;\n}\n\nexport function parseDockerInspectContainers(\n\toutput: string,\n\tdaemonPort = DEFAULT_SANDBOX_DAEMON_PORT,\n): SandboxContainer[] {\n\treturn parseJsonArray<DockerInspectRecord>(output).map((record) => {\n\t\tconst labels = record.Config?.Labels ?? {};\n\t\tconst mountPath = labels[SANDBOX_LABEL_WORKSPACE_MOUNT] ?? DEFAULT_SANDBOX_WORKSPACE_MOUNT;\n\t\tconst mount = record.Mounts?.find((candidate) => candidate.Destination === mountPath);\n\t\tconst name = record.Name?.replace(/^\\//, \"\") ?? \"\";\n\t\treturn {\n\t\t\tid: record.Id ?? \"\",\n\t\t\tname,\n\t\t\timage: record.Config?.Image ?? \"\",\n\t\t\tstatus: record.State?.Status ?? \"\",\n\t\t\tstate: record.State?.Running ? \"running\" : record.State?.Status,\n\t\t\tcreatedAt: record.State?.StartedAt ?? record.Created,\n\t\t\tworkspaceRoot: mount?.Source,\n\t\t\tworkspaceMountPath: mount?.Destination ?? mountPath,\n\t\t\tdaemonPort,\n\t\t\tdaemonEndpoint: getEndpointFromPorts(record.NetworkSettings?.Ports, daemonPort),\n\t\t\tlabels,\n\t\t};\n\t});\n}\nfunction containerIdsMatch(left: string, right: string): boolean {\n\treturn left === right || left.startsWith(right) || right.startsWith(left);\n}\n\nfunction selectStopTarget(\n\tcontainers: SandboxContainer[],\n\ttarget: string | undefined,\n\tcurrentContainerId: string | undefined,\n): SandboxContainer | undefined {\n\tif (target) {\n\t\treturn containers.find((container) => containerIdsMatch(container.id, target) || container.name === target);\n\t}\n\tif (currentContainerId) {\n\t\tconst current = containers.find((container) => containerIdsMatch(container.id, currentContainerId));\n\t\tif (current) return current;\n\t}\n\treturn containers.length === 1 ? containers[0] : undefined;\n}\n"]}

package/examples/sandbox-docker/Dockerfile

@@ -1,274 +0,0 @@
-FROM ubuntu:26.04
-
-SHELL ["/bin/bash", "-o", "pipefail", "-c"]
-
-ARG MISE_VERSION=v2026.7.13
-ARG NODE_VERSION=26.5.0
-
-RUN apt-get update \
-	&& DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-		bash \
-		build-essential \
-		ca-certificates \
-		curl \
-		fd-find \
-		file \
-		git \
-		jq \
-		less \
-		make \
-		nodejs \
-		npm \
-		openssh-client \
-		pkg-config \
-		python3 \
-		python3-pip \
-		python3-venv \
-		ripgrep \
-		sudo \
-		unzip \
-		xz-utils \
-		zip \
-	&& ln -s /usr/bin/fdfind /usr/local/bin/fd \
-	&& mkdir -p /workspace /home/grip /etc/grip \
-	&& chown 1000:1000 /workspace /home/grip \
-	&& rm -rf /var/lib/apt/lists/*
-
-RUN curl -fsSL https://mise.run | MISE_VERSION="${MISE_VERSION}" sh \
-	&& install -m 0755 /root/.local/bin/mise /usr/local/bin/mise \
-	&& rm -rf /root/.local
-
-ENV MISE_DATA_DIR=/home/grip/.local/share/mise
-ENV MISE_CONFIG_DIR=/home/grip/.config/mise
-ENV MISE_CACHE_DIR=/home/grip/.cache/mise
-ENV NPM_CONFIG_PREFIX=/home/grip/.npm-global
-ENV PATH=/home/grip/.local/share/mise/shims:/home/grip/.npm-global/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-
-RUN mkdir -p \
-		/home/grip/.cache \
-		/home/grip/.config \
-		/home/grip/.grip \
-		/home/grip/.local/share \
-		/home/grip/.npm-global \
-	&& mise install "node@${NODE_VERSION}" \
-	&& mise use --global "node@${NODE_VERSION}" \
-	&& node --version \
-	&& npm --version \
-	&& npm install -g \
-		agent-browser@0.33.0 \
-		@astrojs/language-server@latest \
-		@biomejs/biome@latest \
-		@tailwindcss/language-server@latest \
-		@vue/language-server@latest \
-		bash-language-server@latest \
-		dockerfile-language-server-nodejs@latest \
-		pyright@latest \
-		svelte-language-server@latest \
-		typescript@latest \
-		typescript-language-server@latest \
-		vscode-langservers-extracted@latest \
-		yaml-language-server@latest \
-	&& HOME=/home/grip agent-browser install --with-deps \
-	&& npm cache clean --force \
-	&& rm -rf /var/lib/apt/lists/* \
-	&& chown -R 1000:1000 /home/grip
-
-RUN cat >/etc/grip/lsp.json <<'JSON'
-{
-  "enabled": true,
-  "servers": [
-    {
-      "id": "typescript",
-      "selectors": [
-        { "languageId": "javascript", "pattern": "**/*.js" },
-        { "languageId": "javascriptreact", "pattern": "**/*.jsx" },
-        { "languageId": "typescript", "pattern": "**/*.ts" },
-        { "languageId": "typescriptreact", "pattern": "**/*.tsx" }
-      ],
-      "transport": { "type": "spawn", "command": "typescript-language-server", "args": ["--stdio"] },
-      "lifecycle": { "type": "managed" },
-      "workspace": { "type": "markers", "markers": ["tsconfig.json", "jsconfig.json", "package.json"], "fallback": "session" },
-      "timeouts": { "connectMs": 5000, "initializeMs": 15000, "requestMs": 15000, "shutdownMs": 3000 }
-    },
-    {
-      "id": "pyright",
-      "selectors": [{ "languageId": "python", "pattern": "**/*.py" }],
-      "transport": { "type": "spawn", "command": "pyright-langserver", "args": ["--stdio"] },
-      "lifecycle": { "type": "managed" },
-      "workspace": { "type": "markers", "markers": ["pyproject.toml", "setup.py", "setup.cfg", "requirements.txt"], "fallback": "session" },
-      "timeouts": { "connectMs": 5000, "initializeMs": 15000, "requestMs": 15000, "shutdownMs": 3000 }
-    },
-    {
-      "id": "json",
-      "selectors": [
-        { "languageId": "json", "pattern": "**/*.json" },
-        { "languageId": "jsonc", "pattern": "**/*.jsonc" }
-      ],
-      "transport": { "type": "spawn", "command": "vscode-json-language-server", "args": ["--stdio"] },
-      "lifecycle": { "type": "managed" },
-      "workspace": { "type": "session" }
-    },
-    {
-      "id": "html",
-      "selectors": [{ "languageId": "html", "pattern": "**/*.html" }],
-      "transport": { "type": "spawn", "command": "vscode-html-language-server", "args": ["--stdio"] },
-      "lifecycle": { "type": "managed" },
-      "workspace": { "type": "session" }
-    },
-    {
-      "id": "css",
-      "selectors": [
-        { "languageId": "css", "pattern": "**/*.css" },
-        { "languageId": "scss", "pattern": "**/*.scss" },
-        { "languageId": "less", "pattern": "**/*.less" }
-      ],
-      "transport": { "type": "spawn", "command": "vscode-css-language-server", "args": ["--stdio"] },
-      "lifecycle": { "type": "managed" },
-      "workspace": { "type": "session" }
-    },
-    {
-      "id": "yaml",
-      "selectors": [
-        { "languageId": "yaml", "pattern": "**/*.yaml" },
-        { "languageId": "yaml", "pattern": "**/*.yml" }
-      ],
-      "transport": { "type": "spawn", "command": "yaml-language-server", "args": ["--stdio"] },
-      "lifecycle": { "type": "managed" },
-      "workspace": { "type": "session" }
-    },
-    {
-      "id": "bash",
-      "selectors": [
-        { "languageId": "shellscript", "pattern": "**/*.sh" },
-        { "languageId": "shellscript", "pattern": "**/*.bash" },
-        { "languageId": "shellscript", "pattern": "**/.env" }
-      ],
-      "transport": { "type": "spawn", "command": "bash-language-server", "args": ["start"] },
-      "lifecycle": { "type": "managed" },
-      "workspace": { "type": "session" }
-    },
-    {
-      "id": "dockerfile",
-      "selectors": [
-        { "languageId": "dockerfile", "pattern": "**/Dockerfile" },
-        { "languageId": "dockerfile", "pattern": "**/*.Dockerfile" }
-      ],
-      "transport": { "type": "spawn", "command": "docker-langserver", "args": ["--stdio"] },
-      "lifecycle": { "type": "managed" },
-      "workspace": { "type": "session" }
-    },
-    {
-      "id": "tailwindcss",
-      "selectors": [
-        { "languageId": "html", "pattern": "**/*.html" },
-        { "languageId": "javascriptreact", "pattern": "**/*.jsx" },
-        { "languageId": "typescriptreact", "pattern": "**/*.tsx" },
-        { "languageId": "vue", "pattern": "**/*.vue" },
-        { "languageId": "svelte", "pattern": "**/*.svelte" }
-      ],
-      "transport": { "type": "spawn", "command": "tailwindcss-language-server", "args": ["--stdio"] },
-      "lifecycle": { "type": "managed" },
-      "workspace": { "type": "markers", "markers": ["tailwind.config.js", "tailwind.config.cjs", "tailwind.config.mjs", "tailwind.config.ts", "package.json"], "fallback": "session" },
-      "priority": 50
-    },
-    {
-      "id": "vue",
-      "selectors": [{ "languageId": "vue", "pattern": "**/*.vue" }],
-      "transport": { "type": "spawn", "command": "vue-language-server", "args": ["--stdio"] },
-      "lifecycle": { "type": "managed" },
-      "workspace": { "type": "markers", "markers": ["package.json", "vue.config.js", "vite.config.ts", "vite.config.js"], "fallback": "session" }
-    },
-    {
-      "id": "svelte",
-      "selectors": [{ "languageId": "svelte", "pattern": "**/*.svelte" }],
-      "transport": { "type": "spawn", "command": "svelteserver", "args": ["--stdio"] },
-      "lifecycle": { "type": "managed" },
-      "workspace": { "type": "markers", "markers": ["package.json", "svelte.config.js", "svelte.config.mjs"], "fallback": "session" }
-    },
-    {
-      "id": "astro",
-      "selectors": [{ "languageId": "astro", "pattern": "**/*.astro" }],
-      "transport": { "type": "spawn", "command": "astro-ls", "args": ["--stdio"] },
-      "lifecycle": { "type": "managed" },
-      "workspace": { "type": "markers", "markers": ["package.json", "astro.config.mjs", "astro.config.ts"], "fallback": "session" }
-    },
-    {
-      "id": "biome",
-      "selectors": [
-        { "languageId": "javascript", "pattern": "**/*.js" },
-        { "languageId": "javascriptreact", "pattern": "**/*.jsx" },
-        { "languageId": "typescript", "pattern": "**/*.ts" },
-        { "languageId": "typescriptreact", "pattern": "**/*.tsx" },
-        { "languageId": "json", "pattern": "**/*.json" },
-        { "languageId": "jsonc", "pattern": "**/*.jsonc" }
-      ],
-      "transport": { "type": "spawn", "command": "biome", "args": ["lsp-proxy"] },
-      "lifecycle": { "type": "managed" },
-      "workspace": { "type": "markers", "markers": ["biome.json", "biome.jsonc", "package.json"], "fallback": "none" },
-      "priority": 40
-    }
-  ]
-}
-JSON
-
-RUN cat >/SANDBOX.md <<'EOF'
-# Grip Sandbox
-
-This container is the Grip workspace sandbox. The host workspace is mounted read/write at `/workspace`; Grip itself remains the orchestrator outside the container. Grip loads this file into the model system prompt when the sandbox daemon is connected.
-
-Included tooling:
-
-- `grip --daemon` for remote workspace tools
-- `git`, `curl`, `ripgrep`, `fd`, `jq`, `file`, `less`, `make`, `build-essential`
-- Node.js with `npm`
-- Python 3 with `pip` and `venv`
-- `mise` for per-project tool installation (`mise install`, `mise use`, `mise x`)
-- `agent-browser` with Chrome for Testing for headless browser automation (`agent-browser open`, `agent-browser snapshot`, `agent-browser close`)
-- common npm-based LSP servers for TypeScript/JavaScript, Python, JSON, HTML, CSS, YAML, Bash, Dockerfile, Tailwind CSS, Vue, Svelte, Astro, and Biome
-
-LSP is enabled through `/etc/grip/lsp.json` via `GRIP_DAEMON_LSP_CONFIG`. Servers are spawned inside the container, so they see `/workspace` paths and can only inspect the mounted workspace plus the container filesystem.
-
-Useful commands:
-
-```bash
-mise --version
-mise install          # install tools from .mise.toml / mise.toml / .tool-versions
-npm --version
-agent-browser --version
-agent-browser doctor --json
-grip --version
-```
-
-Security model:
-
-- `/workspace` is the host project mount and is intentionally writable.
-- `/tmp` is writable temporary storage. Use it for ad-hoc scripts, generated artifacts, and disposable intermediate files.
-- Host paths outside mounted volumes are not available to agent workspace tools.
-- Do not mount Docker socket, SSH keys, home directories, or extra secrets unless you explicitly want the sandbox to access them.
-EOF
-
-RUN cp /SANDBOX.md /etc/grip/SANDBOX.md
-
-ARG GRIP_RELEASE_NODE_DIR=node
-COPY ${GRIP_RELEASE_NODE_DIR}/ /opt/grip/
-
-RUN test -x /opt/grip/grip \
-	&& ln -s /opt/grip/grip /usr/local/bin/grip \
-	&& grip --help >/dev/null
-
-ENV GRIP_DAEMON_HOST=0.0.0.0
-ENV GRIP_DAEMON_PORT=8787
-ENV GRIP_DAEMON_CWD=/workspace
-ENV GRIP_DAEMON_TEMP_ROOT=/tmp
-ENV TMPDIR=/tmp
-ENV GRIP_DAEMON_ALLOW_INSECURE_TRANSPORT=1
-ENV GRIP_DAEMON_ALLOW_PROCESS_EXEC=1
-ENV GRIP_DAEMON_LSP_CONFIG=/etc/grip/lsp.json
-ENV GRIP_DAEMON_SANDBOX_INSTRUCTIONS=/etc/grip/SANDBOX.md
-ENV HOME=/home/grip
-
-WORKDIR /workspace
-USER 1000:1000
-EXPOSE 8787
-
-CMD ["grip", "--daemon"]

package/examples/sandbox-docker/README.md

@@ -1,88 +0,0 @@
-# Grip sandbox Docker image
-
-This image is the base runtime for `/sandbox start`. It contains the packaged `grip` CLI and starts the integrated workspace daemon with `grip --daemon`.
-
-## Build from a local release
-
-Create local release artifacts from the repository root:
-
-```bash
-npm run release:local -- --out /tmp/grip-local-release --force
-```
-
-Build the image with the local release directory as the Docker context:
-
-```bash
-docker build \
-  -f packages/coding-agent/examples/sandbox-docker/Dockerfile \
-  -t grip-sandbox:local \
-  /tmp/grip-local-release
-```
-
-The Dockerfile consumes `/tmp/grip-local-release/node`, which is the isolated npm install produced from the locally packed tarballs. Do not use `--skip-install`; a tarball-only release does not contain the `node/` install directory the Dockerfile copies.
-
-If you use a different directory name inside the build context, pass it explicitly:
-
-```bash
-docker build \
-  --build-arg GRIP_RELEASE_NODE_DIR=my-node-install \
-  -f packages/coding-agent/examples/sandbox-docker/Dockerfile \
-  -t grip-sandbox:local \
-  /path/to/context
-```
-
-## Runtime defaults
-
-The image sets:
-
-- workspace directory: `/workspace`
-- additional confined temporary root: `/tmp` via `GRIP_DAEMON_TEMP_ROOT`
-- daemon command: `grip --daemon`
-- daemon host inside the image: `0.0.0.0` (the configured `daemonHostBind` controls Docker's published host address)
-- daemon port inside the container: `8787`
-- process execution: enabled for Grip shell/tool execution inside the container
-- user: unprivileged `grip` user with uid `1000`
-- sandbox-only user instructions: `/home/grip/.grip/AGENTS.md` (loaded when present; run `/reload` after changing it)
-
-`GRIP_DAEMON_TOKEN` is intentionally not baked into the image. `/sandbox start` generates a token and passes it through the container environment. For manual runs, provide a long random token yourself:
-
-```bash
-docker run --rm \
-  --name grip-sandbox-local \
-  --network bridge \
-  --publish 127.0.0.1:8787:8787 \
-  -e GRIP_DAEMON_HOST=0.0.0.0 \
-  -e GRIP_DAEMON_TOKEN=dev-token-dev-token-dev-token-dev-token \
-  -v "$PWD:/workspace" \
-  grip-sandbox:local
-```
-
-Then connect a local Grip process as the orchestrator:
-
-```bash
-GRIP_REMOTE_TOKEN=dev-token-dev-token-dev-token-dev-token ./grip-test.sh --remote ws://127.0.0.1:8787/grip/workspace
-```
-
-## Use with `/sandbox start`
-
-Override the sandbox image for one start:
-
-```text
-/sandbox start --image grip-sandbox:local
-```
-
-Or configure the default image with normal sandbox precedence:
-
-```bash
-GRIP_SANDBOX_IMAGE=grip-sandbox:local ./grip-test.sh
-```
-
-The sandbox service mounts the current workspace at `/workspace`, uses Docker bridge networking, publishes only the authenticated daemon port to the configured host bind address (loopback by default), and supplies `GRIP_DAEMON_TOKEN` through the Docker environment. Sandbox processes cannot directly use host loopback services. Tokens must not be put in image layers, command-line arguments, labels, or URLs. See [Workspace Sandbox](../../docs/sandbox.md) for `/sandbox` commands, configuration precedence, stop behavior, troubleshooting, and security boundaries.
-
-## Notes
-
-- The image uses the integrated `grip --daemon` command from `@greppleai/grip`.
-- The mounted workspace is read/write. Files created by the container are owned by uid `1000` unless Docker is run with a different user policy.
-- `/tmp` is writable container-local scratch storage and is not mounted from the host by default.
-- Bridge networking and loopback-only daemon publication avoid exposing host loopback services to the container.
-- Docker is not a complete security boundary. Treat this image and any override image as trusted code for the mounted workspace.